Open Recommendations

We recommend that NYC DOHMH refund $15,671,958 to the Federal government.

We recommend that NYC DOHMH strengthen its oversight of subrecipients to prevent future unallowable payments by reviewing subrecipient invoices and supporting documentation to ensure costs claimed are allowable and allocable.

To address the issues identified, we recommend the Administrator direct the Associate Administrator for the Office of Disaster Recovery and Resilience to reevaluate eligibility for the 47 applicants we questioned and recover grant funds from the ineligible applicants.

To address the issues identified, we recommend the Administrator direct the Associate Administrator for the Office of Disaster Recovery and Resilience to implement additional controls to ensure that, during the monitoring, auditing, and compliance phases, awards are carefully screened to verify eligibility and to recover grant funds from ineligible entities.

Require that the new payroll system be able to execute retroactive pay's complex processing when assessing, reviewing, and selecting a new vendor.

Ensure the Information System Security Officers are reviewing system configurationcompliance scans monthly as required within NARA’s Configuration ComplianceManagement Standard Operating Procedure. (New Recommendation)

Implement improved processes to remediate security deficiencies on NARA’s networkinfrastructure, to include enhancing its patch and vulnerability management program toaddress security deficiencies identified during our assessments of NARA’s applicationsand network infrastructure. (Recommendation #13 from the FY 2022 FISMA audit, report#22-AUD-09)

Document and implement a process to track and remediate persistent configurationvulnerabilities or document acceptance of the associated risks. (Recommendation #15from the FY 2021 FISMA audit, report #22-AUD-04)

Ensure all information systems are migrated away from unsupported operating systemsto operating systems that are vendor-supported. (Recommendation #18 from the FY 2021FISMA audit, report #22-AUD-04)

Finalize and implement system configuration baseline management procedures, whichencompass at a minimum, the request, documentation, and approval of deviations frombaseline settings for all NARA systems. (Recommendation #22 from the FY 2021 FISMAaudit, report #22-AUD-04)

Enhance current procedures to ensure that new NARA users who do not complete theirinitial security awareness training, have their accounts automatically disabled inaccordance with timeframes promulgated within the Privacy and Awareness Handbook.(New Recommendation)

Continue and complete efforts to require PIV authentication for all privileged users, serversand applications, through NARA’s Privileged Access Management authentication projectand other efforts. (Recommendation #26 from the FY 2021 FISMA audit, report #22-AUD04)

Enforce mandatory PIV card authentication for all NARANet users, in accordance withOMB requirements. (Recommendation #27 from the FY 2021 FISMA audit, report #22-AUD-04)

Ensure NARANet user accounts are reviewed and disabled in accordance with NARA’sinformation technology policies and requirements. (Recommendation #29 from theFY 2021 FISMA audit, report #22-AUD-04)

Ensure that the SAOP complete PIAs for all systems which contain PII. (NewRecommendation)

The SAOP review and update the NARA 1609 Initial Privacy Reviews and Privacy ImpactAssessments privacy policies and procedures to reflect NARA’s current processes andcontrols. (Recommendation #33 from the FY 2021 FISMA audit, report #22-AUD-04)

The CIO and SAOP implement a process to ensure role-based privacy training iscompleted by all personnel having responsibility for PII or for activities that involve PII, andcontent includes, as appropriate: responsibilities under the Privacy Act of 1974 andE-Government Act of 2002, consequences for failing to carry out responsibilities,identifying privacy risks, mitigating privacy risks, and reporting privacy incidents, datacollections and use requirements. (Recommendation #34 from the FY 2021 FISMA audit,report #22-AUD-04)

We recommend that the Centers for Disease Control and Prevention create policies and procedures for developing test kits that include roles, responsibilities, and oversight.

We recommend that the Centers for Disease Control and Prevention ensure that the recently finalized GRF addresses the findings we identified in this report.

We recommend that the Centers for Disease Control and Prevention develop and implement documented processes to ensure that adequate staffing and laboratory space can be obtained for future responses and provide for separation of duties and supervisor controls.

We recommend that CDC re-evaluate the IMS structure at all levels of CDC's response framework and integrate positions or roles and responsibilities that provide effective oversight of a response effort, including a laboratory-based response effort.

We recommend CDC implement a CDC-wide laboratory document control system.

We recommend that CDC ensure that all infectious disease laboratories implement and periodically evaluate a QMS.

Emphasize to examiners in the form of training and other internal communications the requirements around timely escalation of supervisory concerns in line with the FDIC’s forward-looking approach to supervision.

Reiterate to examiners requirements around prompt communication of risk and supervisory results to bank management, emphasizing the significance of prompt communication over linear or chronological issuance of supervisory products.