Open Recommendations

The under secretary for health implement the Veterans Health Administration Data Governance Council, to include developing policies and processes for data management across the Veterans Health Administration.

The under secretary for health ensure Veterans Health Administration Data Governance Council identifies authoritative data sources and nominates data stewards for approval by the VA Data Governance Council.

Recover approximately $3.7 million from the contractor for transportation overcharges.

Develop a training for all sorting and delivery center supervisors specific to the network changes/impacts, including techniques to properly supervise route performance, and require all sorting and delivery center supervisors to complete.

We recommend the Natural Resources Conservation Service, in coordination with the EnterpriseGeospatial Management Office, develop and use an applicable geospatial data standard for the National Cooperative Soil Survey Soil Characterization database dataset.

Verify that Tomorrow Youth Organization corrects the instance of material noncompliance detailed on page 23 of the audit report

Update policy for certain non-payment status codes (N05, N06, N18, N36, N39, and S06) we reviewed to: (1) clearly and consistently require employees to exhaust efforts to locate and contact recipients and obtain needed information before applying the suspension or denial and (2) provide examples in each updated policy that are relevant to the specific suspension or denial code to illustrate all aspects of proper development, including timeframes for initial and follow-up requests and determinations regarding sufficient information for eligibility, capability, change of payees, undeliverable mail, extension requests, and procedures to exhaust efforts.

Develop policy and procedures for the Offices of Retirement and Disability Policy and Chief Information Officer to coordinate systems changes to prevent the use of obsolete or temporarily prohibited non-payment status codes. If unable to make systems change, SSA should identify and review records placed into suspension or denied using prohibited non-payment status codes to ensure they are corrected timely.

Complete the implementation of National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, Revision 5.

Identify and assign the senior accountable official for risk management.

Include the organizational risk tolerance and make explicit the threats, assumptions, constraints, and trade offs used for making investment and operational decisions in the Risk Management Strategy.

Document and implement procedures for conducting and updating an organization and system-level risk assessment.

Update the information security continuous monitoring strategy to include the monitoring requirements at the mission/business process and information system levels; the minimum monitoring frequency for implemented controls across the organization; and how ongoing assessments are to be conducted.

Update policies and procedures to require that the senior accountable official for risk management, or other designated official, review and approve the continuous monitoring strategy and retain evidence of the review and approval.

Remind Agency personnel of policies and procedures, including compliance with roles and responsibilities noted in policy, and updating the security plan to document appropriate security control allocations and control tailoring.

Centralize policies and procedures related to the Security Assessment and Authorization (SA&A) process.

Update Agency policy to comply with Federal regulations for SA&A. Specifically, complete a system-level continuous monitoring strategy.

Update Agency process documentation, as applicable, to establish a process to include recommendations in all future Security Assessment Reports.

FHFA should update the disaster recovery procedures document to ensure it includes (a) up to date time periods for the recovery time objective and the recovery point objective for resumption of the general support system operations consistent with the business impact analysis, (b) database procedures, and (c) steps to validate successful failover and failback of the remote access infrastructure system.

FHFA should ensure the After Action Report is consistent with the Recovery Exercise Test Results by documenting all actions taken during the failover and failback of the disaster recovery exercise including all correct dates for when testing was conducted.

FHFA should perform annual testing of the contingency plan in accordance with the recovery procedures document to ensure failover and failback are conducted as planned.

FHFA should ensure Office of Technology and Information Management officials communicate planned disaster recovery exercises and any scheduled changes with all parties involved, including auditors and other independent observers.

FHFA should encrypt all backup data-at-rest at FHFA’s alternate site and update the existing plans of action and milestones to include compensating controls until the plans of action and milestones has been closed.

We recommend that DFC's Chief Information Officer fully implement event logging requirements in accordance with Office of Management and Budget, Memorandum M-21-31.

Enforce existing policies and procedures to consistently perform reviews and analyze system audit records, and document and maintain those reviews and analysis for privileged users and actions taken on [redacted] devices in accordance with FDIC policy.