Open Recommendations

Some or all of the recommendation is not publicly available due to concerns with information protected under the Freedom of Information Act.

We recommend that USAID/Ukraine request that the State Service of Special Communications and Information Protection
of Ukraine assess which USAID-delivered Starlink terminals are at high risk of misuse or
theft, and coordinate with SpaceX to suspend service for those terminals.

The Chief, Taxpayer Services, should perform a study to determine whether a new kiosk program that uses updated technology, or deploys laptops to TACs, would provide effective and efficient self-service options to taxpayers.

We recommend that the Office of Acquisition and Assistance, Cost, Audit and Support Division, Contract Audit Management Branch verify that Creative Associates corrects the one material weaknesses in
internal control detailed on pages 15, 16 and 17of the audit report.

Evaluate which staff should have access to and should update the Consult Toolbox when records are requested or received and update the Consult Business Rules and Uses of the Consult Package Standard Operating Procedure to reflect necessary changes.

Include controls within the Consult Toolbox to prevent errors and improve data quality, including controls on administrative closure of low-risk consults and documenting the records-retrieval method.

Update consult closure policies and procedures to clarify requirements for administrative closure and determine whether metrics for the percentage of records received should be a requirement and included in policy.

Determine whether Veterans Health Administration facilities community care offices should continue to be required to use the administrative closure report for oversight of administratively closed consults, and if not, determine what reports should be required.

Evaluate the workload of community care staff to determine the most efficient way to structure and execute their duties.

Determine if there are mechanisms to identify standardization opportunities and increase efficiency for improving records return processes.

Ensure community care staff follow procedures to reduce duplicate records received.

Evaluate ways to increase use of provider electronic records portals to reduce reliance on electronic fax when retrieving medical records.

Consider increased implementation of technologies to improve records processing once received to reduce the manual renaming of electronic files and uploading of records into the electronic health record.

Ensure records from the Joint Longitudinal Viewer are uploaded into the electronic health record.

The Medical Center Director ensures staff store clean and soiled utility items separately, maintain cleanliness, and dispose of expired items.

Finalize and implement policies and procedures for creating and maintaining current and target cybersecurity profiles in alignment with National Institute of Standards and Technology Cybersecurity Framework Guidance.

Finalize and implement a comprehensive Risk Management Strategy that defines roles and responsibilities, enterprise risk priorities, objectives, and communication protocols, including third-party risk considerations.

Continue to develop and implement an Enterprise Risk Management program based on National Institute of Standards and Technology and Enterprise Risk Management Playbook (Office of Management and Budget Circular A- 123, Section II requirement) guidance.

Develop and implement policies and procedures for developing and maintaining a comprehensive and accurate inventory of data and corresponding metadata for the Consumer Product Safety Commission data types.

Fully implement, assess, and maintain secure configuration settings in accordance with defined configuration management policy and security configuration baseline procedures.

Update all relevant Information Security Continuous Monitoring policies, procedures, and supporting documentation based on latest National Institute of Standard and Technology guidance.

This recommendation contains sensitive information that should not be made public. Therefore, we are not including the wording for this recommendation.

This recommendation contains sensitive information that should not be made public. Therefore, we are not including the wording for this recommendation.

This recommendation contains sensitive information that should not be made public. Therefore, we are not including the wording for this recommendation.

This recommendation contains sensitive information that should not be made public. Therefore, we are not including the wording for this recommendation.