Open Recommendations

FHFA should consider request for an extension or waiver in accordance with OMB M-22-18 and/or OMB M-23-16 if FHFA is unable to meet the requirements in OMB M-22-18 and/or OMB M-23-16 in a timely manner. If FHFA requests a waiver, FHFA should consider documenting a risk-based decision, and document any compensating controls.

FHFA should remediate past due exploitable vulnerabilities in accordance with CISA’s BOD 22-01 and the OTIM Vulnerability Management Process.

FHFA should develop POA&Ms to track the remediation of past due CISA known exploitable vulnerabilities that cannot be remediated in a timely manner (within 14 days) in accordance with CISA’s BOD 22-01 and OTIM Vulnerability Management Process. Consider implementing compensating controls (i.e., isolating systems with un-remediated vulnerabilities) to mitigate the risk of the vulnerabilities.

FHFA should mplement requirements across all EL maturity tiers to ensure events are logged and tracked in accordance with OMB M-21-31.

FHFA should identify and implement solutions, in coordination with vendors, where a solution does not exist for systems to natively forward event logs to the SIEM tool. If there are no viable solutions, perform a risk assessment and cost benefit analysis. Based on the risk assessment, document any risk-based decisions, including compensating controls, for systems not in compliance with OMB M-21-31.

FHFA should update the Disaster Recovery Procedures for FHFA Production Systems to include JPP and its servers, and ensure they are included in the annual contingency testing.

1. The FLRA CIO should develop, review and update, as necessary, the followinginformation security program policies and procedures in accordance with NIST and agencyrequirements:a. Personnel Security policy.b. Security Assessment policy.c. Identification and Authentication policy.d. Access policy.

We recommend the Department of Homeland Security Under Secretary for Management update or create departmental policy for components to follow when a contractor requests extraordinary relief under Public Law 85-804.

State of Ohio management should provide missing supporting documentation and make necessary reporting corrections.

State of Ohio management should provide missing supporting documentation and make necessary reporting corrections.

State of Ohio management should provide missing supporting documentation and make necessary reporting corrections. Additionally, Treasury Office of Inspector General should obtain information to determine if there are other ineligible severance pay transactions in addition to those already identified as part of the desk review.

We recommend that the FWS consult with appropriate U.S. Department of the Interior offices to determine the extent to which unfunded liabilities are allowable grant expenditures, considering reasonableness, classification, and the period incurred.

We recommend that the FWS develop and implement guidance pertaining to WSFR grant agreements that includes disclosure of State agencies' unfunded liabilities in project budgets and clarifies the allowability of unfunded liabilities.

Establish and implement policies and procedures on how to use appropriate analysis techniques when determining prices are fair and reasonable when GSA scheduled list prices and rates are adjusted, in accordance with FAR 8.

Determine the total additional amount paid to Highlight Technologies, LLC due to using Washington, D.C. labor rates and pursue any applicable remedies to recover costs.

Evaluate all call orders issued under the Highlight blanket purchase agreement for compliance with the Limitation on Subcontracting Rule per 13 CFR § 125.6 and pursue any applicable remedies.

Rec. 2: The DoD OIG recommended that the Program Executive Officer, Ground Combat Systems, working with the Director of the U.S. Army Tank-automotive and Armaments Command Integrated Logistics Support Center and in collaboration with Anniston Army Depot officials, conduct a review as required by DoD Instruction 4151.21, "Public-Private Partnerships for Product Support," of the Total Integrated Engine Revitalization workshare public?private partnership with Honeywell. During the review, the Program Executive Officer, Ground Combat Systems, working with the Director of the U.S. Army Tank-automotive and Armaments Command Integrated Logistics Support Center, should identify and document benefits of the partnership, establish metrics to…

Rec. 3: The DoD OIG recommended that the Program Executive Officer, Combat Support and Combat Service Support, in collaboration with Anniston Army Depot officials, conduct a review as required by DoD Instruction 4151.21, "Public-Private Partnerships for Product Support," of the Joint Assault Bridge workshare public-private partnership with Leonardo DRS. During the review, the Program Executive Officer, Combat Support and Combat Service Support should identify and document benefits of the partnership, establish metrics to measure the benefits, and implement a process to monitor the benefits. The Program Executive Officer, Combat Support and Combat Service Support should also consider potential changes to…

Rec. 4: The DoD OIG recommended that the Commander of Anniston Army Depot conduct a review as required by DoD Instruction 4151.21, "Public-Private Partnerships for Product Support," of the direct sales public-private partnerships for the Joint Assault Bridge and the Stryker Family of Vehicles. During the review, the Commander should ensure Depot officials identify and document benefits of the partnerships, establish metrics to monitor the benefits, and implement a process to monitor the benefits. The Commander of Anniston Army Depot should also consider potential changes to the public-private partnerships during the review and implement those that maximize benefits for the…

Rec. 5: The DoD OIG recommended that the Assistant Secretary of Defense (Sustainment) update DoD Instruction 4151.21, "Public-Private Partnerships for Product Support," to establish an oversight structure to ensure that the Secretaries of the Military Departments are implementing their responsibilities as assigned in DoD Instruction 4151.21, "Public-Private Partnerships for Product Support."

Rec. 6: The DoD OIG recommended that the Secretary of the Army designate an office within the Army that is responsible for ensuring project management office and depot officials execute the appropriate analysis to determine that public-private partnerships are structured to maximize benefits to the Army. Specifically, this office should be responsible for the review of all active Army public-private partnerships and ensure that program management office and depot officials establish benefits and metrics to monitor those benefits and conduct 5-year reviews.

Rec. 8: The DoD OIG recommended that the Assistant Secretary of Defense (Sustainment) update DoD Instruction 4151.21, "Public-Private Partnerships for Product Support," and assign the Secretaries of the Military Departments the responsibility to verify that officials developing and implementing public-private partnerships receive public-private partnership training, including LOG 0060, "Public-Private Partnerships" or its equivalent offered by the Defense Acquisition University.

Rec. 9: The DoD OIG recommended that the Secretary of the Army issue a policy memorandum reiterating the importance of reviewing and applying the information in the "Public-Private Partnering for Product Support Guidebook."

Rec. 10: The DoD OIG recommended that the Commander of Anniston Army Depot update Anniston Army Depot Regulation 210?10, "Direct Sales Program," to ensure it aligns with DoD requirements and guidance for public-private partnerships, including establishing metrics to measure the benefits, implementing procedures to monitor benefits, and conducting 5-year reviews.

Rec. 12: The DoD OIG recommended that the Commanding General of the U.S. Army Tank-automotive and Armaments Command update "TACOM Life Cycle Management Command Public-Private Partnerships (P3) Policy" to ensure it aligns with DoD requirements for public-private partnerships, including conducting 5-year reviews.