Open Recommendations

(U) Rec. 3: Report is Classified.

(U) Rec. 4: Report is Classified.

(U) Rec. 5: Report is Classified.

(U) Rec. 5: Report is Classified.

(U) Rec. 5: Report is Classified.

(U) Rec. 6: Report is Classified.

(U) Rec. 6: Report is Classified.

(U) Rec. 7: Report is Classified.

(U) Rec. 8: Report is Classified.

(U) Rec. 9: Report is Classified.

We recommend that the Assistant Secretary for the Office of Elementary and Secondary Education require Iowa torequire Southeast Polk to ensure that LEA officials responsible for making or reviewing and approving purchases receivesufficient training on Federal rules and regulations related to grant administration and management, particularly thoseaddressing procurement process and documentation requirements.

Establish a requirement in the RPT Program Plan for recurring right-size studies for the RPT capability portfolio and use the results to reexamine workforce and capability requirements for the future.

Ensure that cost models deployed at all RPT Centers include full recovery of applicable maintenance costs for the infrastructure and facilities being utilized, similar to that being piloted at Stennis.

Formally document and establish the FM&M process in the RPT Program Plan or RPTMB Operating Procedures.

Document the results and planned RPT actions following completion of the Commercial Capability Survey.

Ensure that the appropriate revisions are made to NPR and NPD 8600.1 to clarify the authority structure.

We recommend that the Chief Information Security Officer identify qualitative and quantitative metrics on service level agreements held with third parties, then perform an analysis with monthly reporting received from those third parties to identify metrics that can be measured and documented, on either a monthly or quarterly basis, to ensure that EAC is receiving all contracted services.

We recommend that the Chief Information Security Officer develop and implement procedures to leverage the Repository for Software Attestation and Artifacts to obtain sufficient assurance that the security and supply chain controls of systems or services provided by contractors or other entities on behalf of the organization meet FISMA requirements.

We recommend that the Chief Information Security Officer provide annual Anti-Counterfeit Training for IT staff with SCRM responsibilities.

We recommend that the Election Assistance Commission's Chief Information Officer implement EL3 logging requirements in accordance with Office of Management and Budget memorandum M-21-31.

We recommend that the Election Assistance Commission's Chief Information Officer establish and implement a formal Information Security Continuous Monitoring Strategy and an effective monitoring mechanism to track the progress of ongoing lessons learned.

We recommend that the Election Assistance Commission's Chief Information Officer identify and employ an automated notification mechanism to test its system level contingency plans thoroughly and effectively.

The Chief Information Officer and the Chief, Direct File, should ensure that Direct File developers document their test plan with traceability to test types, test cases, and test results.

The Director, Collection Policy, SB/SE Division, should remind revenue officers of their obligation to comply with I.R.C. § 6103, ensuring that they follow the proper Oral Disclosure Consent procedures to prevent unauthorized disclosure of taxpayer return information and avoid any potential violation of a taxpayer’s rights under I.R.C. § 6103.

The Chief Human Capital Officer should create and implement a systemic fix to ensure that Section 1204 managers completing their quarterly certifications are automatically routed to the appropriate SharePoint page(s) when their responses necessitate additional information reporting about potential ROTER violations.