Open Recommendations

Implement internal controls that ensure timely and appropriate responses to the detainee request process.

Ensure ICE staff respond appropriately to detainee requests.

Identify process gaps and update NUREG-1021 to ensure that guidance in future revisions remains current and addresses emerging issues.

Implement a process to monitor and ensure that reinvestigations occur for the identified employees and contractors not currently enrolled in continuous vetting through either TW or DoD CV until such time as their enrollment is complete.

Implement a technical capability to capture NRC employees’ and contractors’ initial login dates so that the required cybersecurity awareness and role-based training can be accurately tracked and managed by the current process. Also, as part of this recommendation, consider reviewing the current configuration of the EIH and TMS integration—as well as the logic in TMS itself, as necessary—to ensure training assignments are retained (not cancelled) due to inactivity.

Evaluate and document the decision to address past rebate allocations to ensure that funds were appropriately allocated to the proper accounts.

EXIM’s Engineering and Environment Division, in coordination with the Asset Management Division/Special Assets Group, should update EXIM’s enhanced monitoring plan for the Sasan Power Limited Project to incorporate and require more robust compliance monitoring, to include onsite monitoring, of environmental, health, and safety standards, as required by the credit agreement.

EXIM’s Engineering and Environment Division, in coordination with the Asset Management Division/Special Assets Group and the independent consultants, should identify additional information sources about activities or concerns related to the Sasan Project to help provide more robust enhanced monitoring, such as input from the local community.

EXIM’s Asset Management Division/Special Assets Group, in coordination with the Engineering and Environment Division and the Office of General Counsel, should conduct a review of the Sasan Project to determine what additional accountability mechanisms could be included in credit agreements on future EXIM-financed projects to allow for additional accountability or enforcement authority when a borrower or project sponsor does not comply with the terms of the credit agreement.

EXIM’s Engineering and Environment Division, in coordination with Asset Management Division/Special Assets Group, should incorporate routine maintenance and operations into its update of the enhanced monitoring plan, to include clarifying roles and responsibilities, for the Sasan Power Limited Project.

EXIM’s Asset Management Division/Special Assets Group should require Sasan Power Limited, in coordination with Reliance Power Limited as the project sponsor, to have the original manufacturer perform detailed inspections of all transformers at the Sasan Power Limited Project.

EXIM’s Asset Management Division/Special Assets Group should identify any potential financial risks associated with Sasan Power Limited’s ongoing efforts to comply with India’s flue-gas desulfurization requirement and develop risk mitigation actions, as appropriate.

EXIM’s Office of Board Authorized Finance should conduct a review of the Samalkot Power Limited Project’s transaction approval to determine if EXIM properly identified and accounted for the financial risks specific to the absence of a confirmed source of gas to support the project, and if any lessons learned can be applied to future EXIM transactions.

EXIM’s Asset Management Division/Special Assets Group should develop an action plan to assist in the identification of potential buyers for the <redacted> remaining power modules.

EXIM’s Asset Management Division/Special Assets Group should require verification of equipment inspections at a frequency determined by industry standard, Samalkot Power Limited, Reliance Power Limited, and the independent consultants to ensure the equipment is maintained in a manner that allows the equipment to be sold.

Update the Office of Chief Information Officer Cybersecurity Incident Response Plan to incorporate lessons learned from the security incident and ensure that it reviews and updates the plan annually.

Document and implement a plan to issue policy, implementation instructions, procedures, and configuration guidance to support Departmental enterprise event logging in accordance with OMB M-21-31, Improving the Federal Governments Investigative and Remediation Capabilities Related to Cybersecurity Incidents.

Complete the DOT workforce assessment, which includes the entire DOT IT and cybersecurity workforce.

Direct the DOT Information Assurance and Privacy Management Office and Breach Assessment and Response Team to implement annual testing of the Breach Notification Controls, as required by DOT Order 1351.19, Personally Identifiable Information Breach Notification Controls.

Work with the Cyber Security Assessment and Management (CSAM) system owner to resolve the technical issues to ensure the CSAM Plan of Action and Milestones (POA&M) reporting function is accurate and conduct oversight of the Operating Administrations to ensure that the POA&M entries meet the requirements of Information Technology (IT) Implementation Memorandum 2023-010A, DOT Supplemental Requirements for IT Security POA&M Management.

Strengthen procedures for maintaining a comprehensive and accurate cloud system inventory, which includes reconciling CSAM data to the listing of cloud service providers submitted by the Operating Administrations.

Enforce password polices to ensure passwords are harder to guess and extend the timeframe in which individuals can enter the next password. Further, use cryptographically protected channels to transmit passwords.

Document and implement procedures to review on a periodic basis users with administrative rights and privileged groups with access to domain controllers.

Implement protections to restrict access to system tools used to create and manage shadow copies of the hard drive.

Document and implement procedures to analyze user account passwords against lists of commonly used and compromised passwords and require users to reset weak or compromised passwords.