Open Recommendations

We recommend that OPM establish PBM transparency standards for all new, renewed, or amended contracts that are specific to community-rated HMOs.

We recommend that OPM develop formal policies to ensure that site visits are conducted every three years for FEHBP carriers in accordance with its control to meet OMB Circular A-123 requirements. If the time and costs to perform the site visits outweigh the benefits, OPM should modify its controls and report new procedures to mitigate risks for the FEHBP payment process.

We recommend that OPM eliminate the self-certification process for FEDVIP and implement an enrollment verification process that requires documentation to prove family member relationships at the time of enrollment. In the meantime, BENEFEDS, as the sole enrollment portal for FEDVIP, should have the authority to request eligibility documentation that includes marriage and birth certificates.

We recommend that OPM develop standard performance metrics with penalties to be included in all new or renewed contracts with FEDVIP carriers.

We recommend that RS implement internal controls to ensure that all staff responsible for processing disability cases, including but not limited to Medical Specialists, Paralegals, and Legal Administrative Specialists, take the required training to perform their job functions and that supporting documentation for completed training is maintained.

We recommend that RS establish a plan to complete the Medical Call-ups that are past the annual review period and stop any payments for which annuitants are no longer eligible.

We recommend that RS ensure that Medical Call-ups are conducted timely and that supporting documentation is maintained.

We recommend that RS investigate the cases due for Medical Call-ups in FY 2019 to determine if improper payments were made and immediately initiate any funds recovery, if applicable.

We recommend that Retirement Services continue to work with OPM's Office of the Chief Information Officer to establish a modernized Information Technology system that has capabilities to ensure the proper tracking of cases throughout the disability process.

We recommend that the Chief Information Officer require the Department to establish oversight controls to ensure that POA&Ms are assigned with the required criticality impact levels and remediation is conducted within the required timeframes.

We recommend that the Chief Information Officer require the Department to develop and implement a Department-wide ICT supply chain risk management strategy to include the supply chain risk tolerance, acceptable supply chain risk mitigation strategies, and foundational practices.

We recommend that the Chief Information Officer require the Department to develop a process to evaluate and routinely monitor supply chain risks associated with the development, acquisition, maintenance, and disposal of systems and products.

We recommend that the Chief Information Officer require the Department to establish and automate procedures to ensure all Department-wide IT inventories are accurate, complete, and periodically tested for accuracy. Include steps to establish that all IT contracts are reviewed and verified for applicable privacy, security, and access provisions.

We recommend that the Chief Information Officer require the Department to verify and periodically reconcile the accuracy of cloud service provider inventories in or against CSAM.

We recommend that the Chief Information Officer require the Department to incorporate additional measures to, at a minimum, achieve Level 4 Managed and Measurable status of the Configuration Management program.

We recommend that the Chief Information Officer require the Department to develop enhanced oversight controls to ensure all Department connections are migrated to TLS 1.2 or higher cryptographic protocol.

We recommend that the Chief Information Officer require the Department to enhance implementation controls to prioritize and apply the most up-to-date and timely software patches and security updates to the identified systems and information technology solutions.

We recommend that the Chief Information Officer require the Department to establish stronger monitoring controls to enforce the management of unsupported system components and track and discontinue the use of unsupported operating systems, databases, and applications.

We recommend that the Chief Information Officer require the Department to develop verification procedures and enforce the inactivity settings to ensure virtual private network sessions time out after 30 minutes of inactivity.

We recommend that the Chief Information Officer require the Department to correct or mitigate the vulnerabilities identified during the securityassessment, in accordance with the severity level of each vulnerability identified.

We recommend that the Chief Information Officer require the Department to establish oversight controls to ensure the Department's password, terminations, and deactivation policies are enforced accordingly.

We recommend that the Chief Information Officer require the Department to enforce the mandate for all websites to display warning banners when users login to Departmental resources, and establish additional procedures and monitoring processes to ensure that banners includethe approved warning language.

We recommend that the Chief Information Officer require the Department to establish and enforce a corrective action plan to monitor and remediate identified database vulnerabilities.

We recommend that the Chief Information Officer require the Senior Agency Official for Privacy to establish additional processes, procedures, and monitoring controls to validate, track and enforce the completion of PIAs, PTAs, and SORNs.