Open Recommendations

We recommend the DHS Office of the Chief Information Officer develop and implement policies and procedures to ensure component custom-developed applications have been evaluated and do not have unmitigated vulnerabilities.

We recommend the DHS Office of the Chief Information Officer remove applications from component mobile devices that are prohibited by DHS policy, applications with unmitigated security risk, and applications that do not meet business needs.

We recommend the DHS Office of the Chief Information Officer develop and implement policies and procedures to ensure: • all user-installed applications are evaluated for security risks to the mobile device or data security and for compliance with Department policy before allowing their use; and • user-installed applications are managed and monitored on a routine basis.

We recommend the DHS Office of the Chief Information Officer develop and implement policies and procedures to improve the vulnerability management process and to ensure: • tools used for credentialed scans can detect known vulnerabilities; • credentialed scans are completed and assessed in accordance with DHS guidance; • plans to address vulnerabilities are created and implemented promptly in accordance with DHS guidance; and • the risk of noncompliant enterprise-level system settings is formally accepted or mitigated.

We recommend I&A’s Directorate of Technology and Data Services update its policies and procedures for notification of official foreign travel to incorporate DHS Office of the Chief Information Officer guidance and ensure mobile devices receive proper authorization for international travel.

We recommend the DHS Office of the Chief Information Officer develop and implement policies and procedures to ensure mobile devices are configured with minimal features and applications based on mission needs.

We recommend I&A’s Directorate of Technology and Data Services coordinate with DHS Office of the Chief Information Officer to develop and implement a memorandum of understanding that clearly defines roles, responsibilities, and accountability for the inventory management of I&A mobile devices.

We recommend the DHS Office of the Chief Information Officer update and implement policies and procedures to improve its mobile device management to ensure: • OCIO-issued mobile devices are enrolled in the mobile device management system; • documentation is required for devices that receive waivers from the policy; • all reported lost, stolen, and disposed-of I&A mobile devices are unenrolled from the mobile device management system; • all lost or stolen mobile devices and those I&A no longer needs are reported to the Office of the Chief Information Officer to be remotely wiped by the mobile device management system; and…

We recommend I&A’s Directorate of Technology and Data Services coordinate with the DHS Office of the Chief Information Officer to develop and implement policies and procedures to improve the management of mobile services and ensure: • all mobile devices without a business need are unenrolled from mobile services; • mobile service overage charges are incurred in support of mission needs; and • mobile device use is routinely monitored and reported to prevent paying for unnecessary devices and services.

The Chief, Criminal Investigation, should either reestablish the CI Training Council or update internal guidelines outlining new processes and procedures that CI Senior Executives will follow to review and approve changes to the SAIT training program.

The Chief, Criminal Investigation, should review SAIT training courses to identify those that involve legal components to determine if CT Counsel attorneys should be instructors.

The Chief, Criminal Investigation, should ensure that representatives from the Office of Chief Counsel are consulted when proposing/making curriculum changes on tax related lessons.

The Chief, Criminal Investigation, should initiate a review of the SAIT Training Program Evaluation Policy to ensure that the policy currently reflects the CI Senior Executive Team’s test grading policies.

The Chief, Criminal Investigation, should establish processes and procedures that regularly review test grading to ensure adherence to and compliance with the SAIT training program evaluation policies.

The VA Loma Linda Healthcare System Director ensures the Chief of Staff signs peer review designation memoranda within three days of determining a peer review is needed as outlined in Veterans Health Administration policy.

The VA Loma Linda Healthcare System Director ensures that focused professional practice evaluations for initial appointments and additional privileges are completed in accordance with Veterans Health Administration policy and monitors for compliance.

The VA Loma Linda Healthcare System Director ensures the Chief of Staff signs peer review designation memoranda within three days of determining a peer review is needed as outlined in Veterans Health Administration policy.

The VA Loma Linda Healthcare System Director ensures that focused professional practice evaluations for initial appointments and additional privileges are completed in accordance with Veterans Health Administration policy and monitors for compliance.

Restricted due to sensitive information.

Restricted due to sensitive information.

We recommend the Director of FEMA’s Individual Assistance Division ensure the National Board resolves the $425 million in questioned costs associated with the Emergency Food and Shelter Program-Humanitarian Relief funding during the grant closeout process by collecting supporting documentation, determining whether the costs are allowable, and recouping any costs that are not allowable.

We recommend the Assistant Administrator of FEMA’s Grant Programs Directorate resolve the $16.5 million in questioned costs associated with the Shelter and Services Program funding identified in our report. FEMA should collect supporting documentation, determine whether the costs are allowable, recoup any costs that are not allowable, and upload the necessary information to the FEMA Grants Outcomes system of record.

We recommend the Assistant Administrator of FEMA’s Grant Programs Directorate review payment requests during the grant closeout process for all Shelter and Services Program awards in FY 2023 and FY 2024 to minimize the reimbursement of unsupported costs. FEMA should collect supporting documentation, determine whether the costs are allowable, and upload the necessary information to the FEMA Grants Outcomes system of record.

We recommend the Assistant Administrator of FEMA’s Grant Programs Directorate develop and implement controls to ensure FEMA officials and grant recipients use FEMA Grants Outcomes as the system of record to maintain required documentation supporting all phases of the grants management lifecycle.

We recommend the Director of FEMA’s Individual Assistance Division and the Assistant Administrator of FEMA’s Grant Programs Directorate establish a review process to ensure there was no duplication of FY 2023 funding between the Emergency Food and Shelter Program-Humanitarian Relief and the Shelter and Services Program. FEMA should recoup any duplicate payments identified.