Open Recommendations

Complete a usage study and document a decision regarding if the IRS will mandate that participants use the TFA IVES system.

FHFA should develop and maintain a complete and accurate cloud system component inventory, as required by NIST SP 800-53.

FHFA should develop and implement a solution to encrypt all data-at-rest on the cloud system as required by National Institute of Standards and Technology SP 800-53.

We recommend the CISA Director update CISA’s Continuity of Operations Plan and develop and implement an information system contingency plan, to ensure availability of redundant systems, capabilities, and communication methods to use if primary systems or networks are compromised.

We recommend the CISA Director require the facility and operations staff conduct an assessment to determine whether secure facility space is appropriately sized and configured to meet operational needs and document any changes necessary for staff to obtain and maintain appropriate access to intelligence information.

We recommend the CISA Director require an assessment to document the levels of staffing, resources, and intelligence access needed for operational divisions, cyber detection and mitigation capabilities, and support functions.

We recommend the CISA Director create and implement a long-term plan for the Cybersecurity Division that includes provisions for ownership, operations, and maintenance of the National Cybersecurity Protection System’s data analytics capabilities.

Develop new and/or enhance existing process controls for participating agencies and monitoring controls within the Asset Forfeiture Management Staff to ensure participating agencies accurately and timely record forfeiture and seizure transactions. (Updated)

We recommend the Assistant Secretary for Occupational Safety and Health: Modify the Field Operations Manual to include a policy for mandatory interviews of complainants and witnesses or document the rationale for lack thereof and provide training to Compliance Safety and Health Officers on the updated requirements.

We recommend the Assistant Secretary for Occupational Safety and Health: Update the Field Operations Manual to require documented case file review and approvals by supervisors and provide training for Compliance Safety and Health Officers to ensure complete documentation of significant decisions and actions.

We recommend the Assistant Secretary for Occupational Safety and Health: Establish controls and provide training of Field Operations Manual abatement certification and documentation requirements and create a monitoring process that is reviewed and approved by a supervisor.

We recommend that OPM direct its carriers to issue guidance to members and providers on telehealth billing, privacy and security, and quality of care risks.

We recommend that OPM develop and maintain a list of services that can be provided via telehealth and require carriers to place edits in their claims systems that will check telehealth claims against this list. Any telehealth claims with procedure codes indicating services not on this list should pend for medical review prior to payment. OPM could start with the list maintained by CMS, expanding the allowed services if desired.

We recommend that OPM specify the telehealth technology laws and regulations with which FEHBP providers must comply or create its own list of requirements, if preferred, and require FEHBP carriers to ensure providers are implementing these requirements.

We recommend that OPM consult with the Office of the General Counsel (OGC) to determine the legal sufficiency of OPM's preemptive authority to implement a uniform framework requiring FEHBP providers to obtain informed consent from all parties before recording audio or video telehealth sessions. Should OGC conclude that OPM's preemptive authority is not sufficient to require FEHBP providers to obtain informed consent in all circumstances, then we recommend that OPM issue guidance to FEHBP carriers recommending that FEHBP providers obtain informed consent, where required by existing and applicable authorities. Regardless of OGC's determination, we also recommend that the guidance OPM…

We recommend that OPM direct carriers to review their claims system edits as they relate to telehealth claims and to implement appropriate claim audits and/or data analytics to identify potentially fraudulent, wasteful, or abusive telehealth billing practices.

We recommend that the Deputy Assistant Secretary for Public Housing and Voucher Programs enhance SEMAP or develop a new performance measurement process that would identify PHAs with underperforming HCV Programs, which should include an assessment of PHAs' ability to maximize assistance to house families.

We recommend that the Deputy Assistant Secretary for Field Operations provide training and guidance to field office program staff on SEMAP scoring, rating, and verification procedures, including confirmatory reviews, quality control reviews, and adjustments, as appropriate, for the revised SEMAP process.

Establish a formal process to monitor and track expenditures when grantees’ expenditures exceed the $750,000 threshold to identify if compliance audits are required and verify that the audits, past due and future, are performed.

Provide refresher or updated training to staff regarding the requirements and processes for reviewing auditees’ reporting packages.

Ensure Contracting Officers make a determination on the allowability of any questioned costs from past due audits when completed.

Establish a formal process to monitor and track expenditures when grantees’ expenditures exceed the $750,000 threshold to identify if compliance audits are required and verify that the audits, past due and future, are performed.

Ensure Contracting Officers make a determination on the allowability of any questioned costs from past due audits when completed.

Ensure that Department Order 470.5 is updated to provide more descriptive guidance for LITWGs and add the roles and responsibilities for the Office of Insider Threat.

Ensure that the ARC is receiving insider threat information from LITWGs to be collected and integrated to generate referrals for detection, mitigation, and analysis for the ITP to respond to insider threats