Open Recommendations

Develop and/or identify the one definitive method to report suspected PII breach incidents.

Implement a central training method to ensure employees and contractors receive PII training before accessing GPO’s information system. This method should include reassigning the responsibility for annual training to a single BU, likely Information Technology, and assigning BUs with the responsibility for specialized PII training.

Update the Privacy Program directive to reflect changes resulting from these recommendations.

The Chief Information Officer update ITD’s current policy for accountable IT property, to include the incorporation of defined program personnel roles, requirements aligned with the property management lifecycle and all current program procedures.

The Chief Information Officer continue pursuit of transitioning to a single asset management system that addresses its program needs to track accountable and consumable IT property and establish a detailed implementation plan with target dates to transition to a single asset management system for accountable and consumable IT property as currently captured in Cireson and Jumpstock.

The AOC revise the Board of Survey Process with codified punitive actions to act as a deterrent against future instances of employee negligence and misconduct regarding the loss of AOC property, including both IT mobile devices and personal property.

Enact a formal procedure to review all VBA compensation awards not already reviewed by the OIG that were completed since January 1, 2020, with debts due to reduced disability levels, take corrective action as appropriate, and report the results to the OIG.

Develop a mechanism to review the effectiveness of the recommendations periodically and a process for determining what additional measures, if any, are needed.

Embassy Oslo should require the Embassy Employee Association board to conduct its oversight responsibilities in accordance with Department standards.

Embassy Oslo, in coordination with Regional Information Management Center Frankfurt and the Bureau of Information Resource Management, should bring the embassy’s high frequency radio equipment into compliance with Department standards.

Develop and implement a process to evaluate existing Boeing airplane flight manuals to determine whether they contain required normal, non-normal, and emergency procedures that are necessary for the safe operation of the aircraft. Within this process, include methods to determine what corrective actions are needed if deficiencies are identified.

Develop and implement a documented process to identify what information manufacturers must include in airplane flight manuals.

Develop guidance for air carriers to support the development and implementation of automation management policies. Following publication of the guidance, validate that air carriers' policies, procedures, and training are consistent with the new guidance.

Develop written procedures to maintain documents for Special Purpose, Disaster, or other similar grants. If the documents for requests and approvals of COVID-19 quarterly report extensions can be retrieved, keep them in a central location.

Ensure that OPP and OCE Policies and Procedures Manual are updated and complete, including policies and procedures for the oversight and monitoring of Disaster Program funds, which would include LSC CARES Act Funds.

Complete revisions and publish the OFAS Accounting Procedures Manual (LSC is currently working to complete and publish the draft OFAS Accounting Procedures Manual), including bank account verification policies and procedures.

We recommend the Office of the Chief Security Officer develop and implement a suitability policy for AOC employees and consolidate and implement revisions, as appropriate, to the current contractor suitability policy. Additionally, develop and implement a standardized timeline for policy revision and update within the current Fiscal Year.

We recommend that the Office of the Chief Security Officer develop and implement suitability policy language to include clear lines of responsibility and processes. Improvements should include: • In the contractor suitability policy, assign the responsibility for the centralized recordkeeping of intra-agency badging agreement Memorandums of Understanding or Agreements to the OCSO; and• In both policies, guidance and requirements for secure badge return and protection and oversight of Personally Identifiable Information.

We recommend that the Centers for Medicare & Medicaid Services revise 42 CFR section 405.980 and corresponding manual instructions related to the reopening period for claims to be consistent with statutory provisions contained in section 1870 of the Social Security Act, which allows Medicare contractors to determine whether overpayments were made and to begin to collect them for 5 years following the year payments were made.

We recommend that the Centers for Medicare & Medicaid Services establish a mechanism to reopen claims when OIG starts an audit so that CMS can collect overpayments consistent with the 5-year timeframe contained in section 1870 of the Social Security Act.

Implement registration and inventorying procedures for the CPSC’s information systems. (2022 Recommendation).

Develop, document, and implement a process for determining and defining system boundaries in accordance with National Institute of Standards and Technology guidance (2020 Recommendation).

Define and document the taxonomy of the CPSC’s information system components, and classify each information system component as, at minimum, one of the following types: information technology system (e.g., proprietary and/or owned by the CPSC), application (e.g., commercial off-the-shelf, government off-the-shelf, or custom software), laptops and/or personal computers, service (e.g., external services that support the CPSC’s operational mission, facility, or social media) (2020 Recommendation)

Develop and implement a formal strategy to address information security risk management requirements as prescribed by the National Institute of Standards and Technology guidance (2020 Recommendation).

Complete an assessment of information security risks related to the identified deficiencies and document a corresponding priority listing to address identified information security deficiencies and their associated recommendations. A corrective action plan should be developed that documents the priorities and timing requirements to address these deficiencies (2020 Recommendation).