Open Recommendations

Develop and implement a contingency plan to address potential future staffing challenges that may arise, to mitigate delays in implementing necessary improvements across the applicable FISMA domains.

Establish and execute a monitoring plan to make sure that all information technology policies and procedures, including referenced standards and guidance, are reviewed and updated in accordance with the timeliness requirements defined by EAC policy.

Implement a continuous monitoring governance, risk, and compliance tool that enables the integration of cybersecurity risk management into the enterprise risk management reporting tool. Capture lessons learned to make any necessary adjustments to the process.

Implement a process to detect and prevent the use of untrusted removable media on the EAC’s network.

Fully document and implement a process that includes a clear business reason for risk acceptance in the event that untrusted removable media must be introduced on the EAC’s network.

Develop compensating controls to reduce the risk that vulnerabilities can be exploited that are caused by the use of untrusted removable media on the EAC’s network.

Schedule and complete annual contingency planning tests. Retain supporting documentation to demonstrate compliance during audits.

Develop a plan to ensure manual journal vouchers are justified, documented, and approved before they are entered into the Financial Management System and that they are reviewed after posting to verify accuracy and support compliance, transparency, and audit readiness.

Require ongoing training for all staff who prepare, review, or approve manual journal vouchers, including a process to ensure that new employees complete initial training and that refresher courses are provided when policies or tools are updated.

Clarify expectations for using macro-enabled journal voucher tools by defining when the standardized macro must be used; establishing a process to communicate macro tool updates and prompt the adoption of newly released versions; and providing guidance, training, and user support to promote correct and consistent application of the tools.

Define and communicate clear oversight responsibilities for Veterans Integrated Service Network financial managers by requiring routine monitoring of documentation and compliance at facilities.

Ensure privileged user access reviews for the [redacted] system are performed in accordance with FDIC policy.

Define the accounts, permissions, and roles that are considered privileged within [redacted].

Ensure privileged user access reviews for [redacted] are performed in accordance with FDIC policy.

Ensure a complete and accurate user listing is utilized for the [redacted] user access review as required by FDIC policy.

The Chief Information Officer ensures that the actions shared with the agency in the detailed technical report are taken to properly configure and fully utilize anti-phishing protections.

The Chief Information Officer ensures that the actions shared with the agency in the detailed technical report are taken to properly configure and fully utilize anti-phishing protections.

The Chief Information Officer implements continuous improvement and emphasize a “Zero Click” mindset throughout the organization to reduce the threat from phishing campaigns.

Strengthen controls in the Office of the Assistant Director to ensure inclusion of staffing monitoring contract requirements, in coordination with the contracting officer, to meet gradual staffing level goals during start-up periods in future community‑based outpatient clinic contracts.

Strengthen controls to ensure data used for monitoring contract performance standards are accurate and comply with the methodology required in the contract’s Quality Assurance Surveillance Plan.

Review the medical staff-driven phase of the credentialing process, to ensure action plans implemented to expedite the credentialing process are effective.

Strengthen controls to ensure contracted staff complete required scheduling training before granting them access to VA’s scheduling system and authorizing them to make veteran appointments.

Review the healthcare system’s staffing augmentation plan and coordinate with the contracting officer to ensure the full costs are recovered for all Veterans Health Administration staff who provided services for which the contractor was also compensated.

Review the unilateral memorandum related to staffing augmentation, establish a contract modification in compliance with the Federal Acquisition Regulation provisions regarding contract changes, and ensure relevant documentation is maintained in the contract file.

Recover government funds expended for Veterans Health Administration staff augmented at contracted community-based outpatient clinics using full cost amounts.