Open Recommendations

We recommended the Assistant Secretary for Information and Technology consistently implement an improved continuous monitoring program in accordance with the National Institute of Standards and Technology (NIST) Risk Management Framework (RMF). Specifically, implement an independent security control assessment process to evaluate the effectiveness of security controls prior to granting authorization decisions.

We recommended the Assistant Secretary for Information and Technology implement improved processes for reviewing and updating key security documentation, including Security Control Assessments, Risk Assessments, and Privacy Impact Assessments as needed. Such updates will ensure all required information is included and accurately reflects the current environment, new security risks, and applicable federal standards.

We recommended the Assistant Secretary for Information and Technology implement improved processes to ensure System Security Plans reflect the status of security control implementations and risks are accurately reported to support a comprehensive risk management program across the organization.

We recommended the Assistant Secretary for Information and Technology implement improved mechanisms to ensure system owners and Information System Security Officers follow procedures for establishing, tracking, and updating Plans of Action and Milestones (POA&Ms) for all known risks and weaknesses including those identified during security control assessments.

We recommended the Assistant Secretary for Information and Technology implement measures to ensure that system stewards and other officials responsible for system level POA&Ms are closing items with relevant support that shows sufficient remediation of the identified weakness.

We recommended the VA Office of Personnel Security, Human Resources, and Contract Offices strengthen processes to ensure appropriate levels of background investigations are performed timely and completed for applicable VA employees and contractors.

We recommended the Office of Personnel Security, Human Resources, and Contract Offices implement improved processes for establishing and maintaining accurate investigation data within VA systems used for background investigations.

We recommended the Assistant Secretary for Information and Technology ensure contingency plans for all systems and applications are updated and tested in accordance with VA requirements.

We recommended the Assistant Secretary for Information and Technology implement improved procedures to ensure that system outages are resolved within stated recovery time objectives.

We recommended the Assistant Secretary for Information and Technology ensure system owners consistently implement processes for periodic reviews of user account access. Remove unnecessary and inactive accounts on systems and networks.

We recommend the Assistant Secretary for Information and Technology coordinate with system owners and local system management to ensure the consistent monitoring and reviewing of privileged accounts, service accounts, and accounts for individuals with access to source code repositories are performed across VA systems and platforms.

We recommend the Assistant Secretary for Information and Technology implement improved processes to ensure compliance with VA password policy and security configuration baselines on domain controllers, operating systems, databases, application, and network devices.

We recommended the Assistant Secretary for Information and Technology ensure established change control procedures are consistently followed for testing and approval of system changes for VA applications and networks.

We recommended the Assistant Secretary for Information and Technology implement and consistently enforce established procedures for preventing and detecting potential unauthorized changes across all platforms and applications in the environment.

We recommended the Assistant Secretary for Information and Technology ensure that all systems and platforms are monitored for compliance with documented VA standards for baseline configurations. Ensure that system owners consistently implement and monitor their configurations.

We recommended the Assistant Secretary for Information and Technology implement automated software management processes on all agency platforms to identify and prevent the use of unauthorized software on agency devices.

We recommended the Assistant Secretary for Information and Technology implement improved procedures for establishing, documenting, and monitoring an accurate software and logical hardware inventory for system boundaries across the enterprise.

We recommended the Assistant Secretary for Information and Technology implement improved processes for monitoring and analyzing significant system audit events for unauthorized or unusual activities across all systems and platforms in accordance with VA policy. Ensure privileged activity is monitored on all systems and applications.

We recommended the Assistant Secretary for Information and Technology enable system audit logs on all critical systems and platforms and conduct centralized reviews of security violations across the enterprise.

We recommended the Assistant Secretary for Information and Technology implement improved mechanisms to continuously identify and remediate security deficiencies on VAs network infrastructure, database platforms, and Web application servers in accordance with established policy timeframes. If patches cannot be applied or are unavailable, other protections or mitigations should be documented and implemented to address the specific risks.

We recommended the Assistant Secretary for Information and Technology continue to implement improved segmentation controls that restrict vulnerable medical devices from unnecessary access from the general network.

We recommended the Assistant Secretary for Information and Technology implement improved processes to require system owners and management to provide adequate credentials to ensure security scans are authenticated to end devices where feasible and the subsequent vulnerabilities are remediated in a timely manner.

We recommended the Assistant Secretary for Information and Technology improve the process for tracking and resolving vulnerabilities that cannot be addressed by enterprise processes within policy timeframes. Implement mitigations for identified security deficiencies by applying security patches, system software updates, or configuration changes to reduce applicable security risks.

We recommend the Vice President, Chief Information and Digital Officer, Information Technology, implement controls to prevent and detect disallowed cloud services procured outside of the IT procurement process, in conjunction with TVA Supply Chain and TVA Financial Services personnel.

