Open Recommendations

We recommend that the Principal Deputy Assistant Secretary for Water and Science, as the delegated Federal Geographic Data Committee Chair, conduct an analysis to identify the root cause(s) of the geospatial dataset unavailability on GeoPlatform.

We recommend that the Principal Deputy Assistant Secretary for Water and Science, as the delegated Federal Geographic Data Committee Chair, conduct an analysis to determine the costs, benefits, and feasibility of resolving the root causes identified with GeoPlatform.

We recommend that the Principal Deputy Assistant Secretary for Water and Science, as the delegated Federal Geographic Data Committee Chair, implement appropriate changes based on the root cause and cost benefit analyses to address dataset availability issues.

We recommend that the Office of the Chief Information Officer develop and implement a methodology for the bureaus to identify all DOI geospatial-related costs to ensure consistency.

We recommend that the Office of the Chief Information Officer, in the absence of Federal Geographic Data Committee standards, identify relevant best practices and develop requirements for specific data fields for National Geospatial Data Assets in alignment with best practices.

We recommend that the Office of the Chief Information Officer direct the bureaus to track all geospatial-related costs using the methodology developed in recommendation 4 and report these costs to the Office of the Chief Information Officer annually.

Take corrective action for the subrecipient monitoring and agreement issues cited for eight of the ESG-CV grantees reviewed, and provide additional guidance and technical assistance as needed to ensure that they understand requirements.

Develop and implement additional subrecipient monitoring training and guidance for all ESG grantees.

Confirm VA has resumed submitting biweekly reports and, therefore, has submitted reports from June 2023 to present as required by the VA Transparency & Trust Act of 2021.

Confirm that the American Rescue Plan Act of 2021 section 8002 quarterly reports are submitted to Congress within the time frame established on the Consolidated Appropriations Acts of 2022 and 2023, which is no later than 30 days after the end of each fiscal quarter.

Coordinate with administration and staff office chief financial officers to ensure that the finance office staff responsible for the management of open obligations know and understand VA financial policy requirements for the review of open obligations included in quarterly obligation reports.

Work with the relevant components to better align metrics across the Department and to determine what metrics for the ransomware threat, including metrics tracking disruption efforts, are most impactful, and which demonstrate the effectiveness of its actions to combat the ransomware threat.

Assess the U.S. Attorneys' Offices (USAO) implementation of the deconfliction policy, for ransomware cases, to ensure that federal prosecutors have a consistent understanding of the policy and comply with its requirements.

Rec. 1: The DoD OIG recommended that the Deputy Commandant, Manpower and Reserve Affairs, Headquarters, U.S. Marine Corps, develop and disseminate guidance providing a consistent approach for documenting and uploading dwell waiver requests to the Service member's Electronic Service Record to ensure that a Service member's consent to mobilization while in dwell is properly documented and maintained.

Rec. 4: The DoD OIG recommended that the Deputy Chief of Staff for Personnel, Headquarters, Department of the Army, develop and issue guidance applicable to the Army National Guard and the Army Reserve for maintaining documentation supporting Service members consent to mobilization while in dwell.

We recommend that USAID's Chief Information Officer develop and implement written guidance for performing and documenting cost-benefit and alternative analyses for cloud acquisitions before procuring cloud services.

We recommend that USAID's Chief Information Officer develop and implement a written procedure to document the Chief Information Officer's review and approval of all cloud service acquisition plans.

We recommend that USAID's Chief Information Officer develop and implement a written process for defining and reviewing service level agreements to determine whether they meet Agency needs.

We recommend that USAID's Chief Information Officer develop additional procedures to hold system owners accountable for noncompliance with continuous monitoring reporting requirements. This may include actions other than denying a system authority to operate, such as a negative performance evaluation or disciplinary action.

We recommend that USAID's Chief Information Officer develop additional procedures to hold system accountable for noncompliance with plan of action and milestones requirements. This may include actions other than denying a system authority to operate, such as a negative performance evaluation or disciplinary action.

We recommend that USAID's Chief Information Officer revise Agency procedures to address how system owners should document their monitoring of cloud service providers' remediation activities.

We recommend that the Federal Acquisition Service Commissioner consolidate and improve contract security classification guidance to provide more detail and clarity for AAS contracting personnel.

We recommend that the Federal Acquisition Service Commissioner update existing controls to monitor and ensure compliance with contract security classifications by including a review of the security classification level in contract file transfer checklists; verifying compliance with AAS security classification policies during existing internal contract reviews; and updating briefing templates to use consistent terminology.

We recommend that the Federal Acquisition Service Commissioner implement Assisted Services Shared Information System controls to ensure accuracy and integrity of contract security classifications by prioritizing the development of edit history for immediate visibility of changes to the contract security classification level; and limiting the ability to edit contract data to only the assigned acquisition personnel and their supervisory chain.

We recommend that the Federal Acquisition Service Commissioner strengthen AAS policy to require AAS Level 3 contracting officers to have adequate security clearances and establish a plan to initiate the security clearance process for affected contracting officers.