Open Recommendations

We recommend the Assistant Secretary for Employee Benefits Security reduce or eliminate exemption thresholds for small plans.

We recommend the Chief Information Officer, in conjunction with each program office, develop and implement a comprehensive, systematic process to determine when a MS Access application or database should be recognized as an IT system.

We recommend the Chief Information Officer, in conjunction with each program office: Determine all MS Access databases containing PII and ensure they are: (a) encrypted in storage and transmission; and (b) password-protected in accordance with NARA Directive 1608 and the Privacy Act.

Develop and implement a process, for future MS Access applications and databases created by program offices, including notification to and approval from the Office of Information Services for those that are mission-critical and/or contain PII or otherwise sensitive information.

Competition Advocate, in collaborations with the CAO, develop and implement procedures to promote the acquisition of commercial items and report annually new initiatives to the CAO and SPE.

CAO ensure NARA 501 NARA Procurement policy and NARA’s General Acquisition Policy addresses procurements related to Architecture/Engineering and Construction.

CAO, in collaboration with CFO, Director of Acquisitions, and program managers, develop and implement procedures for proper planning of new contracts with NARA funds.

CAO and SPE develop and implement test plans and procedures to assess internal control over acquisition activities and programs using OMB Memorandum, Conducting Acquisition Assessments.

CAO modify procedures to ensure all contracting activity, including Architecture/ Engineering, construction services are included in random selections for internal control reviews.

CAO include CO’s who are not GS1102’s, COR’s and P/PM’s in the internal control program test plan.

CAO establish various performance metrics to be tracked and analyzed on how long the acquisition takes, where delays occur and why delays occur.

CAO develop and implement meaningful and measurable performance metrics to continually assess the performance of the acquisition function in supporting NARA’s mission and achieving acquisition goals.

CAO ensure NARA 501 NARA Procurement policy include guidance to program offices on their responsibilities in the procurement process.

CAO formally appoint a SPE and procurement officials who are authorized to approve warrants over $100,000,000 and approve warrant for construction and architectural-engineering services contracting officers.

Grant Thornton recommends that OPM document access rights to systems to include roles, role descriptions, and privileges / activities associated with each role and role or activity assignments that may cause a segregation of duties conflict.

Grant Thornton recommends that OPM ensure termination processes (e.g., return of PIV badges and IT equipment, completion of Exist Clearance Forms and completion of exit surveys) are followed in a timely manner and documentation of completion of these processes is maintained.

Grant Thornton recommends that OPM review audit logs on a pre-defined periodic basis for violations or suspicious activity and identify individuals responsible for follow-up or evaluation of issues to the Security Operations Team for review. The review of audit logs should be documented for record retention purposes.

Grant Thornton recommends that OPM system owners establish a methodology to systematically track all configuration items that are migrated to production, and be able to produce a complete and accurate listing of all configuration items for both internal and external audit purposes, which will in turn support closer monitoring and management of the configuration management process.

Grant Thornton recommends that OPM enforce existing policy requiring mandatory security configuration settings, developed by OPM or developed by vendors or federal agencies, are implemented and settings are validated on a periodic basis to ensure appropriateness.

Grant Thornton recommends that OPM establish a means of documenting a list of users with significant information system responsibility to ensure the listing is complete and accurate and the appropriate training is completed.

Grant Thornton recommends that OPM perform a comprehensive review of the appropriateness of personnel with access to systems at the Agency's defined frequencies.