Open Recommendations

We recommend the Vice President, Enterprise Planning, consider aligning the Power Supply Plan Input Schedule with the Power Supply Plan Inputs listed in procedures.

We recommend the Vice President, Enterprise Planning, ensure Power Supply Plan inputs are approved and submitted by designated input providers for inclusion in the Power Supply Plan.

We recommend the Vice President, Enterprise Planning, review, update, and approve the Standard Programs and Processes in the Power Supply Plan process.

We recommend the Vice President, Communications, reinforce the process for engaging strategic business unit/business unit leaders for communication approval.

Revise HUD's Controlled Unclassified Information Policy to include the anti-gag provision.

Revise HUD's Controlled Unclassified Information Policy to state that (a) nondisclosure forms and agreements must include the anti-gag provision as required by law and (b) confidentiality clauses in personnel settlement agreements must include the anti-gag provision if the clause restricts disclosure of any other information beyond the terms and conditions of the agreement itself.

Review whether potential violations of the Antideficiency Act took place because of implementing or enforcing any nondisclosure policies, forms, or agreements that do not include the anti-gag provision as required by law. If it is determined that a violation occurred, the Chief Financial Officer should take disciplinary actions as appropriate and report the identified violations to the oversight authorities, including the HUD Secretary, the President, the Office of Management and Budget, Congress, and the Comptroller General.

Communicate across HUD that (a) HUD employees are required to include the anti-gag provision in nondisclosure policies, forms, and agreements applicable to HUD employees and (b) program offices should consider requiring their employees to request OGC assistance when implementing and enforcing nondisclosure policies, forms, and agreements applicable to HUD employees.

We recommend that the Department of Health and Human Services Office of the Chief Information Officer enforce existing information security continuous monitoring (ISCM) requirements for detecting, preventing, and reporting the installation of unauthorized software across OpDivs referenced in HHS Policy for Information Security and Privacy Protection (IS2P) and enforce the new ISCM policy once approved.

We recommend that the Department of Health and Human Services Office of the Chief Information Officer enforce HHS's continuous monitoring policy for detecting, preventing, and reporting unauthorized or suspicious network activity across OpDivs.

We recommend that the Department of Health and Human Services Office of the Chief Information Officer update the HHS IS2P to require OpDivs to implement NIST 800-53, Revision 5, CA-8 (2) Red Team Exercises at least every 2 years and RA-10 Threat Hunting yearly for high and moderate Federal Information Processing Standards Publication 199 impact systems.

(U) Rec. 1.a: The DoD OIG recommended that the U.S. European Command Chief Information Office Division Chief update inventory records for all classified mobile devices to include information for the six elements required in an accountable property system of record.

(U) Rec. 1.b: This recommendation is Controlled Unclassified Information

(U) Rec. 1.c: This recommendation is Controlled Unclassified Information

(U) Rec. 1.d: The DoD OIG recommended that the U.S. European Command Chief Information Office Division Chief immediately revalidate and document the user justification for the devices and recall the device if the user no longer has a valid mission need, revise existing access policies to require detailed written justifications for obtaining classified mobile devices, and establish processes to periodically, at least annually, revalidate the need for continued access to the devices.

(U) Rec. 1.e: This recommendation is Controlled Unclassified Information

(U) Rec. 1.f: This recommendation is Controlled Unclassified Information

(U) Rec. 1.g: The DoD OIG recommended that the U.S. European Command Chief Information Office Division Chief revise existing or develop new classified mobile device training programs that include information on all 23 Office of the Secretary of Defense memorandum requirements.

(U) Rec. 1.h: The DoD OIG recommended that the U.S. European Command Chief Information Office Division Chief provide all existing classified mobile device users with the updated training that includes all 23 Office of the Secretary of Defense memorandum requirements.

(U) Rec. 1.i: The DoD OIG recommended that the U.S. European Command Chief Information Office Division Chief update the classified mobile device user agreement to include all Committee on National Security Systems Directive No. 520 requirements and ensure that all users have acknowledged the updated user agreement.

(U) Rec. 1.j: This recommendation is Controlled Unclassified Information

(U) Rec. 1.k: This recommendation is Controlled Unclassified Information

(U) Rec. 2.a: The DoD OIG recommended that the U.S. Special Operations Command Director for Command, Control, Communications and Computer/Cyber, Chief Information Officer, update inventory records for all classified mobile devices to include information for the six elements required in an accountable property system of record as required by Committee on National Security Systems Directive No. 520 and DoD Instruction 5000.64.

(U) Rec. 2.b: The DoD OIG recommended that the U.S. Special Operations Command Director for Command, Control, Communications and Computer/Cyber, Chief Information Officer update the Commercial Solution for Classified Implementation Guidance to define the frequency for conducting inventories and reporting results to U.S. Special Operations Command Headquarters; immediately conduct an inventory of all Component classified mobile devices; update their inventory records; and take appropriate action if you are unable to properly reconcile a classified mobile device.

(U) Rec. 2.c: This recommendation is Controlled Unclassified Information