Open Recommendations

2. We recommend that the Assistant Secretary of Commerce for Communications and Information and NTIA Administrator direct FirstNet Authority’s Chief Executive Officer to hold AT&T accountable for meeting service restoration and recovery time objectives for disaster response, as required by the contract.

3. We recommend that the Assistant Secretary of Commerce for Communications and Information and NTIA Administrator direct FirstNet Authority’s Chief Executive Officer to reevaluate the RTO metric to ensure that it aligns with the NPSBN’s operational purpose of being available during disasters.

4. We recommend that the Assistant Secretary of Commerce for Communications and Information and NTIA Administrator direct FirstNet Authority’s Chief Executive Officer to modify the contract to clearly define the requirements for dispatching emergent deployable assets, including defining deployment types and specifying how to calculate RTO for restoring network coverage and improving existing coverage.

5. We recommend that the Assistant Secretary of Commerce for Communications and Information and NTIA Administrator direct FirstNet Authority’s Chief Executive Officer to take the necessary steps to ensure that FirstNet Authority has access to real-time network data and the ability to actively monitor network services and deployed assets.

6. We recommend that the Assistant Secretary of Commerce for Communications and Information and NTIA Administrator direct FirstNet Authority’s Chief Executive Officer to strengthen disaster recovery oversight by developing and implementing formal processes for: a. actively monitoring AT&T’s disaster response efforts until complete network restoration is confirmed; and b. using FirstNet Authority’s incident response teams to conduct contract surveillance activities with public safety to determine the sufficiency of AT&T’s performance.

7. We recommend that the Assistant Secretary of Commerce for Communications and Information and NTIA Administrator direct FirstNet Authority’s Chief Executive Officer to revoke acceptance of AT&T’s Business Continuity/Disaster Recovery Plan and require AT&T to submit a plan that meets all NPSBN contract requirements. The plan should include: a demonstrated capability to provide uninterrupted access to the NPSBN during the disaster within the RTOs; specific protocols for responding to disasters in rural areas and outside the continental United States (including Hawaii and Alaska); a process for pre-positioning deployables with varying capabilities in isolated and rural regions, as determined necessary; logistics for…

8. We recommend that the Assistant Secretary of Commerce for Communications and Information and NTIA Administrator direct FirstNet Authority’s Chief Executive Officer to develop and implement a system for verifying the accuracy and reliability of data in the D-29 Deployable Units and Temporary Coverage Solutions report before accepting it.

9. We recommend that the Assistant Secretary of Commerce for Communications and Information and NTIA Administrator direct FirstNet Authority’s Chief Executive Officer to require AT&T to self-certify the D-29 Deployable Units and Temporary Coverage Solutions report going forward.

10. We recommend that the Assistant Secretary of Commerce for Communications and Information and NTIA Administrator direct FirstNet Authority’s Chief Executive Officer to ensure that AT&T’s after-action reports are accurate and sufficiently documented, with detailed lessons learned and process and protocol improvements to be implemented, before accepting them.

11. We recommend that the Assistant Secretary of Commerce for Communications and Information and NTIA Administrator direct FirstNet Authority’s Chief Executive Officer to ensure that AAR briefing meeting minutes are documented and maintained in the contract file.

We recommend that the DOI Secretary or designee establish a risk appetite as required in the Office of Management and Budget Circular No. A-123 and implement a process to ensure Departmentwide awareness of the risk appetite.

We recommend that the DOI Deputy Secretary or designee implement a process to periodically reevaluate and adjust risk appetite and tolerance levels to meet DOI's needs in accordance with the Office of Management and Budget Circular No. A-123.

We recommend that the DOI Deputy Secretary or designee create a comprehensive risk profile as required by the Office of Management and Budget Circular No. A-123 and ensure it is properly approved and incorporated into discussions for decision making.

We recommend that the DOI Deputy Secretary or designee establish a risk management council or an equivalent governance system to direct and oversee the establishment of DOI's risk profiles, regularly assess risk, develop appropriate risk responses, and approve the updated risk profile annually.

We recommend that the DOI Deputy Secretary or designee define the enterprise risk management roles and responsibilities for DOI's leadership at the executive, bureau, and office level and ensure those roles and responsibilities are clearly communicated.

Develop and implement guidance for Clean School Bus Program personnel on reviewing Clean School Bus rebate recipients' use and management of rebate funds.

Direct U.S. Merchant Marine Academy (USMMA) Sexual Assault Prevention and Response (SAPR) Program officials to work with appropriate USMMA IT officials to ensure that data collected and used for tracking claims and incidents of sexual assault and sexual harassment is secure in accordance with NDAA requirements.

Direct the Maritime Administration's Privacy Officer to complete a privacy impact analysis to ensure personally identifiable information used by the U.S. Merchant Marine Academy (USMMA) Sexual Assault Prevention and Response (SAPR)'s Program is secure based on Federal requirements and verify completion.

Direct U.S. Merchant Marine Academy (USMMA) Sexual Assault Prevention and Response (SAPR) Program officials to work with the USMMA's IT officials to implement the necessary security controls in the following areas: access control, encryption, audit logging, data exfiltration, data integrity, and backup, to mitigate possible cybersecurity risks to the SAPR Program's sensitive information in the interim to the extent possible until a new system is implemented and verify completion.

Treasury OIG should follow-up with Pennsylvania management if the transactions noted as unsupported or ineligible expenditures within the Grants greater than or equal to $50,000, Transfers greater than or equal to $50,000, Direct Payments greater than or equal to $50,000, and Aggregate Reporting less than $50,000 payment types can be supported. If support is not provided, Treasury OIG should recoup the funds or request that Pennsylvania management provide support for replacement expenses, not previously charged, that were eligible during the CRF period of performance. Further, based on Pennsylvania's responsiveness to Treasury OIG's requests and its ability to provide sufficient documentation…

The Chief, Taxpayer Services, and Chief, Tax Compliance Officer, should update internal guidance and develop more robust training to ensure that employees perform adequate research of tax accounts to identify outstanding tax debt prior to initiating manual refunds or credit elects.

The Chief, Taxpayer Services, and Chief, Tax Compliance Officer, should request the necessary programming changes to ensure that the duplicate return freeze and the telephone excise tax freeze code function appropriately. In addition, request programming changes to ensure that overpayments from undelivered refunds and interest offset appropriately.

The Chief, Taxpayer Services, and Chief, Tax Compliance Officer, should analyze the 8,452 individual and 31,967 business cases that we identified and determine whether additional programming or procedural errors exist in the process of offsetting refunds and credit elects. Take appropriate corrective action to prevent erroneous refunds and credit elects in the future.

The Chief Information Officer should ensure that the requested programming changes are implemented by January 2026.

The Chief, Taxpayer Services, and Chief, Tax Compliance Officer, should remove the erroneous LLC indicator from the 76 sole proprietorship accounts.