Open Recommendations

Implement a peer review process to carry out the necessary quality control reviews of the TSAL model.Pending since FY 2017

Strengthen controls to ensure the TSAL modelling is performed by trained personnel to:

Conduct detailed analysis and validation of data sources;

Review and ensure the reasonableness of assumptions used and document the rationale behind these assumptions;

Consider changes in conditions or programs that require further research and analysis. Update the assumptions when necessary;

Compare estimates with subsequent results to assess the reliability of the assumptions and data used to develop estimates.

Develop a multi‐year strategy to better strategically prioritize and allocate resources to address the new and continuing weaknesses identified and work towards automation, continuous monitoring and consistent application of controls.

Enforce the agency‐wide information security program across the enterprise and improve performance monitoring to ensure controls are operating as intended at all facilities.Pending since FY 2017

Strengthen and refine the process for communicating CNCS facility specific control deficiencies to CNCS facility personnel, and coordinate remediation of the control deficiencies.Pending since FY 2017

Strengthen and refine the process for holding system owners and information system security officers accountable for remediation of control deficiencies and ensuring that the appropriate security posture is maintained for CNCS information systems.Pending since FY 2017

Strengthen and refine the process for holding contractors accountable for remediation of control deficiencies in CNCS information systems.Pending since FY 2017

Implement all detailed recommendations in the FY 2018 FISMA Evaluation report.Pending since FY 2017

timely review and approval of SVs; and

Complete development of the probabilistic risk assessment tool and screening tool for biosolids land application scenarios.

Develop and implement a plan to obtain the additional data needed to complete risk assessments and finalize safety determinations on the 352 identified pollutants in biosolids and promulgate regulations as needed.

Publish guidance on the methods for the biosolids pathogen alternatives 3 and 4.

Issue updated and consistent guidance on biosolids fecal coliform sampling practices

Grant Thornton recommends that OPM establish a means of documenting a list of users with significant information system responsibilities to ensure the listing is complete and accurate and the appropriate training is completed.

Grant Thornton recommends that OPM ensures policies and procedures governing the provisioning and de-provisioning of access to information systems are followed in a timely manner and documentation of completion of these processes is maintained.

Grant Thornton recommends that OPM perform a comprehensive periodic review of the appropriateness of personnel with access to systems.

Grant Thornton recommends that OPM document access rights to systems to include roles, role descriptions and privileges or activities associated with each role and role or activity assignments that may cause a segregation of duties conflict.

Grant Thornton recommends that OPM review audit logs on a pre-defined periodic basis for violations or suspicious activity and identify individuals responsible for follow up or elevation of issues to the appropriate team members for review. The review of audit logs should be documented for record retention purposes.

Grant Thornton recommends that OPM establish a means of documenting all users who have access to systems.

Grant Thornton recommends that OPM establish a methodology to systematically track all configuration items that are migrated to production and be able to produce a complete and accurate listing of all configuration items for both internal and external audit purposes, which will in turn support closer monitoring and management of the configuration management process.

Grant Thornton recommends that OPM enforce existing policy developed by OPM, vendors or federal agencies requiring mandatory security configuration settings and implement a process to periodically validate the settings are appropriate.