Open Recommendations

Segregate the duties of maintaining key stock and making keys.

Place network infrastructure equipment in a communications closet or approved enclosure to restrict access to only authorized personnel.

Complete the installation of grounding measures for all telecommunications closets to protect information technology equipment against electromagnetic pulse attack or electrostatic discharge. Ensure the work completed by contractors adheres to the requirements as defined in the work order.

Enforce the requirement for unit management to monitor fuel card purchases, including annotating all high-risk fuel transactions with an appropriate comment.

[Description omitted; CSOSA has determined that this recommendation contains information that is limited official use or classified.]

[Description omitted; CSOSA has determined that this recommendation contains information that is limited official use or classified.]

[Description omitted; CSOSA has determined that this recommendation contains information that is limited official use or classified.]

[Description omitted; CSOSA has determined that this recommendation contains information that is limited official use or classified.]

[Description omitted; CSOSA has determined that this recommendation contains information that is limited official use or classified.]

[Description omitted; CSOSA has determined that this recommendation contains information that is limited official use or classified.]

[Description omitted; DOJ has determined that this recommendation contains information that is limited official use or classified.]

[Description omitted; DOJ has determined that this recommendation contains information that is limited official use or classified.]

[Description omitted; DOJ has determined that this recommendation contains information that is limited official use or classified.]

[Description omitted; DOJ has determined that this recommendation contains information that is limited official use or classified.]

[Description omitted; DOJ has determined that this recommendation contains information that is limited official use or classified.]

Reevaluate FAA's Business Staffing Rules so that workload, fleet count based on make/model/series, and aircraft models and series with separate maintenance review board reports are considered in the staffing algorithm for each inspector position.

Require that an independent workplace survey of the FAA United CMO be conducted to determine how inspector fleet assignments and workload distribution are impacting office culture. This should include implementing an action plan to address these needs.

Establish and implement an action plan to address FAA's documented staffing shortages and provide continuous resources to the United CMO that addresses retirement trends, average training time, and staffing turnover for a period longer than 3 years to ensure sufficient oversight.

Develop a strategic plan to provide outreach and education to the entire inspector work force on the protections of Safety Management System (SMS) data once the designation of protection is published in the Federal Registry. This should include education on inspectors' ability to request and review an air carrier's SMS data and records when conducting surveillance and addressing non-compliances.

Develop and implement a policy for FAA personnel to determine when an inspection should be postponed based on the percentage and/or type of questions that cannot be answered. This should include a management control so that FAA personnel with authority to assign inspections use "resources not available" when this threshold is met.

Provide analytical support from FAA's Safety Analysis Branch to CMOs to gather, analyze, and trend data for questions that have been answered "not observable" to support risk-based decision making.

Implement a plan with the Office of Acquisition and Logistics Project Management Office to ensure system access is more granular and the intent of the principle of least privilege is met.

Ensure all roles and accesses, including those provided by default access, are reviewed and certified periodically as required.

Implement a permanent solution to provide supervisors and information owners with visibility of all roles and accesses, including those provided by default access, granted to users.

OIG recommends the deputy assistant secretary for the FMBT Service implement a plan with the Office of Acquisition and Logistics Project Management Office to ensure system access is more granular and the intent of the principle of least privilege is met.