Open Recommendations

Implement controls to follow National Institute of Standards and Technology guidance when conducting systems categorizations by:a. Involving the appropriate key stakeholders, including mission owners and the chief information security officer, during the system security categorization process as prescribed in the National Institute for Standards and Technology Special Publication 800-60 Volume I,Table 3, Process Roadmap.b. Having responsible parties adhere to all activity steps as outlined in the National Institute for Standards and Technology Process Roadmap, including selecting all application information types applicable to information systems.c. Having responsible parties document the security categorization determinations and decisions within system security plans as provided…

CMS should provide oversight of the 20 MA companies that had a disproportionate share of the risk-adjusted payments from chart reviews and HRAs.

CMS should take additional actions to determine the appropriateness of payments and care for the one MA company that substantially drove risk-adjusted payments from chart reviews and HRAs.

CMS should perform periodic monitoring to identify MA companies that had a disproportionate share of risk-adjusted payments from chart reviews and HRAs.

We recommend CBP’s Component Acquisition Executivereview the Multi-Role Enforcement Aircraft and the Medium Lift Helicopterprograms to ensure they comply with all DHS Acquisition Lifecyclerequirements. Specifically, CBP’s Component Acquisition Executive shoulddetermine whether the Acquisition Program Baseline for the Medium LiftHelicopter program reflects revised requirements accurately.

We recommend CBP AMO conduct a postimplementation review of the Medium Lift Helicopter program to determinewhether the deployed system is meeting capability needs, take correctiveactions as appropriate, and apply lessons learned for future acquisitions.

The under secretary for health makes certain that policies and procedures are developed to require VA police, and other VHA staff as appropriate, to conduct searches for all persons who are reported missing on medical center campuses.

The assistant under secretary for health for operations, in consultation with the VA chief security officer, requires VA police chiefs at medical centers to obtain approval from the facility associate director or the medical center director prior to excluding a building or area of the medical center’s campus from regular patrols, and, if the building or area is subject to an enhanced-use lease, confirms with the Office of Enterprise Asset Management and the Office of General Counsel that the exclusion is not in conflict with the terms of the lease.

For all medical centers that have property subject to enhanced-use leases, the assistant under secretary for health for operations, in consultation with the VA chief security officer, requires the medical center director or the director’s designee to meet with the assigned oversight monitor at the Office of Asset Enterprise Management, the designated local site monitor, and a representative of the Office of General Counsel at least annually—or sooner if there is a change of lease terms or facility leadership—to discuss the terms of the enhanced-use leases and the lessee’s and VA’s responsibilities with respect to the leased properties.

Develop specific guidance regarding communication withdetainees regarding their medical conditions and care and ensure facilitiesimplement this guidance.

We recommend the Director, U.S. Immigration and Customs Enforcement: Ensure all detention facilities that conduct whole-facilitytesting have submitted plans to ICE and that these plans have been approved.

We recommend the Director, Cybersecurity and Infrastructure Security Agency: Recommendation 1: Update the Dams Sector-Specific Plan as required, ensuring alignment with the updated National Infrastructure Protection Plan currently under development.

We recommend the Director, Cybersecurity and Infrastructure Security Agency: Formalize CISA's organizational structure to clarify roles, responsibilities, coordination processes, and reporting procedures across all divisions performing activities relating to CISA's role as the Sector-Specific Agency for the Dams Sector.

We recommend the Director, Cybersecurity and Infrastructure Security Agency: Establish policies, procedures, and performance metrics to help ensure CISA divisions consistently assess the impact of all programs and activities relating to CISA's role as the Sector-Specific Agency for the Dams Sector, and that CISA assess their effectiveness in the role of Sector-Specific Agency for the Dams Sector.

We recommend the Director, Cybersecurity and Infrastructure Security Agency: Strengthen coordination with FEMA by establishing Memorandums of Understanding, Interagency Agreements, or other documented strategies to formally define CISA's and FEMA's roles and responsibilities for information sharing and analytical collaboration for grant decision-making related to safety, security, and resilience of dams, as well as the use and applicability of numerical simulation models, flood inundation tools, and supporting geospatial mapping capabilities to support emergency preparedness and incident response.

We recommend the Director, Cybersecurity and Infrastructure Security Agency: Develop and implement a strategy for Dams Sector stakeholders to use the HSIN-CI Dams Portal to its fullest potential. CISA should develop metrics on usage, performance, and training needs; update the HSIN-CI Dams Portal with clear instructions; and encourage sharing of lessons learned, after action reports, and best practices among stakeholders.

We recommend that the Colorado Department of Health Care Policy and Financing work with CMS to determine the total amount of claims that were eligible for rebates as well as the unallowable portion of the physician-administered drug claims, invoice drug manufacturers for the calculated rebates, and refund the Federal share of rebates collected for the years covered by our audit period and for years after our audit period.

We recommend that the Colorado Department of Health Care Policy and Financing develop and implement policies and procedures to ensure that all eligible physician-administered drugs, including those dispensed to MCO enrollees, are invoiced for rebate.

Develop and institute an agency-wide process to prioritize and fund institutional and programmatic CoF projects that align with Agency-level missions and goals and require business case analyses to be completed and considered as part of the process prior to the project's approval.

In coordination with the Mission Directorates, institute a process to ensure facility requirements are identified and funding sources are specified during a program’s development and implementation phases.

Develop a strategy to work with Federal agencies to reduce the eligible disposal backlog.

Review policies and procedures and determine which internal stakeholders, including the IG, should be notified and revise policies and procedures as necessary.

Prioritize creation of DEER and DCR Audit Reports under the ARCIS contract.

Develop a strategy to transition agencies to use the ARCIS Customer Portal Disposition Module.

Develop and implement an ARCIS internal user manual.