Open Recommendations

2. Immediately restore off-site storage of backup tapes and implement a strategy that will ensure that the Agencyconsistently stores backups of its systems at an off-site location. Additionally, explore alternative methods of off-site backup that can be performed automatically and do notrequire physical intervention by CSB personnel, such as storing backups in the cloud.

We recommend that the New York City provider refund to the Medicare program the estimated $1,118,789 overpayment.

We recommend that the New York City provider based upon the results of this audit, exercise reasonable diligence to identify, report, and return any overpayments in accordance with the 60-day rule and identify any of those returned overpayments as having been made in accordance with this recommendation.

We recommend that the New York City provider develop policies and procedures to ensure that: o treatment plans contain all required elements, are maintained and are signed by the treating physician, o the performing therapists and supervising physicians comply with the requirements related to incident-to services, o psychotherapy services are conducted by therapists that meet Medicare qualification requirements, o time spent on psychotherapy services is documented, and o treatment notes are signed and maintained to support the services billed.

CMS should Encourage Part D plans to increase access to and use of biosimilars.

CMS should Monitor Part D plans’ submitted formularies to determine whether they discourage beneficiaries from using biosimilars

(U) Rec. 2.b: The DoD OIG recommended that the Under Secretary of Defense for Intelligence and Security develop operations security training requirements on the risks of sharing DoD information on non-DoD-controlled systems and add these requirements to the existing training requirements described in DoD Instruction 8170.01, Online Information Management and Electronic Messaging, August 24, 2021, and DoD Directive, 5205.02E, DoD Operations Security (OPSEC) Program, June 20, 2012, (Incorporating Change 2, August 20, 2020).

(U) Rec. 3.a: The DoD OIG recommended that the Commanders of the U.S. Africa Command, U.S. Central Command, U.S. European Command, U.S. Indo-Pacific Command, and U.S. Southern Command issue command-level guidance clarifying the use of non-DoD-controlled electronic messaging systems. This guidance should include: i. any area of responsibility-specific conditions that permit personnel to use non-DoD-controlled messaging systems; ii. what information can be shared over the electronic messaging system; iii. how personnel are to maintain records generated on non-DoD systems in accordance with records management regulations; iv. how to report any security violations or misuse of a system; v. a process…

(U) Rec. 3.a: The DoD OIG recommended that the Commanders of the U.S. Africa Command, U.S. Central Command, U.S. European Command, U.S. Indo-Pacific Command, and U.S. Southern Command issue command-level guidance clarifying the use of non-DoD-controlled electronic messaging systems. This guidance should include: i. any area of responsibility-specific conditions that permit personnel to use non-DoD-controlled messaging systems; ii. what information can be shared over the electronic messaging system; iii. how personnel are to maintain records generated on non-DoD systems in accordance with records management regulations; iv. how to report any security violations or misuse of a system; v. a process…

(U) Rec. 3.b: The DoD OIG recommended that the Commanders of the U.S. Africa Command, U.S. Central Command, U.S. European Command, U.S. Indo-Pacific Command, and U.S. Southern Command establish risk assessment procedures to evaluate and monitor combatant command use of current and emerging information technologies to identify opportunities for use and to assess risks in accordance with DoD Instruction 8170.01, "Online Information Management and Electronic Messaging," August 24, 2021.

(U) Rec. 3.b: The DoD OIG recommended that the Commanders of the U.S. Africa Command, U.S. Central Command, U.S. European Command, U.S. Indo-Pacific Command, and U.S. Southern Command establish risk assessment procedures to evaluate and monitor combatant command use of current and emerging information technologies to identify opportunities for use and to assess risks in accordance with DoD Instruction 8170.01, "Online Information Management and Electronic Messaging," August 24, 2021.

(U) Rec. 3: Recommendation is Classified.

(U) Rec. 4: Recommendation is Classified.

[Description omitted; CSOSA has determined that this recommendation contains information that is limited official use or classified.]

[Description omitted; CSOSA has determined that this recommendation contains information that is limited official use or classified.]

[Description omitted; CSOSA has determined that this recommendation contains information that is limited official use or classified.]

[Description omitted; CSOSA has determined that this recommendation contains information that is limited official use or classified.]

Ensure that the Cloud Resource Center's inventory of cloud projects in the configuration and production phases is comprehensive and periodically maintained.

Develop and implement a process to ensure that the FedRAMP Project Management Office has an accurate inventory of FedRAMP-approved cloud systems used by the Board.

Ensure that the Board’s information security continuous monitoring standards and associated procedures provide consistent guidance on continuous monitoring frequencies and associated documentation review requirements for cloud service providers.

Require the SAAO to develop and implement a policy to ensure Operating Administrations (OA) meet Uniform Guidance's requirements for Federal awarding agencies.

Require the SAAO to develop and implement processes to ensure that OAs confirm its recipients' single audits and reporting packages are completed and timely submitted to the Federal Audit Clearinghouse (FAC).

Require the SAAO to develop and implement processes that ensure OAs download single audit reports from FAC's Image Management System and OAs identify and track single audit findings directly related to their programs.

Require the SAAO to develop and implement processes that ensure OAs issue timely management decisions on all single audit findings affecting their programs.

Require the SAAO to develop and implement processes that ensure OAs follow up on single audit findings and verify that OAs recipients took appropriate and timely corrective actions.