An effective rating with a significant warning
A September 30 Department of Education inspector general audit concluded that the department met baseline security effectiveness requirements for the subset of information systems evaluated. The same report warned of regression across multiple FISMA domains. The assessment covered the fiscal 2026 reporting period ending June 30, with additional identity and access testing covering January through July 2025.
Evidence gaps behind the overall result
The official summary reports 23 conditions across six of ten FISMA domains and identifies insufficient retained documentation for some access-provisioning processes. It cautions that the downward trend threatens long-term sustainability despite the baseline result. This is a federal department assessment, not a finding that all schools or universities have the same weaknesses, and the summary does not establish a breach.
Analysis: ask what changed beneath the rating
For education leaders and government contractors, our assessment is that the report illustrates a useful oversight question: which controls improved or deteriorated beneath the headline result? A board or executive committee should request a short account of unresolved findings, overdue actions and the evidence that supports completed fixes. An overall rating can help organize that discussion, but it cannot replace the underlying work. This is particularly relevant when staff changes leave nobody able to explain why a sensitive account was created. A current list of users answers who has access; the approval record should also explain the business purpose and the person who accepted that decision.
Make access decisions reproducible
A practical internal review can select a small sample of recently created or changed accounts and trace each one from request to approval, implementation and verification. Record missing evidence as an issue to resolve, without assuming that every undocumented action was malicious. For a school or contractor using an MSP, the contract should specify which party keeps the approval and how the customer can retrieve it. Reviewers should include role changes and departures so that removal receives the same attention as creation. Management should give each gap an owner and a date for follow-up, then check that the repair works for a later sample. The goal is an operating process that produces reliable records as part of normal work, not a hurried collection assembled only when the next assessor arrives.
Sources & further reading
Our practical suggestions are editorial guidance. Verify applicability against current source and vendor instructions.
