Open Recommendations

Evaluate efficiency at the 10 facilities to identify inefficiencies in the mail flow (e.g., facility layout/location, space constraints, customer and service impacts, and equipment relocation costs) and, based on the results, consider properly aligning the impacted facilities to efficiently meet the challenges they face based on changes in market demand.

Implement an internal control that prevents a future pension entitlement date on the MBR of more than 1 year in the future.

Identify and correct the future pension entitlement dates on the MBR for the estimated 5,434 beneficiaries who have entitlement dates that do not comply with policy or are not recorded on the MBR.

OIG recommends that until all 11 recommendations (see Appendix A for a list of the 11 recommendations) addressed to the Bureau of Near Eastern Affairs (NEA) referenced in this report (AUD-AOQC-22-33) are implemented and closed, the Under Secretary for Political Affairs monitor NEA's compliance responses to OIG and verify, at least quarterly, that the responses (a) are provided to OIG within the established due dates and (b) contain complete and accurate status updates that include either evidence of implementation or detailed corrective action plans with actual or proposed target dates for achieving these actions.

Recommendation 1:We recommend the Assistant Administrator for Strategic Infrastructure:1. Conduct cyclical reviews (no less than once every 5 years) of the Ames lease process to ensure compliance with federal and NASA requirements.

Recommendation 2:We recommend the Assistant Administrator for Strategic Infrastructure in coordination with the Chief Financial Officer: Update applicable real estate policies and NASA-wide guidance to enhance requirements and procedures to comply with EUL authority and to require maintaining appropriate documentation, documenting decisions, and fostering transparent coordination and communication with internal and external stakeholders in a timely manner.

Recommendation 3: We recommend the Assistant Administrator for Strategic Infrastructure in coordination with the Chief Financial Officer: Update applicable real estate policies and NASA-wide guidance to enhance requirements and standardize applicable financial practices (such as the benefit and cost analysis, life-cycle cost analysis, and audits of tenants’ books and records when required) associated with leases.

Recommendation 5: We recommend the Ames Center Director: Implement written procedures in the lease process to ensure compliance with federal and NASA requirements applicable, but not limited to, timely involvement of the RPAO, competition, life-cycle cost analysis, fair market value assessments, certifications, and termination clauses as appropriate.

Recommendation 4: The Assistant Administrator for Strategic Infrastructure in coordination with the Assistant Administrator for Protective Services: Update applicable real estate policies and NASA-wide guidance to incorporate applicable security requirements and agreement clauses in leases.

Recommendation 9: We recommended the Assistant Administrator for Protective Services, in coordination with the Ames Protective Services Office Chief and Ames Center Director: Within the next 3 years, conduct a Center-wide security vulnerability risk assessment, including the districts outside Ames Campus, to ensure compliance with federal and NASA requirements. 

Recommendation 10: We recommended the Assistant Administrator for Protective Services, in coordination with the Ames Protective Services Office Chief and Ames Center Director: Identify and implement mitigation strategies and resource requirements to address the security vulnerability assessment risks.

Review unprocessed felony referrals identified in this report, take corrective action as needed, and report the efforts taken to the OIG.

Update and publish VA directives and handbooks associated with the Homeland Security Presidential Directive 12 Program and VA’s personnel security and suitability program as required by VA’s enterprise directives management procedures.

Determine the allowability of the questioned transactions and recover $7,148,093, if applicable.

Develop a framework for directing DHS components to deploy staff to support missions, including non-centrally funded, unplanned, or emergency operations, for which DHS resources are needed.

Develop a volunteer deployment strategy that includes provisions for supporting volunteers, regardless of funding source.

Enforce requirements for components to obtain authority to operate, resolve critical and high-risk vulnerabilities, and apply sufficient resources to mitigate security weaknesses.

Revise DHS 4300A Policy, Handbook, and Ongoing Authorization methodology to incorporate applicable changes from NIST SpecialPublications, including SP 800-37, Revision 2, SP 800-53 Revision 5, and SP 800-137A to maintain consistency between the documents.

Develop PIAs for the five untracked PII systems identified: HC Dashboard, APEC ABTC, DC One Card ID, Pentagon Contractors ID Card, and TWIC®.

Identify the mechanism to document confidentiality impact levels and document the confidentiality impact levels for all GPO PII systems.

Implement a process to conduct BU PII inventories and share the results with the Privacy Officer.

Conduct biennial Privacy Compliance Reviews in accordance with GPO’s Privacy Program directive.

Review all stored records to identify and mark which records contain or may contain PII.

Update the PIRT Framework and Procedures to incorporate the guidance for incident response plans from NIST Special Publication 800-122 and include comprehensive guidance, such as: a) defining team member roles and responsibilitiesb) defining key termsc) developing communication templatesd) ensuring notification of the appropriate individuals and organizations by identifying points of contact, including external entities, and how to contact them.

Update the PIHG to incorporate the guidance for incident response plans from NIST Special Publication 800-122 including comprehensive guidance, such as: a) ensuring the proper notification of the appropriate individuals and organizations when evaluating and responding to a suspected PII breach, by identifying points of contact, including external entities, and how to contact themb) stating what information is to be provided to US-CERT and the reporting method, such as through a phone call, email, or a websitec) stating how to document that the information was reported to US-CERT.