Open Recommendations

(U) Rec. A.2.b: The DoD OIG recommended that the Executive Director for the Army Contracting Command-Rock Island direct the Procuring Contracting Officer for the Army Prepositioned Stock-5 contract to coordinate with the Army Prepositioned Stock-5 Administrative Contracting Officer and Contracting Officer's Representatives to update surveillance procedures to require Contracting Officer's Representatives to conduct periodic checks of the Global Combat Support System-Army to provide reasonable assurance that all pieces of Army Prepositioned Stock-5 equipment have a correct maintenance service plan listed in the system.

(U) Rec. A.2.c: The DoD OIG recommended that the Executive Director for the Army Contracting Command-Rock Island direct the Procuring Contracting Officer for the Army Prepositioned Stock-5 contract to coordinate with the Army Prepositioned Stock-5 Administrative Contracting Officer and Contracting Officer's Representatives to develop and implement surveillance plans to include Contracting Officer's Representatives verifying that the Army Prepositioned Stock-5 contractor determined whether all required Basic Issue Items and Components of End Items are on hand for each piece of Army Prepositioned Stock-5 equipment being repaired before allowing the contractor to declare the equipment fully mission capable.

(U) Rec. A.3: The DoD OIG recommended that the Area Support Group-Kuwait Commander coordinate with the Executive Director of the Army Contracting Command-Rock Island to modify the Area Support Group-Kuwait Directorate of Public Works contract to ensure that all Army Prepositioned Stock-5 controlled humidity facilities are in compliance with Army Technical Manual 38-470, including managing the humidity settings to be within 30- to 50-percent relative humidity.

Reduce improper and unknown payments to below 10 percent for the Pension Program. This is a repeat recommendation from the OIG’s FY 2022 report.

Reduce improper and unknown payments to below 10 percent for the Purchased Long-Term Services and Supports Program. This is a repeat recommendation from the OIG’s FY 2022 report.

We recommend that the Chief Financial Officer for the Department develop and implement procedures to ensure that thesampling populations of drawdowns are complete for the basis of calculating the improper payment and unknown paymentestimates.

We recommend that the Chief Financial Officer for the Department ensure changes made for the query design concerningthe use of three filters, are implemented in subsequent years for programs that are required to produce an improper paymentestimate.

We recommend that the Chief Financial Officer for the Department, for programs that require them, design and implementimproper payment and unknown payment sampling and estimation plans that are appropriate for the sampling of paymentsbased on accurate sampling populations and result in reliable estimates. The improper payment and unknown paymentsampling and estimation plans should also include language stating why sampling populations in Stage 1 may not matchsampling population in Stage 2 and explain the statistical impact on the estimates.

We recommend that the Chief Financial Officer for the Department implement its quality assurance checklist to ensure theproper details from the drawdown population are accurately included on the extrapolation sheet.

We recommend that the Chief Financial Officer for the Department, in conjunction with the acting Chief Financial Officer forFSA, develop sampling and estimation plans for the Pell and Direct Loan programs that will produce reliable estimates.Specifically, the plan should (a) produce appropriate and accurate confidence intervals around a statistically valid pointestimate; (b) consistent with 31 U.S.C. section 3352(c)(1)(A), produce an estimate that is otherwise appropriate using amethodology approved by the Director of OMB; or (c) consistent with OMB Circular A-123 Appendix C, Part II, B(2), include adetailed explanation as to why it is not possible to produce a statistically-valid point…

(U) Rec. 1.a: The DoD OIG recommended that the DoD Chief Information Officer develop, in coordination with the Under Secretary of Defense for Research and Engineering and the Under Secretary of Defense for Acquisition and Sustainment, a DoD?wide Supply Chain Risk Management strategy as required by the National Institute of Standards and Technology guidance.

