Open Recommendations

Ensure CORs formally appoint technical monitors for overseeing the contractors and include in the appointment letter a detailed description of the monitoring responsibilities.

Ensure designated contracting officials document the acceptance of all deliverables in accordance with FAR, PBGC FARS, and/or contract requirements.

Improve controls to properly centralize, maintain and safeguard COR contract files, as required by the FAR and internal policies.

Ensure the annual COR file review process identifies improvements needed in COR files and communicates them to the CORs.

Require the PD to follow up on annual COR file reviews within 90 days to ensure the COR fixed any identified discrepancies.

Develop a control to ensure that options are exercised in accordance with contractual language. Implementing this recommendation could have ensured $1,442 would have been put to better use.

Provide training for individuals responsible for writing contracts to ensure requirements are clear and options comply with the FAR.

For plans paid SFA prior to implementation of the Corporation’s full death audit procedure, continue to implement the new death audit procedures, and rectify with the plans the value attributed to deceased participants to include repayment to Treasury. The estimate from this recommendation results in approximately $250 million in questioned costs, including the $140 million identified in the sampled plans.

Report on NASA’s progress to reexamine available orbital debris tracking tools and offices to ensure all practicable data sources are leveraged to inform ISS operations and ensure crew safety.

Document safety contingency plans and vehicle reassignment rules to help ensure the safe return of crew in the event of an emergency—expanding these efforts to include damage to the Crew Dragon and Starliner.

Develop plans that reflect potential cost savings measures and anticipated reductions in operations for ISS decommissioning.

Update the controlled deorbit plan and ensure the plan includes key commitments, technical, schedule, and cost challenges impacting the 2031 deorbit time frame.

We recommend that the Peace Corps develops a plan to implement automation of the Quality Improvement Unit’s update process and management of Technical Guidelines and to assess its impact on the efficiency and effectiveness in managing and updating Technical Guidelines.

We recommend that the Peace Corps develops a process or mechanism for Peace Corps Medical Officers and other users to report Technical Guidelines that need review, to include a procedure for how the issues will be systematically addressed.

We recommend that the Director of CISA develop and implement a strategy and performance metrics to actively recruit and retain Automated Indicator Sharing participants, including Federal data producers.

We recommend that the ICE Office of the Chief Information Officer implement all necessary mobile device security settings per guidance from DHS and the Defense Information Systems Agency’s Security Technology Implementation Guides.

We recommend that the ICE Office of the Chief Information Officer develop and implement policies and procedures to ensure source code scans are performed on ICE-developed applications as required.

We recommend that the ICE Office of the Chief Information Officer develop and implement policies and procedures to improve the vulnerability management process to ensure:• credentialed scans are completed and assessed, per DHS guidance;• limitations posed by non-credentialed scans are properly and promptly reported per DHS guidance;• plans to address vulnerabilities are created and implemented promptly, per DHS guidance; and• formal acceptance of, or mitigate the risk of, noncompliant enterprise-level system settings.

We recommend that the ICE Office of the Chief Information Officer develop and implement policies and procedures to monitor and block unauthorized network access attempts from mobile devices in foreign locations.

We recommend that the ICE Office of the Chief Information Officer revise and implement policies and procedures to protect ICE-issued mobile devices that have been authorized for use on international travel, per DHS and National Institute of Standards and Technology guidance.

We recommend that the ICE Office of the Chief Information Officer develop and implement policies and procedures to protect ICE-issued mobile devices used by employees permanently stationed outside the United States.

We recommend that the ICE Office of the Chief Information Officer update and implement policies and procedures to ensure mobile devices are sanitized before they are released from ICE custody for disposal.

We recommend that the ICE Office of the Chief Information Officer update and implement clear policies and procedures to ensure all lost and stolen mobile devices are treated as security incidents and the associated incident tickets are routed to the ICE Security Operations Center.

We recommend that the Architect of the Capitol develop standardized policies and procedures that govern how jurisdictions should evaluate and document their decision to either engage internal resources or hire external contractors.

We recommend that the Construction Division finalize and formalize its standard operating procedures.