Open Recommendations

Update its internal FOIA guidance for statutory timelines, extension conditions, fee waivers, perfection policy, referrals, and consultations.

We recommend that BOR update the ratesetting standard operating procedures to require documentation of peer and supervisor reviews that include the identity of the reviewer and the date of the review.

We recommend that BOR develop and implement standard operating procedures that provide detailed instructions on all aspects of calculating allocations for construction costs and operations and maintenance costs.

We recommend that BOR establish and implement a policy to periodically conduct a review of the standard operating procedures and determine whether they need to be updated.

We recommend that BOR update the ratesetting standard operating procedures to reflect the current process for calculating the ratesetting schedules.

We recommend that BOR Develop standard operating procedures for all schedules used in the ratesetting process.

Assess the Mississippi State Department of Health sanitary survey program to verify that it has appropriate rules, mechanisms, and authorities to ensure that public water systems take necessary steps to address significant deficiencies outlined in sanitary survey reports, per 40 C.F.R. § 142.16.

Update the EPA's Guidance Manual for Conducting Sanitary Surveys of Public Water Systems; Surface Water and Ground Water Under the Direct Influence (GWUDI) of Surface Water (April 1999) and the EPA's How to Conduct a Sanitary Survey of Drinking Water Systems (August 2019) to include a sanitary survey checklist and a process for states to alert the EPA of public water systems with systemic issues, such as excessive distribution line breaks and frequent boil water notices, that individually may not rise to the level of a significant deficiency.

Verify that the Mississippi State Department of Health has procedures in place to ensure that water systems report compliance monitoring data to the state pursuant to 40 C.F.R. § 141.90, to include verifying that the Mississippi Public Health Laboratory has appropriate procedures in place.

Train Mississippi State Department of Health personnel on using and entering data into the Safe Drinking Water Information System/State Version software.

Evaluate whether the Mississippi State Department of Health is implementing procedures for the enforcement of federal and state drinking water regulations. If the Mississippi State Department of Health is not implementing enforcement procedures as required by Safe Drinking Water Act section 1413, consider whether procedures for rescinding state primacy for water systems should be initiated.

Develop guidance on the applicability and use of the EPA's Safe Drinking Water Act section 1442(b) grant authority to address public health in an emergency situation.

FHFA’s Chief Information Officer should restrict user access to the folders and files on FHFA’s network in accordance with least privilege principle.

FHFA’s Chief Information Officer should ensure that personnel are trained on standard and privileged user FHFA authentication and identification policies.

FHFA’s Chief Information Officer should identify and implement a solution, in coordination with vendors, to ensure that multifactor authentication is required to access FHFA’s network. If there are no viable solutions, document any risk-based decisions, including compensating controls.

FHFA’s Chief Information Officer should identify and implement a solution to detect and monitor the transfer of large amounts of data moving across FHFA’s network.

FHFA’s Chief Information Officer should identify and implement a solution to detect and prevent controlled unclassified information or personally identifiable information from being transferred outside of FHFA’s network to personal accounts on email and cloud-based storage services.

FHFA’s Chief Information Officer should determine whether resources can be made available to implement a data loss prevention system to prevent the exfiltration of controlled unclassified information.

FHFA’s Chief Information Officer should reevaluate the former Acting Chief Information Officer’s risk acceptance related to portable software programs, and implement security controls to detect and prevent users from downloading and running unapproved software on FHFA’s system in accordance with National Institute of Standards and Technology and FHFA’s Rules of Behavior.

FHFA’s Chief Information Officer should monitor and respond to unauthorized software downloads in accordance with FHFA’s Common Control Plan.

FHFA’s Chief Information Officer should identify and secure the resources necessary to remediate identified internal critical, high, and medium exploitable vulnerabilities on the FHFA servers, workstations, and other devices in compliance with Cybersecurity and Infrastructure Security Agency Binding Operational Directive 22-01 and FHFA’s Office of Technology and Information Management Vulnerability Management Process, Revision 2.7 (September 7, 2022).

FHFA’s Chief Information Officer should develop a Plan of Action and Milestones to track the remediation of past due Cybersecurity and Infrastructure Security Agency Known Exploitable Vulnerabilities in accordance with Cybersecurity and Infrastructure Security Agency’s Binding Operational Directive 22-01 and FHFA’s Office of Technology and Information Management Vulnerability Management Process, Revision 2.7 (September 7, 2022). FHFA’s Office of Technology and Information Management should implement compensating controls (i.e., isolating systems with un-remediated vulnerabilities) to mitigate the risk of the vulnerabilities.

FHFA’s Chief Information Officer should prioritize existing Office of Technology and Information Management resources based on the Plan of Action and Milestones to ensure that Cybersecurity and Infrastructure Security Agency Known Exploitable Vulnerabilities are remediated in accordance with Cybersecurity and Infrastructure Security Agency’s Binding Operational Directive 22-01 and FHFA’s Office of Technology and Information Management Vulnerability Management Process, Revision 2.7 (September 7, 2022).

FHFA’s Chief Information Officer should implement security controls to lock down USB ports so that only authorized USB devices are allowed.

Require that the PLUS system for receiving, processing, and assigning applications tracks applications and captures application intake, screening, and status, including key dates; captures data on the type of underwriter used; includes a portal for receiving documents and communicating with lenders; and generates FHA loan numbers. This will allow HUD to identify, monitor, and address processing delays and issues on a continuous basis; evaluate its performance and processes; and manage future challenges.