(U) Rec. 1.b: The DoD OIG recommended that the DoD Chief Information Officer develop, in coordination with the Under Secretary of Defense for Research and Engineering and the Under Secretary of Defense for Acquisition and Sustainment, policies and procedures implementing the DoD-wide Supply Chain Risk Management strategy as required by the National Institute of Standards and Technology guidance, including organizational-wide tools and techniques that allow DoD Components to consistently and effectively manage risks associated with using external providers.

(U) Rec. 1.c: The DoD OIG recommended that the DoD Chief Information Officer determine when DoD Components should complete a privacy impact assessment for information systems and ensure that all DoD guidance, including DoD Instruction 5400.16, "DoD Privacy Impact Assessment (PIA) Guidance," July 14, 2015, Incorporating Change 1, August 11, 2017, and the DoD Risk Management Framework Knowledge Service guidance, aligns with that determination.

(U) Rec. 1.d: The DoD OIG recommended that the DoD Chief Information Officer direct DoD Components, in coordination with the Chief Information Security Officers, Chief Information Officers, and Authorizing Officials, to require that officials conduct privacy impact assessments for all non-national security systems and update the Enterprise Mission Assurance Support Service, or its equivalent system, as required by DoD guidance.

(U) Rec. 1.e: The DoD OIG recommended that the DoD Chief Information Officer implement a process, in coordination with the DoD Component Chief Information Security Officers, Chief Information Officers, and Authorizing Officials, such as periodic Enterprise Mission Assurance Support Service reviews, to ensure that officials complete privacy impact assessments for all non-national security systems and update the Enterprise Mission Assurance Support Service, or its equivalent system, as required by DoD guidance.

(U) Rec. 1.f: The DoD OIG recommended that the DoD Chief Information Officer direct DoD Components, in coordination with the Chief Information Security Officers, Chief Information Officers, and Authorizing Officials, to conduct business impact analyses for all non-national security systems and update the Enterprise Mission Assurance Support Service, or equivalent system, as required by DoD guidance.

(U) Rec. 1.g: The DoD OIG recommended that the DoD Chief Information Officer implement a process, in coordination with the Chief Information Security Officers, Chief Information Officers, and Authorizing Officials, such as periodic Enterprise Mission Assurance Support Service reviews, to ensure that DoD officials complete business impact analyses for all non-national security systems and update the Enterprise Mission Assurance Support Service, or its equivalent system, as required by DoD guidance.

(U) Rec. 1.h: The DoD OIG recommended that the DoD Chief Information Officer direct DoD Components, in coordination with the Chief Information Security Officers, Chief Information Officers, and Authorizing Officials, to conduct information system contingency plan testing, including annual tests, for all non-national security systems and update the Enterprise Mission Assurance Support Service, or its equivalent system, as required by DoD guidance.

(U) Rec. 1.i: The DoD OIG recommended that the DoD Chief Information Officer implement a process, in coordination with the Chief Information Security Officers, Chief Information Officers, and Authorizing Officials, such as periodic Enterprise Mission Assurance Support Service reviews, to ensure that DoD officials annually test contingency plans for all non-national security systems and update the status of the tests in Enterprise Mission Assurance Support Service, or its equivalent system, as required by DoD guidance.

(U) Rec. 1.k: The DoD OIG recommended that the DoD Chief Information Officer complete actions, in coordination with the Chief Information Security Officer, to fully incorporate the National Institute of Standards and Technology Special Publication 800-53, "Security and Privacy Controls for Information Systems and Organizations," Revision 5, Updated December 2020, requirements into DoD policies and procedures, such as updating control information outlined in the Risk Management Framework Knowledge Service and the Enterprise Mission Assurance Support Service.

(U) Rec. 1.l: The DoD OIG recommended that the DoD Chief Information Officer implement a process, in coordination with the Chief Information Security Officer, to incorporate future National Institute for Standards and Technology requirements into DoD policies and procedures for all DoD systems in a timely manner.

(U) Rec. 1.a: Report is Classified.

(U) Rec. 2.a: Report is Classified.

(U) Rec. 2.b: Report is Classified.

(U) Rec. 3.b: Report is Classified.