Open Recommendations

Develop a volunteer deployment strategy that includes provisions for supporting volunteers, regardless of funding source.

Enforce requirements for components to obtain authority to operate, resolve critical and high-risk vulnerabilities, and apply sufficient resources to mitigate security weaknesses.

Revise DHS 4300A Policy, Handbook, and Ongoing Authorization methodology to incorporate applicable changes from NIST SpecialPublications, including SP 800-37, Revision 2, SP 800-53 Revision 5, and SP 800-137A to maintain consistency between the documents.

Develop PIAs for the five untracked PII systems identified: HC Dashboard, APEC ABTC, DC One Card ID, Pentagon Contractors ID Card, and TWIC®.

Identify the mechanism to document confidentiality impact levels and document the confidentiality impact levels for all GPO PII systems.

Implement a process to conduct BU PII inventories and share the results with the Privacy Officer.

Conduct biennial Privacy Compliance Reviews in accordance with GPO’s Privacy Program directive.

Review all stored records to identify and mark which records contain or may contain PII.

Update the PIRT Framework and Procedures to incorporate the guidance for incident response plans from NIST Special Publication 800-122 and include comprehensive guidance, such as: a) defining team member roles and responsibilitiesb) defining key termsc) developing communication templatesd) ensuring notification of the appropriate individuals and organizations by identifying points of contact, including external entities, and how to contact them.

Update the PIHG to incorporate the guidance for incident response plans from NIST Special Publication 800-122 including comprehensive guidance, such as: a) ensuring the proper notification of the appropriate individuals and organizations when evaluating and responding to a suspected PII breach, by identifying points of contact, including external entities, and how to contact themb) stating what information is to be provided to US-CERT and the reporting method, such as through a phone call, email, or a websitec) stating how to document that the information was reported to US-CERT.

Develop and/or identify the one definitive method to report suspected PII breach incidents.

Implement a central training method to ensure employees and contractors receive PII training before accessing GPO’s information system. This method should include reassigning the responsibility for annual training to a single BU, likely Information Technology, and assigning BUs with the responsibility for specialized PII training.

Update the Privacy Program directive to reflect changes resulting from these recommendations.

The Chief Information Officer update ITD’s current policy for accountable IT property, to include the incorporation of defined program personnel roles, requirements aligned with the property management lifecycle and all current program procedures.

The Chief Information Officer continue pursuit of transitioning to a single asset management system that addresses its program needs to track accountable and consumable IT property and establish a detailed implementation plan with target dates to transition to a single asset management system for accountable and consumable IT property as currently captured in Cireson and Jumpstock.

The AOC revise the Board of Survey Process with codified punitive actions to act as a deterrent against future instances of employee negligence and misconduct regarding the loss of AOC property, including both IT mobile devices and personal property.

Enact a formal procedure to review all VBA compensation awards not already reviewed by the OIG that were completed since January 1, 2020, with debts due to reduced disability levels, take corrective action as appropriate, and report the results to the OIG.

Develop a mechanism to review the effectiveness of the recommendations periodically and a process for determining what additional measures, if any, are needed.

Embassy Oslo should require the Embassy Employee Association board to conduct its oversight responsibilities in accordance with Department standards.

Embassy Oslo, in coordination with Regional Information Management Center Frankfurt and the Bureau of Information Resource Management, should bring the embassy’s high frequency radio equipment into compliance with Department standards.

Develop and implement a process to evaluate existing Boeing airplane flight manuals to determine whether they contain required normal, non-normal, and emergency procedures that are necessary for the safe operation of the aircraft. Within this process, include methods to determine what corrective actions are needed if deficiencies are identified.

Develop and implement a documented process to identify what information manufacturers must include in airplane flight manuals.

Develop written procedures to maintain documents for Special Purpose, Disaster, or other similar grants. If the documents for requests and approvals of COVID-19 quarterly report extensions can be retrieved, keep them in a central location.

Ensure that OPP and OCE Policies and Procedures Manual are updated and complete, including policies and procedures for the oversight and monitoring of Disaster Program funds, which would include LSC CARES Act Funds.

Complete revisions and publish the OFAS Accounting Procedures Manual (LSC is currently working to complete and publish the draft OFAS Accounting Procedures Manual), including bank account verification policies and procedures.