Open Recommendations

We recommend that the Department of Health and Human Services develop and maintain an inventory of all geospatial data assets in accordance with section 759(b) of the GDA.

We recommend that the Department of Health and Human Services prepare the required annual reports regarding the achievements of the covered agency in preparing and implementing the strategic plan for the National Spatial Data Infrastructure (section 759(a)(1)) and complying with the other requirements in section 759(a).

Ensure that systems are reauthorized to operate on the 3-year schedule until either moved to a continuous monitoring model or retired.

Ensure that the Authorizing Official reviews and approves security control assessment plans prior to the assessments being conducted.

Ensure that all required controls and control enhancements are assessed for implementation and effectiveness as part of the authorization or reauthorization process.

Develop and implement risk assessments that analyze the likelihood of threats and mitigation measures in place specific to transmission systems.

Ensure that critical- and high-risk vulnerabilities are remediated or mitigated in a timely manner.

Develop processes to incorporate the cybersecurity change management board to seek its review and approval prior to making changes to all transmission systems.

Ensure that all substation SSCPs include all information required by NIST SP 800-53, Revision 5, and consider the control overlay provided in NIST SP 800-82, Revision 3.

Determine unnecessary ports, protocols, and services, and disable them to remove additional avenues for an attacker or a malicious user to exploit the system.

Encrypt data at rest on servers and databases, as appropriate, to protect confidentiality and integrity of the data.

Implement software, firmware, and information integrity checking tools, as appropriate, to identify unauthorized changes to all transmission systems.

Implement separation of duties to help prevent issues and minimize errors.

Ensure appropriate audit logs are capturing information necessary to identify changes to the system.

Ensure continuous monitoring of BPA’s information systems and applications to gain assurance that required controls are implemented, working as intended, and continue to operate at an acceptable level of risk, including implementing a formal process.

Develop a contingency training program that covers the appropriate topics associated with transmission systems and provide the training to those with contingency planning roles and responsibilities.

Ensure all information system contingency plans are developed in accordance with Federal requirements.

Develop policies and procedures to facilitate an effective cybersecurity program for the transmission infrastructure through the implementation of security controls in accordance with Federal and Department requirements.

Implement an effective oversight structure at BPA that encompasses transmission program management activities, to include the development and implementation of continuous monitoring, risk management, and governance activities.

Work to ensure adequate resources are available to implement a cybersecurity program for the transmission infrastructure by providing appropriate funding and personnel.

We recommend that the Senior Official Performing the Duties of the Commissioner of CBP conduct a comprehensive analysis of the risks associated with releasing noncitizens into the country without identification and develop and implement policies and procedures to mitigate those risks.

We recommend that the Director of ICE conduct a comprehensive analysis of the risks associated with releasing noncitizens without identification from ICE custody and develop and implement policies and procedures to mitigate those risks.

We recommend that the TSA Administrator use the results of the Requirements and Capabilities Analysis office’s updated CBP OneTM risk assessment to develop and implement policy and procedural changes needed to mitigate risks

Revise USMS Policy Directive 17.11 to reflect the accurate statutory language for the USMS's Title 18 law enforcement authority.

In consultation with the Department, update policies and procedures to reduce the risks of providing special deputation authority to ineligible or inappropriate applicants and ensure that USMS special deputations are only granted for allowable Title 18 purposes. These updates should clarify requirements and strengthen controls to better ensure reasonable and appropriate sponsorships, justifications, law enforcement authorities, eligibility, and timeframes for special deputations.