Open Recommendations

Implement cross-organizational communication and collaboration with LITWGs to ensure that referrals with the ARC are addressed, as required

Implement cross-organizational communication and collaboration with LITWGs to ensure that referrals with the ARC are addressed, as required.

Ensure that Department Order 470.5 is updated to provide more descriptive guidance for LITWGs and add the roles and responsibilities for the Office of Insider Threat.

Ensure that the ARC is receiving insider threat information from LITWGs to be collected and integrated to generate referrals for detection, mitigation, and analysis for the ITP to respond to insider threats.

We recommend that the contracting officer disallow $1,876,349 in overcharges to the FEHBP due to procedure code modifier claim payment errors.

We recommend that the Director of CPD's Office of Disaster Recovery review the one grantee with a grant totaling $666,666 that did not meet the overall LMI requirement and address the noncompliance.

We recommend that the Director of CPD's Office of Disaster Recovery adopt LMI benchmarking to ensure that grantees budget adequate funds to LMI at significant milestones in the grant lifecycle.

We recommend that the Director of CPD's Office of Disaster Recovery make changes to the action plan process so that the action plan calculates an overall LMI percentage.

We recommend that the Florida Agency for Health Care Administration invoice for, and collect from manufacturers, an estimated $57,700 ($35,126 Federal share) in rebates for single-source physician-administered drugs and refund the Federal share of rebates collected.

We recommend that the Florida Agency for Health Care Administration ensure that all physician-administered drugs eligible for rebates after our audit period are processed for rebates.

We recommend that the Administration for Children and Families work with State agencies to ensure compliance with Federal requirements to report missing children episodes to NCMEC in a timely manner.

We recommend that the Assistant Director, Office of Investigations, United States Secret Service develop and implement internal controls to ensure cell-site simulator users differentiate between cell-site simulator-policy defined exigent circumstances and 18 U.S.C. 3125-defined emergency situations to comply with 18 U.S.C. 3121, et seq., Pen Registers and Trap and Trace Devices.

We recommend that the Assistant Director, Office of Investigations, United States Secret Service develop and implement internal controls to ensure cell-site simulator users differentiate between cell-site simulator-policy defined exigent circumstances and 18 U.S.C. 3125-defined emergency situations to comply with 18 U.S.C. 3121, et seq., Pen Registers and Trap and Trace Devices.

We recommend that the Assistant Director, Cyber and Operational Technology, U.S. Immigration and Customs Enforcement develop and implement internal controls to ensure cell-site simulator users differentiate between cell-site simulator policy-defined exigent situations and 18 U.S.C. 3125-defined emergency circumstances to comply with 18 U.S.C. 3121, et seq., Pen Registers and Trap and Trace Devices.

We recommend that the Assistant Director, Cyber and Operational Technology, U.S. Immigration and Customs Enforcement develop and implement internal controls to ensure cell-site simulator data deletion is accurately documented in the Incident Case Management system.

We recommend that the Assistant Director, Cyber and Operational Technology, U.S. Immigration and Customs Enforcement develop and implement internal controls to ensure cell-site simulator data deletion is accurately documented in the Incident Case Management system.

We recommend that the Assistant Director, Cyber and Operational Technology, U.S. Immigration and Customs Enforcement develop and implement internal controls to ensure privacy compliance documentation is completed and approved before developing or procuring information technology that collects, maintains, or disseminates information in identifiable form.

We recommend that the Assistant Secretary of Commerce for Communications and Information and NTIA Administrator direct FirstNet Authority's Chief Executive Officer and Chief Procurement Officer to modify the current QASP to ensure that NPSBN contract QASP items, for TOs 6 and 7, ae complete and sufficiently detailed to measure the contractor's performance regarding the quality of NPSBN services expected to be provided for the respective TOs.

We recommend that the Assistant Secretary of Commerce for Communications and Information and NTIA Administrator direct FirstNet Authority's Chief Executive Officer and Chief Procurement Officer to ensure the QASP is adequately updated for future reinvestment TOs and QASP items are complete and sufficiently detailed to measure the contractor's performance regarding the quality of NPSBN services expected to be provided for the TOs.

We recommend that the Assistant Secretary of Commerce for Communications and Information and NTIA Administrator direct FirstNet Authority's Chief Executive Officer and Chief Procurement Officer to ensure that any personnel conducting surveillance activities on the NPSBN are appointed, in writing, and complete any necessary training and certifications as required by the Commerce Acquisition Manual and/or the Federal Acquisition Regulation.

We recommend that the OCIO develop and implement a process to evaluate all systems' Authorizations to Operate annually for accuracy and completeness to ensure systems are operating with a valid authorization determined by actual residual risk.

We recommend that the OCIO develop and implement a process to conduct quality control reviews at least annually to ensure that all systems within the official system of record (Cyber Security Assessment and Management system) have an accurate operating status.

We recommend that the OCIO, in addition to ongoing continuous monitoring, develop and implement a policy to direct system owners to test all of the controls for their systems at least every 3 years.

We recommend that the OCIO develop and implement a policy to verify that bureaus and offices perform control assessments every 3 years.

We recommend that the OCIO develop and implement a review process that includes, at minimum, verifying that system owners have completed required testing for a sample of controls for each system before accepting the annual assurance statement.