Open Recommendations

EXIM’s Asset Management Division/Special Assets Group should require verification of equipment inspections at a frequency determined by industry standard, Samalkot Power Limited, Reliance Power Limited, and the independent consultants to ensure the equipment is maintained in a manner that allows the equipment to be sold.

Update the Office of Chief Information Officer Cybersecurity Incident Response Plan to incorporate lessons learned from the security incident and ensure that it reviews and updates the plan annually.

Document and implement a plan to issue policy, implementation instructions, procedures, and configuration guidance to support Departmental enterprise event logging in accordance with OMB M-21-31, Improving the Federal Governments Investigative and Remediation Capabilities Related to Cybersecurity Incidents.

Complete the DOT workforce assessment, which includes the entire DOT IT and cybersecurity workforce.

Direct the DOT Information Assurance and Privacy Management Office and Breach Assessment and Response Team to implement annual testing of the Breach Notification Controls, as required by DOT Order 1351.19, Personally Identifiable Information Breach Notification Controls.

Work with the Cyber Security Assessment and Management (CSAM) system owner to resolve the technical issues to ensure the CSAM Plan of Action and Milestones (POA&M) reporting function is accurate and conduct oversight of the Operating Administrations to ensure that the POA&M entries meet the requirements of Information Technology (IT) Implementation Memorandum 2023-010A, DOT Supplemental Requirements for IT Security POA&M Management.

Strengthen procedures for maintaining a comprehensive and accurate cloud system inventory, which includes reconciling CSAM data to the listing of cloud service providers submitted by the Operating Administrations.

Enforce password polices to ensure passwords are harder to guess and extend the timeframe in which individuals can enter the next password. Further, use cryptographically protected channels to transmit passwords.

Document and implement procedures to review on a periodic basis users with administrative rights and privileged groups with access to domain controllers.

Implement protections to restrict access to system tools used to create and manage shadow copies of the hard drive.

Document and implement procedures to analyze user account passwords against lists of commonly used and compromised passwords and require users to reset weak or compromised passwords.

Develop and formalize a quality program for Plant Operations that emphasizes a culture of measurement and continuous improvement.

Determine if any of the potential metrics highlighted in this report would benefit Plant Operations and its stakeholders, and if so, track and report on those metrics.

Create new workflow diagrams, with cycle times, for each type of product identified in Title 44.

Use Plant Operations Manufacturing System (POMS) to replace the manual tracking of information, track complaints and issues, and generate metrics reports.

Design and implement risk management and general support system policies, procedures, and processes that address National Institute of Standards and Technology Special Publication 800-53, Rev. 5.1, Rel. 5.1.1 control requirements.

Design and implement Supply Chain Risk Management policies, procedures, and processes that address National Institute of Standards and Technology Special Publication 800-53, Rev. 5.1, Rel. 5.1.1 control requirements.

Develop and implement agency-wide Configuration Management policies, procedures, and processes, that address applicable National Institute of Standards and Technology Special Publication 800-53, Rev. 5.1, Rel. 5.1.1, control requirements.

Develop and implement agency-wide identity access management policies, procedures, and processes that address applicable National Institute of Standards and Technology Special Publication 800-53, Rev 5, Rel. 5.1.1, controls requirements.

Develop and implement agency-wide data protection and privacy policies, procedures, and processes that address applicable National Institute of Standards and Technology Special Publication 800-53, Rev. 5, Rel. 5.1.1 control requirements.

Develop and implement agency-wide Security Training policies, procedures, and processes that address applicable National Institute of Standards and Technology Special Publication 800-53, Rev. 5.1, Rel. 5.1.1, control requirements.

Finalize and implement its Information Security Continuous Monitoring plan and update the plan and any additional procedures and processes to address applicable National Institute of Standards and Technology Special Publication 800-53, Rev. 5, Rel. 5.1.1, control requirements.

Develop and implement agency-wide incident response policies, procedures, and processes that address applicable National Institute of Standards and Technology Special Publication 800-53, Rev. 5, Rel 5.1.1, control requirements.

Develop and implement agency-wide contingency planning policies, procedures, and processes that address applicable National Institute of Standards and Technology Special Publication 800-53, Rev. 5, Rel 5.1.1, control requirements.

Consider requesting a class deviation to Federal Acquisition Regulation 52.203-13, Contractor Code of Business Ethics and Conduct to expand contractors’ business ethics awareness and compliance programs and internal control systems to include sexual harassment and sexual assault prevention and reporting, as well as sexual harassment investigations.