Open Recommendations

The Chief Information Officer should work with the Treasury Department to ensure that privileged Enterprise Data Platform user accounts are fully integrated with the PUMAS.

The Chief Information Officer should ensure that the responsible unit with the authority to remove Enterprise Data Platform user access is timely notified when appropriate e.g., entitlements are changed or accounts are inactive.

The Chief Information Officer should coordinate with the Treasury Department to resolve the infrastructure issue between IRS and Treasury networks and ensure that systemic processes are incorporated into the platform user account management process once the infrastructure limitations are resolved.

The Chief Information Officer should establish a corrective action plan or an RBD to address the lack of automated provisioning of user accounts.

The VA Caribbean Healthcare System Director ensures that facility leaders make decisions regarding the need for institutional disclosures independent of the peer review process in alignment with VHA Directive 1190 (1), Peer Review for Quality Management.

The OIG recommends that the Executive Director for Operations develop and issue supplemental guidance clarifying the expected implementation of cybersecurity controls, the interpretation of requirements, and methods for evaluating control effectiveness.

The OIG recommends that the Executive Director for Operations update Inspection Procedure 71130.10 to clarify the Cyber Security Issues Forum process and its potential impacts on findings and violations.

The OIG recommends that the Executive Director for Operations update Inspection Manual Chapter 1245, Appendix D-1, to include periodic refresher training requirements for cybersecurity-qualified inspectors.

The OIG recommends that the Executive Director for Operations define a schedule for contractor-led training (in-person or virtual), and ensure sessions are recorded and accessible.

The OIG recommends that the Executive Director for Operations revise the request for information guidance to require inspectors to identify the most current cybersecurity program documents already in the NRC’s possession before issuing the initial request, and to clearly communicate target dates for both issuing requests and receiving licensee responses.

The OIG recommends that the Executive Director for Operations train staff on the correct Cost Activity Codes for reporting fee-billable and non-billable cybersecurity inspection activities within the Human Capital Management Cloud System.

The OIG recommends that the Executive Director for Operations finalize the Cyber Security Issues Forum Draft Charter to include the Cost Activity Codes used by staff members when participating in or observing meetings.

The OIG recommends that the Executive Director for Operations develop clear guidance on the appropriate use of security oversight Cost Activity Codes.

The OIG recommends that the Executive Director for Operations develop and implement Enterprise Project Identifier codes for inspection oversight activities to improve tracking of safety and security related oversight activities.

Establish policies and implement procedures that provide specific guidance to program managers for the identification of scientific information products that are influential. These procedures shall include a process for determining whether a scientific information product is a principal basis for a decision by a federal decision maker.

Train appropriate employees on the established policies and implement procedures for the identification of scientific information products that are influential.

Based on the lack of evidence that such an assessment was previously performed, perform an analysis on rulemakings conducted after the issuance of OMB’s M-19-15 and determine if a scientific assessment was the principal basis for a decision by a federal decision maker.

Based on the results of the analysis performed for recommendation 3, perform appropriate administrative corrective actions, if necessary.

Perform a risk assessment that covers compliance with the Information Quality Act.

Review account access permission levels in the agency clearance workflow so that only users with a valid business purpose have appropriate access.

Establish policies and procedures for monitoring activities of the agency clearance workflow, to include the review of master data, access authorizations, and system access.

Establish policies and procedures for monitoring activities for compliance with both OMB and agency-specific policies for performing pre-dissemination review of scientific information.

We recommend the FEC formally designate a COO role in accordance with the statutory requirements of GPRAMA and the implementing guidance in OMB Circular A‑11, Part 6. This includes ensuring that the COO is the deputy agency head or equivalent.

We recommend the FEC formally document the COO designation through an internal directive, organizational order, memorandum, or leadership charter, and notify OMB of the designations as required by OMB Circular A‑11. Documentation should clearly define the responsibilities, reporting relationships, and authority of the role to ensure compliance with federal performance governance requirements.

We recommend the FEC ensure the COO role is integrated into the agency’s enterprise performance framework, including participation in strategic planning, development of Annual Performance Plans and Reports, leadership of data‑driven performance reviews, and coordination of performance improvement activities. This integration should support effective execution of GPRAMA and OMB Circular A‑11 performance requirements and strengthen accountability for agency‑wide performance.