Open Recommendations

Review the settings on all issued laptops to ensure MFA requirements are in place.

Review the FMC user setting population to ensure each user is properly configured.

Regular configuration audits should be scheduled on all issued laptops to ensure compliance with FMC MFA requirements.

Periodically require FMC personnel to log out and shut down laptops to ensure all requirements are being installed correctly.

Security Awareness training should be provided to all network administrators on the importance of secure configuration management on user devices.

HRK recommends that FMC implement a monitoring process of required trainings at FMC so that when issues like the vendor management issue arises, they can identify and address early on to ensure the required training is met.

FMC should develop an executable plan to meet the requirements of OMB M-21-31 and ensure the plan is properly supported.

Create an overall BIA policy, procedures, and processes or incorporate a BIA policy, procedures, and processes into its existing contingency planning documents.

Create a Template for completing BIAs consistently across the commission following NIST SP 800-34, rev. 1, Contingency Planning Guide for Federal Information Systems, Chapter 3.

Incorporate the BIAs results into its overall contingency planning efforts.

We recommend the Chairman reevaluate and make further updates, as necessary, and fully implement all provisions of the FDIC’s Anti-Harassment Oversight Plan.

We recommend that the Chairman: (a) incorporate a specific harassment-free culture standard into the Performance Management Program and Bonus Criteria for all staff; (b) incorporate harassment prevention into the bonus criteria for managers and executives;(c) develop and implement a process that considers violations of the anti-harassment policy when determining whether an employee should serve in a supervisory or managerial capacity; and (d) develop and implement a process that considers violations of the anti-harassment policy when determining whether an employee is eligible to receive a bonus.

We recommend that the Chairman/COO develop and implement a mechanism to ensure that corrective actions used to close recommendations related to the sexual harassment prevention program are sustained.

We recommend the Director, Division of Administration, develop and implement quality control procedures to ensure the FDIC maintains an accurate and complete population of sexual harassment misconduct allegations and related records.

We recommend the Director, Division of Administration, conduct a review of prior allegations to ensure that it has an accurate and complete population of sexual harassment allegations and that it has maintained all allegation records in accordance with the FDIC record retention schedule, which requires that all records be maintained for 7 years.

We recommend the Director, Office of Minority and Women Inclusion, develop and implement standard operating procedures to guide the efforts of the Anti-Harassment Program Coordinator.

We recommend the Directors, Office of Minority and Women Inclusion and Division of Administration, develop and implement standard operating procedures for case file records management, including where to securely maintain files, what to maintain, and how long to retain records.

We recommend the Director, Division of Administration, update and implement investigation standard operating procedures to clearly guide investigations by ensuring that investigations are: conducted appropriately and consistently; convey the outcome of the investigation, including a Report of Investigation; and are well-documented.

We recommend the Director, Division of Administration, provide regular investigation training to the LERS Specialists conducting investigations under the Anti-Harassment Program

We recommend the Director, Division of Administration, develop a centralized disciplinary action tracking system or tool and related procedures for what information should be captured in the tool and in support of the disciplinary decision.

We recommend the Chairman consider developing and implementing Agency-wide, consistent penalties or recommended penalty ranges to be used in disciplinary actions for harassing conduct, in accordance with applicable laws and regulations, and, as necessary and appropriate, incorporate the consistent penalties and recommended penalty ranges into policy and procedures.

We recommend the Chairman develop and implement policy to ensure that staff who are responsible for promptly, thoroughly, and impartially investigating allegations of harassment and taking immediate and appropriate corrective action are neutral and free of conflicts or the appearance of a conflict.

We recommend the Chairman establish and implement a policy for handling allegations against senior-level corporate managers and executives from intake to final determination, including the use of Memorandums of Understanding, as appropriate, to engage those outside of the FDIC chains of command.

We recommend the Chairman update the AHP Directive to include: (1) a clear definition of sexual harassment misconduct and practical examples tailored to the workplace, (2) an explanation of the Agency’s duty to investigate and correct harassment even if alleged victims indicate they do not want the matter investigated or corrected, and (3) general time limits for concluding investigations.

We recommend the Chairman reassess and redesign, as needed, the roles and responsibilities within the AHP Directive to ensure all aspects of the Directive can be implemented. Further, we recommend the Chairman develop a plan for implementing all aspects of the AHP Directive