Open Recommendations

We recommended the Assistant Secretary for Information and Technology implement improved processes to ensure compliance with VA password policy and security standards on domain controls, operating systems, databases, applications, and network devices.

We recommended the Assistant Secretary for Information and Technology implement periodic reviews to minimize accounts and permissions in excess of required functional responsibilities, and to remove unauthorized or unnecessary accounts.

We recommended the Assistant Secretary for Information and Technology enable system audit logs on all critical systems and platforms and conduct centralized reviews of security violations across the enterprise.

We recommended the Office of Personnel Security, Human Resources, and Contract Offices implement improved processes for establishing and maintaining accurate investigation data within VA systems used for background investigations.

We recommended the Office of Personnel Security, Human Resources, and Contract Offices strengthen processes to ensure appropriate levels of background investigations are completed for applicable VA employees and contractors.

We recommended the Assistant Secretary for Information and Technology implement more effective automated mechanisms to continuously identify and remediate security deficiencies on VA’s network infrastructure, database platforms, and web application servers.

We recommended the Assistant Secretary for Information and Technology implement improved processes for tracking and resolving vulnerabilities that cannot be addressed within policy timeframes. Implement more effective patch and vulnerability management processes to mitigate identified security deficiencies and reduce applicable security risks.

We recommended the Assistant Secretary for Information and Technology maintain a complete and accurate security baseline configuration for all platforms and ensure all baselines are appropriately monitored for compliance with established VA security standards.

We recommended the Assistant Secretary for Information and Technology implement improved controls that restrict vulnerable medical devices from unnecessary access to the general network.

We recommended the Assistant Secretary for Information and Technology enhance procedures for tracking security responsibilities for networks, devices, and components not managed by the Office of Information and Technology to ensure vulnerabilities are remediated in a timely manner.

We recommended the Assistant Secretary for Information and Technology implement improved processes to ensure that all devices and platforms are evaluated using credentialed vulnerability assessments.

We recommended the Assistant Secretary for Information and Technology implement improved procedures to enforce standardized system development and change control processes that integrates information security throughout the life cycle of each system.

We recommended the Assistant Secretary for Information and Technology implement improved procedures to ensure that system outages and disruptions are tracked to specific system boundaries and that interdependent systems are considered for the purposes of tracking and measuring against stated system recovery time objectives.

We recommended the Assistant Secretary for Information and Technology ensure contingency plans for all systems and applications are updated and tested in accordance with VA requirements.

We recommended the Assistant Secretary for Information and Technology ensure that systems and applications are adequately logged and monitored to facilitate an agency-wide awareness of information security events.

We recommended the Assistant Secretary for Information and Technology implement improved safeguards to identify and prevent unauthorized vulnerability scans on VA networks.

We recommended the Assistant Secretary for Information and Technology implement improved measures to ensure that all security controls are assessed in accordance with VA policy and that identified issues or weaknesses are adequately documented and tracked within POA&Ms.

We recommended the Assistant Secretary for Information and Technology implement improved processes to monitor for unauthorized changes to system components and the installation of prohibited software on all agency devices and platforms.

We recommended the Assistant Secretary for Information and Technology develop a comprehensive inventory process to identify connected hardware, software, and firmware used to support VA applications and operations.

We recommended the Assistant Secretary for Information and Technology implement improved procedures for monitoring contractor-managed systems and services and ensure information security controls adequately protect VA sensitive systems and data.

We recommend that the Chief Information Officer require the Information Technology Division (ITD) to perform an annual validation of the ITD Authorized Access List, in accordance with ITD Authorized Data Center Proxy Card Access List Maintenance standard operating procedure.

EXIM's Office of the Chair should designate a lead office or officials responsible for coordinating development, oversight, and implementation of a sub-Saharan Africa specific strategy to address the Sub-Saharan Africa Mandate (hereafter referred to as the "Lead Office or Officials"). The Lead Office or Officials should have an explicit responsibility and authority to coordinate and guide the mandate's implementation across all relevant EXIM offices, liaise with external stakeholders, including but not limited to the Sub-Saharan Africa Advisory Committee (SAAC) and other U.S. Government agencies and between sub-Saharan Africa importers and U.S. exporters to rebuild relationships, establish and monitor key performance…

The Lead Office or Officials should develop a sub-Saharan Africa specific strategy to address the Sub-Saharan Africa Mandate. This strategy should provide a unified direction and shared vision of EXIM offices and staff and communicate EXIM’s commitments and strategy to interagency partners in the U.S. Government and other stakeholders with a focus to promote the expansion of EXIM’s financial commitments in sub-Saharan Africa.

EXIM’s Office of the Chair should integrate the Sub-Saharan Africa Mandate strategy within the broader EXIM Strategic Plan to re-enforce that the Sub-Saharan Africa Mandate is central to EXIM’s overall strategic planning.

The Lead Office or Officials should develop an actionable plan to enhance collaborative efforts with the Department of Commerce, the Trade Promotion Coordinating Committee (TPCC), and other relevant government agencies, such that EXIM could play a more prominent role in trade discussions and initiatives concerning sub-Saharan Africa.