Open Recommendations

We recommend that the Chief Information Officer require the Department to establish stronger monitoring controls to enforce the management of unsupported system components and track and discontinue the use of unsupported operating systems, databases, and applications.

We recommend that the Chief Information Officer require the Department to develop verification procedures and enforce the inactivity settings to ensure virtual private network sessions time out after 30 minutes of inactivity.

We recommend that the Chief Information Officer require the Department to correct or mitigate the vulnerabilities identified during the securityassessment, in accordance with the severity level of each vulnerability identified.

We recommend that the Chief Information Officer require the Department to establish oversight controls to ensure the Department's password, terminations, and deactivation policies are enforced accordingly.

We recommend that the Chief Information Officer require the Department to enforce the mandate for all websites to display warning banners when users login to Departmental resources, and establish additional procedures and monitoring processes to ensure that banners includethe approved warning language.

We recommend that the Chief Information Officer require the Department to establish and enforce a corrective action plan to monitor and remediate identified database vulnerabilities.

We recommend that the Chief Information Officer require the Senior Agency Official for Privacy to establish additional processes, procedures, and monitoring controls to validate, track and enforce the completion of PIAs, PTAs, and SORNs.

We recommend that the Chief Information Officer require the Department to establish monitoring and oversight controls that ensure all new users satisfy all of the mandatory training requirements before they receive access to Departmental resources.

We recommend that the Chief Information Officer require the Department to establish oversight controls to review, monitor and verify progress of the ISCM strategy, as well as the annual reviews of all Departmental cyber security policies, to reflect the current environment.

We recommend that the Chief Information Officer require the Department to incorporate additional measures to, at a minimum, achieve Level 4 Managed and Measurable status of the Incident Response program.

We recommend that the Chief Information Officer require the Department to develop and implement oversight controls to ensure that incidents are consistently submitted to US-CERT and the OIG within the required timeframes, are consistently categorized, and include the correctvector elements as required.

We recommend that the Chief Information Officer require the Department to establish monitoring controls to ensure policies and procedures are updated frequently to contain the most updated information (i.e., contractual obligations) and those specifically relating to computer incident reporting to OIG are enforced accordingly.

We recommend that the Chief Information Officer require the Department to develop and implement testing procedures and enhance current policies and processes to ensure that the DLP solution works as intended for the blocking of sensitive information transmission.

We recommend that the Chief Information Officer require the Department to improve oversight controls that ensures contingency plan tests, and other artifacts impacting contingency plan testing, are documented, and updated in a consistent and timely manner.

We recommend that the Chief Information Officer require the Department to develop additional processes and controls to confirm the proper validation and verification of all required contingency planning controls is documented accordingly before completing the SSP checklists and granting authorization to cloud service providers.

We recommend that the Chief Information Officer require the Department to establish additional procedures and controls to assure stakeholders are properly adhering to contingency planning guidance.

OIG recommends that the Bureau of African Affairs develop and implement procedures that ensure personnel charged with monitoring and overseeing the Trans-Sahara Counterterrorism Partnership projects in the countries of performance are formally authorized to perform these functions through designation as a government technical monitor or alternate contracting officer’s representatives in accordance with the Foreign Affairs Handbook Section 14 FAH-2 H-140.

OIG recommends that the Bureau of African Affairs establish and implement memoranda of understanding with the Office of Security Cooperation and other partners, as applicable, to describe roles and responsibilities for coordinating, executing, and monitoring Trans-Sahara Counterterrorism Partnership (TSCTP) projects in the countries where TSCTP is implemented, including establishment of a structure for communicating and coordinating in-country.

We recommend that VNA of Central Jersey for the remaining portion of the estimated $2,015,925 overpayment for claims that are outside of the Medicare reopening period, exercise reasonable diligence to identify and return overpayments in accordance with the 60-day rule, and identify any returned overpayments as having been made in accordance with this recommendation

We recommend that VNA of Central Jersey exercise reasonable diligence to identify and return any additional similar overpayments outside of our audit period, in accordance with the 60-day rule, and identify any returned overpayments as having been made in accordance with this recommendation

We recommend that VNA of Central Jersey refund to the Medicare program the portion of the estimated $2,015,925 overpayment for claims incorrectly billed that are within the 4-year reopening period.

Review all loans that had a bank account number changed from that shown on the original application to determine if the changes were legitimate or fraudulent. If not legitimate, work to recover the funds, deobligate any undisbursed funds, and refer to the OIG.

Strengthen data integrity to make it possible to determine if the inaccurate information allowed loans to be made to ineligible entities and to strengthen SBA’s ability to service loans appropriately.

Implement its procurement controls to ensure that it is able to locate and maintain the complete procurement documents for at least 3 years after the closeout of NSP1 and NSP3 in compliance with its own procedures and HUD regulations.

Provide the required documents to support $161,131 in NSP1 and $109,525 in NSP3 funds for expenses for acquisition, rehabilitation, and administration. If the City cannot provide the required documents, it should repay the U.S. Treasury from non-Federal funds.