Open Recommendations

The Facility Director develops and implements written processes to monitor and track compliance with state involuntary commitment requirements.

The Chief of Staff ensures staff use the required admission note template to document legal commitment status.

The Chief of Staff ensures documentation of discussions between prescribers and veterans on the risks and benefits of newly prescribed central nervous system medications.

The Chief of Staff ensures discharge summaries are completed within two business days of discharge.

The Chief of Staff ensures discharge instructions for veterans include appointment locations written in easy-to-understand language.

The Chief of Staff ensures discharge instructions for veterans include an explanation when both trade and generic names are used for the same medication.

The Facility Director directs nonclinical staff to complete VA S.A.V.E. training requirements.

The Facility Director ensures compliance with Veterans Health Administration requirements for the Interdisciplinary Safety Inspection Team, including an assigned lead and recording of meeting minutes and membership.

The Facility Director implements processes to ensure the Interdisciplinary Safety Inspection Team applies Mental Health Environment of Care Checklist standards on the inpatient mental health unit.

The Facility Director directs inpatient unit staff and Interdisciplinary Safety Inspection Team members to complete Mental Health Environment of Care Checklist training requirements.

Complete the implementation of a new governance risk and compliance tool to assist in the timely completion of SBA’s annual security control assessments in coordination with the Office of the Chief Financial Officer.

Update SBA policy and procedures to clearly define the term “annual” and specify whether it refers to a period of 365 days or aligns with the fiscal year ending on September 30.

Ensure the agency follows the policy to perform security control assessments annually, either on a rolling 365-day basis or aligned with the fiscal year ending on September 30.

Update the SBA Standard Operating Procedure (SOP) 20 21 4, The Small Business Administration Acquisition and Procurement Program, January 16, 2025, Appendix C — Cybersecurity and Supply Chain Risk for IT Acquisitions, to reflect the new process in which third-party supply chain risks will be continuously monitored through the Office of the Chief Information Officer.

Implement policies, procedures, and processes for developing and maintaining an accurate inventory of data and its corresponding metadata from third parties.

Improve the governance, risk, and compliance systems to track cybersecurity risks.

Develop and implement a process to monitor program offices’ completion of required annual reviews of interconnection security agreements and ensure program officials review and sign the agreements prior to their expiration.

Improve the existing process to manage personal identity verification exemptions.

Ensure that system owners perform annual privileged user access reviews in accordance with SBA policies.

Provide system owners and individuals with training or other communication emphasizing requirements for approving privileged user access prior to granting access.

Ensure program offices review all system security plans and confirm they are updated, approved, and signed annually by the system owner, information systems security officer, and the information systems security manager.

Document procedures, roles, and responsibilities for performing an annual functional test to ensure that the alternative backup site keeps the system operational in accordance with SBA policy and procedures.

Annually perform functional testing to include failover testing in accordance with SBA policy and procedures.

Establish procedures to monitor program officials’ compliance with SOP 90 47 6, Cybersecurity and Privacy Policy, requirements to ensure information system contingency plans are developed, tested annually, and updated as needed.

Review and update the information system contingency plans and business impact assessments and ensure that key attributes are included.