Open Recommendations

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

[REDACTED]

Update the Vulnerability Disclosure Policy (VDP) to include all internet-accessible systems. Once OIT has updated the VDP, the SEC should immediately report to the Cybersecurity and Infrastructure Security Agency (CISA) regarding:a. Any valid or credible reports of newly discovered or not publicly known vulnerabilities (including misconfigurations) on SEC systems that use commercial software or services that affect or are likely to affect other parties in government or industry.b. Vulnerability disclosure, coordination, or remediation activities that the SEC believes CISA can assist with or should be aware of, particularly as they relate to outside organizations.c. Any other situation in which the…

Develop and implement vulnerability disclosure-handling procedures that describe the SEC’s process for implementing its VDP, in accordance with Department of Homeland Security Binding Operational Directive 20-01.

[REDACTED]

Update the SEC’s system security plans with the latest baseline controls for all FISMA-reportable systems to ensure the SEC is assessing and monitoring the controls in accordance with the level of risk associated with each information security system.

[REDACTED]

We recommend that the Ohio Department of Health work with CMS to develop standardized life safety training for nursing home staff.

We recommend that the Ohio Department of Health work with CMS to develop a risk-based approach to identify nursing homes where surveys should be conducted more frequently than once every 15 months, such as those with a history of multiple high-risk deficiencies or frequent management turnover.

We recommend that the Ohio Department of Health develop a plan with CMS to address the foundational issues preventing more frequent surveys at nursing homes with a history of multiple high-risk deficiencies.

We recommend that the Ohio Department of Health follow up with the 18 nursing homes in this audit that demonstrated life safety, emergency preparedness, and infection control deficiencies to verify that corrective actions have been taken regarding the deficiencies identified in this report.

Conduct a formal assessment of the Regional Service Provider examination program to establish program-level goals, metrics, and indicators and determine whether additional resources and controls are needed to improve the effectiveness of the program, as identified in this memorandum.

Develop and implement a course approvals plan to address the existing backlog and to avoid future approval delays.

Establish and implement quality control measures for course approvals to include peer review or other mechanisms to ensure course approvals meet requirements.

Develop and implement goals and requirements for the course oversight auditing program, including the number and type of audits to be conducted by each auditor in a given time period.

Establish and implement controls to ensure audit results are used to improve operations and apply enforcement actions to MTPs, such as suspension or withdrawal of course approvals, after serious nonconformities are identified.

Develop and implement policy and procedures for routinely conducting in person-audits of mariner training sites to ensure sites are operating in accordance with the site approval.

Develop and implement a policy for routinely conducting audits of thirdparty course approvers to ensure they have processes for reviewing, approving, and monitoring training that are equal to the Coast Guard’s course approval and oversight processes.

Develop and implement a plan to modernize NMC’s examination processes, with a milestone timeline endorsed by the Coast Guard offices whose support and assistance is needed.

Office of the Chief Information Officer implement adequate data logging in compliance with applicable NIST guidance.