Open Recommendations

Ensure that data classification and sensitivity labels are incorporated into the CFPB’s data loss prevention program.

Strengthen flaw remediation processes by developing and implementing a process to clearly map identified vulnerabilities to system IP addresses, host names, and remediation owners within the CFPB’s configuration management database.

Ensure that adequate resources are allocated to reinvestigate CFPB systems users as required.

Develop and maintain a ransomware strategy and specific procedures that provide a formal, focused, and coordinated approach to responding to ransomware attacks.

Ensure that testing of mission-essential functions identified in the CFPB’s continuity of operations plan is periodically performed.

Renew the authorizations to use for the CFPB’s governance, risk, and compliance tool.

Implement a process that ensures the cyber risk information in the CFPB’s governance, risk, and compliance tool is accurate and maintained.

Reiterate policy requiring project managers to transfer expense purchase card supporting documents to credit card approving officials, and for credit card approving officials to maintain the supporting documents for the duration of the retention period.

Create a centralized, electronic repository for storing facility repair supporting documentation.

Establish guidelines and best practices to require project managers to identify and combine related service ticket requests and solicit contracts for projects that exceed expense purchase card authority threshold.

Establish guidelines and controls to monitor the use of batch payments.

Ensure the responsible office updates 3099-001 to include the required anti-gag provision within the policy.

Agricultural Marketing Service needs to update its NDA form(s) to include the required anti-gag provision.

Agricultural Research Service needs to update its NDA policy to include the required anti-gag provision.

Economic Research Service needs to update its NDA policy to include the required anti-gag provision.

Foreign Agricultural Service needs to review and update active NDAs for current Foreign Agricultural Service federal employees signed after November 27, 2012, to ensure they include the required anti-gag provision.

Food and Nutrition Service needs to update its NDA form(s) to include the required anti-gag provision. Food and Nutrition Service also needs to review and update active NDAs for current Food and Nutrition Service Federal employees signed after November 27, 2012, to ensure they include the required anti-gag provision.

Forest Service needs to update its NDA policies and form(s) to include the required anti-gag provision. Forest Service also needs to review and update active NDAs for current Forest Service Federal employees signed after November 27, 2012, to ensure they include the required anti-gag provision.

National Agricultural Statistics Service needs to update its NDA policy and form(s) to include the required anti-gag provision. National Agricultural Statistics Service also needs to review and update active NDAs for current National Agricultural Statistics Service Federal employees signed after November 27, 2012, to ensure they include the required anti-gag provision.

Office of the Chief Financial Officer needs to update its NDA form(s) to include the required anti-gag provision.

PBGC should implement an enterprise-wide approach to prevent counterfeit components from entering its supply chain and establish performance measures to gauge the effectiveness of its anti-counterfeit policies and procedures. Additionally, PBGC should provide a comprehensive anti-counterfeit training for its personnel.

PBGC should manage Active Directory certificate template settings effectively by hardening and auditing existing templates in the environment. Privileges should also be assessed for all templates to prevent unauthorized changes to the configuration settings.

PBGC should establish robust network segmentation and configure firewalls with default rules to ensure the guest wireless network is effectively isolated from internal resources.

PBGC should establish a comprehensive system for monitoring, analyzing, and reporting on quantitative performance measures to evaluate the effectiveness of its Data Breach Response policies and procedures.

PBGC should implement an effective specialized security training program that includes steps to identify and prevent phone-based social engineering for all employees.