Open Recommendations

Ensure that the responsible group develops and implements a process to
a. collect and deactivate third-party access cards from offboarded Board personnel.
b. periodically reconcile third-party access card rights against human resources' list of active Board employees and contractors.

Establish a policy that defines the Technical Security Bureau’s responsibilities and the standard operating procedures needed to fulfill those responsibilities.

Develop and document
a. measurable performance objectives for the Technical Security Bureau’s responsibilities.
b. a monitoring process to assess the Technical Security Bureau’s progress toward achieving those objectives.

Confirm that medical facility directors develop local guidance on using automated dispensing cabinets in accordance with VHA Directive 1108.21 (and any revisions to this directive) and that facilities comply with that local guidance.

Require Pharmacy Benefits Management Services to revise VHA Directive 1108.21 to include routine monitoring for the use of generic information as a requirement in facility-level guidance for automated dispensing cabinets.

Ensure, in coordination with the controlled substance coordinator, or appropriate designee, and Veterans Integrated Service Networks, that reports detailing cabinet transactions for controlled substances removed using generic information are reviewed as part of required controlled substance inspections.

Require Pharmacy Benefits Management Services to revise VHA Directive 1108.21 to include routine monitoring for the use of generic information as a requirement in facility-level guidance for automated dispensing cabinets.

The Overton Brooks VA Medical Center Director conducts a comprehensive review of the patients hospitalization and takes action as indicated, including quality management improvement processes such as a peer review.

The Overton Brooks VA Medical Center Director ensures medical staff recognize the importance of obtaining hospitalized patients non-VA medical records and assesses the current processes for obtaining non-VA medical records, identifies any barriers to completion, and takes action as warranted.

The Overton Brooks VA Medical Center Director assesses the application of the one-to-one observation policy and practices at the facility, and takes action as warranted.

The Overton Brooks VA Medical Center Director reviews interim behavioral patient record flag processes to ensure implementation of safety strategies for staff and patients, and takes action as warranted.

The Overton Brooks VA Medical Center Director evaluates whether documentation of patient and patient-related behavioral events are reflected accurately in the electronic health record to facilitate continuity of care and communication among medical staff and takes action as necessary.

The Overton Brooks VA Medical Center Director conducts a comprehensive review of the patients hospitalization and takes action as indicated, including quality management improvement processes such as a peer review.

The Overton Brooks VA Medical Center Director assesses the application of the one-to-one observation policy and practices at the facility, and takes action as warranted.

The Overton Brooks VA Medical Center Director evaluates whether documentation of patient and patient-related behavioral events are reflected accurately in the electronic health record to facilitate continuity of care and communication among medical staff and takes action as necessary.

Verify that Ministry of Health in Jordan corrects the instance of material noncompliance detailed on page 7 of the audit report.

We recommend that the PBS Commissioner institute policies and procedures to ensure battery systems are designed, installed, operated, and maintained in accordance with federal regulations, PBS policy, and building code requirements.

We recommend that the PBS Commissioner institute policies and procedures to ensure training requirements are designed and implemented for PBS and PBS contractor personnel working with battery systems and associated technologies.

We recommend that the PBS Regional Commissioner of the Pacific Rim Region take immediate action to improve management oversight of the region’s facilities to ensure that: (1) code violations and maintenance deficiencies brought to management’s attention are immediately addressed; (2) local fire department personnel are involved in pre-fire planning activities for future battery system projects; (3) local fire department personnel are involved in post-fire assessments; and (4) final certificates of occupancy are not issued until all outstanding fire and life safety deficiencies are corrected.

Document policies and procedures for developing and maintaining current and target cybersecurity profiles that include, at a minimum, consideration of the NCUA’s mission objectives, threat landscape, and resources (including personnel) and constraints.

Create and maintain current and target cybersecurity profiles—including a gap analysis that identifies differences between the current and target state—that consider anticipated changes in the NCUA’s cybersecurity posture.

Update and maintain the comprehensive inventory of data and the corresponding metadata to meet the requirements of the Open Government Data Act and OMB Memorandum M-25-05 by the established September 2026 deadline.

Implement baseline compliance monitoring for routers, switches, and firewalls on the NCUA network. This includes documenting deviations from the configuration baselines and providing business justifications for these deviations.

Improve processes to ensure that the NCUA remediates workstation vulnerabilities within agency-required timelines, including monitoring for workstations that have been disconnected from the network for an extended period of time.

Develop and implement procedures to remediate vulnerabilities for the (b) (7)(E) within NCUA timeline requirements that fall outside of the (b) (7)(E) monthly patching schedule.