Open Recommendations

(U) Rec. 2.a: The DoD OIG recommended that the Commander, 1st Security Force Assistance Brigade, in coordination with the Commander, U.S. Army South. establish and implement measures of performance and measures of effectiveness to assess the execution of securityforce assistance tasks in the Army Support Campaign Plans, as required by Army Techniques Publication 3-96.1.

(U) The DoD OIG recommended that the Commander, 2nd Security Force Assistance Brigade, in coordination with the Commander, U.S. Southern European Task Force-Africa. establish and implement measures of performance and measures of effectiveness to assess the execution of security force assistance tasks in the Army Support Campaign Plans, as required by Army Techniques Publication 3-96.1.

We recommend the Vice President, River Operations, develop a plan to prioritize and complete overdue inspections.

We recommend the Vice President, River Operations, emphasize the importance of recording the correct completion date for informal inspections.

We recommend the Vice President, River Operations, evaluate the open recommendations and determine a priority and schedule for completion.

We recommend the Vice President, River Operations, evaluate the engineering task list and determine if open items should be closed, addressed, or left on the list.

We recommend the Vice President, River Operations, revise operations, maintenance, and inspection manuals to include an accurate listing of required inspections for all dams.

We recommend the Vice President, River Operations, add required frequency for all inspections.

We recommend the Vice President, River Operations, emphasize the importance of reviewing required weekly inspections and inspecting all monthly checklist items for supplemental inspections.

(U) Rec. 1: Report is Classified.

Revise the registration and fee assessment processes to provide reasonable assurance that the data PHMSA uses to assess registration fees are accurate and verifiable.

Develop and implement a better registration and fee process to ensure data quality. This should include features that can automatically identify potential data problems and make improvements to the system's data fields and controls.

Verify that Appleseeds Tapuach Association for Advancement of the Information Age corrects the one instance of material noncompliance detailed on pages 24-26 of the audit report.

(U) Rec. 1: The DoD OIG recommended that the Chief of Naval Operations, in coordination with the Commander of the U.S. Transportation Command and the Maritime Administrator of the U.S. Department of Transportation, conduct an annual review of the current recapitalization strategy, revise the strategy based on known limiting factors, and develop viable milestones based on those factors to ensure that the Navy is capable of meeting readiness requirements in the event of a contingency.

We recommended the Assistant Secretary for Information and Technology consistently implement an improved continuous monitoring program in accordance with the National Institute of Standards and Technology (NIST) Risk Management Framework (RMF). Specifically, implement an independent security control assessment process to evaluate the effectiveness of security controls prior to granting authorization decisions.

We recommended the Assistant Secretary for Information and Technology implement improved processes for reviewing and updating key security documentation, including Security Control Assessments, Risk Assessments, and Privacy Impact Assessments as needed. Such updates will ensure all required information is included and accurately reflects the current environment, new security risks, and applicable federal standards.

We recommended the Assistant Secretary for Information and Technology implement improved processes to ensure System Security Plans reflect the status of security control implementations and risks are accurately reported to support a comprehensive risk management program across the organization.

We recommended the Assistant Secretary for Information and Technology implement improved mechanisms to ensure system owners and Information System Security Officers follow procedures for establishing, tracking, and updating Plans of Action and Milestones (POA&Ms) for all known risks and weaknesses including those identified during security control assessments.

We recommended the Assistant Secretary for Information and Technology implement measures to ensure that system stewards and other officials responsible for system level POA&Ms are closing items with relevant support that shows sufficient remediation of the identified weakness.

We recommended the VA Office of Personnel Security, Human Resources, and Contract Offices strengthen processes to ensure appropriate levels of background investigations are performed timely and completed for applicable VA employees and contractors.

We recommended the Office of Personnel Security, Human Resources, and Contract Offices implement improved processes for establishing and maintaining accurate investigation data within VA systems used for background investigations.

We recommended the Assistant Secretary for Information and Technology ensure contingency plans for all systems and applications are updated and tested in accordance with VA requirements.

We recommended the Assistant Secretary for Information and Technology implement improved procedures to ensure that system outages are resolved within stated recovery time objectives.

We recommended the Assistant Secretary for Information and Technology ensure system owners consistently implement processes for periodic reviews of user account access. Remove unnecessary and inactive accounts on systems and networks.

We recommend the Assistant Secretary for Information and Technology coordinate with system owners and local system management to ensure the consistent monitoring and reviewing of privileged accounts, service accounts, and accounts for individuals with access to source code repositories are performed across VA systems and platforms.