The overall score stayed stable, but three domains lagged
The Denali Commission’s fiscal 2026 FISMA evaluation rated its overall information-security program Level 3, ‘Consistently Implemented,’ the same as fiscal 2025. That is positive counterevidence to any claim that the entire program was ineffective.
The audit nevertheless kept Data Protection and Privacy, Incident Response, and Contingency Planning at Level 2, ‘Defined.’ A policy can be defined on paper without the repeatable testing and documentation needed to demonstrate consistent implementation.
| Control area | Unfinished action |
|---|---|
| Incident response | Complete and document August 2026 test |
| Continuity | Complete tabletop and technical tests scheduled for September 2026 |
| Privileged access | Periodically review and document account activity |
Two scheduled exercises were past due in the audit record
The first recommendation calls for completing and documenting an incident-response test scheduled for August 2026, retaining lessons learned and updating the response plan. The second covers a business-continuity tabletop and technical testing scheduled for September.
The dates matter because they distinguish planned controls from demonstrated controls. A scheduled exercise cannot validate response readiness until it occurs, results are retained and plans are updated from the findings.
Privileged-user review regressed
Metric 19 fell from Level 3 in fiscal 2025 to Level 2 because the Commission did not periodically review privileged-user activity. The broader Identity and Access Management domain remained at Level 3, so the regression was specific rather than a collapse of the whole domain.
Privileged accounts can make high-impact system changes. A documented periodic review creates an audit trail for detecting inappropriate or anomalous activity; the report’s third recommendation requires that control without assigning questioned costs.
Method, contribution and limits
What’s the Scoop With Broach mapped the overall maturity rating against the three open recommendations and the one metric that declined. The original contribution is showing why a stable headline score and unfinished operational controls can coexist.
The evaluation covers October 1, 2025 through September 30, 2026. It does not report a breach, data loss or dollar loss, and $0 in questioned costs does not mean the control gaps are risk-free. The Commission may complete actions after the audit period.