Open Recommendations

We recommend that USAID's Chief Information Officer develop and
implement procedures to document deviations from Agency policy on security control assessments, including acceptance of the risk of such deviations.

We recommend that USAID's Chief Information Officer implement accurate automated dashboards to provide enterprise-wide metrics to inform top management of its information technology risks.

We recommend that USAID's Chief Information Officer establish and implement a process to track the progress of conducting annual reviews and related lessons learned from the implementation of its Information Security Continuous Monitoring Strategy.

We recommend that USAID's Chief Information Officer update the
event logging checklist to include details of event logging level 3 (advanced) applicability and implement requirements as specified by Office of Management and Budget Memorandum M-21-31.

(U) Rec. A.1: Report is Classified.

(U) Rec. A.2: Report is Classified.

(U) Rec. A.4: Report is Classified.

(U) Rec. B.1: Report is Classified.

(U) Rec. B.2: Report is Classified.

(U) Rec. C.1: Report is Classified.

(U) Rec. 1.b: The DoD OIG recommended that the Assistant Secretary of the Navy (Research, Development, and Acquisition) direct PMA-231 to evaluate all unresolved operational test deficiencies, determine whether action was taken to correct the deficiencies, and if not, determine if the deficiencies should stay unresolved. If the deficiencies should be resolved, develop and implement a plan to correct the deficiencies that impact mission accomplishment. PMA-231 should request that the Operational Test and Evaluation Force, confirm the correction of deficiencies.

(U) Rec. 1: Report is Classified.

(U) Rec. 2: Report is Classified.

(U) Rec. 3: Report is Classified.

CMS should implement additional safeguards to ensure that remote patient monitoring is used and billed appropriately in Medicare.

CMS should require that remote patient monitoring be ordered and that information about the ordering provider be included on claims and encounter data for remote patient monitoring.

CMS should develop methods to identify what health data are being monitored.

CMS should conduct provider education about billing of remote patient monitoring.

CMS should identify and monitor companies that bill for remote patient monitoring.

1. We recommend that the Department's Senior Agency Official for Geospatial Information coordinate with NOAA and Census to review our test results, determine which missing metadata content is most significant for current users of geospatial data, and develop a plan (with goals and timeframes) to ensure more consistent completion of those fields.

We recommend the Director of CISA develop and implement a risk-based national strategic plan that addresses current and evolving risks, to enhance the security and resilience of the Nation’s election infrastructure, including disinformation and the use of artificial intelligence.

We recommend the I&A Deputy Under Secretary for Management develop and implement a resource strategic plan to ensure the Security Branch is staffed to adequately schedule and conduct security inspections of its offices that handle classified information.

We recommend the I&A Deputy Under Secretary for Management update the Security Standard Operating Procedure to require the following:a risk-based methodology for selecting offices to inspect annually; and• a process to confirm inspected offices implemented corrective actions and recommendations.

Review the 100 beneficiaries with payee discrepancies we identified in both samples of our audit and determine whether further action is necessary.

Evaluate the results of its review of the 100 beneficiaries and determine whether it should review the remaining population of 57,412 beneficiaries we identified.