Open Recommendations

Implement improved processes for leveraging dashboards in order to monitor and manage patch compliance and remediation of vulnerabilities including the tracking of approved and unapproved software.

Complete the 2024 backlog of overdue reinvestigations.

Document and implement a process for notifying OHR to add the initial role-based security training requirement to the learning profile in the learning management system for new hires requiring the training

Complete implementation of the new alternate processing and storage site to a fully operational state.

Collaborate with the Bureau of Labor Statistics to track and report data specific to mixed earners in the U.S. economy to allow for the provision of timely and useful assistance to the mixed earner population during future emergencies.

Monitor the state workforce agencies’ levels of benefit payment activity and establish timeframes to reduce the remaining allotment to the sufficiently minimal amount required to meet future benefit payment needs and ensure the remaining Mixed Earners Unemployment Compensation funds are expended appropriately or returned to Treasury.

Perform an assessment of previous emergency unemployment insurance (UI) programs and the pandemic-related UI programs to determine an appropriate historically-based time limit for states’ acceptance of emergency program benefit claims after the expiration of the UI programs’ eligibility periods and consider making a legislative proposal to Congress to use the determined the time limit on future emergency programs.

Develop a process to regularly monitor data assets submitted by components to further comply with GDA subsections 759(a)(2) and 759(a)(6), including: (1) ensure data assets are submitted with the appropriate metadata and, (2) are uploaded to the GeoPlatform as required.

We recommend that Novitas develop and deliver education to auditors and supervisors regarding applicable criteria and review requirements.

(U) Rec. 2: The DoD OIG recommended that the Director of the Defense Security Cooperation Agency, in coordination with the Military Services, update Defense Security Cooperation Agency guidance to include processes for the Services to check the quality and quantities of presidential drawdown items before the items leave the United States, in situations where U.S. personnel will not directly oversee the transfer of items to the receiving country.

We recommend that OSMRE provide training to grants management specialists on conducting thorough risk assessments, including guidance on identifying and analyzing single audit findings.

We recommend that OSMRE develop and implement a long-term staffing plan for grants management specialists that considers existing resources, Infrastructure Investment and Jobs Act funding, and OSMRE's priorities and goals.

We recommend that OSMRE create and implement a mechanism to track and monitor all key dates for processing applications, modifications, and authorizations to proceed to ensure processing dates are met.

We recommend that OSMRE design and implement an updated risk assessment checklist that requires grants management specialists to document consideration of applicable risk factors and document any mitigating measures for each risk factor identified.

We recommend that OSMRE develop and provide to grant applicants guidance on prioritization of projects for the Justice40 Initiative.

We recommend that OSMRE develop and provide to grant applicants guidance on expectations of subrecipient and contractor monitoring.

We recommend that OSMRE develop and provide to grant applicants guidance on information required for OSMRE to compile its Infrastructure Investment and Jobs Act report submission to Congress.

The Chief Information Officer should ensure that separation of duty controls reflect NIST guidance and require that all cloud systems have a unique System Owner and AO or AO Designated Representative.

The Chief Information Officer should ensure that the cloud system immediately completes its pilot program and that an ATO memorandum is approved for the system to remain in production.

The Chief Information Officer should ensure that management approvals are consistent and documented per the requirements for cloud systems.

The FBI devise and implement a plan to ensure that it meets all of the requirements of the e-Recording Policy.

The DEA and FBI include discussion of the e-Recording Policy in the curricula of trainings provided to TFOs.

The ATF, DEA, FBI, and USMS provide their personnel refresher training on the e-Recording Policy, including the policy's allowable exceptions to recording.

The ATF, DEA, FBI, and USMS provide their personnel refresher training on the e-Recording Policy, including the policy's allowable exceptions to recording.

The ATF, DEA, FBI, and USMS provide their personnel refresher training on the e-Recording Policy, including the policy's allowable exceptions to recording.