Open Recommendations

OIG recommends that the Bureau of Budget and Planning, in coordination with the Office of Foreign Assistance, develop and implement a mechanism that bureaus and offices can use to document a justification supporting a decision not to fully implement requirements included in the Foreign Affairs Manual, 18 FAM 301.4-2, for a program or a project (e.g., project justification, scope, stakeholder information, key deliverables, and project schedule).

OIG recommends that the Deputy Secretary of State designate a formal lead and management structure to orchestrate the Department's implementation of the Creating Helpful Incentives To Produce Semiconductors Act of 2022 for the purpose of promoting efficiencies and coordination; furthering the timely advancement of the goal of boosting American semiconductor research, development, and production; and supporting secure and trusted telecommunications technology development.

Revise its FOIA regulations to capture substantive changes from the FOIA Improvement Act of 2016.

Update its internal FOIA guidance for statutory timelines, extension conditions, fee waivers, perfection policy, referrals, and consultations.

Require annual FOIA-specific training for key officials involved in its FOIA program oversight.

Develop a quality assurance process to review FOIA responses for completeness.

Develop and implement systematic quality assurance procedures for FOIA request tracking and management.

Complete compliance with and implement the NARA’s electronic records management requirements as they pertain to FOIA records.

Establish procedures to ensure transparent communication with the COR on developments in the FOIA program and facilitate adequate monitoring of the FOIA-specific sections of the contract in accordance with its terms.

We recommend that BOR update the ratesetting standard operating procedures to require documentation of peer and supervisor reviews that include the identity of the reviewer and the date of the review.

We recommend that BOR develop and implement standard operating procedures that provide detailed instructions on all aspects of calculating allocations for construction costs and operations and maintenance costs.

We recommend that BOR establish and implement a policy to periodically conduct a review of the standard operating procedures and determine whether they need to be updated.

We recommend that BOR update the ratesetting standard operating procedures to reflect the current process for calculating the ratesetting schedules.

We recommend that BOR Develop standard operating procedures for all schedules used in the ratesetting process.

We recommend that BOR implement routine sampling of micropurchase transactions at the Central California, Northern California, and South-Central California Area Offices to ensure compliance with applicable laws, regulations, policies, and procedures.

We recommend that the PBS NCR Regional Commissioner take immediate actions to address the fire safety deficiencies at the GSA HQ building by: promptly ensuring that all fire doors are inspected, repaired, or replaced for proper functionality and compliance with safety standards and fire codes; strengthening oversight to ensure that the building’s operations and maintenance contractor is complying with contract requirements, including, but not limited to, fire safety requirements; expediting the corrective action for the fire safety deficiency identified during the Management Analysis and Review System review, dated January 6, 2023, by coordinating pre-fire planning activities with the local fire…

We recommend that the PBS NCR Regional Commissioner take immediate actions to improve management oversight of its facilities to reassess compliance with Architectural Barriers Act Accessibility Standards and Occupational Safety and Health Administration requirements at the GSA HQ building by: reviewing designated wheelchair-accessible restrooms to ensure individuals with disabilities have easy access and adjusting any restroom doors to fall within the acceptable range for accessibility; addressing the functionality and compliance of all elevators, ensuring that each elevator is equipped with an automatic verbal announcement feature; and, stabilizing the handrail for the wheelchair ramp at the entrance of the building.

FHFA’s Chief Information Officer should restrict user access to the folders and files on FHFA’s network in accordance with least privilege principle.

FHFA’s Chief Information Officer should ensure that personnel are trained on standard and privileged user FHFA authentication and identification policies.

FHFA’s Chief Information Officer should identify and implement a solution, in coordination with vendors, to ensure that multifactor authentication is required to access FHFA’s network. If there are no viable solutions, document any risk-based decisions, including compensating controls.

FHFA’s Chief Information Officer should use the secure access method recommended by FHFA’s cloud service provider to access the FHFA cloud environment.

FHFA’s Chief Information Officer should identify and implement a solution, in coordination with vendors, to ensure multifactor authentication is required for privileged users to access FHFA’s cloud environment. If there are no viable solutions, document any risk-based decisions, including compensating controls.

FHFA’s Chief Information Officer should identify and implement a solution to detect and monitor the transfer of large amounts of data moving across FHFA’s network.

FHFA’s Chief Information Officer should identify and implement a solution to detect and prevent controlled unclassified information or personally identifiable information from being transferred outside of FHFA’s network to personal accounts on email and cloud-based storage services.

FHFA’s Chief Information Officer should determine whether resources can be made available to implement a data loss prevention system to prevent the exfiltration of controlled unclassified information.