Federal Reports

What We Looked At Section 502 of the Federal Aviation Administration (FAA) Reauthorization Act of 2018 mandated that FAA report on the Agency’s progress in implementing Next Generation Air Transportation System (NextGen) programs and that Department of Transportation (DOT) Office of Inspector General (OIG) review the accuracy of FAA’s report. NextGen is an infrastructure effort aimed at modernizing our Nation’s aging air traffic system to provide safer and more efficient air traffic management. As a complex multibillion-dollar, multi-year undertaking, NextGen encompasses multiple programs, procedures, and systems at differing levels of maturity intended to benefit airspace users. Our objectives were to (1) assess FAA’s report on its implementation of NextGen and (2) report the status of OIG’s NextGen recommendations.   What We Found FAA’s Section 502 NextGen report states that all major NextGen systems will be in place by 2025; however, FAA plans to deploy each major system to at least one location by 2025, with full deployment going beyond 2025. The report states that NextGen’s vision has remained constant over time, but our analysis and other stakeholder reports have found that NextGen will be less transformational than originally promised. The report does not include all NextGen expenditures, nor the challenges posed by increasing sustainment and operating costs. The report also projects $100 billion in benefits by 2030, even though FAA had previously acknowledged that this amount was not achievable within that timeframe. In addition, FAA reported that the Agency remains committed to working with industry on NextGen programs, but industry representatives stated that transparency and collaboration with the Agency declined starting in 2018. Finally, of the over 200 NextGen recommendations we made between 2005 to 2022, DOT and FAA have successfully closed all but 3 recommendations. Our Recommendations We made three recommendations for FAA to meet FAA Reauthorization Act of 2018 Section 502 requirements as well as improve communication and transparency on the status of NextGen. FAA concurred with all three of our recommendations and provided acceptable planned action and completion dates.

The report summarizes the FTC OIG’s activities and accomplishments during the first half of the FY 2024 reporting period.

The audit objectives were to determine whether program funds were managed in accordance with the ARC and Federal grant requirements.

Why We Did This ReportThe U.S. Environmental Protection Agency Office of Inspector General conducted this audit to assess the U.S. Chemical Safety and Hazard Investigation Board’s compliance with the FY 2023–2024 Inspector General Federal Information Security Modernization Act of 2014 Reporting Metrics. We contracted with SB & Company LLC to perform this audit under our direction and oversight. Summary of FindingsSB & Company concluded that the CSB achieved an overall maturity of Level 2, Defined, in fiscal year 2023. This means that the CSB’s policies, procedures, and strategies are formalized and documented but not consistently implemented. While the CSB has improved its overall maturity from the Level 1, Ad Hoc, rating it achieved in fiscal year 2022, SB & Company identified that improvements are still needed in the Incident Response domain within the Respond Function Area. Specifically, SB & Company concluded that the CSB should formally document the results of and the lessons learned during its disaster recovery testing scenarios. Because the CSB only has an informal process for documenting testing results and lessons learned, it did not fully document the results of its disaster recovery testing in a manner that was consistent with the National Institute of Standards and Technology guidelines.

The Office of the Inspector General performed an audit to determine if TVA’s security controls were appropriately configured to protect corporate Wi-Fi networks. Our scope was limited to Wi-Fi networks maintained by TVA’s Technology and Innovation organization. We determined TVA’s security controls related to overall architecture design and implementation were generally configured appropriately to protect corporate Wi Fi networks. However, we identified several areas that should be addressed to further improve the security of corporate Wi-Fi networks. Specifically, we identified:• Internal controls for specific types of attacks were ineffective.• Wireless software and hardware were unsupported by the manufacturer.• Data in transit (electronic transmission of information) was not properly secured.• Primary accounts improperly provided privileged user access.• Service account usage was not in accordance with TVA policy.• Baseline configuration management process was not designed or implemented properly.TVA management agreed with our recommendations.