Open Recommendations

We recommend that the Chairman develop and implement regular, comprehensive, and effective required training on preventing and reporting sexual harassment for all nonsupervisory employees that incorporates elements from the EEOC 2023 Promising Practices, including a larger emphasis on the Agency’s prohibition for retaliation of any kind.

We recommend that the Chairman develop and implement regular, comprehensive, and effective required training for all supervisors and executives on preventing and reporting sexual harassment that incorporates elements from the EEOC’s 2023 Promising Practices, including a larger emphasis on the Agency’s prohibition for retaliation of any kind.

We recommend that the Chairman develop and implement a plan to routinely analyze the FDIC’s sexual harassment training, ensure that it is current, and measure the impact that training is having on reducing harassment and retaliation in the Agency.

Assess the potential impacts of the delayed upgrades to the NSN on Roman’s scheduled launchtimeline.

Initiate actions to establish requirements for recipients (or third-party auditors) for how manufacturers' rolling stock documentation will be reviewed when conducting pre-award and post-delivery audits.

Initiate actions to establish requirements for recipients (or third-party auditors) to maintain pre-award and post-delivery audit documentation in a manner that protects manufacturers' sensitive data while also providing supporting evidence of the work described in the audit.

Initiate actions to establish requirements for recipients (or their auditors) to document their verification of suppliers' Buy America information.

Develop and implement Buy America policies or guidance as to how to account for hardware and domestic shipping costs when computing domestic content percentages.

Develop and implement Buy America policies or guidance detailing when to initiate Buy America rolling stock compliance reviews and apply the corrective actions (i.e., specific conditions and remedies for noncompliance) described in the Uniform Grant Guidance.

Update relevant policies and procedures for appraiser roster management so that they align with each other and with regulations and reflect HUD practice. At a minimum, the policies and procedures should clearly cover appraiser roster status, license expiration, disciplinary actions, removals, data accuracy, and documentation.

Maintain historical data for each appraiser record, including history on expiration dates, when appraisers are moved on or off the appraiser roster and when they are and are not allowed to be assigned to conduct appraisals.

Improve quality assurance processes by adding steps to verify that the appraiser roster is accurate and reliable over time through testing of its logic-based system controls and data fields.

Evaluate the postmarking policy and adjust as necessary to ensure that all mail-in ballots receive a postmark.

Define and document the taxonomy of the CPSC’s information system components, and classify each information system component as, at minimum, one of the following types: information technology system (e.g., proprietary and/or owned by the CPSC), application (e.g., commercial off-the-shelf, government off-the-shelf, or custom software), laptops and/or personal computers, service (e.g., external services that support the CPSC’s operational mission, facility, or social media).

Develop and implement a formal strategy to address information security risk management requirements as prescribed by the NIST guidance.

Complete an assessment of information security risks related to the identified deficiencies and document a corresponding priority listing to address identified information security deficiencies and their associated recommendations. A corrective action plan should be developed that documents the priorities and timing requirements to address these deficiencies.

Develop and implement an Enterprise Risk Management program based on NIST, Chief Financial Officers Council and Performance Improvement Council Enterprise Risk Management Playbook, and OMB Circular A-123, Section II guidance. This includes establishing a cross-departmental risk executive (function) led by senior management to provide both a departmental and organization level view of risk to the top decision makers within the CPSC.

Develop, document, and implement a process for determining and defining system boundaries in accordance with NIST guidance.

Develop and implement an information security architecture that supports the enterprise architecture.

Develop an enterprise architecture to be integrated into the risk management process.

Implement solutions to perform scenario analysis and model potential responses, including modeling the potential impact of a threat exploiting a vulnerability and the resulting impact to organizational systems and data.

Implement registration and inventorying procedures for the CPSC’s information systems.

Develop Supply Chain Risk Management procedures to ensure that products, system components, systems, and services of external providers are consistent with the organization’s cybersecurity and Supply Chain Risk Management requirements.

Develop and communicate an organization-wide Supply Chain Risk Management strategy/plan to manage the supply chain risks associated with the research, development, design, manufacturing, acquisition, delivery, integration, operations, maintenance, and disposal of the CPSC systems, system components, or services.

Develop, implement, and disseminate a set of configuration management procedures in accordance with the inherited configuration management policy which includes the process management follows to develop and tailor common secure configurations (hardening guides) and to approve deviations from those standard configurations.