Open Recommendations

Perform an assessment of the knowledge, skills, and abilities of CPSC personnel with significant security responsibilities.

Develop and tailor security training content for all CPSC personnel with significant security responsibilities and provide this training to the appropriate individuals.

Document and implement a process for ensuring that all personnel with significant security roles and responsibilities are provided specialized security training to perform assigned duties.

Fully implement the Awareness and Training Policy.

Develop a security awareness and training strategy/plan in accordance with the Chief Human Capital Officers Council Federal Cybersecurity Workforce Strategy.

Establish and implement a strategy for identifying and integrating organizational risk tolerance and mission risk tolerances into the Information Security Continuous Monitoring program, and ensure the Information Security Continuous Monitoring supporting plan, policy, and procedures are updated to consider each program tier.

Implement Information Security Continuous Monitoring procedures including those procedures related to the monitoring of performance measures and metrics, that support the Information Security Continuous Monitoring program.

Update the System Security Plans to include the most up-to-date information and assess the relevant minor applications.

Define and implement Event Logging requirements in accordance with OMB M-21-31, Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents.

Update the Continuity of Operations Plan, or other documentation supporting CPSC contingency planning efforts, to provide traceability from the statutory requirements to the mission essential functions and to include all necessary information, for example: (1) a list of systems that support the Mission Essential Functions, (2) a list of systems necessary for essential supporting activities, and (3) a list of records essential for the CPSC’s continuity of operations.

Integrate documented contingency plans with the newly developed Continuity of Operations Plan and organizational Business Impact Analyses.

Develop and implement policies and procedures for maintaining a Continuity of Operations Plan and conducting organizational and system level Business Impact Analyses in accordance with current federal guidance (e.g., NIST SP 800-34/53, DHS Federal Continuity Directive 1, NIST Cybersecurity Framework, and National Archives and Records Administration guidance).

Perform a cost benefit analysis of introducing automation to support the testing of system contingency plans; and apply the appropriate risk mitigation strategy.

Fully implement its processes for information system back up for General Support System Cloud.

Define and document the taxonomy of the CPSC’s information system components, and classify each information system component as, at minimum, one of the following types: information technology system (e.g., proprietary and/or owned by the CPSC), application (e.g., commercial off-the-shelf, government off-the-shelf, or custom software), laptops and/or personal computers, service (e.g., external services that support the CPSC’s operational mission, facility, or social media)

Ensure a future systems modernization roadmap includes controls to improve payment and redetermination accuracy.

Include controls in future debt management system modernization efforts to address system limitations causing overpayments to not be recovered via Cross-Program Recovery or transferred to another liable individual for recovery.

Pending automation improvements, remind employees of circumstances when a manual action is needed to initiate cross-program recovery or transfer a debt to another liable individual for recovery.

Complete efforts to lift the suspension for the External Collection Operation so overpayments that meet the criteria for the Treasury Offset Program may be referred for collection.

Create a diary or revise policies for existing overpayment diaries, as appropriate, that will alert employees to develop for an estate when a deceased recipient has an overpayment and there are no liable persons to whom it should transfer.

FHFA should develop and implement policies and procedures to oversee FHFA’s background reinvestigation process, including oversight controls over FHFA’s service provider.

FHFA should update the service level agreement between FHFA and the service provider to include requirements for the service provider to provide background reinvestigation status reports on a regular basis.

FHFA should implement a process to monitor and ensure that background reinvestigations for relevant employees and contractors are conducted timely in accordance with FHFA and OPM standards.

FHFA-OIG's Chief Information Officer should develop and implement policies and procedures to oversee FHFA-OIG’s background reinvestigation process, including oversight controls over FHFA-OIG’s service provider.

FHFA-OIG's Chief Information Officer should update the service level agreement between FHFA-OIG and the service provider to include requirements for the service provider to provide background reinvestigation status reports on a regular basis.