Open Recommendations

We recommend that the Acting GSA Administrator continue to collaborate with federal law enforcement agencies to address security risks at GSA-owned federal buildings.

Establish a common framework with roles and responsibilities for deferred maintenance that applies throughout the organization, standardizing what is considered deferred maintenance and the process for prioritizing and addressing it.

Prioritize and track all deferred maintenance and associated costs, including capital and maintenance projects, and begin addressing its backlog of maintenance in order of priority.

Establish procedures, responsibilities, and accountability mechanisms for staff and supervisors to periodically review and validate all data including "estimated cost" within the maintenance system, for completeness and accuracy.

Ensure that the maintenance system has functionality and reporting capabilities to assist project managers with identifying outstanding maintenance calls and alert supervisors of maintenance calls without periodic updates or resolution.

Establish a policy requiring project managers to provide local management with periodic status updates on reported maintenance issues and document statuses until resolved.

Improve oversight of its local self-assessment programs by assigning staff to conduct periodic reviews of assessments for facilities under 6,500 square feet and establishing an escalation process to obtain annual assessments from larger facilities for review.

Address all building maintenance, safety, and security issues identified during site visits.

We recommend that OPM evaluate and adjust its cybersecurity risk management strategy based on its threat environment and organization-wide cyber and privacy risk assessment.

We recommend that OPM develop policies and procedures for developing and maintaining a data inventory.

We recommend that OPM ingest security logs from its FISMA systems and analyze events and anomalies.

We recommend that OPM configure the agency logs/logging tools to meet the EL1 (basic) logging requirements outlined in M-21-31.

We recommend that OPM document lessons learned to improve its ISCM policies and strategy.

We recommend that OPM document POA&Ms for all ISCM risks.

We recommend that OPM update its ISCM strategies to include policies and procedures to monitor its cloud service providers security posture.

We recommend that OPM test all ISCP's annually as required by OPM policy.

Develop processes and requirements for routinely collecting excess and underutilized space data across its property portfolio and include accountability mechanisms for ensuring this data is collected on a regular basis.

Develop processes to periodically assess and verify the accuracy of excess and underutilized space data and update in the designated system of record.

Develop and implement a comprehensive strategy for managing excess and underutilized space, which would include processes for identifying space at properties throughout the network, centralized tracking and reporting, and corrective action plans (such as for renting, disposing, or repurposing).

Verify that all rooms and spaces reported in the Real Asset Management Program Out-leasing module are properly coded.

Reconcile property space data across all modules within the property management system to verify consistency and accuracy of the data.

Rec. 1.a: The DoD recommended that the Under Secretary of Defense for Acquisition and Sustainment, in coordination with the Under Secretary of Defense (Comptroller)/ Chief Financial Officer, DoD, provide clarifying information to DoD Components on why the Government'Furnished Property Module is an essential part of the DoD'wide solution for recording and reporting Government Property in the Possession of Contractors.

Rec. 1.b: The DoD recommended that the Under Secretary of Defense for Acquisition and Sustainment, in coordination with the Under Secretary of Defense (Comptroller)/ Chief Financial Officer, DoD, issue DoD guidance requiring the DoD Components to use the Government'Furnished Property Module for inventory management of Government Property in the Possession of Contractors.

Rec. 1.c.: The DoD recommended that the Under Secretary of Defense for Acquisition and Sustainment, in coordination with the Under Secretary of Defense (Comptroller)/ Chief Financial Officer, DoD, work with DoD Components to implement the Government'Furnished Property Module and the necessary interfaces with each Components non'retiring Accountable Property System of Record.

Rec. 2.a: The DoD OIG recommended that the Assistant Secretary of the Army (Financial Management and Comptroller), align Component'level Government Property in the Possession of Contractors material weakness remediation efforts with the Office of the Under Secretary of Defense for Acquisition and Sustainment Corrective Action Plan.