FY 2023 Federal Information Security Modernization Act Independent Evaluation

We recommend that EEOC communicates and implements an organization-wide SCRM and CSCRM strategy to guide supply chain analyses, provide communication channels with internal/external partners and stakeholders, and assist in building consensus regarding the appropriate resources for SCRM and C-SCRM. We recommend that EEOC offices of the Chief Financial Officer and the Chief Information Officer identify SCRM/C-SCRM as a risk to be included in their respective ERM risk registers until the issue is resolved so that commission management understand that SCRM/C-SCRM is a commission-wide requirement.