Open Recommendations

The National Taxpayer Advocate should set specific, attainable time frames for initial contact, with an emphasis on economic burden cases, and adopt permanent policies that provide clear and consistent expectations for taxpayers.

The National Taxpayer Advocate should establish an automated process within the new case and systemic issue management system that would apprise the taxpayer of the progress on their case.

The National Taxpayer Advocate should establish an automated process within the new case and systemic issue management system that would 1) notify the case advocate and their manager when an OAR has been prepared but not sent, and 2) notify IRS function personnel the next business day following the requested or negotiated OAR completion date.

Ensure that Building Futures establishes policies and procedures to ensure the accuracy and appropriateness of its reported performance data.

Work with Cal OES to revise its subrecipient compliance assessment procedures to ensure corrective action plans are implemented in a timely manner.

Ensure that Building Futures establishes controls to allocate costs to VOCA based on a consistent and documented methodology.

Ensure that the Building Futures implements controls to ensure salaries and wages expenses charged to the subaward are based on records that accurately reflect the work performed to comply with federal award requirements.

Remedy $32,478 in salaries and fringe benefits costs that were not adequately supported.

Remedy $8,897 in unsupported operating costs.

Remedy $2,156 in unallowable operating costs charged to VOCA in error.

Work with Cal OES to ensure that it provides the necessary guidance for its subrecipients to report only VOCA-funded activities in PMT, prorating when appropriate.

Work with Cal OES to establish procedures to verify subrecipients' VOCA performance data to ensure that it is prorated, when appropriate, to prevent duplicative reporting.

Work with Cal OES to enhance its subrecipient monitoring policies and procedures to ensure subrecipients are recording or allocating expenditures by funding source, as required.

1. We recommend the Undersecretary of Commerce for Industry and Security direct BIS’s Chief Information Officer to implement an EDR on Network A.

2. We recommend the Undersecretary of Commerce for Industry and Security direct BIS’s Chief Information Officer to adopt the threat hunting security control and use existing BIS SOC tools to proactively hunt threats and mitigate malicious or unauthorized network activity.

3. We recommend the Undersecretary of Commerce for Industry and Security direct BIS’s Chief Information Officer to establish and implement detailed incident response procedures to detect, contain, eradicate, and recover from threats.

4. We recommend the Undersecretary of Commerce for Industry and Security direct BIS’s Chief Information Officer to implement a method to identify and prevent the exfiltration of PII, BII, and other sensitive data from BIS networks.

5. We recommend the Undersecretary of Commerce for Industry and Security direct BIS’s Chief Information Officer to properly configure network security devices to prevent unauthorized connections from outside BIS networks.

6. We recommend the Undersecretary of Commerce for Industry and Security direct BIS’s Chief Information Officer to properly restrict BIS networks to prevent unauthorized lateral movement between BIS networks.

7. We recommend the Undersecretary of Commerce for Industry and Security direct BIS’s Chief Information Officer to implement a security control to allow only approved software on Network B and consider implementing this control for all BIS networks.

8. We recommend the Undersecretary of Commerce for Industry and Security direct BIS’s Chief Information Officer to review all BIS user access, for networks and applications, to ensure each user is assigned the correct levels of access according to the principle of least privilege.

9. We recommend the Undersecretary of Commerce for Industry and Security direct BIS’s Chief Information Officer to immediately search BIS networks for classified credentials and establish a procedure to regularly search for plain-text credentials.

10. We recommend that the Undersecretary of Commerce for Industry and Security direct BIS’s Chief Information Officer to ensure passwords are disabled for all user accounts as soon as operationally possible.

11. We recommend that the Undersecretary of Commerce for Industry and Security direct BIS’s Chief Information Officer to establish and implement BIS helpdesk procedures for user access issues, including a user verification process.

12. We recommend that the Undersecretary of Commerce for Industry and Security direct BIS’s Chief Information Officer to implement an automated solution to change local administrator credentials after sharing them with BIS users and use different local administrator passwords for each system.