Open Recommendations

CMS should clarify and expand its initiative on payment data.

Use the fully defined ISA to: a. Assess enterprise, business process, and information system level risks;b. Formally define enterprise, business process, and information system level risk tolerance and appetite levels necessary for prioritizing and guiding risk management decisions;c. Conduct an organization wide security and privacy risk assessment; and,d. Conduct a supply chain risk assessment.

Using the results of recommendations one (1) and two (2)above:a. Collaborate with the DNFSB’s Cybersecurity Team to establish performance metrics in service level agreements to measure, report on, and monitor the risks related to contractor systems and services being monitored by IT Operations;b. Utilize guidance from the National Institute of Standards in Technology (NIST) Special Publication (SP) 800-55 (Rev. 1) – Performance Measurement Guide for Information Security to establish performance metrics to more effectively manage and optimize all domains of the DNFSB information security program;c. Implement a centralized view of risk across the organization; and,d. Implement formal procedures for prioritizing…

Implement automated mechanisms (e.g. machine-based, or user-based enforcement) to support the management of privileged accounts, including for the automatic removal/disabling of temporary, emergency, and inactive accounts, as appropriate.

Develop and implement a plan to address the challenges presented by the Unit’s organizational structure.

Establish minimum criteria for referrals of patient abuse and neglect to be sent to the MFCU.

Establish a process to coordinate on cases and improve collaboration with Federal partners.

Take steps to ensure that Unit staff report all convictions and adverse actions to Federal partners within the appropriate timeframes.

Take steps to ensure that newly hired investigators complete new employee trainings.

Take steps to ensure that supervisory reviews of case files are conducted and documented in accordance with Unit policy.

We recommend EEOC ensure that emailed policy memos are promptly updated in the appropriate EEOC Directives Transmittal Order.

We recommend EEOC management update its policies and procedures to include all required safeguards and internal controls to be compliant with the Government Charge Card Abuse Prevention Act of 2012. In addition, EEOC should create a monitoring control to review the policy when changes or updates are made to federal law or Office of Management and Budget or General Services Administration guidance.

Update user system access control procedures to include the requirement for individuals to complete a non-disclosure agreement as part of the clearance waiver process prior to the individual being granted access to the NRC systems and information. Also, incorporate the requirement for contractors and employees to complete non-disclosure agreements as part of the agency’s on-boarding procedures prior to these individuals being granted access to the NRC’s systems and information.

Continue efforts to identify individuals having additional responsibilities for PII or activities involving PII and develop role-based privacy training for them to be completed annually.

Implement the technical capability to restrict NRC network access for employees who do not complete annual security awareness training and, if applicable, their assigned role-based security training.

Integrate metrics for measuring the effectiveness of information system contingency plans with information on the effectiveness of related plans, such as organization and business process continuity, disaster recovery, incident management, insider threat implementation, and occupant emergency plans, as appropriate, to deliver persistent situational awareness across the organization.

Implement automated mechanisms to test system contingency plans, then update and implement procedures to coordinate contingency plan testing with ICT supply chain providers and implement an automated mechanism to test system contingency plans.

Standardize documentation required in alien files that Customs and Border Protection needs to include for transfer of aliens from Customs and Border Protection to Immigration and Customs Enforcement, Enforcement and Removal Operations custody that will apply to all field offices.

We recommend that North Mississippi Medical Center refund to the Medicare program the estimated $67,038 in overpayments for claims that it incorrectly billed.

We recommend that North Mississippi based upon the results of this audit, exercise reasonable diligence to identify, report, and return any overpayments in accordance with the 60-day rule,18 and identify any of those returned overpayments as having been made in accordance with this recommendation

We recommend that North Mississippi Medical Center educate its staff on properly billing for polysomnography services.

We recommend that North Mississippi Medical Center revise policies and procedures to ensure that claims are coded correctly and that sleep technicians have the required credentials before billing claims for polysomnography services to ensure full compliance with Medicare requirements.

We recommend that the FWS work with the Department to resolve the questioned costs related to ineligible other direct costs totaling $8,503.

We recommend that the FWS require the Department to implement policies and procedures that properly allocate ASPA charges.

We recommend that the FWS work with the Department to resolve the questioned costs related to unsupported leave payouts totaling $3,167.