Open Recommendations

Define and document policies and procedures outlining the CPSC’s remote access configuration/connection requirements, including use of Federal Information Processing Standards 140-2 validated cryptographic modules, system timeouts, and monitoring and control of remote access sessions.

Implement data encryption policies and procedures for data at rest and data in transit. This should include fully implementing the Data Loss Prevention solution.

Document and implement a process for inventorying and securing systems that contain Personally Identifiable Information or other sensitive agency data (e.g., proprietary information)

Document and implement a process for periodically reviewing for and removing unnecessary Personally Identifiable Information from agency systems.

Perform an assessment of the knowledge, skills, and abilities of the CPSC personnel with significant security responsibilities.

Finalize and implement the Awareness and Training policy which is currently in draft.

Develop a security awareness and training strategy/plan in accordance with Federal Cybersecurity Workforce Strategy.

Establish and implement a strategy for identifying and integrating organizational risk tolerance and mission risk tolerances into the Information Security Continuous Monitoring program, and ensure the Information Security Continuous Monitoring supporting plan, policy, and procedures are updated to consider each program tier.

Update the System Security Plans to include the most up-to-date information and assess the relevant minor applications.

Implement Information Security Continuous Monitoring roles and responsibilities.

Develop mechanisms to ensure Information Security Continuous Monitoring stakeholder accountability.

Define and implement event logging requirements in accordance with Office of Management and Budget Memorandum 21-31, Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents.

Develop and implement policies and procedures for maintaining a Continuity of Operations Plan and conducting organizational and system level Business Impact Analyses in accordance with current federal guidance. (e.g., National Institute of Standards and Technology Special Publication 800- 34/53, Federal Continuity Directive 1, National Institute of Standards and Technology Cybersecurity Framework, and National Archive and Records Administration guidance).

Update the Continuity of Operations Plan, or other documentation supporting the CPSC contingency planning efforts, to provide traceability from the statutory requirements to the Mission Essential Functions and to include all necessary information, for example: (1) a list of systems that support the Mission Essential Functions, (2) a list of systems necessary for essential supporting activities, and (3) a list of records essential for the CPSC’s continuity of operations.

Integrate documented contingency plans with the newly developed Continuity of Operations Plan and organizational Business Impact Analyses.

Test the set of documented contingency plans.

Treasury OIG follow-up on the missing documentation and make a determination whether to conduct a full-scope audit of Point Hope. In addition, Treasury OIG personnel determine whether to take further action, up to and including recoupment of Point Hope’s CRF proceeds, based on the scope limitation and potential noncompliance with the records retention requirement.

We recommend the Acting Assistant Secretary for Employment and Training specify within its policy the information states must include in their documentation to support compliance with the requirements to receive grant funds prior to disbursement of the funds.

We recommend the Acting Assistant Secretary for Employment and Training remedy the $136,353,567.50 in questioned costs.

Conduct a cost-benefit analysis of either appointing personnel with full travel authority and oversight responsibility or allowing travelers to be responsible for submitting, tracking, and supporting their travel actions and expenses in eTravel.

Update the travel policy to reflect the needs of the Postal Regulatory Commission and align with agency priorities.

Create a training program about the travel process and require employees that travel to complete this training and retake as needed when changes to the process occur.

FHFA should update FHFA’s Supply Chain Risk Management Strategy to include past due OMB M-22-18 requirements including: i. Obtaining a self-attestation from the software producer before using the software; ii. Obtaining from software producers artifacts that demonstrate conformance to secure software development practices, as needed; iii. Establishing a system to store self-attestation letters from the software producer that are not publicly available in a central location; andiv. Assessing and developing training for reviewing and validating self-attestation letters.

FHFA should consider request for an extension or waiver in accordance with OMB M-22-18 and/or OMB M-23-16 if FHFA is unable to meet the requirements in OMB M-22-18 and/or OMB M-23-16 in a timely manner. If FHFA requests a waiver, FHFA should consider documenting a risk-based decision, and document any compensating controls.

FHFA should remediate past due exploitable vulnerabilities in accordance with CISA’s BOD 22-01 and the OTIM Vulnerability Management Process.