Open Recommendations

Require that the new payroll system be able to execute retroactive pay's complex processing when assessing, reviewing, and selecting a new vendor.

Ensure the Information System Security Officers are reviewing system configurationcompliance scans monthly as required within NARA’s Configuration ComplianceManagement Standard Operating Procedure. (New Recommendation)

Implement improved processes to remediate security deficiencies on NARA’s networkinfrastructure, to include enhancing its patch and vulnerability management program toaddress security deficiencies identified during our assessments of NARA’s applicationsand network infrastructure. (Recommendation #13 from the FY 2022 FISMA audit, report#22-AUD-09)

Document and implement a process to track and remediate persistent configurationvulnerabilities or document acceptance of the associated risks. (Recommendation #15from the FY 2021 FISMA audit, report #22-AUD-04)

Ensure all information systems are migrated away from unsupported operating systemsto operating systems that are vendor-supported. (Recommendation #18 from the FY 2021FISMA audit, report #22-AUD-04)

Finalize and implement system configuration baseline management procedures, whichencompass at a minimum, the request, documentation, and approval of deviations frombaseline settings for all NARA systems. (Recommendation #22 from the FY 2021 FISMAaudit, report #22-AUD-04)

Enhance current procedures to ensure that new NARA users who do not complete theirinitial security awareness training, have their accounts automatically disabled inaccordance with timeframes promulgated within the Privacy and Awareness Handbook.(New Recommendation)

Continue and complete efforts to require PIV authentication for all privileged users, serversand applications, through NARA’s Privileged Access Management authentication projectand other efforts. (Recommendation #26 from the FY 2021 FISMA audit, report #22-AUD04)

Enforce mandatory PIV card authentication for all NARANet users, in accordance withOMB requirements. (Recommendation #27 from the FY 2021 FISMA audit, report #22-AUD-04)

Ensure NARANet user accounts are reviewed and disabled in accordance with NARA’sinformation technology policies and requirements. (Recommendation #29 from theFY 2021 FISMA audit, report #22-AUD-04)

Ensure that the SAOP complete PIAs for all systems which contain PII. (NewRecommendation)

The SAOP review and update the NARA 1609 Initial Privacy Reviews and Privacy ImpactAssessments privacy policies and procedures to reflect NARA’s current processes andcontrols. (Recommendation #33 from the FY 2021 FISMA audit, report #22-AUD-04)

The CIO and SAOP implement a process to ensure role-based privacy training iscompleted by all personnel having responsibility for PII or for activities that involve PII, andcontent includes, as appropriate: responsibilities under the Privacy Act of 1974 andE-Government Act of 2002, consequences for failing to carry out responsibilities,identifying privacy risks, mitigating privacy risks, and reporting privacy incidents, datacollections and use requirements. (Recommendation #34 from the FY 2021 FISMA audit,report #22-AUD-04)

We recommend that the Centers for Disease Control and Prevention create policies and procedures for developing test kits that include roles, responsibilities, and oversight.

We recommend that the Centers for Disease Control and Prevention ensure that the recently finalized GRF addresses the findings we identified in this report.

We recommend that the Centers for Disease Control and Prevention develop and implement documented processes to ensure that adequate staffing and laboratory space can be obtained for future responses and provide for separation of duties and supervisor controls.

We recommend that CDC re-evaluate the IMS structure at all levels of CDC's response framework and integrate positions or roles and responsibilities that provide effective oversight of a response effort, including a laboratory-based response effort.

We recommend CDC implement a CDC-wide laboratory document control system.

We recommend that CDC ensure that all infectious disease laboratories implement and periodically evaluate a QMS.

Emphasize to examiners in the form of training and other internal communications the requirements around timely escalation of supervisory concerns in line with the FDIC’s forward-looking approach to supervision.

Reiterate to examiners requirements around prompt communication of risk and supervisory results to bank management, emphasizing the significance of prompt communication over linear or chronological issuance of supervisory products.

Reevaluate the FDIC's strategy to attract, retain, and allocate staffing, including how to enhance the supervision of large, complex financial institutions.a. This evaluation should be documented and submitted to the FDIC’s Chairman for review and approval.

Implement target metrics and monitor variances for key supervisory outputs consistent with requirements contained in CEP Procedures, such as:a. Supervisory Plan percentage completed to actual percentage completed to identify and take timely corrective action when examination teams are not on track to achieve objectives detailed in annual supervisory plans.b. Target review start date to actual review start date to identify and take timely corrective action when examination teams are not on track to achieve objectives detailed in annual supervisory plans.c. Number of days elapsed between target review start date and exit meeting to expectation to identify and take corrective action…

We recommend that the Centers for Medicare & Medicaid Services use the information we obtained from States about the challenges they are still encountering and develop an action plan for helping States more easily identify liable third parties and recover Medicaid payments.

We recommend that the Centers for Medicare & Medicaid Services work with States, as appropriate, to encourage better cooperation from third parties that routinely resist States' TPL identification and recovery efforts.