Open Recommendations

(U) Rec. 3: The DoD OIG recommended that the Chief Information Officer for the Air Force require that the authorizing officials for the Tailored Multitenancy Integrated Service and Cloud One systems reevaluate the authorizations to operate, including a review of all required documentation to consider the risks associated with using the authorized commercial cloud service offering, such as the documentation supporting the Federal Risk and Authorization Management Program and DoD authorization processed and continuous monitoring activities, as required by the DoD Cloud Computing Security Requirements Guide.

Determine the allowability of the questioned transactions and recover $3,546,767, if applicable.

The Chief, Appeals, should establish a process with the appropriate Business Operating Divisions (BOD) to identify, track, and update forms, letters, publications, notices, websites, and social media that still require the new IRS Independent Office of Appeals name.

Update DOL entity-wide and system-level security policies, procedures, and plans to comply with NIST SP 800-53, Rev. 5.

Implement data loss prevention tools and alerts based on the results of agencies’ data exfiltration tests.

[Description omitted; DOJ has determined that this recommendation contains information that is limited official use or classified.]

[Description omitted; DOJ has determined that this recommendation contains information that is limited official use or classified.]

We recommend that the GSA Administrator, through the Federal Acquisition Service and Public Buildings Service Commissioners, and the Assistant Administrator for the Office of Administrative Services revise or issue Agency policy to ensure: the appropriate oversight of acquisition planning activities for performance- based service contracts, including the creation of a QASP that complies with applicable regulations; and contracting personnel have clear, descriptive instruction on how to monitor and enforce QASPs during contract administration to ensure compliance and improve acquisition outcomes.

We recommend that the GSA Administrator, through the Federal Acquisition Service and Public Buildings Service Commissioners, and the Assistant Administrator for the Office of Administrative implement management oversight to ensure contracting personnel comply with policies and procedures intended to ensure sufficient government oversight of contractor performance.

Perform an AHP workforce planning analysis using the minimum examination frequencies for AHP risk areas established in response to Recommendation 1 to determine current and future examination needs and address any staffing gaps identified.

(U) Rec. 1.b: The DoD OIG recommended that the DoD Chief Information Officer direct the DoD Components to immediately, after completion of Recommendation 1.a, remove all unauthorized unmanaged applications from all DoD mobile devices.

(U) Rec. 1.c: The DoD OIG recommended that the DoD Chief Information Officer direct the DoD Components to immediately, after completion of Recommendation 1.a, assess all unmanaged applications for operational and cybersecurity risks and remove those with unacceptable risks or without a justifiable need from users mobile devices and Component application stores.

(U) Rec. 1.d: The DoD OIG recommended that the DoD Chief Information Officer direct the DoD Components to immediately assess mobile device users' access to public application stores and remove access of those without a justifiable need. If unable to remove mobile device users' access, require Components to develop and implement policy that defines the acceptable use of public application stores and requires periodic assessments of mobile device users downloads to determine that all applications have a justifiable need.

(U) Rec. 2.a: The DoD OIG recommended that the DoD Chief Information Officer, in coordination with the Under Secretary of Defense for Intelligence and Security, develop comprehensive mobile device and mobile application policy for Components and users. The policy should, at a minimum, define the acceptable use of DoD mobile devices and mobile applications for official DoD business and personal use.

(U) Rec. 2.b: The DoD OIG recommended that the DoD Chief Information Officer, in coordination with the Under Secretary of Defense for Intelligence and Security, develop comprehensive mobile device and mobile application policy for Components and users. The policy should, at a minimum, address the cybersecurity and operational security risks of 1) user access to unmanaged applications without cybersecurity assessments through Component application stores or public application stores, and 2) mobile device features, including geolocation, screen capture, copy and paste, and camera, among others.

(U) Rec. 2.c: The DoD OIG recommended that the DoD Chief Information Officer, in coordination with the Under Secretary of Defense for Intelligence and Security, develop comprehensive mobile device and mobile application policy for Components and users. The policy should, at a minimum, address the DoD records management requirements of DoD Instruction 5015.02, "DoD Records Management Program," February 25, 2015 (Incorporating Change 1, August 17, 2017) and the Deputy Secretary of Defense memorandum "Records Management Responsibilities for Text Messages," August 3, 2022.

(U) Rec. 2.d: The DoD OIG recommended that the DoD Chief Information Officer, in coordination with the Under Secretary of Defense for Intelligence and Security, develop comprehensive mobile device and mobile application policy for Components and users. The policy should, at a minimum, require DoD Components to provide regularly scheduled training to DoD mobile device users on the responsible and effective use of mobile devices and applications, including electronic messaging services, in accordance with DoD Chief Information Officer memorandum, "Mobile Application Security Requirements," October 6, 2017, and DoD Instruction 8170.01, "Online Information Management and Electronic Messaging," January 2, 2019 (Incorporating…

(U) Rec. 2.e: The DoD OIG recommended that the DoD Chief Information Officer, in coordination with the Under Secretary of Defense for Intelligence and Security, develop comprehensive mobile device and mobile application policy for Components and users. The policy should, at a minimum, require DoD Components to justify and approve the mission requirements for all managed and unmanaged applications and limit access to only those applications with a justified and approved need.

(U) Rec. 3: The DoD OIG recommended that the DoD Chief Information Officer, in coordination with the Defense Information Systems Agency Chief Information Officer, revise DoD policy and memorandums and Defense Information Systems Agency mobile application documentation and training to ensure the use of common terminology when referring to approved, managed, DoD-controlled, authorized, and official applications; and unmanaged, non-DoD-controlled, unauthorized, non-official, and personal-use applications.

Establish a documented annual enterprise-wide examination planning process that aligns with the multiyear, comprehensive Examination Strategic Plan.

Develop a tool to consider risk and other relevant variables to inform examination resource allocation decisions, then expand its use to include Examination workstreams from all divisions.

We recommend that the Michigan Department of Health and Human Services ensure the electronic case records for children who are prescribed opioid medications are maintained in accordance with requirements by implementing procedures requiring caseworkers to monitor Medicaid claim data for opioid medications prescribed for the children and providing training to caseworkers on the requirements for documenting medications prescribed for the children in MiSACWIS, including opioid medications due to medical procedures or emergency treatments.

We recommend that the Michigan Department of Health and Human Services ensure the electronic case records for children who are prescribed psychotropic medications are maintained in accordance with requirements by implementing policies specific to non-emergency situations that require the FC-PMOU to document when consent forms do not need to be obtained; implementing procedures for caseworkers and the FC-PMOU to monitor the Medicaid claim data to ensure consent forms are obtained and documented; and implementing procedures requiring caseworkers and the FC-PMOU to monitor other medications prescribed for children, including opioids, for potential medication interaction and adverse side effects.

We recommend that the Michigan Department of Health and Human Services ensure that electronic case records for the children under its care and supervision are maintained in accordance with State requirements by modifying procedures for the monitoring of caseworkers to include a review of medical passports in MiSACWIS.

KPMG recommends that ESC management create monitoring procedures over the existing management review of the JV control logs monthly reconciliation to ensure the consistent operation of the control, as defined within policy.