Open Recommendations

Maximize technology (for example, develop automated program that compares Numident name, date of birth, sex designation, place of birth, parents’ names) to identify all instances where two different individuals’ Numident records are cross-referred and uncross-refer the records.

Review all cases where the Numident records of beneficiaries in current payment status are cross-referred to deceased individuals’ Numident records and take action to correct the records.

Maximize technology (for example, develop automated program that compares Numident name, date of birth, sex designation, place of birth, parents’ names) to review the 2.4 million non-current payment status beneficiaries whose cross-referred Numident records contain death information, and input death information on their cross-referred record, as appropriate.

Implement controls to prevent similar errors from occurring in the future.

We recommend that the Chief Operating Officer of FSA ensure that budget requests and lifecycle cost estimates forSABER-related projects are submitted and approved according to FSA’s Management Review 1 SOP and FSA’s otherestablished policies and procedures, and that they are properly maintained.

We recommend that the Chief Operating Officer of FSA ensure that FSA Acquisition officials follow the Department’sContract Monitoring Directive, specifically pertaining to COR Appointment Memorandums, deliverable monitoring, contractpayment records, contract monitoring plans, and QASPs for the FTI SABER system contracts we reviewed.

We recommend that the Chief Operating Officer of FSA ensure that all future SABER-related contract deliverables,including the FTI Infrastructure deliverables, are clearly defined in the contracts, related modifications, or as anattachment to contracts and related modifications to ensure proper tracking, monitoring, and contractor performance.

We recommend that the Chief Operating Officer of FSA clearly define who is responsible for supervising each part of theCOR’s performance for SABER-awarded contracts and hold the contracting officers accountable for the overall monitoringof the contracts awarded by FSA, including the FTI Module, FTI SAIG, and FTI Infrastructure contracts.

We recommend that the Chief Operating Officer of FSA require that the data fields that FSA defines as primary in theSABER risk registers be completed as appropriate, and data fields in decision logs be completed.

We recommend that the Chief Operating Officer of FSA fix the technical issues to reduce data loss in SABER riskregisters and other risk registers.

Review the installed applications on all issued laptops to ensure no unauthorized software is present.

Review the FMC "user" setting population to ensure each "user" is properly configured in compliance with FMC's approved GPOs.

Review Active Directory settings to ensure unauthorized software cannot be installed, including the Print Driver settings.

Regular software audits should be scheduled on all issued laptops to ensure compliance with FMC approved software policy.

Security Awareness training should be provided annually to all FMC users on the risks of downloading software.

Security Awareness training should be provided to all network administrators on the importance of secure configuration management on user devices.

Perform the procedures and associated controls identified in the SCRM SOP. The SOP lists fourteen procedures to perform.

During its annual review for changes to Commission Order (CO)-112, Acquisitions, include verbiage that all IT acquisitions should follow the SCRM SOP by reference.

Review the settings on all issued laptops to ensure MFA requirements are in place.

Review the FMC user setting population to ensure each user is properly configured.

Regular configuration audits should be scheduled on all issued laptops to ensure compliance with FMC MFA requirements.

Periodically require FMC personnel to log out and shut down laptops to ensure all requirements are being installed correctly.

Security Awareness training should be provided to all network administrators on the importance of secure configuration management on user devices.

HRK recommends that FMC implement a monitoring process of required trainings at FMC so that when issues like the vendor management issue arises, they can identify and address early on to ensure the required training is met.

FMC should develop an executable plan to meet the requirements of OMB M-21-31 and ensure the plan is properly supported.