Open Recommendations

CMS should identify the reasons for the unexplained variation in program integrity activities across UPICs.

We recommend the Federal Emergency Management Agency Administrator establish and provide a target completion date to finalize and implement the Equity in Policy Guide and Lens.

Document and implement a periodic review of subsystem inventories to verify information maintained for each ITI subsystem is current, complete, and accurate.

Implement a process to validate that all personnel with privileged level responsibilities complete annual security awareness and role-based training.

We recommend that the BIA resolve the questioned costs of $237,270 by requiring the Three Affiliated Tribes to provide supporting documentation to ensure that the incurred costs are allowable, allocable, and reasonable.

We recommend that the BIA require the Three Affiliated Tribes to establish controls to ensure that it can determine the appropriate funding source for each CARES Act expense.

We recommend that the BIA resolve the questioned costs of $106,280 by creating and adjusting journal entries to reallocate the funds from the U.S. Department of the Interior to the U.S. Department of Health and Human Services.

We recommend that the BIA resolve the questioned costs of $89,623 by creating adjusted journal entries to reallocate the funds from the BIA CARES Act to the appropriate funding source.

Enhance policy tracking requirements to consistently capture information for all policies, including BOP official time and costs associated with different policy development initiatives.

We recommend that Dialysis Clinic, Inc refund to the Federal Government the portion of the estimated $14,193,677 in improper payments for claims incorrectly billed to the Medicare program that are within the 4-year reopening period.

We recommend that Dialysis Clinic, Inc. based on the results of this audit, exercise reasonable diligence to identify, report, and return any overpayments in accordance with the 60-day rule and identify any of those returned overpayments as having been made in accordance with this recommendation.

(U) Rec. 3.a: The DoD OIG recommended that the Under Secretary of Defense for Intelligence and Security, in coordination with the Defense Counterintelligence and Security Agency Director and the DoD Insider Threat Management and Analysis Center Director ensure that the Enterprise Program Management Office establishes and implements a process for assessing DoD Component compliance with insider threat reporting requirements.

(U) Rec. 3.b: The DoD OIG recommended that the Under Secretary of Defense for Intelligence and Security, in coordination with the Defense Counterintelligence and Security Agency Director and the DoD Insider Threat Management and Analysis Center Director establish a policy with timelines for DoD Components to report insider threats to the DoD Insider Threat Management and Analysis Center.

(U) Rec. 3.c: The DoD OIG recommended that the Under Secretary of Defense for Intelligence and Security, in coordination with the Defense Counterintelligence and Security Agency Director and the DoD Insider Threat Management and Analysis Center Director submit the FY 2022 annual report on the DoD Insider Threat Program to the Secretary of Defense and establish a process for ensuring that subsequent reports are submitted in accordance with the National Insider Threat Task Force Minimum Standards for Insider Threat Programs and DoD Directive 5205.16, "The DoD Insider Threat Program," September 30, 2014, (Incorporating Change 2, August 28, 2017).

(U) Rec. 4: The DoD OIG recommended that the Commander of the U.S. Cyber Command require that the U.S. Cyber Command Insider Threat Hub Director, in coordination with the National Security Agency Insider Threat Hub Director, review the insider threat incidents received since the establishment of the Hub and report incidents that involve a covered person and meet one or more of the reporting thresholds to the DoD Insider Threat Management and Analysis Center.

(U) Rec. 6: The DoD OIG recommended that the Defense Health Agency Director require that the Defense Health Agency Insider Threat Hub Director review the insider threat incidents that we determined should have been reported to the DoD Insider Threat Management and Analysis Center and report those incidents as required.

(U) Rec. 7: The DoD OIG recommended that the National Security Agency/Central Security Service Director require that the National Security Agency Insider Threat Hub Director review the insider threat incidents received since the 2016 DoD Component reporting requirement was initiated and report incidents that involve a covered person and meet one or more of the reporting thresholds to the DoD Insider Threat Management and Analysis Center.

We recommend the Chief Human Capital Officer for DHS’ Management Directorate develop, implement, and communicate departmental policies and procedures for the Unemployment Compensation for Federal Employees program to each component to ensure compliance with Federal requirements.

The Department should ensure that adequate resources are made available and are prioritized to validate the accuracy and completeness of asset inventory counts prior to submission to the Department of Homeland Security (DHS) as part of CIO FISMA Metrics.

Coordinate with the components to develop or revise their plans to fully transition the remaining information systems to enable and enforce PIV, except those that are subject to exclusions that are documented and approved.

FAA should develop and implement procedures to perform periodic reviews of mobile devices to ensure non-compliant mobile devices are upgraded to the current operating system release.

Strengthen processes to ensure privileged account reviews are completed and privileged account activities are logged and periodically reviewed, in accordance with DOT policy.

In coordination with the OA system owners, complete DOT's plans to implement existing solutions where possible and create a plan to address all exceptions where there is not a current solution for encryption of data at rest and in transit.

In coordination with the OA system owners, complete the deployment of DOT's data loss prevention controls to include the utilization or activation of enhanced DLP features available within existing tools and to develop and implement policies and procedures which eliminate or restrict the ability of users to connect mass storage devices to DOT networks and systems.

Enhance current procedures to implement and require the retention of records to track when computer media are sanitized prior to disposal or reuse and implement procedures to validate the remediation of computer media that have failed media sanitization upon return to DOT.