Open Recommendations

Roles and responsibilities of the SAOGI and other key stakeholders are defined in both the Geospatial Data Strategy and its implementation plan.

The implementation plan for the Geospatial Data Strategy contains detailed action items and milestones, including those for developing a complete and accurate inventory of the Agency’s geospatial data.

Continued coordination with NARA to establish the appropriate level of scientific data for inclusion in NARA-approved records schedules.

Update applicable requirements to require assisted property owners, including PHAs, to maintain adequate documentation to support their determinations that maintenance and hazard reduction activities that disturb surfaces with lead-based paint qualify for the de minimis exemption from the lead-safe work practices under the Lead Safe Housing Rule.

Status

To address this recommendation, OLHCHH agreed to:

We recommend the Executive Assistant Commissioner, Operations Support, U.S. Customs and Border Protection: Recommendation 1: Refine current and identify new strategies and solutions to manage delays in detainee transfers to partner agencies and communicate these improvements throughout the sector.

We recommend the Del Rio Sector Chief, Border Patrol, U.S. Customs and Border Protection: Recommendation 2: Assess whether the Eagle Pass soft-sided facility’s supplemental guidance on the management of detainee property can be developed and implemented sector-wide, and implement where operationally feasible.

Oversee a data integrity review at Del Rio Border Patrol facilities for a sampling of detainee activity logs for 1 month, to verify that the information recorded is accurate. If the problem we identified persists, implement a quality assurance plan and continue to monitor data integrity.

The Under Secretary for Management should develop standard guidance for all reporting entities, clarifying which allegations the Department should report to OIG under the Authorities Act and defining the terms serious misconduct and head of the Department entity, and include affected stakeholders in the development of the guidance.

The Under Secretary for Management should develop a standard approach to tracking reporting dates to ensure compliance with the law and update internal guidance accordingly.

that the Director develop a strategy and structure that integrates information security into the agency’s business operations. This should include an established responsibility for assessing information security risks in all agency programs and operations and providing this analysis to senior leadership, including the ERM Council, for decision-making.

OIG recommended that the Director appoint the chief information security officer to serve on the Enterprise Risk Management Council as a voting member

OIG recommended that that the Director further define and implement the Enterprise Risk Management program to ensure information security risks are communicated and monitored at the system, business process, and entity levels.

OIG recommended that the Chief Information Officer perform a full security assessment of the General Support System to obtain a complete understanding of system weaknesses

OIG recommended that the Peace Corps consistently improve and implement its inventory management process to ensure information system, hardware, and software inventories are accurate, complete, and up-to-date.

We recommend the Acting Assistant Secretary for Employment and Training: Use data collected from monitoring and BAM reports to identify the areas of highest improper payments including fraud and create a plan to prevent similar issues in future temporary UI benefit programs.

We recommend the Acting Assistant Secretary for Employment and Training: Work with NASWA to update the IDH Participant Agreement to require state to submit the results of their UI fraud investigations.

We recommend the Acting Assistant Secretary for Employment and Training: Work with NASWA to ensure the IDH cross matches are effective at preventing the types of fraud that were detected during the pandemic and regularly update using the results of state fraud investigations.

Ensure that risks are appropriately categorized and prioritized on the Board’s cybersecurity risk register.

Ensure that an enterprisewide software inventory is conducted and maintained.

HUD OCIO should implement procedures to ensure that information in cybersecurity risk registers is obtained accurately, consistently, and in a reproducible format and is used to
a. quantify and aggregate security risks,
b. normalize cybersecurity risk information across organizational units, and
c. prioritize operational risk response (derived from metric 5).

HUD OCIO and the HUD Chief Risk Officer should coordinate to implement procedures to monitor the effectiveness of cybersecurity risk responses to ensure that risk tolerances are maintained at an appropriate level (derived from metric 5).

HUD OCIO and the Office of Administration should implement procedures to ensure proper validation of media sanitization in accordance with HUD Media Protection Procedures 2.0 (February 2022) and form HUD 1067A, Certification of Sanitization (derived from metric 36).

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

Fully establish a process to collect and analyze customer feedback.

Explore alternative means of collections for PPP loans with an outstanding balance of $100,000 or less.