Open Recommendations

We recommend that OIT update policies and procedures to require OIT management’s approval of commands during troubleshooting activities that result in a factory reset of Capstone officials’ devices, and verification that appropriate device logs and forensic data have been collected and retained beforehand.

Remove the six identified deceased participants from benefit pay status and take other actions, as appropriate.

Coordinate with the OIG to periodically run DNP as needed.

Develop and implement a formal process for defining, documenting, and maintaining its cybersecurity target profile(s).

Develop and formalize thresholds or target values for key cybersecurity and risk performance metrics, at a minimum, in the following areas:
Cybersecurity risk management program;
Data exfiltration and enhanced network defenses;
Information security continuous monitoring (ISCM) policies, strategy, and
processes; and
Incident detection, analysis, handling, and response activities.

Develop and implement detailed procedures to support its existing supply chain risk management policy and implementation plan.

Establish policies and standards for data classification, quality, access, lifecycle management, and metadata management.

Identify the baseline knowledge, skills, and abilities required for STB's cybersecurity workforce, conduct an assessment to determine any skill gaps, and customize specialized training to address the identified deficiencies.

The Chief Information Officer should timely remediate GSS BDA vulnerabilities in accordance with IRS policies.

The Chief Information Officer should ensure that all configurations for GSS BDA assets adhere to federal and IRS policies.

The Chief Information Officer should ensure the asset discovery tool is properly configured to the source data to accurately account for all GSS BDA assets.

(U) Rec. 1: Report is Classified.

(U) Rec. 1: The DoD OIG recommended that the Director of the Defense Security Cooperation Agency revise Defense Security Cooperation Agency Manual 5105.38-M to address DoD storage of benefiting partner-owned items. The revisions should address situations where benefiting partners cannot immediately receive items and should specify how the DoD should segregate and store these items to prevent incorrect accounting on DoD property records.

Update WCF customer documentation to provide a clear understanding of how their advance payments are used regarding what services were provided and at what costs for both estimated and actuals.

Review and take corrective action to address the approximately $1.2 million in questioned costs based on errors and unsupported charges included in customer bills.

Review and take corrective action to address the approximately $443,062 in questioned costs based on issues with WCF-funded employees' salaries, benefits, and bonuses identified in the report.

Reassess DOT's WCF management structure to evaluate how best to consolidate it under one central office to better promote and provide for economy and efficiency in WCF activities.

Develop and implement a written standard operating procedure to accurately track and maintain DOT's WCF-funded employees-including a regular assessment of employees' work contributions to the delivery of WCF services to customers.

Document and implement the policy and decision tree the WCF Improvement Project reported it is developing to help better determine what positions should be WCF-funded.

Formally institute the workforce planning system the WCF Improvement Project reported it is working to implement to better track and oversee each WCF-funded employee.

We recommend the Acting Assistant Secretary for Employment and Training establish a policy that requires evaluation criteria or standards to be used to ensure grant applications include evidence of a specific issue prior to awarding a grant intended to address said issue.

We recommend the Assistant Secretary for Employment and Training develop additional guidance and staff training to improve monitoring of grant recipients, including a focus on reviewing progress reports to ensure reporting complies with requirements and grant recipients are on target to achieve grant goals as identified in the grant agreement.

We recommend the Assistant Secretary for Employment and Training review $2,827,736 in costs for grant projects that did not achieve project goals and recover funds where appropriate.

We recommend the Acting Assistant Secretary for Employment and Training develop guidance for planning new discretionary grant programs to ensure better coordination, minimize duplication of effort, and promote more efficient use of grant funds.

Automate Postal Service Form 1571, Undelivered Mail Report, for delayed mail reporting in the Delivery Condition Visualization system and require carriers to use the automated format at the end of the day to report undelivered mail.