Open Recommendations

We recommend that the Millennium Challenge Corporation verify that the MCA-Senegal corrects the three instances of material noncompliance detailed on pages 47 to 50 of the audit report.

We recommend that the Maryland Department of Health remediate the seven control findings OIG identified.

We recommend that the Maryland Department of Health assess the effectiveness of all required NIST SP 800-53 controls according to the organization's defined frequency.

We recommend that the Maryland Department of Health assess at least annually and if necessary, adjust baseline configurations for its MMIS and E&E public servers.

We recommend that the Maryland Department of Health perform periodic phishing exercises and enhance employee and contractor cybersecurity awareness training based on the results of the phishing exercises, if needed.

Create a method to collect the identifying information of authorized individuals as part of the application for a CAF number. For authorized individuals who already have a CAF number assigned, create a method to collect identifying information during subsequent authorization requests.

We recommend that the Vermont Department of Health, Division of Substance Use Programs refund $282,643 to the Federal Government.

We recommend that the Vermont Department of Health, Division of Substance Use Programs require subrecipients to provide and retain supporting documentation for invoices submitted for reimbursement under Federal grants as recommended in Bulletin No. 5.

We recommend that the Vermont Department of Health, Division of Substance Use Programs conduct a periodic review of supporting documentation (i.e., invoices, payroll registers, and time and effort reports) for subrecipient expenditures submitted to DSU for reimbursement.

We recommend that the Vermont Department of Health, Division of Substance Use Programs provide training to State employees responsible for conducting pre-award risk assessments of potential subrecipients of Federal grant funds.

We recommend that the Vermont Department of Health, Division of Substance Use Programs conduct annual site visits as required within the terms and conditions of the grant award that include program and fiscal reviews.

We recommend that the Centers for Medicare & Medicaid Services remediate the seven security control findings OIG identified.

We recommend that the Centers for Medicare & Medicaid Services update security controls to align with the most current NIST SP 800-53 requirements.

We recommend that the Centers for Medicare & Medicaid Services enhance policies and procedures to periodically identify and assess whether security controls are in place and operating effectively in accordance with the most current NIST SP 800-53 controls and remediate weak controls timely.

Embassy Brussels should advise and brief U.S. citizens in Belgium in accordance with Department standards.

Embassy Brussels, in coordination with the Bureaus of Consular Affairs and Overseas Buildings Operations, should provide a wheelchair-accessible restroom option for consular customers.

Embassy Brussels, in coordination with the Bureau of Overseas Buildings Operations, should bring its fire protection program into compliance with Department standards.

The U.S. Mission to the North Atlantic Treaty Organization, in coordination with Embassy Brussels, should require that all residences are inspected and certified in the Post Occupational Safety and Health Officer Certification Application in accordance with Department standards.

Embassy Brussels should obtain authorization from the Bureau of Overseas Buildings Operations to use shipping containers for permanent storage or dismantle and remove them, in accordance with Department standards.

Embassy Brussels should bring its contracting officer's representative program into compliance with Department standards.

The U.S. Mission to the North Atlantic Treaty Organization, in coordination with Embassy Brussels, should submit its living quarters expenditure reports in accordance with Department standards.

Embassy Brussels, in coordination with the Bureaus of Budget and Planning, the Comptroller and Global Financial Services, European and Eurasian Affairs, and Global Talent Management, should implement a plan to fully fund the locally employed staff defined benefit pension plan to comply with Belgium's labor laws and address long-term funding concerns.

Embassy Brussels should cease paying for residential internet for vacant residences that do not have an alarm system connected to internet, in accordance with Department standards.

Embassy Brussels should categorize, assess, and authorize its locally developed applications in accordance with Department standards.

Embassy Brussels should replace the unauthorized wireless access points operating within its facilities with an approved wireless network.