Open Recommendations

Follow its NSP procedures and HUD regulations to complete and submit its future NSP1 and NSP3 HUD quarterly performance reports and annual single audit reports within the required timeframes until the closeout of the respective programs or until HUD is assured that these reports are consistently submitted on time.

Follow its own procedures and HUD regulations to post the missing 21 NSP1 and 22 NSP3 HUD quarterly performance reports, as of June 30, 2019, on its official website; and, post the future NSP1 and NSP3 HUD quarterly performance reports on its website until the closeout of the respective programs or until HUD is assured that these reports are consistently posted on its website.

Obtain technical assistance from HUD to ensure that the City is able to submit its quarterly performance reports and annual single audit reports on time and post the performance reports on its website to comply with program regulations.

To help ensure the success of the MAP transformation, we recommend NASA’s Assistant Administrator for Procurement document contract assignments to COs, CORs, and program/project managers in a centralized system for inclusion in the Performance Metrics Dashboard.

Consolidate to the enterprise Tenable Nessus system to ensure accessibility of baseline compliance and/or vulnerability assessment capabilities.

Ensure that missing security patches are either applied in accordance with DOT policy or that vulnerable software is otherwise remediated on the affected endpoints. In addition, ensure that missing security patches attributable to specific mission/business requirements are identified, control weaknesses are appropriately documented in POA&Ms, and that the authorizing official is aware of and has accepted risk for the associated weaknesses.

Document and implement a process to identify software end of life dates and require the development of implementation plans to eliminate unsupported software.

Work with FAA to secure a reliable funding stream for background reinvestigations.

Work with the OST IT Director to ensure an alternate processing site (including necessary agreements) is more clearly described within the contingency plan to permit the transfer and resumption of information system operations for essential missions/business functions consistent with recovery time objectives when the primary processing capabilities are unavailable, for those systems in accordance with the requirements of the Cybersecurity Compendium and NIST guidance.

Work with the PHMSA CIO to ensure an alternate storage site (including necessary agreements) is described within contingency plans to permit the transfer and resumption of information system operations for essential missions/business functions consistent with recovery time objectives when the primary processing capabilities are unavailable, for those systems in accordance with the requirements of the Cybersecurity Compendium and NIST guidance.

Work with OAs to update privacy risk management procedures to ensure the completion, tracking, review, and approval of privacy plans and compliance documentation prior to system authorization or reauthorization. Components should engage the Departmental Chief Privacy Officer as appropriate.

Work with the Departmental Chief Privacy Officer to establish processes and procedures to determine Component compliance with Departmental policy requiring Privacy Risk Management plans be established prior to system authorization or reauthorization.

Coordinate with appropriate offices within the Office of Secretary to develop and implement a strategy and solution(s) to ensure that supervisors, contracting officers, and contracting officer representatives enforce personnel onboarding and off boarding procedures, completion of the DOT Rules of Behavior and other IT requirements prior to being granted access to DOT networks, systems, and information, or have existing access revoked upon separation, in accordance with DOT policy.

Strengthen its oversight of the configuration management processes performed by OAs to ensure configuration management plans are developed, kept up-to-date, and document requirements for each system.

Work with OAs to implement oversight to address configuration change weaknesses and to ensure configuration changes to the information systems are properly documented and tracked through implementation, and undergo a post-implementation review to verify procedures are followed.

Ensure that baseline configuration deviations are monitored and deviations are approved to ensure that baseline compliance reports demonstrate a consistent and accurate application of baseline standards.

We recommend that the Massachusetts Executive Office of Health and Human Services refund to the Federal Government $10,518,114 (Federal share) for claims for single-source physician-administered drugs that were ineligible for Federal reimbursement.

We recommend that the Massachusetts Executive Office of Health and Human Services refund to the Federal Government refund $882,892 (Federal share) for claims for top-20 multiple-source physician-administered drugs that were ineligible for Federal reimbursement.

We recommend that the Massachusetts Executive Office of Health and Human Services work with CMS to determine the unallowable portion of $4,154,511 (Federal share) for other claims for covered outpatient physician-administered drugs that were submitted without NDCs or with invalid NDCs and that may have been ineligible for Federal reimbursement and refund that amount, and whether the remaining $782,917 (Federal share) of other physician-administered drug claims could have been invoiced to the manufacturers to receive rebates and, if so, upon receipt of the rebates, refund the Federal share of the manufacturers’ rebates for those claims.

We recommend that the Massachusetts Executive Office of Health and Human Services work with CMS to determine and refund the unallowable portion of Federal reimbursement for physician-administered drugs that were not invoiced for rebates after December 31, 2017.

We recommend that the Massachusetts Executive Office of Health and Human Services strengthen its internal controls to ensure that all physician-administered drugs eligible for rebates are invoiced.

Coordinate with the Office of the Secretary to revise the National Infrastructure Protection Plan and other planning documents toincorporate current and evolving risks as well as mitigation strategies needed to secure the Nation’s election infrastructure.

Assign the staff resources needed to conduct timely cybersecurity and physical assessments to assist states and localities with securing the election infrastructure.

We recommend that the Minnesota Department of Human Services bill for and collect manufacturers’ rebates for pharmacy drugs and for single-source and top-20 multiple-source physician-administered drugs that we calculated to be $5,899,308 (Federal share) and refund the Federal Government

We recommend that the Minnesota Department of Human Services work with CMS to determine whether the non-top-20 multiple-source physician-administered drugs were eligible for rebates that we calculated to be at least $173,780 (Federal share) and, if so, upon receipt of the rebates, refund the Federal share of the rebates collected