In a report released Monday, the OIG said it contracted CliftonLarsonAllen to evaluate VA’s information security program and assess compliance with FISMA requirements. What Did the FY 2025 FISMA Audit Evaluate? The audit reviewed 24 applications and general support systems hosted at 11 VA facilities and on the VA Enterprise Cloud. Access controls, configuration management controls, security management controls and service continuity practices all showed persistent shortcomings, according to the assessment. The audit also identified areas where VA could address deficiencies, including security patch deployment, system upgrades, system configurations, performance monitoring and communication of security issues to appropriate personnel.