Open Recommendations

Treasury's Assistant Secretary for Management, working as needed with Treasury's Senior Accountable Official, the Senior Procurement Executive, reporting entities, the Program Management Office, and the Office of Management and Budget should develop and implement a method and procedures to submit Treasury Forfeiture Fund financial assistance award data to the Financial Assistance Broker Submission in accordance with the reporting submission specifications established by the DATA Act Information Model Schema.

We recommend that the Centers for Medicare & Medicaid Servicesreview the 37,124 outpatient claims totaling $1,162,562 in potential overpayments to determine whether the outpatient facilities met the requirement to bill for CCM services and o recoup any overpayments from outpatient facilities and o instruct the outpatient facilities to refund corresponding overcharges to beneficiaries

We recommend the Bureau of Actuary and Research ensure financial assistance awards containing personally identifiable information are reported in accordance with Office of Management and Budget Memorandum M-17-04.

We recommend the Bureau of Actuary and Research ensure DATA Act file assistance award preparers obtain training over the reporting of financial assistance awards containing personally identifiable information. For example, financial assistance award should be reported at the most granular level practicable while protecting personally identifiable information. The Railroad Retirement Board and Bureau of Actuary and Research should consider the different available Record Types as described in Appendix V of the report.

We recommend the Bureau of Fiscal Operations develop a plan to obtain an automated interface between the Railroad Retirement Board’s benefit paying systems and the Railroad Retirement Board’s financial system that would ensure the Railroad Retirement Board is in compliance with Office of Management and Budget Management Performance Memorandum 2016-03 and Office of Management and Budget Memorandum M-17-04.

Update DOT Order 4410.4 to include: a. Defining roles and responsibilities of DOT offices and personnel with respect to management of WCF laptop computers. b. Requiring hand receipts or a similar form whenever an accountable property asset (e.g., laptop) is assigned or unassigned to/from a user. c. Requiring record retention of records from hand receipts or a similar control with the appropriate property official. d. Establishing a timeframe for submitting Reports of Survey to OFIAM.

Establish a Board of Survey to review instances of lost or damaged WCF equipment as required by DOT Order 4410.4.

Develop and implement procedures for conducting the annual property inventory to include obtaining missing hand receipts or similar control and timely resolution of discrepancies for WCF laptops. Implementation of this recommendation could result in $2.9 million in funds put to better use.

If all of the Medicare contractors had received the postpayment edit's automatic notifications of improperly billed claims and had properly taken action since CY2013, Medicare could have saved $70,011,503

Work with the Federal Reserve System to ensure that the data loss protection replacement solutiona. functions consistently across the Board's technology platforms. b. supports rulesets that limit the exfiltration weaknesses we identified, to the extent practicable.

Develop and implement a Boardwide process to incorporate the review of data loss protection logs into employee and contractor offboarding processes to identify any potential unauthorized data exfiltrations or access.

We recommend that the Deputy Secretary and Chief Operating Officer require OCIO and FSA to incorporate additional measures to, at a minimum, achieve Level 3 Consistently Implemented status of the Identity and Access Management program.

We recommend that the Deputy Secretary and Chief Operating Officer require that OCIO and FSA incorporate additional measures to, at a minimum, achieve Level 3 Consistently Implemented status of the Risk Management program.

We recommend that the Deputy Secretary and Chief Operating Officer require that OCIO and FSA ensure that POA&M remediation is performed within the required timeframe.

We recommend that the Deputy Secretary and Chief Operating Officer require that OCIO and FSA ensure that all POA&Ms are assigned with the required appropriate remediation official.

We recommend that the Deputy Secretary and Chief Operating Officer require that OCIO and FSA incorporate additional measures to, at a minimum, achieve Level 3 Consistently Implemented status of the Configuration Management program.

We recommend that the Deputy Secretary and Chief Operating Officer require that OCIO and FSA migrate to Transport Layer Security 1.2 or higher as the only connection for all Department connections.

We recommend that the Deputy Secretary and Chief Operating Officer require that OCIO and FSA review solutions to ensure that the default username and password has been changed.

We recommend that the Deputy Secretary require OCIO to ensure that 51 websites are routed through a trusted internet connection or managed trusted internet protocol service.

We recommend that the Deputy Secretary require OCIO to ensure that all existing websites and services are accessible through a secure connection as required by OMB M-15-13

We recommend that the Chief Operating Officer require FSA to discontinue the use of unsupported operating systems, databases, and applications.

We recommend that the Chief Operating Officer require FSA to ensure that all websites and portals hosting personally identifiable information are configured not to display clear text.

We recommend that the Chief Operating Officer require FSA eliminate the use of Social Security numbers as an authentication element when logging into FSA websites by requiring the user to create a unique identifier for account authentication. (Repeat Recommendation FY 2018 & FY 2019).

We recommend that the Chief Operating Officer require FSA to immediately correct or mitigate the vulnerabilities identified during the security assessment

We recommend that the Chief Operating Officer require FSA to create corrective action plans to remedy database vulnerabilities for all database vulnerabilities identified.