We recommend the Chief Information Officer, in coordination with the Office of Federal Register, develop and implement a process to maintain an up-to-date security authorization package for the EFR system, which includes a system security plan, security assessment report, risk assessment report, plan of action and milestones (PO&M), contingency plan, contingency plan test, and business impact analysis.