Open Recommendations

Update the Bank Secrecy Act scope tasks and questions within the Modern Examination and Risk Identification Tool to ensure examiners complete and document all necessary steps during Bank Secrecy Act examinations and direct examiners to use additional external guidance such as the National Supervision Policy Manual, Examiner’s Guide, and Federal Financial Institutions Examination Council BSA/AML Manual, as needed.

Meet with the Financial Crime Enforcement Network (FinCEN), no less often than annually, to discuss the operation of the Memorandum of Understanding and to identify any issues or adjustments that may be required. Document any revised agreements and update the agency’s policies to communicate the FinCEN reporting requirements and information needed from the regions and the Office of National Examinations and Supervision.

Develop and implement an efficient process that ensures the completeness, accuracy, timeliness, and validity of information obtained from the agency’s Modern Examination and Risk Identification Tool, such as establishing reports, to meet the agency’s Bank Secrecy Act reporting objectives, including communicating information in accordance with the Memorandum of Understanding and other agreement(s) with the Financial Crimes Enforcement Network.

Revise the content of the NCUA’s Enforcement Manual to include current policies, procedures, and responsibilities for the NCUA’s formal enforcement actions and ensure its content is consistent with other agency policies. Regularly review this guidance for continued relevance and effectiveness in achieving the agency’s objectives.

We recommend that OPM issue an improper payment estimate for the Federal Employees Health Benefits Program's that will allow them to be in compliance with the four PIIA requirements for future reporting years.

We recommend that Retirement Services develop and implement additional cost-effective corrective actions, aimed at the root causes of improper payments, to further reduce the improper payments rate.

Implement steps to prevent the inadvertent activation of circuit breakers at all VA data centers, such as updating the physical security controls policy to require protective covers and explicit warning labels.

Implement annual testing of Hines Information Technology Center contingency and restoration procedures following a power loss to ensure all stakeholders are aware of their responsibilities in accordance with revised information system contingency plan procedures.

(U) Rec. A.1: The DoD OIG recommended that the Chief Digital and Artificial Intelligence Officer, in coordination with the Washington Headquarters Services Director, develop, resource, and implement a records management program that includes records management training for all personnel in accordance with Federal and DoD records management requirements.

(U) Rec. A.2: The DoD OIG recommended that the Chief Digital and Artificial Intelligence Officer implement a formal after?action review process to determine the success and effectiveness of the Defense Digital Services' engagements.

(U) Rec. A.3: The DoD OIG recommended that the Washington Headquarters Services Director ensure that each head of a Washington Headquarters Services?serviced Component has established and resourced a records and information management program within their organization in accordance with DoD policies.

(U) Rec. B.1.a: The DoD OIG recommended that the Chief Digital and Artificial Intelligence Office Chief Information Officer and Authorizing Official, in coordination with the Defense Information Systems Agency Chief Information Officer, assess the hardware, software, cloud services, networks, and any other tools used by the Defense Digital Service since 2015 to determine whether the hardware, software, cloud services, and other tools are necessary to meet the mission requirements of the Defense Digital Service;

(U) Rec. B.1.b: The DoD OIG recommended that the Chief Digital and Artificial Intelligence Office Chief Information Officer and Authorizing Official, in coordination with the Defense Information Systems Agency Chief Information Officer, assess the hardware, software, cloud services, networks, and any other tools used by the Defense Digital Service since 2015 to determine whether the hardware, software, cloud services, and other tools are approved for use by the DoD.

(U) Rec. B.1.c: This recommendation is Controlled Unclassified Information

(U) Rec. B.1.d: The DoD OIG recommended that the Chief Digital and Artificial Intelligence Office Chief Information Officer and Authorizing Official, in coordination with the Defense Information Systems Agency Chief Information Officer, assess the hardware, software, cloud services, networks, and any other tools used by the Defense Digital Service since 2015 to determine whether the hardware, software, cloud services, and other tools were acquired under terms that ensure that the DoD retains ownership of DoD data.

(U) Rec. B.2.a: The DoD OIG recommended that the Chief Digital and Artificial Intelligence Office Chief Information Officer and Authorizing Official, in coordination with the Defense Information Systems Agency Chief Information Officer, conduct a risk assessment of the DoD data stored, processed, or transmitted by the hardware, software, cloud services, networks, and any other tools used by the Defense Digital Service to determine the DoD Component owner, the nature, and classification of the data.

(U) Rec. B.2.b: The DoD OIG recommended that the Chief Digital and Artificial Intelligence Office Chief Information Officer and Authorizing Official, in coordination with the Defense Information Systems Agency Chief Information Officer, conduct a risk assessment of the DoD data stored, processed, or transmitted by the hardware, software, cloud services, networks, and any other tools used by the Defense Digital Service to determine whether the DoD data were and are appropriately protected in accordance with DoD cybersecurity and cloud security policies.

(U) Rec. B.2.c: The DoD OIG recommended that the Chief Digital and Artificial Intelligence Office Chief Information Officer and Authorizing Official, in coordination with the Defense Information Systems Agency Chief Information Officer, conduct a risk assessment of the DoD data stored, processed, or transmitted by the hardware, software, cloud services, networks, and any other tools used by the Defense Digital Service to determine whether any DoD data were spilled, compromised, or potentially compromised, and if so, immediately initiate mitigating and remedial actions to protect DoD information, including personally identifiable information, in accordance with DoD policies.

(U) Rec. B.3: The DoD OIG recommended that after completion of Recommendations B.1 and B.2, the Chief Digital and Artificial Intelligence Officer develop and implement a plan of actions and milestones to bring any out-of-compliance hardware, software, cloud services, networks, and other tools used by the Defense Digital Service and other Office of the Chief Digital and Artificial Intelligence Office Components into compliance with DoD policies.

(U) Rec. B.4.a: The DoD OIG recommended that the Chief Digital and Artificial Intelligence Officer develop and implement a formal process for all Chief Digital and Artificial Intelligence Office directorates to follow when requesting waivers of DoD policies and guidance that, at a minimum, requires documentation of the request, justification for the request, and the approval or denial from the policy's issuing DoD Component.

(U) Rec. B.4.b: The DoD OIG recommended that the Chief Digital and Artificial Intelligence Officer develop and implement a formal process for all Chief Digital and Artificial Intelligence Office directorates to follow when requesting waivers of DoD policies and guidance that, at a minimum, requires documentation of the Office of the Secretary of Defense's approval and notification in writing to the policy's issuing DoD Component of the approval of the waiver, if the Office of the Secretary of Defense overrides the denial of the waiver by the Office of the Secretary of Defense Principal Staff Assistant or DoD Component head…

(U) Rec. B.4.c: The DoD OIG recommended that the Chief Digital and Artificial Intelligence Officer develop and implement a formal process for all Chief Digital and Artificial Intelligence Office directorates to follow when requesting waivers of DoD policies and guidance that, at a minimum, requires maintenance of the documentation created as a result of the implementation of Recommendations B.1.a and B.1.b in accordance with Federal and DoD records management requirements.

(U) Rec. B.5: The DoD OIG recommended that the Chief Digital and Artificial Intelligence Officer implement Recommendations B.1, B.2, and B.3 for all the Chief Digital and Artificial Intelligence Office directorates.

Ensure that the contractual requirements included in applicable Department directives are flowed down to the support subcontractors or define specific reporting requirements for when an event occurs such as a ransomware attack.

Implement more effective oversight of data protection by the Information Technology Services Directorate, such as a review process, to determine what data should be backed up and ensure that appropriate corrective actions are taken.