Federal Reports

At the request of the Tennessee Valley Authority (TVA) Supply Chain, the OIG examined a cost proposal submitted for construction and modification services. Our objective was to determine if the vendor's cost proposal was fairly stated for a planned $100 million contract. In our opinion, the proposal (1) included inconsistent and overstated labor markup rates; (2) did not comply with the request for proposal requirements related to nonmanual wages, resulting in overstated wage rates; and (3) included multiple fees in the Paradise Fossil Plant baseline costs. We estimated TVA could avoid about $3.34 million by (1) negotiating reduced labor markup rates and (2) reimbursing the contractor's actual salaries within established wage ranges instead of paying a single estimated wage rate for each labor classification. In addition, we found the contract's compensation terms and related attachments were inconsistent with the methodology TVA intends to use to compensate the contractor.(Summary Only)

For our final report on the sufficiency of the National Marine Fisheries Service’s (NOAA Fisheries’) research and progress toward implementation of electronic monitoring (EM) programs, our objectives were to evaluate NOAA Fisheries’ study, oversight, progress, implementation, and incorporation of EM into its National Observer Program and determine how NOAA Fisheries is executing its EM policy.

We performed a wireless penetration test of select Centers for Medicare & Medicaid Services' Data Centers and facilities to determine whether CMS's security controls over its wireless networks were effective.

Overall, the Department continues to implement changes to strengthen its enterprise-wide information security program. However, opportunities were identified that will allow HHS to continue to enhance its enterprise-wide information security program. We identified several reportable exceptions in the Department's security program. Areas for improvement were identified in the Department's Continuous Monitoring Management, Configuration Management, Identity and Access Management, Incident Response and Reporting, Risk Management, Security Training, Plan of Action and Milestones, Remote Access Management, Contingency Planning, and Contractor Systems.