Open Recommendations

[Description omitted; CSOSA has determined that this recommendation contains information that is limited official use or classified.]

[Description omitted; CSOSA has determined that this recommendation contains information that is limited official use or classified.]

[Description omitted; CSOSA has determined that this recommendation contains information that is limited official use or classified.]

[Description omitted; CSOSA has determined that this recommendation contains information that is limited official use or classified.]

[Description omitted; CSOSA has determined that this recommendation contains information that is limited official use or classified.]

We recommend that the National Institutes of Health define the process and timeline for what NIH considers "immediate notification" as it relates to specific award conditions intended to report unexpected research outcomes.

Establish and implement comprehensive written investigative policies and procedures for whistleblower investigations conducted by AAE that address best practice investigation standards in the areas of Qualifications, Independence, Due Professional Care, Planning, Execution, Reporting, and Information Management

Revise FAA Order 1100.167B to readjust duties that are inconsistent with the limitations established by the Aircraft Certification, Safety, and Accountability Act of 2020.

Assess its help desk system against other technical solutions and ensure that the help desk solution used captures complete data on technical support requests. This measure includes but is not limited to ensuring that sequence gaps are properly documented or do not occur, valid transactions are accepted by the help desk system, rejected transactions are identified, and the history of each transaction is retained.

The Under Secretary for Health conducts a review to assess the possible scope of current and former VA psychiatry residents being in possession of patients’ personal health information, to include video recorded treatment sessions and consent forms, and consults with the appropriate organizational leaders such as the Office of General Counsel on the required disposition of the recordings and forms, and takes action as needed.

We recommend that management design and implement controls that require the validation of the relevance and reliability of underlying data used in developing the assumptions related to the subsidy cost estimates. Such review should be documented and maintained.

We recommend that the Department evaluate, develop, and implement a formal process to track and report all new and separated contractors.

We recommend that the Department ensure separated contractors are off-boarded and system personnel are notified in a timely manner to disable or remove access to IT resources.

We recommend that the Department provide training and oversight to the Department’s personnel with on/off-boarding responsibilities to help ensure new/separated contractors are properly tracked.

We recommend that the Department update access review procedures to require the reviewers to verify the access lists received to be used in the performance of the access reviews is complete and accurate and not modified prior to commencing the access reviews.

We recommend that the Department identify and implement a process for the reviewer to validate the population generated for review is complete and accurate.

We recommend that the Department enforce established access authorization controls and ensure all requirements are met prior to granting system access.

We recommend that the Department formally perform and document the periodic reviews of all database user accounts in accordance with Department policy to confirm access is current, authorized, and commensurate with job responsibilities.

We recommend that the Department ensure the application and database server access reviews include the verification of access privileges assigned to the user accounts are commensurate with job responsibilities and follow the concept of least privilege.

We recommend that the Department evaluate ensure the database and server layers comply with the disabling of inactive accounts and account lockout duration password setting requirements, as required by Department policy.

We recommend that the Department adhere to the SSP control requirements and avoid the use of generic and shared accounts. If generic and shared accounts are required, obtain a formal risk acceptance and develop a policy and procedure to: • Authorize the use of these accounts by approved personnel, • Control who can access the generic/shared accounts and those sensitive actions performed by the accounts are logged and reviewed every time the accounts are used, and • Require that generic/shared accounts’ passwords are changed each time approved personnel separate or transfer from the Department.

We recommend that FSA implement a process to evaluate the magnitude of impact, likelihood of occurrence, and nature of the deficiency in order to tailor the corrective actions to remediate the risk and address the root cause. Further, update guidance to ensure that quality reviews over the POA&M closure documentation are conducted to confirm the noted deficiencies are fully addressed to help prevent future reoccurrences.

We recommend that FSA formally develop and implement a quality control review process to ensure that logical access control processes are followed completely and accurately to validate logical access requests, reviews, and recertifications.

We recommend that FSA ensure segregation of duties and least privilege principles are adhered to when granting user access to prevent users from having the ability to develop and/or change application code and having update access to the environment where the final tested and approved changes are staged prior to migration to the production environment; and prevent users with access to develop code from having update access to the production environment.

We recommend that FSA evaluate and update the access review control process based on risk and enforce segregation of duties.