Open Recommendations

We recommend the Assistant Secretary of Labor for Mine Safety and Health: Develop MSHA guidance that sets expectations for MSHA’s: (1) support of mine rescue contests and (2) timely response to contest preparers’ requests. Then, notify the mining industry about these identified expectations.

We recommend the Assistant Secretary of Labor for Mine Safety and Health: Conduct a gap analysis between what MSHA uses for a wireless underground communications system and the systems used by the mining industry and develop a mitigation plan for any identified gaps. Communicate the results of the gap analysis and mitigation plan to the mining industry and, if appropriate, to Congress.

Take corrective action on the remaining three of seven instances that led to about $612,000 in improper payments.

Update the Veterans Benefits Administration’s Adjudication Procedures Manual to clarify and strengthen the actions claims processors should take to verify foreign beneficiaries are alive.

Ensure jurisdiction guidance for routine reviews for residents in the Philippines is clearly communicated to all regional offices.

Provide guidance to assist claims processors in verifying information in the Veterans Benefits Administration’s systems compared to the results from the Social Security Administration inquiry results.

Update the Adjudication Procedures Manual to require claims processors to upload the Social Security Administration inquiry results to beneficiaries’ records.

Take corrective action on the remaining three of seven instances that led to about $612,000 in improper payments.

Update requirements provided to the VA Hines Information Technology Center to ensure all foreign beneficiaries, including those with an address in the Philippines, are included in the annual end product generation.

Update the Veterans Benefits Administrations Adjudication Procedures Manual to clarify and strengthen the actions claims processors should take to verify foreign beneficiaries are alive.

Ensure jurisdiction guidance for routine reviews for residents in the Philippines is clearly communicated to all regional offices.

Provide guidance to assist claims processors in verifying information in the Veterans Benefits Administrations systems compared to the results from the Social Security Administration inquiry results.

Update the Adjudication Procedures Manual to require claims processors to upload the Social Security Administration inquiry results to beneficiaries records.

We recommend that for future broadband grant programs administered by NTIA, the Associate Administrator for NTIA, Office of Internet Connectivity and Growth, ensure that the program office conducts reviews to confirm that initial, merit, and programmatic reviews are completed, ensuring applications meet program requirements.

We recommend that for future broadband grant programs administered by NTIA, the Associate Administrator for NTIA, Office of Internet Connectivity and Growth, ensure that training is developed and implemented for grant file reviewers that, at a minimum, addresses the responsibility for (1) evaluating applications and (2) maintaining official grant award files that are consistent and complete.

We recommend that for future broadband grant programs administered by NTIA, the Associate Administrator for NTIA, Office of Internet Connectivity and Growth, ensure that following the implementation of the training (described in recommendation 3), grant file reviewers complete the training and retain documentation in the grant files that support that the training was completed.

We recommend that the Associate Administrator for NTIA, Office of Internet Connectivity and Growth develop milestones and performance metrics for reviewing future broadband program planning phase deliverables during program planning and design as required by Office of Management and Budget circular A-11. The performance metrics should be specific, measurable, achievable, relevant, and timely for measuring performance against the established review timelines.

We recommend that for future broadband grant programs administered by NTIA, the Associate Administrator for NTIA, Office of Internet Connectivity and Growth, ensure that NTIA FPOs confirm that the official award files are complete and accurate before they are submitted to the grants officer.

We recommend the DHS Office of the Chief Information Officer implement all necessary mobile device security countermeasures in accordance with guidance from DHS and the Defense Information System Agency’s Security Technology Implementation Guides.

We recommend I&A’s Directorate of Technology and Data Services implement controls to address identified custom-developed application vulnerabilities and weaknesses.

We recommend the DHS Office of the Chief Information Officer develop and implement policies and procedures to ensure component custom-developed applications have been evaluated and do not have unmitigated vulnerabilities.

We recommend the DHS Office of the Chief Information Officer remove applications from component mobile devices that are prohibited by DHS policy, applications with unmitigated security risk, and applications that do not meet business needs.

We recommend the DHS Office of the Chief Information Officer develop and implement policies and procedures to ensure: • all user-installed applications are evaluated for security risks to the mobile device or data security and for compliance with Department policy before allowing their use; and • user-installed applications are managed and monitored on a routine basis.

We recommend the DHS Office of the Chief Information Officer develop and implement policies and procedures to improve the vulnerability management process and to ensure: • tools used for credentialed scans can detect known vulnerabilities; • credentialed scans are completed and assessed in accordance with DHS guidance; • plans to address vulnerabilities are created and implemented promptly in accordance with DHS guidance; and • the risk of noncompliant enterprise-level system settings is formally accepted or mitigated.

We recommend I&A’s Directorate of Technology and Data Services update its policies and procedures for notification of official foreign travel to incorporate DHS Office of the Chief Information Officer guidance and ensure mobile devices receive proper authorization for international travel.