Open Recommendations

(U) Rec. 2.c: Recommendation is Classified.

(U) Rec. 3.c: Recommendation is Classified.

(U) Rec. 3.d: Recommendation is Classified.

(U) Rec. 3.f: Recommendation is Classified.

(U) Rec. 3.g: Recommendation is Classified.

We recommend that the Iowa Department of Human Services, Iowa Medicaid Enterprise follow up with the 20 nursing homes to ensure that corrective actions have been taken regarding the life safety and emergency preparedness deficiencies identified in this report,

We recommend that the Iowa Department of Human Services, Iowa Medicaid Enterprise work with CMS to develop standardized life safety training for nursing home staff, conduct more frequent surveys at nursing homes that have a history of multiple high-risk deficiencies, (212-909-10-02) and require nursing homes and inspection contractors to (1) tag systems that are critical to the health and safety of nursing home residents when they have found that these systems may not work as required when needed and (2) notify the State agency. (074-348-10-02)

We recommend that the Iowa Department of Human Services, Iowa Medicaid Enterprise conduct more frequent surveys at nursing homes that have a history of multiple high-risk deficiencies,

We recommend that the Iowa Department of Human Services, Iowa Medicaid Enterprise require nursing homes and inspection contractors to (1) tag systems that are critical to the health and safety of nursing home residents when they have found that these systems may not work as required when needed and (2) notify the State agency.

1. Control Weaknesses over Rules of Behavior Process (NCUA IT-20-01) We noted weaknesses over the Rules of Behavior process. Specifically, we noted that NCUA management did not ensure that two (2) users out of a sample of fifteen (15) new users, signed the NCUA’s Rules of Behavior (RoB) acknowledgement, indicating they had read, understood and agreed to abide by the RoB prior to the agency authorizing the users to access the NCUA network. NCUA management did not develop and implement a process to enforce and ensure that the NCUA Information System Security Manual isfollowed for the onboarding process and that…

2. Control Weakness over the AMAC Data Center Access (NCUA IT-20-02) We noted AMAC management did not timely remove one (1) individual’s access to the AMAC Data Center on March 11, 2020. Due to a lack of enforcement of policy, an individual did not successfully remove access badge permissions.

3. Control Weaknesses over Separated Users and Removal of Users (NCUA-IT-20-03) We noted the following account management issues pertaining to separated and inactive users in the General Support System (GSS) Active Directory (AD) network:a. Separated Users: NCUA did not timely disable access for multiple users. For example, four (4) separated users accessed the GSS one day after their effective separation date.

4. Control Weakness over Third-Party Oversight for XP2 Application Hosted by Fiserv (NCUA IT-20-04) We noted that in performing its risk assessment, management did not adequately evaluate the System and Organization Controls (SOC) 1 report over Fiserv’s XP2 application service provider environment. Specifically, management’s risk assessment did not:a. Identify and evaluate the NCUA’s design and operating effectiveness of the Complementary User Entity Controls (CUECs) identified within the SOC 1 report.b. Identify and evaluate the complementary subservice organization controls (CSOCs) identified within the SOC 1 report.c. Obtain and perform an assessment of a bridge/gap letter to determine whether coverage was provided…

The Under Secretary for Health ensures a review of policies related to the role and training requirements of chaperones for sensitive examinations and takes action as appropriate.

Determine the allowability of the questioned transactions and recover $5,130,999, if applicable.

Complete the Risk Assessment process as required by NIST 800-37, re-evaluate the Risk Management Framework to make in more fluent to leverage day-to-day processes in place for completing the risk assessment, and determine how to best implement an organization-wide governance process for monitoring and reporting on risks.

Document the process in place to monitor required flaw remediation to resolution and enhance the flaw remediation process to require approvals if risks cannot be mitigated to an acceptable level in a timely manner. In addition, develop timeframes and monitoring on the timeliness of applying patch updates.

Establish a formal process to capture and track data related to wildland fire activities to ensure completion of all preparedness activities and mitigation efforts.

Ensure oversight activities related to wildland fire management such as review and approval of the contractor's Wildland Fire and Health Plan, performance of formal assessments, and verification of mitigation efforts through operational awareness

We recommend the U.S. Border Patrol Chief and Office of Field Operations Executive Assistant Commissioner ensure the Canine Program has enough certified canine instructors and adequate training aids to provide proficiency training for canines after they are deployed. This should include:• implementing a process to ensure sufficient staff are available to provideall training needs to U.S. Border Patrol and the Office of Field Operationscanine teams; and• creating a systemic schedule and plan for pseudo and actual narcoticreplacement for every U.S. Border Patrol sector and Office of FieldOperations field office within the time recommended by the Laboratoriesand Scientific Services Directorate. (See…

We recommend the Executive Director of the Laboratories and Scientific Services Directorate conduct a study to determine the appropriate time for replacement of pseudo and actual narcotics to limit the constant expiration of these training aids. Pseudo and actual narcotic replacement cycles should be updated according to the results of the Laboratories and Scientific Services Directorate study.

We recommend the U.S. Border Patrol Associate Chief of Law Enforcement Operations and Office of Field Operations Director of Tactical Operations update the Canine Program policies to provide adequate oversight to ensure program needs are being met. The policies should include:• record retention timelines for all training documents to beconsistent with the CBP Records General Schedule or provideadequate documentation on retention policies after consultationwith record retention personnel to determine the appropriateapproach;• a systematic schedule and plan for pseudo and actual narcotictraining aids (see Recommendation 2.); and• development of standard operating policies, procedures, andquality assurance measures for use of the Canine…

Fiscal Service management perform a review of the current system environment against the Configuration Management Database (CMDB) to ensure that all information system components are inventoried.

Fiscal Service management perform a risk assessment over the subject matter and determine the appropriate personnel to be responsible for monitoring and updating the Configuration Management Database (CMDB).

Fiscal Service management update policy and procedures related to recommendations 5-1 and 5-2 and disseminate the documentation to enforce such policy and procedures.