Open Recommendations

We recommend that the PBS Commissioner institute policies and procedures to ensure appropriate action is taken to address PBS personnel performance deficiencies identified in this report, including supervisory chains of command and individuals responsible for managing the battery systems.

We recommend that the PBS Regional Commissioner of the Pacific Rim Region take immediate action to safeguard the occupants and assets in the Anderson and Reagan Buildings by: (1)verifying that the ESCO removed the batteries and any other hazards from both the Anderson and Reagan Buildings using only qualified personnel; and, (2) obtaining the complete third-party investigation report into the cause of the battery system fire at the Anderson Building. Upon receipt, ensuring any remaining health and safety hazards listed in the report are addressed or mitigated.

We recommend that the PBS Regional Commissioner of the Pacific Rim Region take immediate action to improve management oversight of the region’s facilities to ensure that: (1) code violations and maintenance deficiencies brought to management’s attention are immediately addressed; (2) local fire department personnel are involved in pre-fire planning activities for future battery system projects; (3) local fire department personnel are involved in post-fire assessments; and (4) final certificates of occupancy are not issued until all outstanding fire and life safety deficiencies are corrected.

Rec. A.1: The DoD OIG recommended that the Under Secretary of Defense for Policy update guidance and identify specific steps to address highly sensitive information requests that require additional coordination and approvals, including the levels of coordination required to efficiently transfer information to facilitate the Government Accountability Office engagement, in accordance with 31 U.S.C. 716, and for a more transparent process for tracking requests.

Rec. A.2.a: The DoD OIG recommended that the DoD Performance Improvement Officer and Director of Administration and Management establish and consistently implement guidance and training for all primary action officers, including their roles and responsibilities, as well as procedures for processing Government Accountability Office information requests, including requests for highly sensitive information, in accordance with 31 U.S.C. 716.

Rec. A.2.b: The DoD OIG recommended that the DoD Performance Improvement Officer and Director of Administration and Management engage with the Government Accountability Office to develop and implement mutually agreed?upon processes and procedures for the DoD Audit Management Division and the Government Accountability Office during engagements that involve highly sensitive information, including the roles of the DoD Audit Management Division liaisons and primary action officers.

Document policies and procedures for developing and maintaining current and target cybersecurity profiles that include, at a minimum, consideration of the NCUA’s mission objectives, threat landscape, and resources (including personnel) and constraints.

Create and maintain current and target cybersecurity profiles—including a gap analysis that identifies differences between the current and target state—that consider anticipated changes in the NCUA’s cybersecurity posture.

Update and maintain the comprehensive inventory of data and the corresponding metadata to meet the requirements of the Open Government Data Act and OMB Memorandum M-25-05 by the established September 2026 deadline.

Implement baseline compliance monitoring for routers, switches, and firewalls on the NCUA network. This includes documenting deviations from the configuration baselines and providing business justifications for these deviations.

Improve processes to ensure that the NCUA remediates workstation vulnerabilities within agency-required timelines, including monitoring for workstations that have been disconnected from the network for an extended period of time.

Develop and implement procedures to remediate vulnerabilities for the (b) (7)(E) within NCUA timeline requirements that fall outside of the (b) (7)(E) monthly patching schedule.

Coordinate with (b) (7)(E) to upgrade the (b) (7)(E) software or document any risk-based decisions, including compensating controls.

Conduct a review of all current (b) (7)(E) privileged user accounts to ensure that the NCUA has documented access requests and approvals for each privileged user account, as required by NCUA policies and procedures.

Validate that the NCUA completes quarterly account reviews for the (b) (7)(E) and (b) (7)(E) systems.

Implement automatic disabling of privileged (b) (7)(E) user accounts upon 30 days of inactivity or document any risk-based decisions, including compensating controls.

The Director, Collection Policy, Small Business/Self-Employed Division, should remind employees of the NFTL filing requirement for notifying a taxpayer’s representative(s) who are authorized for any tax period listed on the NFTL and designated to receive notices and updating the ICS Power of Attorney Module with new information pertaining to those representative(s).

Coordinate with the Alaska DPS to evaluate the feasibility of including a needs assessment within its ongoing efforts to develop a funding strategy to help ensure program sustainability and effectiveness.

Work with the Alaska DPS to remedy $40,779 in unsupported questioned costs for the Alaska DPS's software purchases.

Ensure the Alaska DPS establishes policies and procedures to ensure program income requirements are adequately communicated to subrecipients and that program income earned is being tracked, reported, and expended in accordance with the VOCA Guidelines.

Ensure the Alaska DPS updates its written policies and procedures to reflect its current subaward selection process.

Ensure the Alaska DPS establish written policies and procedures to ensure 10 percent of its total grant funds are awarded to each of the victim categories, as required by the VOCA Guidelines.

Work with the Alaska DPS to establish a monitoring mechanism that will ensure that it adheres to the frequency of financial desk reviews, as required by the Alaska DPS policy.

Remedy $117,352 in unsupported subrecipient personnel expenditures.

Remedy $9,282 in unallowable subrecipient expenditures.