Four recommendations aimed at strengthening the federal credit union regulator’s Continuity of Operations Program (COOP) are laid out in an inspector general report following an audit of all COOP program activities from Jan. 1, 2018, through Dec. 31, 2021.
The report by the National Credit Union Administration (NCUA) Office of Inspector General (OIG) found generally that the COOP program was operating in accordance with applicable laws, regulations, policies, and procedures and that it was ready and able to execute should the need arise – the two areas of focus of the review. However, it said the audit also identified areas needing improvement.
“Specifically, we determined the NCUA should perform a full failover test of its IT network to ensure management is made aware of any potential weaknesses and correct them, as necessary,” the report states. “We also determined that the Office of Continuity and Security Management (OCSM) and the Office of the Chief Information Officer (OCIO) need to improve communication with each other regarding COOP and security matters.”
(A failover test, according to a footnote in the report, would test the IT network’s capability to switch over automatically to a redundant or standby system “upon the failure or abnormal termination of the previously active system.”)
The OIG’s specific recommendations were that NCUA management:
- perform a business impact analysis to define the IT network as essential and determine timelines for restoration to be used as a measurement for a full failover test of the NCUA IT network;
- ensures the Chief Information Officer plans, conducts, and reports on a full failover test of the NCUA’s IT network to identify and correct any identified weaknesses;
- ensures the results of the failover test from are communicated in writing to the NCUA Board, the Office of the Executive Director, and the Director, Office of Continuity and Security Management, to ensure the agency’s Continuity of Operations program and disaster recovery capabilities are thoroughly managed and reported on; and
- ensures OCIO management shares all necessary NCUA IT network, systems, disaster recovery information and details with the Director of OCSM, including dates and results of the OCIO’s tabletop exercises and other disaster recovery drills, such as failover tests.
The report states that management agreed with the recommendations and estimated year-end 2023 and 2024 completion dates.
Audit of the NCUA’s Continuity of Operations Program (Report #OIG-22-09 12/30/2022)