Open Recommendations

We recommend that OPM's Healthcare and Insurance office update its IPR calculation, including a plan to do so with target dates, and documentation of any analysis conducted and conclusions reached in developing the updated methodology. This methodology, at a minimum, should include estimations for the population of FEHBP carriers that have not been audited each year and statistically valid sampling to provide a more accurate representation of improper payments for reporting.

We recommend that all payments made to deceased annuitants be classified as improper in the year in which they are identified.

We recommend that Retirement Services provide support to show the final results of the 9,169 cases in which reclamation was initiated and the 43 cases referred to the Survivor Processing Section from its review of returned 2016 tax year Form 1099-Rs.

We recommend that Retirement Services maintain support for future reviews of returned Form 1099-Rs, including an accounting of overpayments made to annuitants dropped from the annuity rolls, identified as deceased, or referred for further research and/or drop action, and include the total of such payments in the annual calculation of improper payments.

We recommend that Retirement Services conduct an analysis to determine if other types of data mining reviews can be performed, using the annuity roll data, to identify improper payments.

We recommend that Retirement Services develop a plan of action to utilize the data mining reviews identified in response to Recommendation 10 and report the results of those reviews in its improper payment calculation, including documenting any issues identified.

We recommend that the Mississippi Department of Human Services develop policies and procedures to ensure that attendance documentation is maintained and provided to the State agency when a provider closes.

We recommend that the Mississippi Department of Human Services strengthen its monitoring program to ensure that providers maintain required attendance documentation to support the childcare payment amounts that they claim for reimbursement by the State agency.

We recommend that the Mississippi Department of Human Services refund to the Federal Government the estimated $22,284,900 Federal CCDF share of the Child Care Payment Program claims paid during FYs 2016 and 2017.

We recommend that the HHS OCIO work with the OPDIVs to ensure that they: Obtain waiver or acceptances of risk approved by senior OPDIV management for those systems continuing to operate in the production environment without authorization.

We recommend that the HHS OCIO work with the OPDIVs to ensure that they: Plan and execute resource staffing such that SCAs are kept up to date as needed to support the ATO process.

We recommend that the HHS OCIO work with the OPDIVs to: - Develop and document an enterprise-wide configuration management plan that allows for OPDIV-level and system-level configuration management plans to be created and implemented in alignment with the higher-level enterprise plans, to ensure that changes implemented at the system level are consistent with and made only after approval by the OPDIV, and that an HHS level plan defines the role of the OPDIVs for the creation, implementation and execution of OPDIV-specific configuration management plans.

We recommend that the HHS OCIO work with the OPDIVs to ensure that they: Plan and execute resource staffing such that ATOs are kept up to date without a lapse of authorization.

We recommend that the HHS OCIO work with the OPDIVs to: - Ensure that the OPDIVs cybersecurity management create and implement a patch management strategy to ensure that patches are installed timely as required by HHS and Federal requirements.

We recommend that the HHS OCIO work with the OPDIV to: - Define a threat profiling framework that structures and standardizes threat profiling at the OPDIV.

We recommend that the HHS OCIO work with the OPDIVs to ensure that all ODPIVs: Conduct background checks on all personnel with information system access before they are granted access. The OPDIV should also conduct reinvestigations on these individuals in accordance with current personnel security policy.

We recommend that the HHS OCIO: Periodically sample systems to ensure that PIAs are created and maintained for all systems that require one.

We recommend that the HHS OCIO work with the OPDIVs to ensure that all ODPIVs: Ensure implementation of strong authentication mechanisms for privileged and non-privileged users to all OPDIV systems using multifactor PIV credentials, NIST 800-63 Identity Assurance Level 3/Authenticator Assurance Level 3/Federated Assurance Level 3 credential or other strong authentication for non-privileged and privileged users.

We recommend that the HHS OCIO: Work with the OPDIVs to monitor and validate each OPDIV’s implementation progress, which should include periodically sampling HHS systems to ensure the effectiveness of contingency plans, including adequate testing based on system categorization.

We recommend that the HHS OCIO work with the OPDIVs to: Identify roles of stakeholders to ensure proper identification of responsibilities in a shared responsibility environment.

We recommend that the HHS OCIO work with the OPDIVs to: Communicate the enterprise-wide configuration management plan to all HHS system owners and stakeholders.

We recommend that the HHS OCIO work with the ODPIVs ensure that: Role-based training is obtained for all users with significant security responsibilities before granting access to the system and annually thereafter.

We recommend that the HHS OCIO: Require each OPDIV to develop a POA&M to implement activities required to achieve an effective maturity level for contingency planning, pending HHS risk assessment.

We recommend that the HHS OCIO work with the OPDIV to: Implement threat profiling techniques within the defined framework that helps management understand where the OPDIV’s high-value assets are located, who could be interested in taking control of them, and what attack vectors and under which scenarios they would likely be used to exploit vulnerabilities to succeed in their pursuits.

The Information Security and Privacy Policy (IS2P) is HHS’ primary policy document governing cybersecurity which is pending a rewrite to address the upcoming requirements in NIST 800-53 revision 5. When this update occurs to the IS2P, HHS should: - Specify required cybersecurity control maturity levels in addition to identifying the selection of NIST controls. - Describe HHS’ Cybersecurity Shared Responsibility Model, including the key roles under centralized, federated and hybrid strategies for control implementation. Include responsibilities of the OCIO, the OPDIVs, and third-party stakeholders (including contractors). - Communicate that a Managed and Measurable or the optimal maturity level, based on…