Open Recommendations

We recommend that the Department of Health and Human Services Office of the Chief Information Officer update the HHS IS2P to require OpDivs to implement NIST 800-53, Revision 5, CA-8 (2) Red Team Exercises at least every 2 years and RA-10 Threat Hunting yearly for high and moderate Federal Information Processing Standards Publication 199 impact systems.

(U) Rec. 1.a: The DoD OIG recommended that the U.S. European Command Chief Information Office Division Chief update inventory records for all classified mobile devices to include information for the six elements required in an accountable property system of record.

(U) Rec. 1.b: Report is Classified.

(U) Rec. 1.c: Report is Classified.

(U) Rec. 1.d: The DoD OIG recommended that the U.S. European Command Chief Information Office Division Chief immediately revalidate and document the user justification for the devices and recall the device if the user no longer has a valid mission need, revise existing access policies to require detailed written justifications for obtaining classified mobile devices, and establish processes to periodically, at least annually, revalidate the need for continued access to the devices.

(U) Rec. 1.e: Report is Classified.

(U) Rec. 1.f: Report is Classified.

(U) Rec. 1.g: The DoD OIG recommended that the U.S. European Command Chief Information Office Division Chief revise existing or develop new classified mobile device training programs that include information on all 23 Office of the Secretary of Defense memorandum requirements.

(U) Rec. 1.h: The DoD OIG recommended that the U.S. European Command Chief Information Office Division Chief provide all existing classified mobile device users with the updated training that includes all 23 Office of the Secretary of Defense memorandum requirements.

(U) Rec. 1.i: The DoD OIG recommended that the U.S. European Command Chief Information Office Division Chief update the classified mobile device user agreement to include all Committee on National Security Systems Directive No. 520 requirements and ensure that all users have acknowledged the updated user agreement.

(U) Rec. 1.j: Report is Classified.

(U) Rec. 1.k: Report is Classified.

(U) Rec. 2.a: The DoD OIG recommended that the U.S. Special Operations Command Director for Command, Control, Communications and Computer/Cyber, Chief Information Officer, update inventory records for all classified mobile devices to include information for the six elements required in an accountable property system of record as required by Committee on National Security Systems Directive No. 520 and DoD Instruction 5000.64.

(U) Rec. 2.b: The DoD OIG recommended that the U.S. Special Operations Command Director for Command, Control, Communications and Computer/Cyber, Chief Information Officer update the Commercial Solution for Classified Implementation Guidance to define the frequency for conducting inventories and reporting results to U.S. Special Operations Command Headquarters; immediately conduct an inventory of all Component classified mobile devices; update their inventory records; and take appropriate action if you are unable to properly reconcile a classified mobile device.

(U) Rec. 2.c: Report is Classified.

(U) Rec. 2.d: Report is Classified.

(U) Rec. 2.e: The DoD OIG recommended that the U.S. Special Operations Command Director for Command, Control, Communications and Computer/Cyber, Chief Information Officer immediately revalidate and document the user justification for the devices and recall the device if the user no longer has a valid mission need, and revise existing access policies to require detailed written justifications for obtaining classified mobile devices, and establish processes to periodically, at least annually, revalidate the need for continued access to the devices.

(U) Rec. 2.f: Report is Classified.

(U) Rec. 2.g: Report is Classified.

(U) Rec. 2.h: The DoD OIG recommended that the U.S. Special Operations Command Director for Command, Control, Communications and Computer/Cyber, Chief Information Officer revise existing or develop new classified mobile device training programs that include information on all 23 Office of the Secretary of Defense memorandum requirements.

(U) Rec. 2.i: The DoD OIG recommended that the U.S. Special Operations Command Director for Command, Control, Communications and Computer/Cyber, Chief Information Officer provide all existing classified mobile device users with the updated training that includes all 23 Office of the Secretary of Defense memorandum requirements.

(U) Rec. 2.j: The DoD OIG recommended that the U.S. Special Operations Command Director for Command, Control, Communications and Computer/Cyber, Chief Information Officer update the classified mobile device user agreement to include all Committee on National Security Systems Directive No. 520 and National Security Agency requirements and ensure that all users have acknowledged the updated user agreement.

(U) Rec. 2.k: The DoD OIG recommended that the U.S. Special Operations Command Director for Command, Control, Communications and Computer/Cyber, Chief Information Officer 4develop and implement procedures for retaining signed classified mobile device user agreements.

(U) Rec. 2.l: Report is Classified.

(U) Rec. 2.m: Report is Classified.