We recommend the Executive Assistant Commissioner for the Office of Enterprise Services adhere to DHS policy and fully implement the Defense Information Systems Agency Security Technical Implementation Guide control categories for the servers supporting the Mobile Passport Control program, request waivers as appropriate, or fully document any exception obtained from the Department when deviating from policy requirements