Open Recommendations

KPMG recommends that the OCIO document and map access rights in OPM systems to personnel roles and functions, following the principle of 'least privilege'.

KPMG recommends that the OCIO enhance OPM’s information security control monitoring program to detect information security control weaknesses by: • Implementing and monitoring procedures to ensure system access is appropriately granted to new users, consistent with the OPM access approval process; and Monitoring the process for the identification and removal of separated users to ensure that user access is removed timely upon separation; implementing procedures to ensure that user access, including user accounts and associated roles, are reviewed on a periodic basis consistent with the nature and risk of the system, and modifying any necessary accounts identified.

The CIO develop a process for managing access to shared user accounts.

The CIO should implement the annual compliance check required by the User Account Management Standard Operating Procedure for Administrator accounts to the shared user accounts.

Develop and implement system-based evaluation criteria and risk-based tools to aid ODA team members in targeting their oversight.

Rec. 2.a: The DoD OIG recommended that the Under Secretary of Defense for Personnel and Readiness, based on the results of Recommendation 1, revise current policies and procedures and integrate existing programs to develop a comprehensive DoD-wide approach to address prevention and response to workplace violence.

Rec. 2.b: The DoD OIG recommended that the Under Secretary of Defense for Personnel and Readiness develop and issue interim, comprehensive DoD-wide policy for the prevention and response to workplace violence until the publication of final policies and procedures.

Rec. 3: The DoD OIG recommended that the Defense Procurement and Acquisition Policy Director for the Office of the Under Secretary of Defense for Acquisition, Technology, and Logistics, in coordination with the Under Secretary of Defense for Personnel and Readiness, direct the Defense Acquisition Regulations Council to revise the Defense Federal Acquisition Regulation Supplement to address interim and final contractor requirements for the prevention of workplace violence.

We recommend that, to the extent possible, NARA revisit all site locations and ensure that appropriate and consistent PE, infrastructure, and cabling controls are implemented.  At a minimum, NARA should take the following appropriate steps to remediate the issues identified above, which represent the present risks and flaws applicable to NARA ensure that neat cable management and labeling mechanisms are employed for all sites.

We recommend that, to the extent possible, NARA revisit all site locations and ensure that appropriate and consistent PE, infrastructure, and cabling controls are implemented. At a minimum, NARA should take the following appropriate steps to remediate the issues identified above, which represent the present risks and flaws applicable to NARA Ensure that all server racks, switches, and network equipment are adequately secured from unauthorized access via locked racks.

Reimburse FHA borrowers $25,700 for fees that were not customary or reasonable and $46,510 in discount fees that did not represent their intended purpose.

Reimburse $13,726 to FHA borrowers for the fees that were not customary or reasonable.