Open Recommendations

Implement qualitative or quantitative measures that have been defined in the Incident Response Plan to monitor and maintain the effectiveness of an overall incident response capability.

Perform risk-based allocation for stakeholders to effectively implement incident response activities.

Implement qualitative or quantitative measures to ensure the effectiveness of incident detection and analysis policies and procedures.

FLRA should monitor and analyze qualitative and quantitative performance measures on the effectiveness of incident handling policies and procedures.

Incident response metrics should be used to measure and manage the timely reporting of incident information to organizational officials and external stakeholders.

FLRA should employ automated mechanisms to test system contingency plans more thoroughly and effectively.

Assess backups.

Establish a separate fraud risk management framework or evaluate and build upon its ERM framework by incorporating fraud risk management practices that are consistent with the principles of GAO's Standards for Internal Control in the Federal Government (Green Book), including developing a fraud risk management framework in alignment with best practices identified in GAO's A Framework for Managing Fraud Risks in Federal Programs and the Chief Financial Officers Council's Antifraud Playbook.

Obtain training or technical assistance on the implementation of fraud risk management practices consistent with the principles of GAO's Standards for Internal Control in the Federal Government (Green Book).

The auditors recommend that the Chief Information Officer require the Department and FSA to capture the missinghardware data elements for each identified system and assess whether other information systems may be missing similaror related data elements.

The auditors recommend that the Chief Information Officer require the Department and FSA to further define the oversightcontrols that are in the current policy to ensure all Departmental systems consistently utilize the inventory template whencompleting/updating the hardware inventory.

The auditors recommend that the Chief Information Officer require the Department and FSA to capture the missingsoftware data elements for each identified system and assess whether other information systems may be missing similaror related data elements.

The auditors recommend that the Chief Information Officer require the Department and FSA to further define the oversightcontrols that are in the current policy to ensure all Departmental systems consistently utilize the inventory template whencompleting/updating the software inventory.

The auditors recommend that the Chief Information Officer require the Department and FSA to review and approve theUSDS-MaxED/AidVntge and EDAWSEW MOU. Furthermore, the Department and FSA should update existingprocedures and ensure all MOUs reflect the appropriate two-year review cycle.

The auditors recommend that the Chief Information Officer require the Department and FSA to implement a process tomonitor that PRDs are reviewed and signed prior to the security investigation.

The auditors recommend that the Chief Information Officer require the Department and FSA to implement an automationprocess to centrally document, track, and share risk designation and screening information.

The auditors recommend that the Chief Information Officer require the Department and FSA to reinforce their process fordocumenting the authorization, review, and approval of PUAs.

The auditors recommend that the Chief Information Officer require the Department and FSA to develop enhanced monitoring controls to ensure proper internal controls mechanisms and processes are strictly enforced.

The auditors recommend that the Chief Information Officer require Departmental Principal Offices re-evaluate the use ofPIV alternates/exemptions across the organization, and modify onboarding procedures, as needed, to support a newstrategic direction which aligns with HSPD-12.

Establish guidance to clarify the roles and responsibilities of the Millennium Challenge Corporation's Monitoring and Evaluation Leads in reviewing and approving data quality review recommendations and tracking Millennium Challenge Accounts' implementation of the recommendations.

Establish a requirement that Millennium Challenge Accounts directly attribute modifications to their Monitoring and Evaluation plans to data quality review recommendations, as applicable.

Establish action plan guidance that defines roles and responsibilities related to addressing data quality review recommendations, the required contents of an action plan, and any permissible exceptions to the action plan requirement.

Conduct an assessment to determine whether the Millennium Challenge Corporation would benefit from periodic Agency-wide or sector-specific analyses of data quality reviews and their recommendations to identify lessons learned.

Provide the Millennium Challenge Corporation's Monitoring and Evaluation Leads access to individual data quality reviews on established Agency platforms or another central repository.

The Director of FinCEN should implement quality control measures, including a timeliness metric for form completion, to ensure supervisors properly review and complete departed employees’ out-processing forms.