Open Recommendations

We recommended the Assistant Secretary for Information and Technology ensure contingency plans for all systems and applications are updated and tested in accordance with VA requirements.

We recommended the Assistant Secretary for Information and Technology ensure that systems and applications are adequately logged and monitored to facilitate an agency-wide awareness of information security events.

We recommended the Assistant Secretary for Information and Technology implement improved safeguards to identify and prevent unauthorized vulnerability scans on VA networks.

We recommended the Assistant Secretary for Information and Technology implement improved measures to ensure that all security controls are assessed in accordance with VA policy and that identified issues or weaknesses are adequately documented and tracked within POA&Ms.

We recommended the Assistant Secretary for Information and Technology implement improved processes to monitor for unauthorized changes to system components and the installation of prohibited software on all agency devices and platforms.

We recommended the Assistant Secretary for Information and Technology develop a comprehensive inventory process to identify connected hardware, software, and firmware used to support VA applications and operations.

We recommended the Assistant Secretary for Information and Technology implement improved procedures for monitoring contractor-managed systems and services and ensure information security controls adequately protect VA sensitive systems and data.

We recommend that the Chief Information Officer require the Information Technology Division (ITD) to perform an annual validation of the ITD Authorized Access List, in accordance with ITD Authorized Data Center Proxy Card Access List Maintenance standard operating procedure.

EXIM's Office of the Chair should designate a lead office or officials responsible for coordinating development, oversight, and implementation of a sub-Saharan Africa specific strategy to address the Sub-Saharan Africa Mandate (hereafter referred to as the "Lead Office or Officials"). The Lead Office or Officials should have an explicit responsibility and authority to coordinate and guide the mandate's implementation across all relevant EXIM offices, liaise with external stakeholders, including but not limited to the Sub-Saharan Africa Advisory Committee (SAAC) and other U.S. Government agencies and between sub-Saharan Africa importers and U.S. exporters to rebuild relationships, establish and monitor key performance…

The Lead Office or Officials should develop a sub-Saharan Africa specific strategy to address the Sub-Saharan Africa Mandate. This strategy should provide a unified direction and shared vision of EXIM offices and staff and communicate EXIM’s commitments and strategy to interagency partners in the U.S. Government and other stakeholders with a focus to promote the expansion of EXIM’s financial commitments in sub-Saharan Africa.

EXIM’s Office of the Chair should integrate the Sub-Saharan Africa Mandate strategy within the broader EXIM Strategic Plan to re-enforce that the Sub-Saharan Africa Mandate is central to EXIM’s overall strategic planning.

The Lead Office or Officials should develop an actionable plan to enhance collaborative efforts with the Department of Commerce, the Trade Promotion Coordinating Committee (TPCC), and other relevant government agencies, such that EXIM could play a more prominent role in trade discussions and initiatives concerning sub-Saharan Africa.

The Lead Office or Officials should establish effective metrics to measure EXIM’s Sub-Saharan Africa Mandate performance to inform the growth strategy (e.g., the number of U.S. exporters, lenders, and importers in sub-Saharan Africa reached, relationships established, total commitments and authorizations, and export value). The Sub-Saharan Africa Mandate performance metrics should also be incorporated within the next EXIM Annual Performance Plan.

EXIM’s Office of Board Authorized Finance and Office of General Counsel should conduct a comprehensive review of the post-authorization process to identify the primary factors within the documentation phase that contribute to the lag between authorization and disbursements and devise strategies to remedy these shortcomings.

EXIM’s Office of Global Business Development should devise a detailed plan to directly engage importers in sub-Saharan Africa that are not already engaging with EXIM’s sub-Saharan Africa programs. The office must ensure that the plan is incorporated as an integral part of the overarching strategy devised by the Lead Office or Officials.

The Lead Office or Officials should devise a plan to directly engage U.S. businesses that are not already engaging with EXIM’s sub-Saharan Africa programs.

EXIM’s Office of Policy Analysis and International Relations should conduct an analysis of the potential impacts of lowering the mandated domestic content policy for EXIM programs targeted to sub-Saharan Africa on U.S. jobs and present its findings to EXIM’s Board of Directors.

Allocate all unassigned software licenses to the CSRs working on the TAC Appointment Telephone Line so they can assist taxpayers with existing appointments without the need to transfer them to a different CSR.

Rec. 1.a: The DoD OIG recommended that the Air Force Chief of Safety, in coordination with the Air Force Nuclear Weapons Center Commander, update Air Force Manual 91-119 to include detail and clarity of independent verification and validation requirements. Specifically, Air Force Manual 91-119 should be updated to include procedures to select an independent verification organization team.

Rec 1.b: The DoD OIG recommended that the Air Force Chief of Safety, in coordination with the Air Force Nuclear Weapons Center Commander, update Air Force Manual 91-119 to include detail and clarity of independent verification and validation requirements. Specifically, Air Force Manual 91-119 should be updated to include procedures to document the independent verification organization team's independence with the Air Force Safety Center; define technical, managerial, and financial independence; and comply with these levels of independence during an independent verification and validation.

Rec. 1.c: The DoD OIG recommended that the Air Force Chief of Safety, in coordination with the Air Force Nuclear Weapons Center Commander, update Air Force Manual 91-119 to include detail and clarity of independent verification and validation requirements. Specifically, Air Force Manual 91-119 should be updated to include procedures to define how the prime contractor's laboratory, equipment, and software can be used during independence verification and validation when the independent verification organization team does not have access to Government laboratory, equipment, and software.

Rec. 1.d: The DoD OIG recommended that the Air Force Chief of Safety, in coordination with the Air Force Nuclear Weapons Center Commander, update Air Force Manual 91-119 to include detail and clarity of independent verification and validation requirements. Specifically, Air Force Manual 91-119 should be updated to include procedures to define the responsibilities of the independence verification and validation with the Air Force Safety Center and documenting and coordinating the modifications to and deviations from software with the prime contractor.

Rec. 2.a: The DoD OIG recommended that the Under Secretary of Defense for Personnel and Readiness identify exceptions to the transfer timelines for approved Expedited Transfers.

Rec. 2.b: The DoD OIG recommended that the Under Secretary of Defense for Personnel and Readiness establish and implement an exception to policy process for transfers that cannot be processed within the required timelines, to include identifying the appropriate approving official for the exceptions.

Rec. 3.a: The DoD OIG recommended that the Sexual Assault Prevention and Response Office Director review the effectiveness of the Military Departments' procedures to regularly review and assure the quality of data entered into the Defense Sexual Assault Incident Database, and implement additional training, reminders, or other corrective actions, as necessary.