Open Recommendations

We recommend that the Department update access review procedures to require the reviewers to verify the access lists received to be used in the performance of the access reviews is complete and accurate and not modified prior to commencing the access reviews.

We recommend that the Department identify and implement a process for the reviewer to validate the population generated for review is complete and accurate.

We recommend that the Department enforce established access authorization controls and ensure all requirements are met prior to granting system access.

We recommend that the Department formally perform and document the periodic reviews of all database user accounts in accordance with Department policy to confirm access is current, authorized, and commensurate with job responsibilities.

We recommend that the Department ensure the application and database server access reviews include the verification of access privileges assigned to the user accounts are commensurate with job responsibilities and follow the concept of least privilege.

We recommend that the Department ensure the database and server layers comply with the disabling of inactive accounts and account lockout duration password setting requirements, as required by Department policy.

We recommend that the Department adhere to the SSP control requirements and avoid the use of generic and shared accounts. If generic and shared accounts are required, obtain a formal risk acceptance and develop a policy and procedure to: • Authorize the use of these accounts by approved personnel, • Control who can access the generic/shared accounts and those sensitive actions performed by the accounts are logged and reviewed every time the accounts are used, and • Require that generic/shared accounts’ passwords are changed each time approved personnel separate or transfer from the Department.

We recommend that FSA implement a process to evaluate the magnitude of impact, likelihood of occurrence, and nature of the deficiency in order to tailor the corrective actions to remediate the risk and address the root cause. Further, update guidance to ensure that quality reviews over the POA&M closure documentation are conducted to confirm the noted deficiencies are fully addressed to help prevent future reoccurrences.

We recommend that FSA formally develop and implement a quality control review process to ensure that logical access control processes are followed completely and accurately to validate logical access requests, reviews, and recertifications.

We recommend that FSA ensure segregation of duties and least privilege principles are adhered to when granting user access to prevent users from having the ability to develop and/or change application code and having update access to the environment where the final tested and approved changes are staged prior to migration to the production environment; and prevent users with access to develop code from having update access to the production environment.

We recommend that FSA evaluate and update the access review control process based on risk and enforce segregation of duties.

We recommend that FSA reconcile the list of users’ roles and responsibilities per the identity and access software tools to the lists that reside in each system accessed by such users.

We recommend that FSA update access review procedures to require the reviewer to verify the access list, received to be used in the performance of the access reviews, is complete and accurate and not modified prior to commencing the access reviews.

We recommend that FSA enforce established access authorization controls and ensure all requirements are met prior to granting access to systems.

We recommend that FSA ensure a complete and accurate population of application changes is provided. Formally develop and implement a quality control review process to ensure that the application change control process is followed and consistently and accurately documented.

We recommend that management implement the following to improve the effectiveness of entity-level controls: improve the risk assessment process at the financial statement assertion level and at the process level to ensure the department is appropriately defining objectives to enable the identification of risks and define risk tolerances.

We recommend that management implement the following to improve the effectiveness of entity-level controls: implement key monitoring controls to ensure that corrective action plans are implemented to timely remediate control deficiencies identified. In addition, increase oversight, review, and accountability over the process among various offices and directorates within the Department and FSA.

Rec. A.1: The DoD OIG recommended that the Secretary of the Navy conduct a review of Secretary of the Navy Instruction 5430.92C to determine if a revision is necessary to align the initial written notification requirement with Department of Defense Instruction 7050.05. Specifically, update the instruction to require immediate written notification to the centralized organization at the start of all significant fraud investigations.

Rec. A.4.a: The DoD OIG recommended that the Naval Criminal Investigative Service Director conduct a review of supervisor review procedures to ensure Naval Criminal Investigative Service case agents consistently notify, coordinate with, and distribute final reports to the Naval Acquisition Integrity Office.

Rec. A.5.a: The DoD OIG recommended that the Office of Special Investigations Commander conduct a review of supervisor review procedures to ensure Office of Special Investigation case agents consistently notify and distribute final reports to the Secretary of the Air Force, Deputy General Counsel for Contractor Responsibility.

Rec. A.5.b: The DoD OIG recommended that the Office of Special Investigations Commander review and update current investigative procedures to better align with policy requirements.

Rec. B.1: The DoD OIG recommended that the Secretary of the Navy conduct a review of Secretary of the Navy Instruction 5430.92C to determine if a revision is necessary to align legal notifications to the appropriate legal jurisdiction. Specifically, to notify the General Counsel, Acquisition General Counsel for Acquisition Integrity when civilian personnel, contractors, or contractor employees are involved in an investigation, and notify the Judge Advocate General when military personnel are involved in an investigation.

The Bureau of International Narcotics and Law Enforcement Affairs should follow Department guidance with respect to the communication and execution of its ongoing reorganization plans.

The Bureau of International Narcotics and Law Enforcement Affairs should develop an implementation plan for its functional bureau strategy, in accordance with Department standards.

The Bureau of International Narcotics and Law Enforcement Affairs should implement procedures for conducting regularly scheduled and senior leadership-led reviews of its progress in meeting strategic goals and objectives, in accordance with Department guidance.