Open Recommendations

Economic Research Service needs to update its NDA policy to include the required anti-gag provision.

Foreign Agricultural Service needs to review and update active NDAs for current Foreign Agricultural Service federal employees signed after November 27, 2012, to ensure they include the required anti-gag provision.

Food and Nutrition Service needs to update its NDA form(s) to include the required anti-gag provision. Food and Nutrition Service also needs to review and update active NDAs for current Food and Nutrition Service Federal employees signed after November 27, 2012, to ensure they include the required anti-gag provision.

Forest Service needs to update its NDA policies and form(s) to include the required anti-gag provision. Forest Service also needs to review and update active NDAs for current Forest Service Federal employees signed after November 27, 2012, to ensure they include the required anti-gag provision.

National Agricultural Statistics Service needs to update its NDA policy and form(s) to include the required anti-gag provision. National Agricultural Statistics Service also needs to review and update active NDAs for current National Agricultural Statistics Service Federal employees signed after November 27, 2012, to ensure they include the required anti-gag provision.

Office of the Chief Financial Officer needs to update its NDA form(s) to include the required anti-gag provision.

PBGC should implement an enterprise-wide approach to prevent counterfeit components from entering its supply chain and establish performance measures to gauge the effectiveness of its anti-counterfeit policies and procedures. Additionally, PBGC should provide a comprehensive anti-counterfeit training for its personnel.

PBGC should manage Active Directory certificate template settings effectively by hardening and auditing existing templates in the environment. Privileges should also be assessed for all templates to prevent unauthorized changes to the configuration settings.

PBGC should establish robust network segmentation and configure firewalls with default rules to ensure the guest wireless network is effectively isolated from internal resources.

PBGC should establish a comprehensive system for monitoring, analyzing, and reporting on quantitative performance measures to evaluate the effectiveness of its Data Breach Response policies and procedures.

PBGC should implement an effective specialized security training program that includes steps to identify and prevent phone-based social engineering for all employees.

PBGC should strengthen its controls around verifying the identity of PBGC personnel prior to temporarily disabling their requirement for MFA for remote access should a user purportedly have a malfunctioning PIV card or other MFA token.

Develop and implement a policy or procedure for NDAs that:• Establishes a standard format for NDAs; and,• Requires the Office of the General Counsel to review all NDAs and confirm they contain required language regarding whistleblower protections.

Develop and document criteria outlining the circumstances under which the agency would ask employees to sign an NDA.

Individually inform current staff members who previously signed NDAs that did not contain the anti-gag provision, in writing, of their whistleblower rights.

Implement a tracking system for storage of the DNFSB’s existing and future NDAs that is consistent with the Privacy Act.

We recommend that OESPIM develop a SORN for all applicable systems.

We recommend that OPM obtain feedback on its security awareness and training program and use the information to make improvements to the IT security training program.

Develop and distribute nationwide policy that addresses personal belongings on the workroom floor.

identify all cameras not functioning and develop a plan to restore them to operational status.

develop and implement a strategic, nationwide plan that includes continuous monitoring of the operational status of cameras and diagnosing and addressing camera failures timely.

Strengthen policies, processes, and procedures within NSF’s excepted service pay system to ensure administratively determined pay bands for administratively determined appointments under the NSF Act are established in accordance with the EX-III and EX-IV statutory limits and to ensure employee salaries are established and maintained in compliance with applicable pay band limits.

Assess and resolve the additional $1,636,333 in past salary payments above applicable salary limitations that were not included in NSF’s prior debt collection waivers, in accordance with applicable law.

We recommend that the Assistant Secretary for the Office of Elementary and Secondary Education require the AlaskaDepartment of Education to require Yukon-Koyukuk to determine whether the $24,386 that Yukon-Koyukuk charged toARP ESSER for the three expenditures made without maintaining proper documentation of the competitive procurementprocess was reasonable when compared to the costs of suitable alternatives, and if not, require appropriate correctiveactions.

We recommend that the Assistant Secretary for the Office of Elementary and Secondary Education require the AlaskaDepartment of Education to require Yukon-Koyukuk to ensure that LEA officials responsible for making and documentingpurchasing decisions receive sufficient training on Federal procurement requirements, including those covered under 2C.F.R. sections 200.318(i) and 200.320 (methods of procurement to be followed).