Open Recommendations

We are referring $8,534 in questioned costs for further review and action. The questioned costs consist of
credit card purchases for which LAW did not maintain adequate documentation to support the purposes of
the transactions or explain why they were allowable under LSC regulations and guidance.

(U) Rec. 3: The DoD OIG recommended the Under Secretary of Defense for Policy coordinate with the Department of State to develop and implement a process to provide the Defense Security Cooperation Agency, as well as the divesting and receiving country's Security Cooperation Offices, with documentation of third party transfer approvals of enhanced end use monitoring defense articles in advance of transfer.

(U) Rec. 4: The DoD OIG recommended the Defense Security Cooperation Agency Director and the Military Department implementing agencies develop and implement a system to update the Security Cooperation Information Portal-End Use Monitoring database with the serial numbers of all enhanced end use monitoring defense articles provided to Ukraine to confirm the accuracy and completeness of the database and the total number of enhanced end use monitoring defense articles provided to Ukraine.

(U) Rec. 4: The DoD OIG recommended the Defense Security Cooperation Agency Director and the Military Department implementing agencies develop and implement a system to update the Security Cooperation Information Portal-End Use Monitoring database with the serial numbers of all enhanced end use monitoring defense articles provided to Ukraine to confirm the accuracy and completeness of the database and the total number of enhanced end use monitoring defense articles provided to Ukraine.

(U) Rec. 5.a: The DoD OIG recommended the Defense Security Cooperation Agency Director develop and implement a system of internal controls to verify that all inventories and serial number notifications provided to the Security Cooperation Information Portal-End Use Monitoring Help Desk are accurately updated in the Security Cooperation Information Portal-End Use Monitoring database within a required timeframe.

(U) Rec. 5.b: The DoD OIG recommended the Defense Security Cooperation Agency Director: Revise the Security Assistance Management Manual to reflect the role that the Security Cooperation Information Portal-End Use Monitoring Help Desk plays in maintaining responsibility for updating the Security Cooperation Information Portal-End Use Monitoring database with barcode scanner data, in accordance with current procedures and authorities.

(U) Rec. 5.c: The DoD OIG recommended the Defense Security Cooperation Agency Director revise the Security Cooperation Information Portal-End Use Monitoring database to verify whether the next inventory accurately populated as annual rather than initial when inventories are conducted before the serial number is provided by the Military Department implementing agencies.

We recommend the CISA Director establish and implement a written Memorandum of Understanding with EPA to fully document each agency’s roles and responsibilities and mechanisms for collaboration.

We recommend the CISA Director develop and implement comprehensive policies and procedures regarding its collaboration with EPA and other Water and Wastewater Systems Sector stakeholders. These policies and procedures should address: • the Water Sector Liaison’s roles and responsibilities; • what information should be shared with stakeholders; • how often and when divisions should coordinate their communications; and • how best to facilitate information sharing about cyber threats, vulnerabilities, incidents, potential protective measures, and best practices, in both routine and urgent circumstances.

We recommend the CISA Director have an agency-wide requirement to develop and implement standard operating procedures to improve regular communication among CISA divisions relevant to the Water and Wastewater Sector or other critical infrastructure Sectors and share that information and updates on projects, decisions, and lead roles and responsibilities related to the Water and Wastewater Systems Sector and other sectors as appropriate.

Strengthen the Parcel Return Service manifest verification process by incorporating the facility type as a required parameter.

Develop and maintain an accurate list of active return delivery units in the Facilities Database.

Enhance the Parcel Return Service refund review process to include an automated validation to verify that refunds are warranted, including an assessment of whether the return delivery units that received the packages were active at the time of mailing.

The Chief, FMSS, should ***** **** *** ** **** *** *************** ** ******* ****** ***** ******** ******** *************** *** ********* ******* *** **********

The Chief, FMSS, ****** ********** **** *** ******* ******** ************** ****** *********** **** ** ********* ********** *** *** ******** ****** ** *** *** * *** ** ******* ******** ** **** *** ** *** ******** *** *** ********* * *** **** ** *** ******** ** ******* *** ******* ******* ******* ** ******** **** ***********

The Chief, FMSS, ****** ********** **** *** *** ** ******** ****** ******** ******* ******** ****** **** *** ****** ** ********* ***** *** ******* ******* ****** **************** *** **** ******* **** ********** ** ******** *** *********** ****** *** ***** ********** **** ************ ******* ************ ** ******** **** ***********

The Chief, FMSS, should ****** **** ************ ****** **** *** *** *** *** ******** ****** ** ******* ** ********** ****** ******* ****** ** **** ****** ****** ** ******* ******** *** ******** ****** ** ******** ***** *** ******* ********* ** *** ***** ** ******** **** ***********

The Chief, FMSS, should ****** **** ************ ****** **** *** *** *** *** ******** ****** ** ******* ** ********** ****** ******* ****** ** *** ****** ***** ** *** ******** ********* ** ******* ******** *** ******** ****** ** *** ******** **** *** ******* ** ******** **** ***********

CDC should take further steps to ensure the quality of nursing home reporting of COVID-19 data to NHSN.

CDC should consider how quality assurance checks can be enhanced to ensure data accuracy, as appropriate.

CDC should improve the user support the NHSN Help Desk provides to nursing homes.

Risk Management

Risk Management

Identity and Access Management

Identity and Access Management