Open Recommendations

Develop a policy or procedure to periodically evaluate whether the Department's practice of awarding terms that require payment in less than 30 days is in the best interest of the Government.

Ensure Bechtel identifies all teaming arrangements, related entities, and affiliates needed to facilitate reviews for subcontractor unallowable fees on a regular basis.

Evaluate the impact of contract time extensions on the self-performance percentage objective and its effect on the Subcontracting Plan goals, and adjust the contract (if appropriate);

Use the contract terms remaining in the contract to prompt Bechtel to meet the self-performance objective by encouraging and incentivizing more subcontracting;

Discuss the self-performance status with Bechtel, develop a mutual method of accurately calculating self-performance, and establish a plan to monitor the self-performance objective on a regular basis

Evaluate cyber risks associated with HEC assets to determine oversight and monitoring requirements, establish risk appetite, and address controldeficiencies. Consider using NASA’s Splunk enterprise platform as a shared resource.

Implement an HEC classification/category designation within Risk Information Security Compliance System for identifying HEC assets.

Document data risk impact levels, classification, and export control categorization for all HEC jobs.

Identify and mitigate gaps in the foreign national accreditation access process.

Rec. 1.a: The DoD OIG recommended that the Commander of the U.S. Central Command develop minimum requirements for the U.S. Central Command End-Use Monitoring program manager's quarterly reviews of the Security Cooperation Information Portal to ensure the reviews include:
Reviewing enhanced end-use monitoring inventory and physical security inspection documentation.
Reviewing application of alternate procedures when in-person inventories and physical security inspections are not feasible.
Identifying and resolving deficiencies related to enhanced end-use monitoring.

Rec. 1.b: The DoD OIG recommended that the Commander of the U.S. Central Command, in coordination with the Office of Security Cooperation-Iraq, develop a plan that could include using contractors to assist with the End-Use Monitoring program, filling the Office of Security Cooperation-Iraq End-Use Monitoring program manager position with a civilian, or expanding the authorities of the locally employed staff, to ensure continuity in the end-use monitoring program within the Office of Security Cooperation-Iraq.

Rec. 1.c: The DoD OIG recommended that the Commander of the U.S. Central Command update Central Command Regulation 12-2 to include guidance on virtually inspecting security cooperation offices when in-person inspections are not feasible.

Rec. 2.c: The DoD OIG recommended that the Chief of the Office of Security Cooperation-Iraq, in coordination with the U.S. Central Command, develop and implement a plan that could include using contractors to assist with the End-Use Monitoring program, filling the Office of Security Cooperation-Iraq End-Use Monitoring program manager position with a civilian, or expanding the authorities of the locally employed staff, to ensure continuity in the End-Use Monitoring program within the Office of Security Cooperation-Iraq.

We recommend the Vice President, Supply Chain, consider using early payment discount data as an evaluation tool for FIA performance and training needs.

The Chief of Staff ensures providers complete the Comprehensive Suicide Risk Evaluation following a patient’s positive suicide risk screen.

The Chief of Staff ensures providers complete the Comprehensive Suicide Risk Evaluation following a patient’s positive suicide risk screen.

The VA Maine Healthcare System Director verifies that patients identified as having suicidal ideations or behaviors have personalized safety plans documented in the electronic health record, and monitors compliance.

Implement procedures to ensure a complete and updated listing of administrative user accounts of Linux servers are included in the review process.

Define and implement a process for reviewing all Linux server administrators, including those found within the wheel group with root access.

Implement a formalized process to validate or follow up on account removal actions identified during the semi-annual review process to ensure that user accounts align with job responsibilities and least privilege concepts.

Implement system access authorization processes for Splunk administrators to include separation of duties controls. When separation of duties cannot be achieved for conflicting roles, assess the risk and document the control deviation and risk-based decisions.

Ensure that audit log collection and retention is implemented in accordance with Federal and site-level policies and procedures.

Ensure account passwords are reset, and documentation retained, whenever an individual with access to service accounts leaves BEA or is no longer in a role requiring such access.

Update and implement existing configuration management procedures for all servers, printers, and services on the production network to enforce changing default credentials before the server or printer is connected to the network.

Update and implement vulnerability management procedures to ensure that security vulnerabilities involving anonymous access, default credentials, and vulnerable services are identified, monitored, and remediated.