Open Recommendations

We recommend that the Chief Operating Officer of FSA ensure that all future SABER-related contract deliverables,including the FTI Infrastructure deliverables, are clearly defined in the contracts, related modifications, or as anattachment to contracts and related modifications to ensure proper tracking, monitoring, and contractor performance.

We recommend that the Chief Operating Officer of FSA clearly define who is responsible for supervising each part of theCOR’s performance for SABER-awarded contracts and hold the contracting officers accountable for the overall monitoringof the contracts awarded by FSA, including the FTI Module, FTI SAIG, and FTI Infrastructure contracts.

We recommend that the Chief Operating Officer of FSA require that the data fields that FSA defines as primary in theSABER risk registers be completed as appropriate, and data fields in decision logs be completed.

We recommend that the Chief Operating Officer of FSA fix the technical issues to reduce data loss in SABER riskregisters and other risk registers.

Review the installed applications on all issued laptops to ensure no unauthorized software is present.

Review the FMC "user" setting population to ensure each "user" is properly configured in compliance with FMC's approved GPOs.

Review Active Directory settings to ensure unauthorized software cannot be installed, including the Print Driver settings.

Regular software audits should be scheduled on all issued laptops to ensure compliance with FMC approved software policy.

Security Awareness training should be provided annually to all FMC users on the risks of downloading software.

Security Awareness training should be provided to all network administrators on the importance of secure configuration management on user devices.

Perform the procedures and associated controls identified in the SCRM SOP. The SOP lists fourteen procedures to perform.

During its annual review for changes to Commission Order (CO)-112, Acquisitions, include verbiage that all IT acquisitions should follow the SCRM SOP by reference.

Review the settings on all issued laptops to ensure MFA requirements are in place.

Review the FMC user setting population to ensure each user is properly configured.

Regular configuration audits should be scheduled on all issued laptops to ensure compliance with FMC MFA requirements.

Periodically require FMC personnel to log out and shut down laptops to ensure all requirements are being installed correctly.

Security Awareness training should be provided to all network administrators on the importance of secure configuration management on user devices.

HRK recommends that FMC implement a monitoring process of required trainings at FMC so that when issues like the vendor management issue arises, they can identify and address early on to ensure the required training is met.

FMC should develop an executable plan to meet the requirements of OMB M-21-31 and ensure the plan is properly supported.

Create an overall BIA policy, procedures, and processes or incorporate a BIA policy, procedures, and processes into its existing contingency planning documents.

Create a Template for completing BIAs consistently across the commission following NIST SP 800-34, rev. 1, Contingency Planning Guide for Federal Information Systems, Chapter 3.

Incorporate the BIAs results into its overall contingency planning efforts.

We recommend the Chairman reevaluate and make further updates, as necessary, and fully implement all provisions of the FDIC’s Anti-Harassment Oversight Plan.

We recommend that the Chairman: (a) incorporate a specific harassment-free culture standard into the Performance Management Program and Bonus Criteria for all staff; (b) incorporate harassment prevention into the bonus criteria for managers and executives;(c) develop and implement a process that considers violations of the anti-harassment policy when determining whether an employee should serve in a supervisory or managerial capacity; and (d) develop and implement a process that considers violations of the anti-harassment policy when determining whether an employee is eligible to receive a bonus.

We recommend that the Chairman/COO develop and implement a mechanism to ensure that corrective actions used to close recommendations related to the sexual harassment prevention program are sustained.