OJP Information Security Management Program Audit - FISMA FY2025

DOJ Inspector General Reports

Published March 31st, 2026

Detected April 1st, 2026

Summary

The DOJ Office of Inspector General released Report 26-042, an audit of the Office of Justice Programs' (OJP) Information Security Management Program under the Federal Information Security Modernization Act (FISMA) for Fiscal Year 2025. The audit assessed OJP's compliance with federal information security requirements, evaluating risk management, security controls, and incident response capabilities. The report identifies deficiencies in OJP's information security program and provides recommendations for corrective action.

View original document View source feed page

What changed

The DOJ OIG conducted an audit of the Office of Justice Programs' information security management program pursuant to the Federal Information Security Modernization Act of 2014. The audit evaluated OJP's implementation of security controls, risk management frameworks, continuous monitoring, and incident detection and response capabilities. Report Number 26-042 documents findings across multiple FISMA metric areas including risk management strategy, supply chain risk management, and contingency planning.

OJP management is expected to develop and implement corrective action plans addressing the identified deficiencies. While OIG audit recommendations are not legally binding, agencies are expected to either remediate the findings or provide explanations for any disagreements. The audit serves as a compliance assessment for federal information security requirements and may inform future budget and oversight decisions regarding OJP's cybersecurity posture.

What to do next

Review OJP information security findings and assess applicability to own agency
Update security controls to address any similar deficiencies identified in the audit
Incorporate FISMA audit findings into annual security assessment processes

Source document (simplified)

Home
Reports

Audit of the Office of Justice Programs’ Information Security Management Program Pursuant to the Federal Information Security Modernization Act of 2014, Fiscal Year 2025

Read Report
Posted Date

March 31, 2026

Report Number 26-042 Component Office of Justice Programs Report Type Audit

Named provisions

Risk Management Security Control Assessment Continuous Monitoring Incident Response Configuration Management Identity and Access Management Supply Chain Risk Management