Open Recommendations

Develop and finalize policies and procedures that address cyber threat information
sharing. These policies and procedures should, at a minimum, include:
*Formally documenting internal and external sharing practices, clarifying the
criteria and threshold to inform individual credit unions or external stakeholders
of a cyber threat, and clarifying the method and timing of informing credit unions
or external stakeholders.
*Determining the criteria for internal assessment for escalation and communication
of cyber threat information.

Formally establish and clarify operational roles and responsibilities across offices for
cyber threat information sharing and any delegation of authorities to determine when
issues must be escalated. This should, at a minimum, address:
*Establishing operational responsibilities at all stages of cyber threat-related
events, including pre-incident declaration.
*Clarifying delegation of authorities for efficient and timely decision making and
issue escalation.
*Identifying single point dependencies and addressing appropriate resourcing.
*Determining appropriate communication and coordination protocols between
offices.

Ensure timely finalization and implementation of recommendations identified in the after-action and lessons learned reports for cyber-related incidents, including the draft (b)(8) after-action report and the draft pre-victim notification lessons learned report.

Update and document incident reporting triage protocols to provide consistent and
useable data in the Cyber Incidents for Credit Unions Reporting System.

Document and implement internal data management protocols that ensure the appropriate
sharing, assessment, and response of available cyber threat information.

Evaluate and determine if cyber threat information in suspicious activity reports should
be used in NCUA’s general examination and supervision of credit unions.

Develop a process to assess credit unions' and other stakeholders' feedback on NCUA's cyber threat information sharing and update information sharing processes to reflect any necessary changes.

Ensure the Office of Examination and Insurance provides timely updates to examination and supervisory guidance to address cyber risks.

We recommend that the Acting Commandant of the Coast Guard conduct an analysis to determine how best to use available resources in District 8 to increase its IUU fishing interdiction rate.

We recommend that the Acting Commandant of the Coast Guard develop and implement a measurable performance goal for IUU fishing enforcement on the high seas or within the EEZ of another nation.

We recommend FEMA’s Grant Programs Directorate Assistant Administrator develop and implement an agreed-upon process to establish and report Operation Stonegarden grant performance measures and targets to the Office of National Drug Control Policy.

We recommend FEMA’s Grant Programs Directorate Assistant Administrator develop and implement a methodology for estimating the percentage of Operation Stonegarden grant funds used for drug enforcement activities.

We recommend FEMA’s Grant Programs Directorate Assistant Administrator develop and implement a process in coordination with CBP to obtain and review Operation Stonegarden grant performance information reported to Office of National Drug Control Policy.

The Office of Programs should develop and document new procedures to reflect the Program Evaluation and
Management Services’ representative payee monitoring responsibilities as a result of Board Order 21-31, or
work with the Bureau of Field Service to update Field Operations Manual 1 1450 to ensure complete and
timely monitoring, for all the annual representative payee monitoring cycles;

The Office of Programs should determine the appropriate number of full-time equivalent Program Evaluation and
Management Services employees that are needed to effectively perform representative payee monitoring each year;

The Office of Programs should if needed, reassign or hire additional employees
to assist with the annual representative payee monitoring;

The Office of Programs should provide applicable Program Evaluation and Management Services’ employees
(those assigned to conduct the annual rep payee monitoring) with the appropriate access to the third party system
used to conduct background checks; and

The Office of Programs should design and implement a process to periodically analyze the results of
representative payee monitoring cycles to ensure the effectiveness of representative payee monitoring.

The Office of Programs Should determine if annual refresher training is needed for its employees assigned
to representative payee monitoring to ensure that representative payee cases are completed timely;

The Office of Programs should request that Bureau of Field Service assign trained and experienced
representative payee monitoring employees to supplement Program Evaluation and Management Services
to ensure all backlogged fiscal year 2022 representative payee monitoring cases are completed as soon as possible.
If this is not feasible, obtain additional support based on management’s decision (e.g., contractors, other agency bureaus, etc.);

The Office of Programs should complete all fiscal year 2022 backlogged representative payee monitoring cases; and

The Office of Programs should implement procedures to ensure that all representative payee monitoring cases
in each annual cycle are completed before the next annual cycle begins.

Work with Vendor One to remediate (or accept the risks associated with) the vulnerabilities identified with its charging stations.

Work with Vendor Two to remediate (or accept the risks associated with) the vulnerabilities identified with its charging stations.

Work with Vendor Three to remediate (or accept the risks associated with) the vulnerabilities identified with its charging stations.