October 8, 2026
Additional Effort Is Needed to Improve the Department of Energy’s Unclassified Cybersecurity Program – 2025
The Federal Information Security Modernization Act of 2014 requires that the Office of Inspector General conduct an independent evaluation to determine whether the Department of Energy’s unclassified cybersecurity program adequately protected its data and information systems in accordance with Federal and Department requirements.
The Federal Information Security Modernization Act of 2014 mandates Federal agencies to develop, implement, and manage agency-wide information security programs. Agencies are also required to provide acceptable levels of security for the information and systems that support their operations and assets.
Our fiscal year 2025 Federal Information Security Modernization Act of 2014 evaluation determined that the Department, including the National Nuclear Security Administration, had taken actions to address some of the previously identified weaknesses related to its unclassified cybersecurity program. Actions were taken to close 57 of 120 (48 percent) cybersecurity recommendations from our prior year reviews. However, we determined that 63 recommendations remained open, of which 29 had not been fully addressed for more than 2 years. We also issued 55 new recommendations. Of the 55, 41 were made to address a significant access control deficiency over various financial systems within the Department. This significant deficiency was an audit result described within our report, The Department of Energy’s Fiscal Year 2025 Consolidated Financial Statements (DOE-OIG-26-03, December 2025).
The weaknesses occurred for a variety of reasons. For instance, deficiencies related to access controls occurred, in part, due to management not responding to changes in risks or identifying risks associated with inappropriate or unnecessary access to systems.
Without improvements to address the weaknesses identified in our report, the Department may be unable to adequately protect its information systems and data from compromise, loss, or unauthorized modification.
If fully implemented, the 118 recommendations that remain open should help to enhance the Department’s unclassified cybersecurity program. The Department should emphasize closing findings in a timely manner, especially those findings repeated from prior years. As cybersecurity remains an ongoing challenge and one of its highest risks, the Department should take action to implement the latest Federal cybersecurity requirements to ensure adequate protection of the Department’s data and information systems.