Open Recommendations

OCSS should Bolster State agency resilience during emergencies.

OCSS should create forums for identifying and sharing State agency best practices in providing paternity establishment services.

We recommend the TSA Chief Information Officer require the selected High Value Asset system owner to document an approved secure baseline configuration and perform testing to verify that all approved settings are implemented.

We recommend the TSA Chief Information Officer enforce the requirement for the selected High Value Asset system owner to apply security updates and service patches to remediate vulnerabilities on all devices, as required by applicable DHS policies.

We recommend the TSA Chief Information Officer require the selected High Value Asset system owner to develop and implement a supply chain risk management plan to address and mitigate risks associated with the hardware components and software being used on the selected High Value Asset system.

We recommend the TSA Chief Information Officer direct the selected High Value Asset system owner to strengthen its user account management procedures to ensure user access agreements are developed and signed by users before users are given access to the selected High Value Asset system or when the agreement is revised.

We recommend the TSA Chief Information Officer require the selected High Value Asset system owner develop and implement detailed procedures on granting system access, including emergency or temporary access. In addition, the TSA Chief Information Officer should require the selected High Value Asset system owner to maintain a current list of system users and remove or disable inactive accounts according to applicable DHS and TSA policies.

We recommend the TSA Chief Information Officer direct the selected High Value Asset system owner to require all non-privileged users’ system access requests be reviewed, authorized, and documented before granting system access. In addition, users’ system access should be reviewed periodically and removed if it is no longer needed.

We recommend the TSA Chief Information Officer direct the selected High Value Asset system owner to review and document the approval of all privileged users’ system access before granting system access. In addition, privileged users’ system access should be reviewed and removed according to applicable DHS and TSA requirements if it is no longer needed.

We recommend the TSA Chief Information Officer require the selected High Value Asset system owner to develop and implement procedures to remove system access for separated users.

We recommend the TSA Chief Information Officer direct the selected High Value Asset system owner to require all system users sign Computer Access Agreements to acknowledge the rules of behavior when accessing the system.

We recommend the TSA Chief Information Officer direct the selected High Value Asset system owner to enforce users to receive security awareness training when they are given system access and annually thereafter.

We recommend the TSA Chief Information Officer direct the selected High Value Asset system owner to strengthen its system-level Information Security Continuous Monitoring by ensuring (1) security documents contain current and accurate information about the system; (2) relevant policies and procedures are developed, reviewed, and approved; and (3) Plans of Action and Milestones are remediated promptly and include all required information.

We recommend the TSA Chief Information Officer require the selected High Value Asset System’s Contingency Plan and Contingency Plan Test to be reviewed and approved in accordance with DHS and National Institute of Standards and Technology guidance.

We recommend that the Chief Operating Officer for Federal Student Aid (FSA) require USC to— 1.1 Calculate the actualamount of improper Pell and any other Title IV payments made to the 13 students for whom it did not apply professionaljudgment other than dependency override in accordance with section 479A of the HEA and return those funds to theDepartment.

We recommend that the Chief Operating Officer for Federal Student Aid (FSA) require USC to— 1.2 Review its records forthe 6,062 students for whom the school reported that it applied professional judgment other than dependency override foraward year 2019–2020 or award year 2020–2021 but were not included in our sample and (a) identify those students forwhom it improperly adjusted the value of data items affecting AGI based on allowances or expenses unrelated to specialcircumstances, (b) provide FSA with a listing of the improperly disbursed Title IV funds and the records associated withthose students for whom financial aid administrators improperly applied…

We recommend that the Chief Operating Officer for FSA require USC to— 2.1 Review its records for the 6,162 studentsfor whom the school reported that it applied professional judgment other than dependency override for award year2019–2020 or 2020–2021; identify records adequately documenting the use of professional judgment; and provide therecords for any students with inadequately documented professional judgment to FSA along with a listing of the amount ofTitle IV funds, if any, that were improperly awarded and disbursed to students.

We recommend that the Chief Operating Officer for FSA require USC to— 3.1 Provide additional records that adequatelydocument the financial aid administrators’ determinations of independence for the six students or return to the Department$3,700 in Pell funds and $26,200 in Direct Loan funds.

We recommend that the Chief Operating Officer for FSA require USC to—Review its records for the 81 students notincluded in our sample; identify records adequately documenting the financial aid administrators’ determinations ofindependence; and provide the records for any students with inadequately documented dependency override to FSA alongwith a listing of the amount of Title IV funds, if any, that the school improperly awarded and disbursed to the students.

We recommend that the Chief Operating Officer for FSA require USC to— 4.1 Develop and implement procedures forconfirming that its student information system data are corroborated by its financial assistance records before reportingthe use of professional judgment to the Department’s Central Processing System.

We recommend that the FEMA Administrator resolve questioned costs totaling an estimated $24,438,662 for expenses deemed ineligible by FEMA’s Individual Assistance Program and Policy Guide and determine the amount of any debts owed by recipients for erroneous payments.

We recommend that the FEMA Administrator ensure that future iterations of the Individual Assistance Program and Policy Guide and supporting procedures (a) provide consistent guidance on eligibility of funeral expenses for all future disaster declarations; and (b) allow for reimbursement of only necessary expenses and serious needs, consistent with the law.

We recommend that the FEMA Administrator ensure that FEMA provides its COVID-19 Funeral Assistance call center contractor the guidance and training necessary to meet the quality control and production monitoring metrics as prescribed by its agreement with the contractor.

We recommend that the Office of Insular Affairs work with the U.S. Virgin Islands Department of Finance to revise the Department of Finance Standard Operating Procedure 604 to include all methods of allocating compensation costs by documenting responsibilities and procedures for determining the allocation.

We recommend that the Office of Insular Affairs work with the U.S. Virgin Islands Department of Finance to develop and implement written procedures for determining cost allowability and for reviewing drawdown requests.