Open Recommendations

We recommend the CISA Director strengthen CISA’s Tier 1 High Value Asset Assessment Process to include the major security threats that it identifies in its alerts and notifications to Federal agencies as part of the assessment.

To ensure the required anti-gag provision is included in all nondisclosure forms, agreements, and related documents and to rectify the fact that the anti-gag provision has not consistently been included in NDAs, the OIG recommends the Acting Secretary direct OASAM, in coordination with SOL, to send an updated memorandum to all DOL Agency Heads reminding them of the requirement to include the anti-gag provision in all nondisclosure forms, agreements, and related documents.

To ensure the required anti-gag provision is included in all nondisclosure forms, agreements, and related documents and to rectify the fact that the anti-gag provision has not consistently been included in NDAs, the OIG recommends the Acting Secretary Direct OASAM, in coordination with SOL, to send an email to all DOL employees providing the required anti-gag language and informing all DOL employees that such language should be read as incorporated into any nondisclosure agreement (an agreement requiring an employee not to disclose certain governmental information) they may have signed since November 27, 2012, that did not include the required language.

To ensure the required anti-gag provision is included in all nondisclosure forms, agreements, and related documents and to rectify the fact that the anti-gag provision has not consistently been included in NDAs, the OIG recommends the Acting Secretary revise all existing nondisclosure agreement forms or templates to include the required anti-gag language.

We recommend the Director, Sequoyah Nuclear Plant Site Projects, ensure project managers include Supply Chain in the solicitation process.

We recommend the Director, Sequoyah Nuclear Plant Site Projects, ensure project managers include Supply Chain in the bid evaluation process.

We recommend the Director, Sequoyah Nuclear Plant Site Projects, ensure project managers request implementation estimates be developed as required by Nuclear Power Group Standard Programs and Processes 19.6.

Ensure that LAWV develops and implements written closeout procedures to ensure compliance with federal award requirements and DOJ Grants Financial Guide.

Ensure that the YWCA of Seattle establishes written policies and procedures to accurately track victims served with VOCA grant funding.

Ensure that the YWCA of Seattle implements controls to ensure its subaward transactions are accurately tracked, to include routinely reconciling any subsidiary ledgers utilized to the program's general ledger.

Remedy $18,804 in unapproved salary and fringe benefit costs charged to the subaward.

Remedy $24,810 in unallowable gift card purchases charged to the VOCA subaward.

Remedy $24,810 in unsupported gift card purchases for which the YWCA of Seattle could not produce adequate documentation.

Ensure that the YWCA of Seattle establishes controls to ensure expenditures charged to the subawards are allowable and adequately supported.

Work with the Washington COM to ensure its policies and procedures for collecting and reporting subrecipient performance data align with the OVC's guidance, to include communicating clear instructions to subrecipients on how to report VOCA grant-funded performance data into the Washington COM's victim tracking database.

We recommend that USAID's Office of Acquisition and Assistance Cost, Audit and Support Division/Contract Audit Management Branch verify that Kenya Red Cross Society corrects the one instance of material noncompliance detailed on pages 25 and 27 of the audit report.

Rec. 1: The DoD OIG recommended that the DoD Chief Information Officer, in coordination with the Defense Industrial Base Cybersecurity Assessment Center Director, develop and implement a quality assurance process that will ensure that all requirements in the Cybersecurity Maturity Model Certification Third?Party Assessment Organization (C3PAO) authorization process are successfully met before a candidate C3PAO is authorized to perform Cybersecurity Maturity Model Certification Level 2 assessments.

Rec. 2.a: The DoD OIG recommended that the Cybersecurity Maturity Model Certification (CMMC) Program Management Office Director direct the contracting officer to modify the contract with the Cyber Accreditation Body to require the Cyber Accreditation Body (Cyber AB) to:

Verify that the Cyber AB has signed Cybersecurity Maturity Model Certification Third?Party Assessment Organization (C3PAO) Agreements and Codes of Professional Conduct for every authorized C3PAO within 30 days of the date of this report or revoke the C3PAO's authorization to perform CMMC Level 2 assessments until the documents are received.

Rec. 2.c: The DoD OIG recommended that the Cybersecurity Maturity Model Certification (CMMC) Program Management Office Director direct the contracting officer to modify the contract with the Cyber Accreditation Body to require the Cyber Accreditation Body (Cyber AB) to:

Verify that the quality control leads (QCL) for every authorized Cybersecurity Maturity Model Certification Third?Party Assessment Organization (C3PAO) meet the certification requirement within 30 days of the date of this report, and, for any of the C3PAO's QCLs who are not certified, revoke the authorization for those C3PAOs to perform CMMC Level 2 assessments until the C3PAOs provide support the QCLs…

Rec. 2.d: The DoD OIG recommended that the Cybersecurity Maturity Model Certification (CMMC) Program Management Office Director direct the contracting officer to modify the contract with the Cyber Accreditation Body to require the Cyber Accreditation Body (Cyber AB) to:

Verify the employment status of the on?staff CMMC certified assessors and certified quality control leads (QCL) by requesting and reviewing employment records to confirm that CMMC certified assessors and certified QCLs are part of the candidate Cybersecurity Maturity Model Certification Third?Party Assessment Organization's staff and are assigned those specific roles and responsibilities.

Rec. 2.e: The DoD OIG recommended that the Cybersecurity Maturity Model Certification (CMMC) Program Management Office Director direct the contracting officer to modify the contract with the Cyber Accreditation Body to require the Cyber Accreditation Body (Cyber AB) to:

Verify the employment status of the CMMC certified assessors and certified quality control leads of all previously authorized Cybersecurity Maturity Model Certification Third?Party Assessment Organizations (C3PAOs) using the methodology defined in Recommendation 2 .d within 30 days of the date of this report and revoke the C3PAO's authorization to perform CMMC Level 2 assessments if the employment status cannot be verified.

Rec. 3.a: The DoD OIG recommended that the Cybersecurity Maturity Model Certification (CMMC) Program Management Office Director:

Develop and implement a formal reauthorization process for the Cybersecurity Maturity Model Certification Third?Party Assessment Organizations (C3PAO) that includes a review and verification for all requirements in the C3PAO authorization process.

Rec. 5.b: The DoD OIG recommended that the Cybersecurity Maturity Model Certification (CMMC) Program Management Office Director:

Develop and implement a process to ensure Cybersecurity Maturity Model Certification Third?Party Assessment Organizations (C3PAO) immediately notify both the CMMC Program Management Office and Cyber Accreditation Body of any changes associated with any of the requirements in the C3PAO authorization process.

Rec. 3.c: The DoD OIG recommended that the Cybersecurity Maturity Model Certification (CMMC) Program Management Office Director:

Revise the CMMC assessment guides to further define the requirement for disabling inactive accounts to include group accounts.

The District Director, in conjunction with the Deputy District Director, develops a contingency coverage plan to ensure oversight during periods of vet center director vacancies.