Open Recommendations

Document and implement procedures to review on a periodic basis users with administrative rights and privileged groups with access to domain controllers.

Implement protections to restrict access to system tools used to create and manage shadow copies of the hard drive.

Document and implement procedures to analyze user account passwords against lists of commonly used and compromised passwords and require users to reset weak or compromised passwords.

The New York/New Jersey VA Health Care Network Director conducts a review of system leaders responses to repeated concerns regarding delayed community care consult scheduling for patients with serious health conditions to determine whether leaders actions were in alignment with patient safety and high reliability organizational principles, and take action as warranted.

The New York/New Jersey VA Health Care Network Director ensures VA Western New York Health Care System Director develops community care consult practices and procedures for managing consults deemed high-risk or complex, implements an effective process to ensure consistency with processing consults within Veterans Health Administration timeliness requirements, and audits for compliance.

The VA Western New York Health Care System Director ensures system community care leaders develop and implement standardized operating procedures for consult management consistent with Veterans Health Administration standards, provide training to community care staff, monitor compliance, and evaluate effectiveness

Develop and formalize a quality program for Plant Operations that emphasizes a culture of measurement and continuous improvement.

Determine if any of the potential metrics highlighted in this report would benefit Plant Operations and its stakeholders, and if so, track and report on those metrics.

Create new workflow diagrams, with cycle times, for each type of product identified in Title 44.

Use Plant Operations Manufacturing System (POMS) to replace the manual tracking of information, track complaints and issues, and generate metrics reports.

Design and implement risk management and general support system policies, procedures, and processes that address National Institute of Standards and Technology Special Publication 800-53, Rev. 5.1, Rel. 5.1.1 control requirements.

Design and implement Supply Chain Risk Management policies, procedures, and processes that address National Institute of Standards and Technology Special Publication 800-53, Rev. 5.1, Rel. 5.1.1 control requirements.

Develop and implement agency-wide Configuration Management policies, procedures, and processes, that address applicable National Institute of Standards and Technology Special Publication 800-53, Rev. 5.1, Rel. 5.1.1, control requirements.

Develop and implement agency-wide identity access management policies, procedures, and processes that address applicable National Institute of Standards and Technology Special Publication 800-53, Rev 5, Rel. 5.1.1, controls requirements.

Develop and implement agency-wide data protection and privacy policies, procedures, and processes that address applicable National Institute of Standards and Technology Special Publication 800-53, Rev. 5, Rel. 5.1.1 control requirements.

Develop and implement agency-wide Security Training policies, procedures, and processes that address applicable National Institute of Standards and Technology Special Publication 800-53, Rev. 5.1, Rel. 5.1.1, control requirements.

Finalize and implement its Information Security Continuous Monitoring plan and update the plan and any additional procedures and processes to address applicable National Institute of Standards and Technology Special Publication 800-53, Rev. 5, Rel. 5.1.1, control requirements.

Develop and implement agency-wide incident response policies, procedures, and processes that address applicable National Institute of Standards and Technology Special Publication 800-53, Rev. 5, Rel 5.1.1, control requirements.

Develop and implement agency-wide contingency planning policies, procedures, and processes that address applicable National Institute of Standards and Technology Special Publication 800-53, Rev. 5, Rel 5.1.1, control requirements.

Consider requesting a class deviation to Federal Acquisition Regulation 52.203-13, Contractor Code of Business Ethics and Conduct to expand contractors’ business ethics awareness and compliance programs and internal control systems to include sexual harassment and sexual assault prevention and reporting, as well as sexual harassment investigations.

For the upcoming contract award for the management of the U.S. Antarctic Program, require as a contract deliverable, and maintain, contractor policies related to sexual harassment prevention, reporting, and investigations.

Remediate the vulnerabilities identified through the penetration testing using NSF’s vulnerability management procedure.

Reconcile departure reports received from Human Capital to the asset managementinventory system, on a regular basis (e.g., monthly, quarterly, etc.) to ensure updates arebeing made in a timely manner and are accurate to reflect separated or transferredemployees and contractors.

Perform a reconciliation of all NARA hardware asset inventories to ensure all data such asassignments and status are accurately and completely stated, investigating any unusual orpotentially duplicate entries, and making revisions as needed.

Ensure IT policies, procedures, methodologies, and supplements are reviewed andapproved in accordance with NARA Directive 111.