Open Recommendations

We recommend that USAID/Nigeria verify that Center for Clinical Care and Clinical Research corrects the one instance of material noncompliance detailed on page 23 of the audit report.

We recommend the NOAA Deputy Under Secretary for Operations direct the Assistant Administrators for the
NWS and OAR to develop a detailed implementation plan on how to achieve the TWIEP Plan’s activities using time-bound goals with clear resource expectations, relevant control activities, and performance measures.

We recommend the NOAA Deputy Under Secretary for Operations direct the Assistant Administrators for the NWS and OAR to develop loss of life and economic loss performance metrics to support performance assessment.

We recommend the NOAA Deputy Under Secretary for Operations direct the Assistant Administrators for the NWS and OAR to revise existing policies (e.g., Policy on Research and Development Transitions, Products and Services Change Management, Verification, and Termination of NWS Information Services) to evaluate the operational performance impacts associated with research investments that have transitioned to operations.

We recommend the NOAA Deputy Under Secretary for Operations direct the Assistant Administrators for the NWS and OAR to conduct an assessment of how IDSS risk communication efforts for tornado watches and warnings affect the public’s actions to reduce loss of life or property, and revise the IDSS Policy Directive as appropriate.

We recommend the NOAA Deputy Under Secretary for Operations direct the Assistant Administrator for OAR to conduct an assessment of existing processes for ensuring the consistent communication of key performance metrics and address identified gaps, such as the inaccurate public-facing GPRA tornado lead-time metric definition.

We recommend the NOAA Deputy Under Secretary for Operations direct the Assistant Administrator for OAR to conduct an assessment of potential lead-time metrics and determine which approach, or combination of approaches, is best suited for facilitating representative performance assessment and external oversight.

We recommend that the FEC OCIO update the agency’s SSPP documents and establish a privacy program plan that aligns with NIST SP 800-53, Rev.5.1.1 requirements as required by OMB.

We recommend that the FEC OCIO develop and implement a SCRM strategy, policies, and procedures that align with NIST and as OMB requires.

We recommend the FEC OCIO secure (redacted) by monitoring configuration settings to ensure compliance with STIG security configuration settings as required by the agency’s SSP.

We recommend the FEC OCIO review and monitor STIG security configuration settings for its Server 2 as required by the FECLAN SSP.

We recommend that the FEC OCIO implement STIG security configuration settings for Server 1 in accordance with the agency’s FECLAN SSP. If the agency cannot utilize its directory GPOs, we recommend that the agency use alternative methods.

We recommend that the FEC OCIO conduct regular security scans of Server 1 to verify compliance with STIG security configuration settings in accordance with the agency’s FECLAN SSP.

We recommend that the FEC OCIO reassess and reprioritize resources to identify opportunities to accelerate the remediation of urgent, critical, and high vulnerabilities.

We recommend that the FEC OCIO regularly conduct risks assessments in accordance with OMB Circular A-130, Managing Information as a Strategic Resource, to help identify other corrective actions to improve the timeliness of vulnerability remediation.

We recommend that the FEC develop and implement SLA policy and procedures and define KPMs for managing the performance of third-party service contracts.

We recommend that the FEC OCIO ensure (redacted) logs are forwarded to and actively monitored by the agency’s centralized SIEM system, in accordance with the agency’s system security plan.

Review, and take appropriate corrective action for, the 67 remittance exceptions that employees processed incorrectly.

Using a risk-based approach, review, and take appropriate actions on, remaining unissued remittance funds.

Provide targeted training to Program Service Center employees who process remittance exceptions on the policy-compliant procedures to address the errors we identified.

We recommend that FSIS update its policy to include applicable legal requirements and financial processes pertaining to its Cooperative Interstate Shipment program.

We recommend the DHS Secretary designate a DHS component or office to oversee parole expiration for parolees under the reviewed parole processes who are no longer authorized to remain in the United States, and report on the prevalence of this issue.

We recommend the Commissioner of CBP and the Director of USCIS develop and implement a process to identify parolees under the reviewed parole processes who are no longer authorized to remain in the United States.

We recommend that the Commissioner of CBP and the Director of USCIS develop and implement a process to ensure ICE receives timely, accurate data regarding parolees under the reviewed parole processes who are no longer authorized to remain in the United States.

The St. Cloud VA Medical Center Director completes a comprehensive review of surgical service credentialing and privileging processes, ensures facility policy and practice in alignment with Veterans Health Administration policy, and as necessary, consults with Veterans Integrated Service Network leaders, and monitors for compliance.