Open Recommendations

Recommend that the Acting Manager, direct the Contracting Officer, in consultation with the Cognizant Federal Agency Official, to determine the allowability of costs questioned in the report, as summarized in Appendix 2,and recover any amounts deemed unallowable.

We recommend that the Manager, Fermi Site Office, direct the Contracting Officer, in consultation with the Cognizant Federal Agency Official, to require FRA to establish a policy to permit reasonable subsistence reimbursements for visiting researchers on extended assignment.

We recommend that CPB management require KSVR-FM to post its most recent unaudited financial statement on its website.

We recommend that CPB management require KSVR-FM to identify the corrective actions and controls it will implement to ensure future compliance with Act and CPB requirements for open financial records.

We recommend that CPB management require KSVR-FM to identify the corrective actions and controls it will implement to ensure future compliance with diversity requirements.

We recommend the United States Coast Guard require the Office of Commercial Vessel Compliance to develop and implement key performance indicators to facilitate the systematic assessment and evaluation of the Streamlined Inspection Program.

We recommend the United States Coast Guard require the Office of Commercial Vessel Compliance to collect and evaluate relevant and accurate Streamlined Inspection Program outcomes to ensure the program is operating as intended.

We recommend the United States Coast Guard require the Office of Commercial Vessel Compliance to evaluate the impact the Streamlined Inspection Program has on the Coast Guard’s mission and resources and ensure: (a) reported outcomes are accurate; and (b) the most beneficial alternative inspection program is used to improve the effectiveness and efficiency of the Coast Guard’s inspection process.

We recommend that CBP’s Office of Facilities and Asset Management: a. evaluate all International Mail Facility space agreements to identify unusable space for future cost savings; and b. revise agreements with unusable space, given the $3.2 million in funds that could have been put to better use identified in this audit.

We recommend that CBP’s Office of Facilities and Asset Management develop and implement a process for escalating and effectively resolving local and regional facility issues.

We recommend that CPB management require WOJB-FM to identify the corrective actions and controls it will implement to ensure future compliance with CPB’s General Provisions requirements for diversity.

Incorporate the required standard cloud security clauses in the Departments enterprise cloud service contracts as well as other cloud services contracts for FAA, MARAD, and OST to ensure the cloud services are secure.

Working with the appropriate DOT procurement officials for FAA, FMCSA, FHWA, MARAD, FRA, NHTSA, PHMSA, and OST, set up service level agreements as required, with each of their cloud service providers to define and set agency expectations and cloud service provider-specific responsibilities.

Direct departmental security officials working with appropriate procurement officials to verify that service level agreements contain a requirement to report security incidents to DOTs Security Operations Center and require confirmation of completion.

Develop and implement a process that enables FAAs Security Operations Center to receive the necessary log data for ensuring proper cybersecurity incident monitoring for all departmental cloud-based systems.

Report DOT plans for fully adopting multifactor authentication and encryption for data at rest and in transit in accordance with Executive Order 14028.

Direct and require confirmation of completion from OST's cloud-based system owner for the Federal Human Resources Navigator"Software-as-a-Service to: a. Include in its executive summary/Authorization to Operate letter to the Authorizing Official proof of its review of cloud service provider's continuous monitoring activities to ensure its cloud system security posture remains sufficient for its own use and supports its ongoing authorization as required by FedRAMP. b. Use personal identity verification cards as the primary authentication mechanism to ensure secure system login. c. Develop a Privacy Impact Analysis to help identify and manage personally identifiable information and privacy risks. d. Identify a…

Direct and require confirmation of completion from OST's cloud-based system owner for the Electronic Document Management System"Software-as-a-Service to: a. Include in its executive summary/Authorization to Operate letter to the Authorizing Official proof of its review of cloud service provider's continuous monitoring activities to ensure its cloud system security posture remains sufficient for its own use and supports its ongoing authorization, as required by FedRAMP. b. Require multifactor authentication for non-DOT system users. c. Develop and implement a process to automatically disable inactive system accounts after 60 days of inactivity.

Direct and require confirmation of completion from OST's cloud-based system owner for the Data Analysis Visualization Environment"Software-as-a-Service to: a. Include in its executive summary/Authorization to Operate letter to the Authorizing Official proof of its review of cloud service provider's continuous monitoring activities to ensure its cloud system security posture remains sufficient for its own use and supports its ongoing authorization, as required by FedRAMP. b. Develop and implement a process to conduct monthly vulnerability scans as required by DOT.

Direct and require confirmation of completion from MARAD's cloud-based system owner for US Merchant Marine Academy/Campus Labs"Software-as-a-Service to: a. Include in its executive summary/Authorization to Operate letter to the Authorizing Official proof of its review of cloud service provider's continuous monitoring activities to ensure its cloud system security posture remains sufficient for its own use and supports its ongoing authorization, as required by FedRAMP. b. Complete an annual security authorization process and obtain a full authorization to operate for its Software-as-a-Service cloud information system to ensure all system risks have been properly identified and accepted in accordance with departmental cybersecurity…

Direct and require confirmation of completion from FRA's cloud-based system owner for its Cloud Application Services"Software-as-a-Service"to: a. Include in its executive summary/Authorization to Operate letter to the Authorizing Official proof of its review of cloud service provider's continuous monitoring activities to ensure its cloud system security posture remains sufficient for its own use and supports its ongoing authorization as, required by FedRAMP. b. Update the Privacy Impact Analysis for the Railroad Compliance System to ensure the proper privacy controls are in place to identify and protect personally identifiable information and other sensitive information.

Direct and require confirmation of completion from NHTSA's cloud-based system owner for the Web System"Platform-as-a-Service and Infrastructure-as-a-Service"to: a. Include in its executive summary/Authorization to Operate letter to the Authorizing Official proof of its review of cloud service provider's continuous monitoring activities to ensure its cloud system security posture remains sufficient for its own use and supports its ongoing authorization as required by FedRAMP. b. Develop and implement a process to review audit logs and analyze vulnerability scan reports on its Platform-as-a-Service on a weekly basis to check for various risks, including software flaws per NHTSA's audit and accountability plan.

Direct and require confirmation of completion from PHMSA's cloud-based system owner for the Pipeline Risk Management Information System"Infrastructure-as-a-service"and PHMSA Data Mart"Infrastructure-as-a-service to: a. Include in its executive summary/Authorization to Operate letter to the Authorizing Official proof of its review of cloud service provider's continuous monitoring activities to ensure its cloud system security posture remains sufficient for its own use and supports its ongoing authorization as FedRAMP requires for Pipeline Risk Management Information System. b. Include in its executive summary/Authorization to Operate letter to the Authorizing Official proof of its review of cloud service provider's continuous monitoring activities to ensure its…

Direct and require confirmation of completion from FMCSA's cloud-based system owner for the Cloud Environment"Infrastructure-as-a-service to: a. Include in its executive summary/Authorization to Operate letter to the Authorizing Official proof of its review of cloud service provider's continuous monitoring activities to ensure its cloud system security posture remains sufficient for its own use as required by FedRAMP. b. Complete its annual security authorization process and obtain a full Authorization to Operate for its cloud information system to ensure all systems risks have been properly identified and accepted in accordance with departmental cybersecurity policies. c. Develop and implement a process to…

Direct and require confirmation of completion from FRA's cloud-based system owner for the Multiple Case Incident Analysis"Infrastructure-as-a-service to include in its executive summary/Authorization to Operate letter to the Authorizing Official proof of its review of cloud service provider's continuous monitoring activities to ensure its cloud system security posture remains sufficient for its own use and supports its ongoing authorization, as required by FedRAMP.