Open Recommendations

Update DOL entity-wide and system-level security policies, procedures, and plans to comply with NIST SP 800-53, Rev. 5.

Implement data loss prevention tools and alerts based on the results of agencies’ data exfiltration tests.

[Description omitted; DOJ has determined that this recommendation contains information that is limited official use or classified.]

(U) Rec. 2.a: The DoD OIG recommended that the DoD Chief Information Officer, in coordination with the Under Secretary of Defense for Intelligence and Security, develop comprehensive mobile device and mobile application policy for Components and users. The policy should, at a minimum, define the acceptable use of DoD mobile devices and mobile applications for official DoD business and personal use.

(U) Rec. 2.b: The DoD OIG recommended that the DoD Chief Information Officer, in coordination with the Under Secretary of Defense for Intelligence and Security, develop comprehensive mobile device and mobile application policy for Components and users. The policy should, at a minimum, address the cybersecurity and operational security risks of 1) user access to unmanaged applications without cybersecurity assessments through Component application stores or public application stores, and 2) mobile device features, including geolocation, screen capture, copy and paste, and camera, among others.

(U) Rec. 2.c: The DoD OIG recommended that the DoD Chief Information Officer, in coordination with the Under Secretary of Defense for Intelligence and Security, develop comprehensive mobile device and mobile application policy for Components and users. The policy should, at a minimum, address the DoD records management requirements of DoD Instruction 5015.02, "DoD Records Management Program," February 25, 2015 (Incorporating Change 1, August 17, 2017) and the Deputy Secretary of Defense memorandum "Records Management Responsibilities for Text Messages," August 3, 2022.

(U) Rec. 2.d: The DoD OIG recommended that the DoD Chief Information Officer, in coordination with the Under Secretary of Defense for Intelligence and Security, develop comprehensive mobile device and mobile application policy for Components and users. The policy should, at a minimum, require DoD Components to provide regularly scheduled training to DoD mobile device users on the responsible and effective use of mobile devices and applications, including electronic messaging services, in accordance with DoD Chief Information Officer memorandum, "Mobile Application Security Requirements," October 6, 2017, and DoD Instruction 8170.01, "Online Information Management and Electronic Messaging," January 2, 2019 (Incorporating…

(U) Rec. 2.e: The DoD OIG recommended that the DoD Chief Information Officer, in coordination with the Under Secretary of Defense for Intelligence and Security, develop comprehensive mobile device and mobile application policy for Components and users. The policy should, at a minimum, require DoD Components to justify and approve the mission requirements for all managed and unmanaged applications and limit access to only those applications with a justified and approved need.

(U) Rec. 3: The DoD OIG recommended that the DoD Chief Information Officer, in coordination with the Defense Information Systems Agency Chief Information Officer, revise DoD policy and memorandums and Defense Information Systems Agency mobile application documentation and training to ensure the use of common terminology when referring to approved, managed, DoD-controlled, authorized, and official applications; and unmanaged, non-DoD-controlled, unauthorized, non-official, and personal-use applications.

Establish a documented annual enterprise-wide examination planning process that aligns with the multiyear, comprehensive Examination Strategic Plan.

Develop a tool to consider risk and other relevant variables to inform examination resource allocation decisions, then expand its use to include Examination workstreams from all divisions.

We recommend that the Michigan Department of Health and Human Services ensure the electronic case records for children who are prescribed opioid medications are maintained in accordance with requirements by implementing procedures requiring caseworkers to monitor Medicaid claim data for opioid medications prescribed for the children and providing training to caseworkers on the requirements for documenting medications prescribed for the children in MiSACWIS, including opioid medications due to medical procedures or emergency treatments.

We recommend that the Michigan Department of Health and Human Services ensure the electronic case records for children who are prescribed psychotropic medications are maintained in accordance with requirements by implementing policies specific to non-emergency situations that require the FC-PMOU to document when consent forms do not need to be obtained; implementing procedures for caseworkers and the FC-PMOU to monitor the Medicaid claim data to ensure consent forms are obtained and documented; and implementing procedures requiring caseworkers and the FC-PMOU to monitor other medications prescribed for children, including opioids, for potential medication interaction and adverse side effects.

We recommend that the Michigan Department of Health and Human Services ensure that electronic case records for the children under its care and supervision are maintained in accordance with State requirements by modifying procedures for the monitoring of caseworkers to include a review of medical passports in MiSACWIS.

KPMG recommends that ESC management create monitoring procedures over the existing management review of the JV control logs monthly reconciliation to ensure the consistent operation of the control, as defined within policy.

KPMG recommends that FAA management perform a risk assessment to consider the potential impact of discrepancies between vendor-submitted invoice web portal amounts and the vendor-submitted supporting documentation, and respond to the level of risk identified as appropriate.

KPMG recommends that FAA management design and implement controls to ensure that the population generated to support the disclosure of future minimum lease payments is complete and accurate.

KPMG recommends that FAA management design and implement control activities to monitor the effective operation of its process controls related to provisioning new payroll shared service center access requests.

KPMG recommends that FAA management develop policies and procedures for maintaining completed and authorized payroll shared service center access forms for new user access requests in a secure centralized location.

KPMG recommends that FAA management design and implement control activities to monitor the effective operation of its process controls related to monitoring FAA employees' payroll shared service center access.

KPMG recommends that FAA management take measures to ensure that FAA has sufficient control operator personnel available to support the annual recertification of FAA employees with payroll shared service center access within the reporting timeline prescribed by DOT.

We recommend that the North Carolina Department of Health and Human Services, Division of Health Benefits work with CMS to determine the unallowable portion of $684,731 (Federal share) for other claims for multiple-source physician-administered drugs that may have been ineligible for Federal reimbursement, refund that amount, and consider invoicing drug manufacturers for rebates for these drugs if CMS determines that the drug claims are allowable.

We recommend that the North Carolina Department of Health and Human Services, Division of Health Benefits work with CMS to determine and refund the unallowable portion of Federal reimbursement for physician-administered drugs that were not invoiced for rebates after December 31, 2019.

We recommend that the North Carolina Department of Health and Human Services, Division of Health Benefits to strengthen its internal controls to ensure that all physician-administered drugs eligible for rebates are invoiced.

Ensure compliance with segregation standards, including having a basis for use of restraints and providing access to recreation, library, mail, and religious services.