Open Recommendations

Develop and implement an Enterprise Risk Management (ERM) program based on National Institute of Standards and Technology and ERM Playbook (OMB Circular A-123, Section II requirement) guidance. This includes establishing a cross-departmental risk executive (function) lead by senior management to provide both a departmental and organization level view of risk to the top decision makers within the CPSC (2020 Recommendation).

Implement solutions to perform scenario analysis and model potential responses, including modeling the potential impact of a threat exploiting a vulnerability and the resulting impact to organizational systems and data (2022 Recommendation).

Develop supply chain risk management procedures to ensure that products, system components, systems, and services of external providers are consistent with the organization’s cybersecurity and supply chain risk management requirements (2021 Recommendation).

Develop, implement, and disseminate a set of configuration management procedures in accordance with the inherited configuration management policy which includes the process management follows to develop and tailor common secure configurations (hardening guides) and to approve deviations from those standard configurations (2020 Recommendation).

Integrate the management of secure configurations into the organizational configuration management process (2020 Recommendation).

Develop and implement policies and procedures in support of Binding Operational Directive 22-01, Reducing the Significant Risk of Known Exploitable Vulnerabilities (2020 Recommendation - Modified).

Log and actively monitor activities performed while using privileged access that permit potentially incompatible duties (2020 Recommendation).

Define and implement processes for provisioning, managing, and reviewing privileged accounts (2021 Recommendation).

Implement data encryption and sanitization of digital media policies and procedures (2020 Recommendation - Modified).

Perform an assessment of the knowledge, skills, and abilities of CPSC personnel with significant security responsibilities (2020 Recommendation).

Integrate the established strategy for identifying organizational risk tolerance into the Information System Configuration Management plan (2020 recommendation).

Update the System Security Plans to include the most up-to-date information and assess the relevant minor applications (2022 recommendation).

Develop, document, and distribute all required Contingency Planning documents (ex. organization-wide Continuity of Operation Plan and Business Impact Assessment, Disaster Recovery Plan, Business Continuity Plans, in accordance with appropriate federal and best practice guidance (Contingency Planning 2020 Recommendation).

Integrate documented contingency plans with the other relevant agency planning areas (2020 Recommendation).

Test the set of documented contingency plans (2020 Recommendation - Modified).

Develop and implement a plan to modify external emails to include information to assist the recipient of the level of risk posed by external email. For example, the Subject line of an email should be modified to identify the source of the email as external to the agency. In addition, the body of the email should contain warnings concerning the dangers of external email and attachments. Finally, warnings should include how frequently the sender has interacted with the recipient.

Implement a plan to increase the frequency of behaviortraining directed at the identification of unwanted spam emails with an emphasis on continual reminders of recognition techniques, appropriate actions, and confidence that self‐reporting poor behavioral actions will lead to a better outcome in the future.

Implement a process to improve the detection rate to reduce the occurrence of email spam that reaches the users’ inboxes.

Review all denials of compensation claims identified as burn pit claims completed from May 1, 2020, to May 1, 2021, for conditions claimed by eligible veterans to be due to burn pit exposure; correct any errors identified; and provide certification of completion of the review to the Office of Inspector General.

Review all denials of compensation claims not identified as burn pit claims completed from May 1, 2020, to May 1, 2021, for conditions of bronchial asthma, chronic bronchitis, allergic rhinitis, sleep apnea, and chronic obstructive pulmonary disease submitted by veterans who served where and when burn pits were used even if not specifically cited in the claim; correct any errors identified; and provide certification of completion of the review to the Office of Inspector General.

Issue guidance on when and how to conduct the kinetically derived maximum dose approach in cancer-risk assessments for pesticides.

Issue specific criteria requiring external peer review of Office of Pesticide Programs' risk assessments that use scientifically or technically novel approaches or that are likely to have precedent-setting influence on future risk assessments, in accordance with the Office of Management and Budget's Final Information Quality Bulletin for Peer Review.

We recommend that the Under Secretary of Commerce for Intellectual Property and Director of the United States Patent and Trademark Office direct the Chief Information Officer to establish an LCCE and IMS for current and plannned PPL investments.

Enhance the Fiscal Management Information System or develop an agency-wide data management process to provide FHWA personnel with access to change order information for performing their oversight, which includes identifying and monitoring change orders.

Evaluate and revise as necessary the Agency processes, including Compliance Assessment Program reviews, to include an oversight methodology that can generate accurate, statistically valid, and representative compliance results for change orders.