Open Recommendations

This recommendation is Sensitive But Unclassified.

This recommendation is Sensitive But Unclassified.

This recommendation is Sensitive But Unclassified.

This recommendation is Sensitive But Unclassified.

This recommendation is Sensitive But Unclassified.

This recommendation is Sensitive But Unclassified.

This recommendation is Sensitive But Unclassified.

This recommendation is Sensitive But Unclassified.

This recommendation is Sensitive But Unclassified.

We recommend the Executive Assistant Commissioner for the Office of Field Operations to enhance the existing process by conducting a documented semiannual review to ensure the daily risk assessments in the cruise ship environment remain effective. This semiannual review should include a thorough review of risk assessment methodologies, data quality, and operation effectiveness.

We recommend the National Incident Command Center Logistics Section coordinate with the Border Patrol and the DOD to identify and document appropriate functions and steps to effectively use DOD support in the “Operation Homeland Resolve Strategic Approach” and the “Departmental migration resource and response plan,” directed by former DHS Secretary Mayorkas in his October 27, 2023, memorandum.

We recommend the Chief, Border Patrol, regularly and continuously refine strategies to incorporate demographic information of aliens approaching the Southwest border in the allocation of Border Patrol facility holding units.

We recommend the National Incident Command Center Logistics Section document the communication and use of resource request tracking tools, such as WebEOC, in the “Operation Homeland Resolve Strategic Approach” and the “Departmental migration resource and response plan.”

We recommend that the NRC complete the implementation of CSF 2.0 requirements, and develop and maintain current and target CSF profiles that anticipate changes in the NRC’s cybersecurity posture.

We recommend that the NRC coordinates with its software producers to obtain Secure Software Development Attestation Forms. If the NRC is unable to obtain the self-attestation forms, it should request POA&Ms from the software producers and submit them to the OMB, in accordance with OMB Memorandum M-23-16 and EO 14028 self-attestation requirements.

We recommend that the NRC request an extension or a waiver from the OMB for continued use of the producer’s software when a self-attestation is not provided, in accordance with OMB Memorandum M-23-16 and EO 14028 self-attestation requirements.

EXIM OIG recommends the Office of Board-Authorized Finance update its policies and procedures to consider additional documentation on the status of collateral as part of the scheduled or ad hoc credit risk reviews. These updates should include information on inspections or site visits performed as well as the appropriateness of maintaining a one level improvement on the Budget Cost Level.

Establish and implement guidance for performing Cybersecurity Framework 2.0 activities through policies and procedures, including the development of current and target cybersecurity profiles which consider anticipated changes in DOT's cybersecurity posture.

Work with FAA CIO to secure a reliable funding stream for continuous vetting.

Work with FAA CIO to initiate and complete the background investigation of FAA employees in public trust positions.

Work with FAA CIO to enroll FAA employees into continuous vetting through Trusted Workforce.

Document policies and procedures for developing and maintaining a comprehensive and accurate inventory of data and the corresponding metadata for DOT's data types.

Create and maintain a comprehensive inventory of data and corresponding metadata.

Define and implement policies and procedures that utilize standard data elements and taxonomy to develop and maintain an up-to-date inventory of all software assets and associated licenses, including Executive Order-critical software.

Require and document its justification when the agency chooses to forgo its existing agency-wide grant monitoring procedures–such as site visits and risk-based reviews of source documentation.