Open Recommendations

Direct and require confirmation of completion from OST's cloud-based system owner for the Infrastructure and Operations Common Operating Environment (COE)"Software-as-a-Service, Infrastructure-as-a-service, and Platform-as-a-Service to: a. Include in its executive summary/Authorization to Operate letter to the Authorizing Official proof of its cloud service provider's continuous monitoring activities to ensure its cloud system security posture remains sufficient for its own use and supports its ongoing authorization as required by FedRAMP. b. Develop security baseline configuration settings and a checklist and assess whether the COE cloud-based system is properly configured and the network secure. c. Develop and implement a process to conduct reviews…

Direct and require confirmation of completion from FAA's cloud-based system owner for the FAA Cloud Services"Infrastructure-as-a-service and Platform-as-a-Service to: a. Incorporate flaw remediation into ongoing configuration management processes. b. Develop and implement a process to regularly manage malicious code protection to detect and eradicate malicious code at the entry point for its Infrastructure-as-a-service and Platform-as-a-Service. c. Develop and implement a change control process and use baseline configuration settings and document configuration settings to establish a basis for future builds, releases, and/or changes. d. Develop and implement a process to perform an automated review of network accounts or implement an alternative…

1. We recommend that the Director of the U.S. Census Bureau evaluate alternative strategies to achieve target response rates, particularly in underrepresented units.

5. We recommend that the Director of the U.S. Census Bureau ensure that regional offices adhere to prescribed telephone interview rates or work with the Bureau of Labor Statistics to adjust them as needed.

6. We recommend that the Director of the U.S. Census Bureau ensure all surveys and regional offices maximize the use of data analysis and monitoring tools to oversee survey quality and performance.

7. We recommend that the Director of the U.S. Census Bureau ensure RI requirements are met and completed in a timely manner.

8. We recommend that the Director of the U.S. Census Bureau reevaluate the effectiveness of the CED survey RI lag time metric.

12. We recommend that the Director of the U.S. Census Bureau ensure that staff are trained on completing adequate falsification investigations.

13. We recommend that the Director of the U.S. Census Bureau strengthen the quality control plan for the CPS by evaluating cases worked by FRS with confirmed falsifications to assess the impact on survey estimates.

15. We recommend that the Director of the U.S. Census Bureau implement a system for tracking FRs with confirmed falsifications so that applicants for FR positions can be appropriately vetted prior to reemployment.

We recommend that the Commissioner of CBP finalize the draft CBP Integrated SWB Mass Irregular Migration Contingency Plan.

We recommend that the Commissioner of CBP establish a comprehensive, formal policy to: • consistently document the use of all available information to make informed facility planning decisions; • conduct and document analysis of all possible alternative options before establishing temporary facilities; and • regularly reassess the continued need for existing temporary facilities and evaluate the cost-effectiveness of maintaining existing temporary facilities.

Create a performance standard that requires that teleservice center managers and other employees who conduct service observations conduct a minimum of three service observations for each qualified 800-number employee per month, as required by SSA policy.

Create policy to ensure all problematic calls identified through speech analytics are referred to regional management and regional management intervenes with the 800-number employees referred within defined timeframes to ensure prompt interventions address problematic and/or inadequate customer service.

Develop and implement a feedback process for external threat sharing activities.

Develop performance measures to assess the effectiveness of its external threat and vulnerability information sharing activities

Ensure that all data sets within the FDIC that contain relevant threat and vulnerability information are assessed and natural language processing or alternative technological capabilities are considered for enhancing threat and vulnerability information sharing operations.

OCSS should Bolster State agency resilience during emergencies.

OCSS should create forums for identifying and sharing State agency best practices in providing paternity establishment services.

We recommend the TSA Chief Information Officer require the selected High Value Asset system owner to document an approved secure baseline configuration and perform testing to verify that all approved settings are implemented.

We recommend the TSA Chief Information Officer enforce the requirement for the selected High Value Asset system owner to apply security updates and service patches to remediate vulnerabilities on all devices, as required by applicable DHS policies.

We recommend the TSA Chief Information Officer require the selected High Value Asset system owner to develop and implement a supply chain risk management plan to address and mitigate risks associated with the hardware components and software being used on the selected High Value Asset system.

We recommend the TSA Chief Information Officer direct the selected High Value Asset system owner to strengthen its user account management procedures to ensure user access agreements are developed and signed by users before users are given access to the selected High Value Asset system or when the agreement is revised.

We recommend the TSA Chief Information Officer require the selected High Value Asset system owner develop and implement detailed procedures on granting system access, including emergency or temporary access. In addition, the TSA Chief Information Officer should require the selected High Value Asset system owner to maintain a current list of system users and remove or disable inactive accounts according to applicable DHS and TSA policies.

We recommend the TSA Chief Information Officer direct the selected High Value Asset system owner to require all non-privileged users’ system access requests be reviewed, authorized, and documented before granting system access. In addition, users’ system access should be reviewed periodically and removed if it is no longer needed.