We recommend the Vice President, Chief Information and Digital Officer, Information Technology, update the cloud inventory reconciliation process to include other data sources of cloud services procured or in use to improve cloud inventory completeness.

We recommend the Vice President, Chief Information and Digital Officer, Information Technology, review and update the cloud inventory as appropriate.

We recommend the Vice President, Chief Information and Digital Officer, Information Technology, implement a periodic process to identify and update blank required fields to improve cloud inventory accuracy.

The facility director ensures leaders provide a safe and clean environment of care for veterans, including having adequate staff to clean floors, protecting patient information, and ensuring food is dated and has not expired.

Review outreach staffing assignments and ensure appropriate coverage during future disaster response efforts when minimal resources are available.

Immediately conduct outreach efforts in those counties in North Carolina and South Carolina where the deadline to submit loan applications has not elapsed.

Perform a root cause analysis to determine the basis of insufficient outreach efforts in North Carolina and South Carolina and implement appropriate changes to ensure maximum awareness of available assistance to disaster survivors that accounts for rural
areas.

We recommend that APHIS establish a formal conflicts-of-interest policy that outlines the responsibilities and expectations for all VMOs that perform inspections at horse shows.

We recommend that APHIS establish a process to monitor inspectors’ completion of the requirements set forth in its formal conflicts-of-interest policy to ensure all requirements and actions are complete.

We recommend that APHIS conduct and document an assessment to determine the feasibility of implementing an alternative dispute resolution process for noncompliance determinations made during HPA horse shows.

USDA OIG has determined that this recommendation contains sensitive information and will not be publicly released due to privacy concerns.

We recommend that APHIS develop a process to ensure HPA policy guidance and expectations are communicated to the horse show industry in advance of their implementation date and the start of the horse show season.

We recommend that the PBS Region 2 Regional Commissioner take immediate actions to address any fire protection and worker safety deficiencies at the Javits Building by: ensuring that all fire extinguishers are mounted and unobstructed, all elevator machine rooms comply with applicable requirements for fire barriers, and all fire evacuation route diagrams are up to date to comply with fire codes; confirming that the O&M contractor promptly repairs water leaks or displays proper signage in affected areas to prevent slipping accidents in accordance with Occupational Safety and Health Administration requirements. This is especially important for prolonged leaks for which PBS…

We recommend that the PBS Region 2 Regional Commissioner take immediate actions to reassess compliance with Architectural Barriers Act Accessibility Standards requirements at the Javits Building by: ensuring that proper signage is installed that directs individuals to disability- accessible entrances, exits, restrooms, and other applicable building locations; and cataloging all accessibility violations, resources permitting, throughout the building and developing a plan to remediate them.

We recommend that the PBS Region 2 Regional Commissioner implement controls to ensure that appropriate PBS Region 2 officials notify building occupants of identified EHSF risks in a timely manner in accordance with PBS policies.

The OIG recommends that the Executive Director for Operations update Management Directive 11.6 to ensure roles and responsibilities are clearly defined.

The OIG recommends that the Executive Director for Operations develop procedures to ensure all current NRC staff performing grant-related functions have appropriate authority or delegation letters that fully cover their grant roles and responsibilities.

The OIG recommends that the Executive Director for Operations develop relevant training and a plan to ensure grant staff know their roles and responsibilities.

The OIG recommends that the Executive Director for Operations develop a process to ensure the timely deobligation of funds for grants past their period of performance.

The OIG recommends that the Executive Director for Operations validate the completeness of grant files past their period of performance and deobligate the more than $321,000 in funds specified in this report, or provide documentation to the OIG to justify not deobligating the funds.

The OIG recommends that the Executive Director for Operations validate the completeness of grant files past their period of performance and deobligate the more than $920,000 specified in this report, or provide documentation to the OIG to justify not deobligating the funds.

The OIG recommends that the Executive Director for Operations implement a policy that requires periodic reviews to ensure compliance with 2 C.F.R. Part 200 requirements related to the allowability of costs.

The OIG recommends that the Executive Director for Operations develop a method within existing agency resources to optimize public access, in compliance with all relevant laws and policies, to the results of research funded by NRC grants.

The OIG recommends that the Executive Director for Operations train SBCR staff to ensure they are aware of the communication and documentation requirements related to grant periodic reviews.

Enroll all GPO-issued devices in a Mobile Device Management system capable of controlling application installations, limited to only approved applications, and enforcing policy compliance.

While the current annual GPO Cybersecurity Awareness Training highlights the risks of downloading mobile applications, the OIG recommends that the annual training include more information about or greater emphasis on the prohibition of downloading personal or non-GPO software on GPO-issued mobile devices.