Federal Deposit Insurance Corp. Cloud Strategy Insufficient, Watchdog Says

A new audit report has identified several ways the Federal Deposit Insurance Corp.’s cloud practices fall short of requirements set internally and by the Office of Management and Budget and the National Institute of Standards and Technology.

According to the agency’s inspector general, the FDIC lacks an organized cloud data asset catalog, an exit strategy if a contract with a cloud service provider is terminated, management plans for $546 million in cloud service contracts and phase-out plans for older systems. Such gaps increase security risks for the agency and, in some cases, could incur larger costs, the FDIC IG said.

The IG acknowledged that the FDIC has implemented effective controls in other areas, including application rationalization, cloud spending, workforce transformation and continuous monitoring.

The agency agreed with nine recommendations given by the watchdog and said it plans to carry out corrective actions by September 2024.

The FDIC is in the process of transitioning its key systems to the cloud with a focus on information technology modernization.