Open Recommendations

Update Agency process documentation, as applicable, to require that system owners identify, define, and document requirements from the Prepare phase.

Update Agency process documentation, as applicable, to establish a process to document the review and approval of Security Categorization and Security Assessment Plan by the authorizing official or designated representative.

Update Agency process documentation, as applicable, to establish a process to include recommendations in all future Security Assessment Reports.

FHFA should update the disaster recovery procedures document to ensure it includes (a) up to date time periods for the recovery time objective and the recovery point objective for resumption of the general support system operations consistent with the business impact analysis, (b) database procedures, and (c) steps to validate successful failover and failback of the remote access infrastructure system.

FHFA should ensure the After Action Report is consistent with the Recovery Exercise Test Results by documenting all actions taken during the failover and failback of the disaster recovery exercise including all correct dates for when testing was conducted.

FHFA should perform annual testing of the contingency plan in accordance with the recovery procedures document to ensure failover and failback are conducted as planned.

FHFA should ensure Office of Technology and Information Management officials communicate planned disaster recovery exercises and any scheduled changes with all parties involved, including auditors and other independent observers.

FHFA should encrypt all backup data-at-rest at FHFA’s alternate site and update the existing plans of action and milestones to include compensating controls until the plans of action and milestones has been closed.

We recommend that DFC's Chief Information Officer fully implement event logging requirements in accordance with Office of Management and Budget, Memorandum M-21-31.

Update and implement the POA&M Management and Acceptance of Risk Process document to clearly define requirements of when vulnerabilities must be documented within a POA&M, and what the remediation timeline for POA&Ms must be.

Enforce existing policies and procedures to consistently perform reviews and analyze system audit records, and document and maintain those reviews and analysis for privileged users and actions taken on [redacted] devices in accordance with FDIC policy.

Update DOT Orders 4410.4 and 4600.2B to incorporate the requirements of Public Law Number (Pub. L. No.) 115-419.

Implement object class code(s) to enable MARAD to separately record vessels from equipment.

Update DOT Order 2700.13 to direct Operating Administrations to develop and implement a process to validate and reconcile capitalized equipment listings with DOT's Delphi financial system and provide confirmation of completion.

Update DOT Order 2700.13 to clarify when Operating Administrations deviations from established DOT capitalization thresholds must be approved by the Office of the Secretary and implement a requirement for documentation justifying higher or lower thresholds.

Direct the Federal Highway Administration (FHWA), National Highway Traffic Safety Administration (NHTSA), Maritime Administration (MARAD), and Federal Railroad Administration (FRA) to update the relevant orders or guidance to incorporate the requirements of Pub. L. No. 115-419 and require confirmation of completion. These orders and guidance are FHWA Order 4300.1; NHTSA Order 440-1D; MARAD's Property, Plant, and Equipment Desk Guide; and FRA Order 4601.1E.

Direct FRA's Office of the Chief Financial Officer to capitalize FRA's eligible equipment in accordance with DOT Order 2700.13 and provide confirmation of completion.

Direct the Federal Motor Carrier Safety Administration (FMCSA) to implement policies and procedures for the management of capitalized equipment that incorporate the requirements of Pub. L. No. 115-419 and provide confirmation of completion.

Develop and implement standard operating procedures to identify and calculate reliable drug control-related obligations.

Develop and implement a methodology that can be applied to data in NHTSA's financial system to track drug control-related obligations, by budget decision unit and drug control function.

Develop a budget formulation methodology that provides a reasonable basis for consistent estimation of NHTSA's drug control budget that fairly quantifies its financial commitment to drug control activities and provides the methodology to the Office of National Drug Control Policy for approval.

1. We recommend that the Under Secretary of Commerce for Standards and Technology and the Director of NIST revise MEP's economic impact reports for FYs 2022 and 2023 and other references to economic impacts on MEP's website attributable to the Centers we reviewed; in addition, disclose MEP's reported economic impacts may be based on inaccurate data and therefore their reliance and use should be limited.

2. We recommend that the Under Secretary of Commerce for Standards and Technology and the Director of NIST establish procedures for NIST personnel to ensure data reliability (reasonably free from error and bias), including but not limited to (1) formal policies requireing staff to diligently review significant impacts for accuracy and connection to services provided by Centers and (2) techniques to analyze survey data for anomalies before it is finalized.

3. We recommend that the Under Secretary of Commerce for Standards and Technology and the Director of NIST establish and implement procedures for Centers and subrecipients to (1) comply with NIST guidelines and (2) ensure data reliability (reasonabley free from error and bias), including but not limited to techniques that hold Centers accountable, such as including consequences for noncompliance and certification of Center executives confirming integrity, independence, and due diligence that the reported economic impacts represent what they are intended to: actual economic benefits realized over the last 12 months that are attributable to the services provided.

4. We recommend that the Under Secretary of Commerce for Standards and Technology and the Director of NIST establish procedures that hold Centers accountable for monitoring subrecipient compliance with NIST survey guidelines and ensuring data reliablility (reasonably free from error and bias), including consequences for noncompliance.