Open Recommendations

We recommend that OPM's Contracting Officer require the Carrier to adopt new controls to ensure that the PBM charges no greater than the value of the PBM's negotiated discounts with each retail pharmacy that was in effect at the time the claim was adjudicated. True ups to any retail pricing guarantees between the PBM and the Carrier should be performed quarterly or annually in accordance with the Carrier's PBM agreement.

We recommend that OPM's Contracting Officer assess the PBM and Carrier $119,438 for LII on the questioned costs due back to the FEHBP for this finding, calculated through June 30, 2024. The LII should be adjusted to account for the date the questioned costs are returned to the program.

We recommend that the Carrier collect $925,895 in claim transaction fees that were credited back to the PBM by retail pharmacies for the FEHBP's CY 2017 through 2022 prescription drug benefits and return this amount to the FEHBP.

We recommend that the PBM adopt policies and procedures to ensure that the Carrier receives the value of all credits (i.e., claim transaction fees) that the PBM collects from retail pharmacies under pass-through transparent pricing.

We recommend that OPM's Contracting Officer require the PBM and Carrier to return $190,134 to the FEHBP for its portion of the PBM's non-specific drug inventory purchasing discounts that were not received for CYs 2017 through 2022.

We recommend that OPM's Contracting Officer assess the PBM and Carrier $58,060 for LII on the questioned costs due back to the FEHBP for this finding, calculated through June 30, 2024. The LII should be adjusted to account for the date the questioned costs are returned to the program.

We recommend that the Carrier adopt new controls to ensure that the PBM passes through all its drug inventory purchasing discounts associated with the Carrier and the FEHBP in accordance with the PBM transparency standards for mail order and specialty drug actual acquisition costs.

We recommend that the Deputy Chief Financial Officer and the Principal Deputy Assistant Secretary for Employment and Training design and implement controls over their respective estimates to ensure management's review of the estimates are performed at a sufficient level of detail, and includes the review of the methodology, relevance and reliability of the underlying data, and assumptions used to develop the estimates.

We recommend that the Deputy Chief Financial Officer and the Principal Deputy Assistant Secretary for Employment and Training maintain documentation of the reviews performed to assess the reasonableness of the methodology, underlying data, and assumptions used to develop the estimates that is sufficiently detailed to evidence the specific items reviewed, analysis performed, and conclusions reached.

We recommend that the Deputy Chief Financial Officer and the Principal Deputy Assistant Secretary for Employment and Training update Department of Labor's policies and procedures to provide sufficient details on the performance of the reconciliation of the State Workforce Agencies monthly financial summary report to the general ledger, including the required level of precision.

Implement and periodically monitor the effectiveness of a plan to provide oversight for unsent packages in the Package Manager application.

Implement a plan to address existing unsent packages in the Package Manager application.

Implement a process to ensure accounts with access to the Domain Administrators group are appropriately assigned based on job responsibilities. If determined that an account can be configured with more restrictive access, then implement a process to revoke the Domain Administrator group membership and apply the most restrictive access.

Develop and implement policies and procedures for network user accounts to:
a. Create unique passwords for each service account;
b. Maintain a list of commonly used, expected, or compromised passwords;
c. Update the list on an organization defined timeframe and when organizational passwords are suspected to have been compromised directly or indirectly;
d. Verify (such as through regular password audits or system configurations), when users create or update passwords, the passwords are not found on the list of commonly used, expected, or compromised passwords.

Ensure NARANet user accounts are reviewed and disabled in accordance with NARA’s information technology policies and requirements.

Coordinate with other departments as necessary to implement an authoritative data source which provides the current status of NARA contractors and volunteers at the enterprise level.

Enforce mandatory Personal Identity Verification (PIV) card authentication for all NARANet users, in accordance with OMB requirements.

Continue and complete efforts to require PIV authentication for all privileged users, servers, and applications, through NARA’s identity and access management project and other efforts.

Ensure a comprehensive identity, credential, and access management (ICAM) policy or strategy, which includes the establishment of related standard operating procedures, identification of stakeholders, communicating relevant goals, task assignments, and measure and reporting progress is developed and implemented.

Document and implement a process to track and remediate persistent configuration vulnerabilities, or document acceptance of the associated risks.

Implement remediation efforts to address security deficiencies on affected systems identified, to include enhancing its patch and vulnerability management program as appropriate, or document acceptance of the associated risks.

Fully complete the migration of applications to vendor supported operating systems.

Ensure the Information System Security Officers are reviewing system configuration compliance scans monthly as required within NARA’s Configuration Compliance Standard Operating Procedure.

Enhance current procedures to ensure that new NARA users who do not complete their initial security awareness training, have their accounts automatically disabled in accordance with timeframes promulgated within the Privacy and Awareness Handbook.

Implement requirements across all event logging maturity tiers to ensure events are logged and tracked in accordance with OMB M-21-31.