Open Recommendations

7. We recommend the Undersecretary of Commerce for Industry and Security direct BIS’s Chief Information Officer to implement a security control to allow only approved software on Network B and consider implementing this control for all BIS networks.

8. We recommend the Undersecretary of Commerce for Industry and Security direct BIS’s Chief Information Officer to review all BIS user access, for networks and applications, to ensure each user is assigned the correct levels of access according to the principle of least privilege.

9. We recommend the Undersecretary of Commerce for Industry and Security direct BIS’s Chief Information Officer to immediately search BIS networks for classified credentials and establish a procedure to regularly search for plain-text credentials.

10. We recommend that the Undersecretary of Commerce for Industry and Security direct BIS’s Chief Information Officer to ensure passwords are disabled for all user accounts as soon as operationally possible.

11. We recommend that the Undersecretary of Commerce for Industry and Security direct BIS’s Chief Information Officer to establish and implement BIS helpdesk procedures for user access issues, including a user verification process.

12. We recommend that the Undersecretary of Commerce for Industry and Security direct BIS’s Chief Information Officer to implement an automated solution to change local administrator credentials after sharing them with BIS users and use different local administrator passwords for each system.

13. We recommend that the Undersecretary of Commerce for Industry and Security direct BIS’s Chief Information Officer to implement a technical control to generate unique, strong passwords for each account created.

Facility leaders determine appropriate supply storage locations, and for any suppliesstored outside these defined locations, implement a process to ensure staff identifyand remove expired supplies.

Facility leaders ensure video laryngoscope supplies are readily available and notexpired.

The Director ensures staff keep patient care areas clean and safe.

The Director ensures staff complete required preventive maintenance forbiomedical equipment.

Facility leaders develop service-level workflows and processes to monitorcommunication of test results to patients.

USDA OIG has determined that this recommendation contains sensitive information and will not be publicly released due to privacy concerns.

USDA OIG has determined that this recommendation contains sensitive information and will not be publicly released due to privacy concerns.

USDA OIG has determined that this recommendation contains sensitive information and will not be publicly released due to privacy concerns.

Review existing financial advisory and consulting services Receivership Basic Ordering Agreements and take appropriate steps to establish an adequate supply of contractors with appropriate resources to address the FDIC’s future procurement needs in the event of financial institution failures and financial crises.

Establish a process to periodically review financial advisory and consulting services Receivership Basic Ordering Agreements to ensure sufficient contractor resources are available to meet the FDIC’s mission-critical needs.

Establish an upfront pricing framework or advanced pricing within all financial advisory and consulting service Receivership Basic Ordering Agreements.

Establish an emergency response acquisition team with appropriate FDIC personnel and ensure that a dedicated team of key individuals (including Technical Monitors) is available to carry out emergency procurement procedures.

Develop and implement periodic emergency procurement testing exercises for appropriate FDIC employees.

Establish a process for emergency procurements to document and maintain analysis, decisions, and commitments, to include, at a minimum, those identified in this report.

Develop and implement a process to analyze and determine when documented deliverables should be required on emergency service contracts to ensure contract personnel have the ability and resources to oversee contractor performance.

Perform retrospective reviews when the FDIC conducts or tests emergency acquisition procedures.

Review the work performed and information used by the four non-U.S. citizens and take appropriate action.

Provide training and guidance to its Executive Management and personnel reinforcing their roles and responsibilities in carrying out and overseeing the FDIC’s emergency acquisition procedures. This training and guidance should include, at a minimum, the following:
• understanding roles and responsibilities;
• initiating and performing emergency and expedited procedures; and
• initiating, modifying, approving, and submitting requirements packages.