Open Recommendations

(U) Rec. 1.a: The DoD OIG recommended that the [Redacted] develop and implement a plan to correct the systemic weaknesses at the facilities, data centers, and laboratories that manage ballistic missile defense system technical information related to using multifactor authentication.

(U) Rec. 1.b: The DoD OIG recommended that the [Redacted] develop and implement a plan to correct the systemic weaknesses at the facilities, data centers, and laboratories that manage ballistic missile defense system technical information related to mitigating vulnerabilities in a timely manner.(2019 & 2020 High Priority)

(U) Rec. 1.b: The DoD OIG recommended that the [Redacted] develop and implement a plan to correct the systemic weaknesses at the facilities, data centers, and laboratories that manage ballistic missile defense system technical information related to mitigating vulnerabilities in a timely manner. (2019 & 2020 High Priority)

(U) Rec. 1.c: The DoD OIG recommended that the [Redacted] develop and implement a plan to correct the systemic weaknesses at the facilities, data centers, and laboratories that manage ballistic missile defense system technical information related to securing server racks.

(U) Rec. 1.c: The DoD OIG recommended that the [Redacted] develop and implement a plan to correct the systemic weaknesses at the facilities, data centers, and laboratories that manage ballistic missile defense system technical information related to securing server racks.

(U) Rec. 1.d: The DoD OIG recommended that the [Redacted] develop and implement a plan to correct the systemic weaknesses at the facilities, data centers, and laboratories that manage ballistic missile defense system technical information related to protecting and monitoring data on removable media. (2019 & 2020 High Priority)

(U) Rec. 1.e: The DoD OIG recommended that the [Redacted] develop and implement a plan to correct the systemic weaknesses at the facilities, data centers, and laboratories that manage ballistic missile defense system technical information related to implementing intrusion detection controls.

(U) Rec. 1.e: The DoD OIG recommended that the [Redacted] develop and implement a plan to correct the systemic weaknesses at the facilities, data centers, and laboratories that manage ballistic missile defense system technical information related to implementing intrusion detection controls.

(U) Rec. 1.f: The DoD OIG recommended that the [Redacted] develop and implement a plan to correct the systemic weaknesses at the facilities, data centers, and laboratories that manage ballistic missile defense system technical information related to requiring and maintaining justifications for accessing networks.

(U) Rec. 1.g: The DoD OIG recommended that the [Redacted] develop and implement a plan to correct the systemic weaknesses at the facilities, data centers, and laboratories that manage ballistic missile defense system technical information related to implementing physical security controls.

(U) Rec. 2.a: The DoD OIG recommended that the [Redacted] enforce the use of multifactor authentication to access systems that process, store, and transmit ballistic missile defense system technical information, or obtain a waiver that exempts the networks from using multifactor authentication.

(U) Rec. 2.i: The DoD OIG recommended that the [Redacted] require written justification as a condition for obtaining access to all networks and systems that process, store, and transmit ballistic missile defense system technical information.

(U) Rec. 2.j: The DoD OIG recommended that the [Redacted] maintain access request forms for all users with access to networks and systems that contain ballistic missile defense system technical information and verify, at least annually, the continued need for access.

(U) Rec. 3.b: The DoD OIG recommended that the Chief Information Officer for the [Redacted] implement intrusion detection capabilities on networks that maintain ballistic missile defense system technical information.

(U) Rec. 4.a: The DoD OIG recommended that the Chief Information Officers for the [Redacted] encrypt ballistic missile defense system technical information stored on removable media.

(U) Rec. 4.b: The DoD OIG recommended that the Chief Information Officers for the [Redacted] develop and implement a process for identifying individuals who are authorized to use removable media on their networks and systems as well as procedures for monitoring the type and volume of data transferred to and from removable media.

(U) Rec. 4.c: The DoD OIG recommended that the Chief Information Officers for the [Redacted] assess existing security camera placements to identify gaps in security coverage and install security cameras with [Redacted] to monitor personnel movements throughout their facilities.

CMS should develop policies and procedures to improve the timeliness of recovering Medicaid overpayments, and recover uncollected amounts identified during OIG’s audit.

Verify that future overpayments are reported correctly on Line 10 of the CMS-64

Recover the remaining $1,644,235,438 due the Federal Government from the current period

Require states to submit corrected CMS-64s to identify recovered overpayments on Line 10 when done incorrectly

Recover the remaining $188,593,212 due the Federal Government from the prior period

Continue to educate the States about their responsibility to report overpayments on the correct line of the CMS-64 to improve oversight of the reporting process

Rec. A.1: The DoD OIG recommended that the Under Secretary of Defense for Intelligence examine current DoD intelligence training and education policies and mandate, as necessary, training standards based on a common essential body of knowledge, including Intelligence Community Directive 203, "Analytic Standards," January 2, 2015, for all entry-level/developmental intelligence professionals.

To improve the DOT's information security continuous monitoring program, DOT Chief Information Officer needs to update the department's federal information security modernization act standard operating procedures to include steps for verifying the accuracyand completeness of the Federal Aviation Administration's (FAA) CrossAgency Priority (CAP) goal metrics.