Open Recommendations

Provide system owners and individuals with training or other communication emphasizing requirements for approving privileged user access prior to granting access.

Ensure program offices review all system security plans and confirm they are updated, approved, and signed annually by the system owner, information systems security officer, and the information systems security manager.

Document procedures, roles, and responsibilities for performing an annual functional test to ensure that the alternative backup site keeps the system operational in accordance with SBA policy and procedures.

Annually perform functional testing to include failover testing in accordance with SBA policy and procedures.

Establish procedures to monitor program officials’ compliance with SOP 90 47 6, Cybersecurity and Privacy Policy, requirements to ensure information system contingency plans are developed, tested annually, and updated as needed.

Review and update the information system contingency plans and business impact assessments and ensure that key attributes are included.

Update the information system contingency plans and business impact assessments at least once a year and include the recovery priority and lessons learned.

Conduct the information system contingency plans to include a business impact assessment at least annually.

We recommend the Senior Director, Labor and Employee Relations, develop measures to evaluate the impact of completed actions on the probability of occurrence and financial impact.

We recommend the Senior Director, Labor and Employee Relations, take steps to ensure risk information in the ERM system of record is accurate.

The Chief Information Officer should implement a process to review vendor usage reports for overseas mobile device activity. Further, take appropriate actions to sanitize the devices transported overseas in accordance with existing IRS procedures.

The Chief Information Officer should update Form 1321 to include the name and other identifiable features of mobile devices being taken outside the country.

Work with ARC to resolve the questioned costs of $13,480 for non-ARC match cost share.

Establish a process to reconcile actual expenditures to the reported expenditures to ensure accurate reporting in accordance with the Uniform Guidance and exclude unsupported costs from the amounts reported.

Work with ARC to resolve the questioned cost totaling $13,618 of non-ARC matching cost share.

Establish policies and procedures to ensure timely preparation and submission of financial and progress reports in accordance with the Uniform Guidance and ARC grant agreement requirements.

Clarify procedures for validating the security level of armored vehicles when approving asset disposition plans

Implement a plan to ensure remaining health commodities associated with terminated awards in Haiti are donated in accordance with their USAID-approved disposition plans.

Implement a plan to ensure port rehabilitation materials located in the U.S. and in Haiti are disposed of in accordance with USAID-approved disposition plans.

We recommend the Director, Nuclear Asset Sustainability Projects, take steps to ensure that project managers include Supply Chain in the solicitation and bid evaluation processes in a timely manner.

We recommend the Director, Nuclear Asset Sustainability Projects, take steps to ensure that independent estimates are completed as required.

We recommend the Director, Nuclear Asset Sustainability Projects, take steps to ensure that estimation checklists are completed as required.

The Chief, Taxpayer Services, should work with the Department of the Treasury Office of Tax Policy to request legislation that would accelerate the filing deadline for all information returns whose current deadline is March 31.

We recommend that USAID determine the allowability of $66,733 in ineligible questioned costs on page 23 of the audit report and recover any amount that is unallowable.

We recommend that USAID verify that Program for Appropriate Technology in Health in Kenya corrects the one instance of material noncompliance detailed on pages 29 to 30 of the audit report.