Open Recommendations

Embassy Khartoum should document all nonexpendable property transfers in accordance with Department standards.

Embassy Khartoum should dismantle and remove its shipping containers and portable structures in accordance with Department requirements or obtain authorization from the Bureau of Overseas Buildings Operations to use them as permanent storage.

Embassy Khartoum should comply with Department training standards on the use of powered industrial trucks, such as forklifts.

Embassy Khartoum should comply with Department guidance on mishap reporting.

Embassy Khartoum should manage its bulk fuel operation in accordance with Department standards.

Embassy Khartoum should use the Integrated Logistics Management System to track all uniforms and personal protective equipment in accordance with Department standards.

Embassy Khartoum should complete all information systems security officer responsibilities in accordance with Department standards.

Embassy Khartoum should register its dedicated internet networks with the Bureau of Information Resource Management.

Embassy Khartoum should implement steps to secure and monitor its dedicated internet networks.

Embassy Khartoum should complete information technology contingency plans for the unclassified and classified networks and test the plans in accordance with Department standards.

Embassy Khartoum should develop an acquisition plan for its information technology needs in accordance with Department standards.

Embassy Khartoum should implement standard operating procedures for managing and tracking mobile devices as required by Department standards.

Embassy Khartoum should implement a records management program that complies with Department standards.

Complete a usage study and document a decision regarding if the IRS will mandate that participants use the TFA IVES system.

FHFA should develop and maintain a complete and accurate cloud system component inventory, as required by NIST SP 800-53.

FHFA should develop and implement a solution to encrypt all data-at-rest on the cloud system as required by National Institute of Standards and Technology SP 800-53.

We recommend the CISA Director update CISA’s Continuity of Operations Plan and develop and implement an information system contingency plan, to ensure availability of redundant systems, capabilities, and communication methods to use if primary systems or networks are compromised.

We recommend the CISA Director require the facility and operations staff conduct an assessment to determine whether secure facility space is appropriately sized and configured to meet operational needs and document any changes necessary for staff to obtain and maintain appropriate access to intelligence information.

We recommend the CISA Director require an assessment to document the levels of staffing, resources, and intelligence access needed for operational divisions, cyber detection and mitigation capabilities, and support functions.

We recommend the CISA Director create and implement a long-term plan for the Cybersecurity Division that includes provisions for ownership, operations, and maintenance of the National Cybersecurity Protection System’s data analytics capabilities.

We recommend the Assistant Secretary for Occupational Safety and Health: Modify the Field Operations Manual to include a policy for mandatory interviews of complainants and witnesses or document the rationale for lack thereof and provide training to Compliance Safety and Health Officers on the updated requirements.

We recommend the Assistant Secretary for Occupational Safety and Health: Update the Field Operations Manual to require documented case file review and approvals by supervisors and provide training for Compliance Safety and Health Officers to ensure complete documentation of significant decisions and actions.

We recommend the Assistant Secretary for Occupational Safety and Health: Establish controls and provide training of Field Operations Manual abatement certification and documentation requirements and create a monitoring process that is reviewed and approved by a supervisor.

We recommend that OPM direct its carriers to issue guidance to members and providers on telehealth billing, privacy and security, and quality of care risks.

We recommend that OPM develop and maintain a list of services that can be provided via telehealth and require carriers to place edits in their claims systems that will check telehealth claims against this list. Any telehealth claims with procedure codes indicating services not on this list should pend for medical review prior to payment. OPM could start with the list maintained by CMS, expanding the allowed services if desired.