EXECUTIVE SUMMARY:

This final audit report points out that the Centers for Disease Control and Prevention (CDC) had not placed enough importance on ensuring the physical security of its data processing operations. Specifically, we found significant deficiencies in several areas such as the adequacy of facilities, access controls, plans for disaster recovery and continuity of operations and security training for employees and contractor staff. We recommended that the CDC develop and implement comprehensive organizationwide policies and procedures regarding security and establish a program to provide appropriate security awareness and emergency response training to employees and contractor staff.