Open Recommendations

[Description omitted; DOJ has determined that this recommendation contains information that is limited official use or classified.]

[Description omitted; DOJ has determined that this recommendation contains information that is limited official use or classified.]

[Description omitted; DOJ has determined that this recommendation contains information that is limited official use or classified.]

Review the 1,799 PPP loans totaling over $89 million that matched a DNP data source to ensure eligibility requirements were met and seek remedy or repayment of all loans deemed ineligible.

Review the 49 PPP loans totaling approximately $3.5 million and the 43 loans totaling approximately $7.2 million to ensure borrowers met eligibility requirements and seek remedy or repayment of loans deemed ineligible.

Review PPP loans in which the DNP hold codes were cleared to 1) identify those cleared using pre-decisional memos and 2) those cleared without sufficient evidence to support the reviewer’s loan decision and seek remedy or repayment of loans deemed ineligible.

Develop and implement controls, such as supervisory reviews, to ensure PPP loans and loans for future stimulus programs with DNP matches receive manual reviews, as required. The reviews should ensure that pre-decisional memos are not used to clear DNP hold codes and that loan files contain relevant and appropriate documentary evidence to support the loan review decisions.

Develop and implement clear guidance requiring responsible officials to maintain documentary evidence used to support loan decisions in the loan files.

Review the 59,893 PPP applications that matched a DNP data source to ensure borrowers met eligibility requirements and seek remedy or repayment of loans deemed ineligible.

Review the additional 47,940 PPP loans totaling over $1.7 billion, identified through the DNP data match, to ensure borrowers met the eligibility requirements and seek remedy or repayment of loans deemed ineligible.

(U) Rec. 1.a: Report is Classified.

(U) Rec. 1.c: Report is Classified.

1. We recommend that the Deputy Secretary of Commerce ensure the development and ongoing maintenance of a lifecycle cost estimate and schedule for the program in accordance with the Department's Acquisition Project Management Policy (DAO-208-16) and the U.S. Government Accountability Office's (GAO) Cost Estimating and Assessment Guide and Schedule Assessment Guide.

2. We recommend that the Deputy Secretary of Commerce ensure that the BAS Executive Board reviews the program's cost, schedule, and scope performance against baselines, as well as risk management and additional metrics needed to support adequate investment oversight.

3. We recommend that the Deputy Secretary of Commerce ensure the program defines and executes cost management controls in accordance with the Department's Acquisition Project Management Policy (DAO-208-16) and the Department of Commerce Cost Estimating Guide.

4. We recommend that the Deputy Secretary of Commerce ensure the program defines and executes schedule management controls in accordance with the Department's Acquisition Project Management Policy DAO-208-16 and GAO's Schedule Assessment Guide.

5. We recommend that the Deputy Secretary of Commerce direct the program to work with the contractor to ensure the Department receives the full value of monthly reports by including sufficient information for monitoring cost compared to budget and managing changes to schedule and cost baselines, thereby putting funds for those deliverables to better use.

6. We recommend that the Deputy Secretary of Commerce ensure the Department facilitates the collection of lessons learned from the NOAA financial applications' implementation and incorporates those lessons into plans and procedures for the NIST and Census implementations.

We recommend that the Office of the Chief Information Officer extend the capability of its data loss prevention solution to include rule-based analysis to detect and prevent the exfiltration of sensitive data from the subject system in accordance with industry best practices.

We recommend that the Office of the Chief Information Officer regularly test the Department's data loss prevention capability to ensure that sensitive data in the subject system is protected against data exfiltration attempts.

We recommend that the Office of the Chief Information Officer evaluate data communication protocols in use by the subject system that are vulnerable to exploitation and implement controls to mitigate identified vulnerabilities.

We recommend that the Office of the Chief Information Officer ensure the implementation and annual testing of contractually required data loss prevention controls on all cloud systems containing sensitive data.

We recommend that the Office of the Chief Information Officer establish controls to ensure that only FedRAMP-approved cloud-computing services are authorized to access the Department's network and that non?FedRAMP?approved cloud-computing services in use are discontinued and blocked from access to Department network resources in accordance with the Department's acceptable use policy.

We recommend that the Office of the Chief Information Officer ensure all existing non-Foundation Cloud Hosting Services contracts are migrated to an approved enterprisewide cloud-hosting procurement or modified to incorporate OCIO requirements and best practices for procuring cloud services, as recommended by the Chief Acquisition Officer and Chief Information Officer Councils and OCIO policy.

Conduct a review of the convalescence claims for hip and knee replacements and
resurfacing completed from February 7, 2021, through August 31, 2022, and take
appropriate actions to correct convalescence periods and ensure monetary benefits are
accurate.