FFMIA Systems Requirements Integrity - Service - Innovation Purpose To provide an update on the Project of Correlating the FFMIA Financial Management Systems Requirements to the FISCAM Hyper Critical Controls. FFMIA Systems Requirements 9/18/2018 Integrity - Service - Innovation

Why a Correlation of FFMIA and FISCAM Controls? Duplication of efforts during testing and assessments exist FFMIA Requirements and FISCAM Controls testing is independent of one another however, both are systems related Many FFMIA Requirements supports FISCAM Controls System Managers and Customers may not recognize the FFMIA/FISCAM relationship Changing Environment Management changes Legacy and ERP’s system changes Volume of both the FFMIA Requirements and the FISCAM Controls to be tested and assessed Provide a useful tool to improve the efficiency and effectiveness for each effort Identify the correlation for customers 9/18/2018 Integrity - Service - Innovation

Benefits of the Linkage of FFMIA and FISCAM Controls FFMIA Assessments and FISCAM Controls testing can be completed simultaneously Identify Linked FISCAM Controls to FFMIA Requirements and test and assess at the same time Leverage existing documentation to support the testing and assessment process Key Supporting Documentation (KSD) Deficiency Reports Corrective Action Plans Increase Operational Excellence 9/18/2018 Integrity - Service - Innovation

Example of FFMIA Requirements to FISCAM Controls Identified FFMIA Requirement Linked Hyper Critical FISCAM Controls AS-2.2: Control Activity: Application users are appropriately identified and authenticated. Control Technique: Identification and authentication is unique to each user. All approved users should enter their user ID (unique) and password (or other authentication) to gain access to the application. DRRT DFAS Owned System BB# 02.02.016 The system shall provide the capability for an authorized user to identify if an adjustment is required to change official accounting records or to correct errors made during the preparation of a cash report. AS-2.4.3: Control Activity: Access to the application is restricted to authorized users. Control Technique: Access is limited to individuals with a valid business purpose (least privilege). Linked Hyper Critical FISCAM Controls FFMIA-FISCAM Identified FFMIA Requirement BB# 14.01.001 The system must generate an audit trail of transactions recorded as a document moves from its source through all document statuses. IN-2.5.3: Control Activity: Rejected interface data is isolated, analyzed and corrected in a timely manner. Control Technique: Audit trails are used to identify and follow-up on interface errors. The corrections to interface errors are included in the audit trail. CAPS-W DFAS Owned System AS-3.7.1: Control Activity: Movement of programs and data among libraries is controlled. Control Technique: A group independent of the user and programmers control movement of programs and data among libraries. Before and after images of program code are maintained and compared to ensure that only approved changes are made. Identified FFMIA Requirement CDS DFAS Owned System Linked Hyper Critical FISCAM Controls BB# 17.14.034 The system must have edits preventing a user from making a payment generated internally within the system / Disbursing Office if it has not been certified in the system. AS-4.2.1: Control Activity: Application controls prevent users from performing incompatible duties. Control Technique: Users are prevented by the application from executing incompatible transactions, as authorized by the business owners. 9/18/2018 Integrity - Service - Innovation

Integrity - Service - Innovation Questions? Email Us at: dfas.indianapolis-in.zpr.mbx.ffmiarequirementsmailbox@mail.mil 9/18/2018 Integrity - Service - Innovation