Open Recommendations

We recommend that the ICE Office of the Chief Information Officer implement all necessary mobile device security settings per guidance from DHS and the Defense Information Systems Agency’s Security Technology Implementation Guides.

We recommend that the ICE Office of the Chief Information Officer develop and implement policies and procedures to ensure source code scans are performed on ICE-developed applications as required.

We recommend that the ICE Office of the Chief Information Officer develop and implement policies and procedures to improve the vulnerability management process to ensure:• credentialed scans are completed and assessed, per DHS guidance;• limitations posed by non-credentialed scans are properly and promptly reported per DHS guidance;• plans to address vulnerabilities are created and implemented promptly, per DHS guidance; and• formal acceptance of, or mitigate the risk of, noncompliant enterprise-level system settings.

We recommend that the ICE Office of the Chief Information Officer develop and implement policies and procedures to monitor and block unauthorized network access attempts from mobile devices in foreign locations.

We recommend that the ICE Office of the Chief Information Officer revise and implement policies and procedures to protect ICE-issued mobile devices that have been authorized for use on international travel, per DHS and National Institute of Standards and Technology guidance.

We recommend that the ICE Office of the Chief Information Officer develop and implement policies and procedures to protect ICE-issued mobile devices used by employees permanently stationed outside the United States.

We recommend that the ICE Office of the Chief Information Officer update and implement policies and procedures to ensure mobile devices are sanitized before they are released from ICE custody for disposal.

We recommend that the ICE Office of the Chief Information Officer update and implement clear policies and procedures to ensure all lost and stolen mobile devices are treated as security incidents and the associated incident tickets are routed to the ICE Security Operations Center.

We recommend that the Architect of the Capitol develop standardized policies and procedures that govern how jurisdictions should evaluate and document their decision to either engage internal resources or hire external contractors.

We recommend that the Construction Division finalize and formalize its standard operating procedures.

This recommendation is Sensitive But Unclassified.

This recommendation is Sensitive But Unclassified.

Office of Capital Access management should require Houston's and Harris County's management to take appropriate and timely corrective actions to (a) determine if payments related to the total population of 1,797'ERA1 household address groupings with potential duplicative assistance totaling approximately $20'million as of December 31, 2021, from which TOIG identified $98,242 in questioned costs from a sample, were made to eligible beneficiaries in the correct amounts, (b)'identify whether additional ERA1 ineligible and duplicate payments occurred after December 31, 2021 and, if applicable, provide the amount of such payments, and (c)'identify whether ineligible and duplicate payments were made during the entire…

Office of Capital Access management should develop, document, and communicate to TOIG OCA's processes to monitor grantees for overpayments and duplicate payments, track grantees' recharacterizations, and ensure data quality for household addresses provided by grantees.

Office of Capital Access management should provide technical advice and counsel to all grantees and TOIG about the use of funds in circumstances where a landlord and a tenant are related. While OCA concurred with our recommendations and its planned corrective actions meet the intent of our recommendations, management did not provide an implementation date for its planned corrective action for our third recommendation regarding familial tenant/landlord relationships.

Review and take corrective action as needed for the 83 beneficiaries whose payee applications the Social Security Administration had not resolved in the electronic Representative Payee System; 65 beneficiaries who have payees in the payment record that the Social Security Administration had not recorded in the electronic Representative Payee System; and 63 beneficiaries whose payees’ Social Security numbers were missing on the payment records.

Evaluate the results of its review for the beneficiaries in Recommendation 1 and determine whether it should review the remaining populations.

Improve controls to ensure employees resolve electronic Representative Payee System alerts, resolve pending representative payee applications in the electronic Representative Payee System, and properly establish or record the payees in the electronic Representative Payee System, such as establishing a timeframe for resolving alerts and management controls such as supervisory review to monitor unresolved alerts.

Conduct training and issue reminders to ensure employees resolve alerts and record payees’ Social Security numbers on the payment records.

Note: We did not make a formal recommendation for this report. However, we are claiming cost savings. The following is the language we used in the Tracking Sheet we submitted to the agency. We identified 189 beneficiaries in current, suspended or terminated payment status whose names and ages were consistent with individuals listed as missing persons in the National Missing and Unidentified Persons System (NamUs). SSA issued the beneficiaries approximately $11.9 million in payments after the individuals’ dates of last contact reported in NamUs and we estimate SSA will issue an additional $2.1 million in payments to the beneficiaries in…

Implement controls requiring that teams adhere to the Agency’s policies for backlog refinement and sprint planning, including effective prioritization and ensuring a proper hierarchy. This should include updated backlog refinement checklists and/or quality assurance reviews.

Use Portfolio Kanban to perform release planning, conduct backlog refinement above the team level, and manage cross team dependencies and coordination.

Specify that naming conventions for work items should not include team names.

Specify that sprint names should include the release to differentiate them in lists and reports.

Revise its risk-management policy to include specific guidelines requiring that Agile teams manage risks at the team, workstream, and product levels. The policy should align with the principles of transparency, traceability, and responsiveness that are essential for Agile methodologies. The Agency should place special emphasis on ensuring the timely and accurate dissemination of emerging risks throughout the project.