Open Recommendations

The Commission should Implement effective ERM reporting tools impacting and related to the Identify Function.

The Commission should ensure system-level Business Impact Analyses are integrated with the ERM program impacting and related to the Recover Function.

Create documented processes for ensuring all DOL’s geospatial data is included within the geospatial data inventory and processes to improve data accuracy and data quality.

Develop a training program that ensures DOL officials with system and data responsibilities are aware of the requirements when implementing Department of Labor Geospatial Data Strategy and the geospatial data inventory processes.

Create a plan to acquire sufficient funding to properly oversee and create data quality standards of geospatial data throughout DOL and its contracts.

Develop an approach for including pertinent financial (i.e., costs and savings) and sustainability impact data in its Vehicle Acquisition Strategy and related contingencies.

The Department of Energy Has Made Little Progress Implementing the Geospatial Data Act of 2021

Complete a privacy assessment specific to geospatial data to ensure that personal privacy information is adequately protected in the Department’s information systems.

Use the FY24–26 Geospatial Science Program Communications Plan to increase engagement with programs and sites.

Finalize and distribute the revised DOE Geospatial Science Program Implementation Plan

We recommend that the Department of Health and Human Services fulfill the remaining seven covered agency responsibilities established in GDA section 759(a).

We recommend that the Department of Health and Human Services ensure that the HHS Office of the Chief Data Officer oversees, coordinates, and facilitates HHS's implementation of geospatial-related requirements, policies, and activities.

We recommend that the Department of Health and Human Services develop and maintain an inventory of all geospatial data assets in accordance with section 759(b) of the GDA.

We recommend that the Department of Health and Human Services prepare the required annual reports regarding the achievements of the covered agency in preparing and implementing the strategic plan for the National Spatial Data Infrastructure (section 759(a)(1)) and complying with the other requirements in section 759(a).

Ensure that systems are reauthorized to operate on the 3-year schedule until either moved to a continuous monitoring model or retired.

Ensure that the Authorizing Official reviews and approves security control assessment plans prior to the assessments being conducted.

Ensure that all required controls and control enhancements are assessed for implementation and effectiveness as part of the authorization or reauthorization process.

Develop and implement risk assessments that analyze the likelihood of threats and mitigation measures in place specific to transmission systems.

Ensure that critical- and high-risk vulnerabilities are remediated or mitigated in a timely manner.

Develop processes to incorporate the cybersecurity change management board to seek its review and approval prior to making changes to all transmission systems.

Ensure that all substation SSCPs include all information required by NIST SP 800-53, Revision 5, and consider the control overlay provided in NIST SP 800-82, Revision 3.

Determine unnecessary ports, protocols, and services, and disable them to remove additional avenues for an attacker or a malicious user to exploit the system.

Encrypt data at rest on servers and databases, as appropriate, to protect confidentiality and integrity of the data.

Implement software, firmware, and information integrity checking tools, as appropriate, to identify unauthorized changes to all transmission systems.

Implement separation of duties to help prevent issues and minimize errors.