Open Recommendations

Work with Cal OES to revise its subrecipient compliance assessment procedures to ensure corrective action plans are implemented in a timely manner.

Ensure that Building Futures establishes controls to allocate costs to VOCA based on a consistent and documented methodology.

Ensure that the Building Futures implements controls to ensure salaries and wages expenses charged to the subaward are based on records that accurately reflect the work performed to comply with federal award requirements.

Remedy $32,478 in salaries and fringe benefits costs that were not adequately supported.

Remedy $8,897 in unsupported operating costs.

Remedy $2,156 in unallowable operating costs charged to VOCA in error.

Work with Cal OES to ensure that it provides the necessary guidance for its subrecipients to report only VOCA-funded activities in PMT, prorating when appropriate.

Work with Cal OES to establish procedures to verify subrecipients' VOCA performance data to ensure that it is prorated, when appropriate, to prevent duplicative reporting.

Work with Cal OES to enhance its subrecipient monitoring policies and procedures to ensure subrecipients are recording or allocating expenditures by funding source, as required.

1. We recommend the Undersecretary of Commerce for Industry and Security direct BIS’s Chief Information Officer to implement an EDR on Network A.

2. We recommend the Undersecretary of Commerce for Industry and Security direct BIS’s Chief Information Officer to adopt the threat hunting security control and use existing BIS SOC tools to proactively hunt threats and mitigate malicious or unauthorized network activity.

3. We recommend the Undersecretary of Commerce for Industry and Security direct BIS’s Chief Information Officer to establish and implement detailed incident response procedures to detect, contain, eradicate, and recover from threats.

4. We recommend the Undersecretary of Commerce for Industry and Security direct BIS’s Chief Information Officer to implement a method to identify and prevent the exfiltration of PII, BII, and other sensitive data from BIS networks.

5. We recommend the Undersecretary of Commerce for Industry and Security direct BIS’s Chief Information Officer to properly configure network security devices to prevent unauthorized connections from outside BIS networks.

6. We recommend the Undersecretary of Commerce for Industry and Security direct BIS’s Chief Information Officer to properly restrict BIS networks to prevent unauthorized lateral movement between BIS networks.

7. We recommend the Undersecretary of Commerce for Industry and Security direct BIS’s Chief Information Officer to implement a security control to allow only approved software on Network B and consider implementing this control for all BIS networks.

8. We recommend the Undersecretary of Commerce for Industry and Security direct BIS’s Chief Information Officer to review all BIS user access, for networks and applications, to ensure each user is assigned the correct levels of access according to the principle of least privilege.

9. We recommend the Undersecretary of Commerce for Industry and Security direct BIS’s Chief Information Officer to immediately search BIS networks for classified credentials and establish a procedure to regularly search for plain-text credentials.

10. We recommend that the Undersecretary of Commerce for Industry and Security direct BIS’s Chief Information Officer to ensure passwords are disabled for all user accounts as soon as operationally possible.

11. We recommend that the Undersecretary of Commerce for Industry and Security direct BIS’s Chief Information Officer to establish and implement BIS helpdesk procedures for user access issues, including a user verification process.

12. We recommend that the Undersecretary of Commerce for Industry and Security direct BIS’s Chief Information Officer to implement an automated solution to change local administrator credentials after sharing them with BIS users and use different local administrator passwords for each system.

13. We recommend that the Undersecretary of Commerce for Industry and Security direct BIS’s Chief Information Officer to implement a technical control to generate unique, strong passwords for each account created.

Facility leaders determine appropriate supply storage locations, and for any suppliesstored outside these defined locations, implement a process to ensure staff identifyand remove expired supplies.

Facility leaders ensure video laryngoscope supplies are readily available and notexpired.

The Director ensures staff keep patient care areas clean and safe.