Open Recommendations

We recommend that the Chief Operating Officer\Chief Risk Officer develop and implement a formal process to review and evaluate the completeness and accuracy of ICP documentation submitted. Validation procedures should include a formal review: To ensure all required documentation has been submitted by the due date. Where documentation has not been provided, NARA should have a formal process in place to follow up and obtain the required documentation. Of ICP documentation submitted to ensure it is both complete and accurate. Where discrepancies are identified, NARA should have a formal process in place to follow up with management so corrections can…

We recommend that the Chief Operating Officer\Chief Risk Officer develop and fully implement a formal ICP training program. NARA’s ICP training program should identify and require individuals who are involved with NARA’s ICP to complete initial training and refresher training periodically thereafter. Further, management should track completion of ICP training to ensure all individuals involved in the ICP process have received adequate training.

Issue a change to regulations at 24 CFR Part 203, which would avoid unnecessary costs to the FHA insurance fund, allowing an estimated $2.23 billion to be put to better use. These changes include (1) a maximum period for filing insurance claims and (2) disallowance of expenses incurred beyond established timeframes. Status

Rec. A.1: The DoD OIG recommended that the Secretaries of the Military Departments annually perform at least two comprehensive, independent inspections of installations. The purpose of these inspections is to verify compliance with all applicable health and safety requirements.

Rec. C: The DoD OIG recommended that the Under Secretary of Defense for Acquisition, Technology, and Logistics, establish a permanent policy for the sustainment of facilities, including standardized facility inspections. This policy should incorporate the requirements in the September 10, 2013, "Standardizing Facility Condition Assessments," and in the April 29, 2014, "Facility Sustainment and Recapitalization Policy," memorandums.

Establish policy and controls for the use of maintenance data terminals to reduce the incidence of malware on these terminals.

Require OAs to provide their network maps to the Cyber Security Management Center.

Reimburse its program $28,199 ($19,771 $7,793 $635) from non-Federal funds for the overpayment of housing assistance and ineligible administrative fees it received for the deficiencies cited in this report.

Acknowledge that the attached settlement agreement for $510,000 represents an amount due HUD.

We recommend that the Acting Deputy Assistant Secretary for Grant Programs require the State to develop and implement policies and procedures to document and perform detailed review and testing to establish eligibility, existence, disaster event qualifications, reasonableness of cost estimates, prioritization, and fund allocation, both retroactively and prospectively, which would put $81,982,712 to better use.

We recommend that the Acting Deputy Assistant Secretary for Grant Programs require the State to support or properly obligate $11,717,288 in unsupported obligations.

We recommend that Indian Affairs identify BIA-owned school facilities that are not on the BIE school listings, including the Todd County School District schools, and ensure facility responsibilities are clearly delineated and upheld.

We recommend Indian Affairs take immediate action to correct the health and safety issues identified in this report or ensure that the students and staff are adequately protected until these problems are resolved.

We recommend that DOI's Chief Information Officer incorporate and enforce the following items into its newly evolving vulnerability management program- a. enterprise-level monitoring and reporting of all devices and software packages; b. enterprise-level enforcement of consistent assessment, detection, prioritization and remediation techniques; c. required elevated account credential usage for testing; d. enterprise-level monitoring and bureau accountability for patch deployment; and e. enterprise-level quarantining for critically vulnerable systems that are not patched in a pre-defined timeframe.

Continue to pursue ways to make the business records process more efficient, particularly for applications related to cyber cases.

Develop training on the proper use of Religious Compensatory Time and require all managers approving, and employees using, Religious Compensatory Time to complete the course.

We recommend that USBR promptly notify the Klamath Irrigation District of its obligation to repay the cost to design, construct, and operate and maintain the A-Canal head gates and fish screens and the total amount that must be repaid, as determined by USBR in Recommendations 1 and 2.

We recommend that USBR negotiate and establish a repayment contract with the Klamath Irrigation District to secure timely repayment of USBR's cost to design, construct, and operate and maintain the A-Canal head gates and fish screens, as determined by USBR in Recommendations 1 and 2.

Require New Mexico HSD verify enrollment and/or exemption, as applicable, for the four student cases identified, and if it is determined the students were ineligible, require HSD to determine if payments were improper and warrant establishment of a claim.

Require HSD to review the four cases identified to determine if payments were improper and warrant establishment of a claim.