Open Recommendations

(U) Rec. 4: The DoD OIG recommended that the Commander of the U.S. Cyber Command require that the U.S. Cyber Command Insider Threat Hub Director, in coordination with the National Security Agency Insider Threat Hub Director, review the insider threat incidents received since the establishment of the Hub and report incidents that involve a covered person and meet one or more of the reporting thresholds to the DoD Insider Threat Management and Analysis Center.

(U) Rec. 6: The DoD OIG recommended that the Defense Health Agency Director require that the Defense Health Agency Insider Threat Hub Director review the insider threat incidents that we determined should have been reported to the DoD Insider Threat Management and Analysis Center and report those incidents as required.

(U) Rec. 7: The DoD OIG recommended that the National Security Agency/Central Security Service Director require that the National Security Agency Insider Threat Hub Director review the insider threat incidents received since the 2016 DoD Component reporting requirement was initiated and report incidents that involve a covered person and meet one or more of the reporting thresholds to the DoD Insider Threat Management and Analysis Center.

We recommend the Chief Human Capital Officer for DHS’ Management Directorate develop, implement, and communicate departmental policies and procedures for the Unemployment Compensation for Federal Employees program to each component to ensure compliance with Federal requirements.

The Department should ensure that adequate resources are made available and are prioritized to validate the accuracy and completeness of asset inventory counts prior to submission to the Department of Homeland Security (DHS) as part of CIO FISMA Metrics.

Coordinate with the components to develop or revise their plans to fully transition the remaining information systems to enable and enforce PIV, except those that are subject to exclusions that are documented and approved.

FAA should develop and implement procedures to perform periodic reviews of mobile devices to ensure non-compliant mobile devices are upgraded to the current operating system release.

Strengthen processes to ensure privileged account reviews are completed and privileged account activities are logged and periodically reviewed, in accordance with DOT policy.

In coordination with the OA system owners, complete DOTs plans to implement existing solutions where possible and create a plan to address all exceptions where there is not a current solution for encryption of data at rest and in transit.

In coordination with the OA system owners, complete the deployment of DOTs data loss prevention controls to include the utilization or activation of enhanced DLP features available within existing tools and to develop and implement policies and procedures which eliminate or restrict the ability of users to connect mass storage devices to DOT networks and systems.

Enhance current procedures to implement and require the retention of records to track when computer media are sanitized prior to disposal or reuse and implement procedures to validate the remediation of computer media that have failed media sanitization upon return to DOT.

In coordination with the OA system owners, strengthen DOTs oversight of the contingency planning processes to ensure contingency planning documentation is developed, updated, and tested in a timely manner, in accordance with policy.

Create and implement guidance for a QASP or QASP equivalent to use as the basis to monitor performance under medical services contracts that contains: (1) measurable performance standards to ensure desirable contract requirement outcomes including those related to quality and timeliness of care; and (2) standards for maintaining documentation related to the ratings in the QASP.

Create and implement strategies to leverage inmate healthcare utilization data that the OIG recommended to collect in 2016, which would enable the BOP to determine the cost effectiveness of alternative medical services contract structures.

Create and implement a uniform or universal billing review and approval process to: (1) ensure medical claims are properly supported and (2) improve timeliness of processing medical invoices.

Create and implement a timeline for utilizing the medical claims adjudication vendor contract awarded in December 2019 to process and ensure healthcare claims are accurate and complete

Ensure the existing SBA System Development Methodology is updated to include supply chain risk-management practices as required by OMB Circular A-130 and high-value asset system designation guidance. Also, ensure high-value asset system risks are incorporated into the enterprise risk management framework, as recommended by OMB M-19-03 and SBA SOP 90 47 6.

Communicate and enforce the SBA System Development Methodology in which a traceability matrix is used to ensure that system requirements can be tested and demonstrated in the operational system. Ensure all requirements are aligned with the contractual acceptance criteria.

Implement in updated agency guidance, the requirements of OMB Circular No. A-123 that stipulate a SOC 1 Type 2 report is needed for all new and existing financial systems. This guidance should also require confirmation at least annually that the controls are functioning as designed.

In conjunction with the Enterprise Risk Management Board, implement enterprise-wide privacy risk mitigation practices that can be assimilated into new and existing system program designs.

Complete an initial assessment and authorization for each information system and all agency-designated common controls before operation.

Transition information systems and common controls to an ongoing authorization process (when eligible for such a process) with the formal approval of the respective authorizing officials or reauthorize information systems and common controls as needed, on a time or event-driven basis in accordance with agency risk tolerance, as required by OMB Circular No. A-130 and SOP 90 47 6.

Review and update POA&Ms at least quarterly as required by SOP 90 47 6.

Implement an automated process to document and monitor system changes as recommended by NIST SP 800-53 Rev. 5.

Review the 179 PPP loans, totaling approximately $684 million, for compliance with affiliation and size standards to ensure eligibility requirements were met and seek remedy or repayment for all loans deemed ineligible.