Open Recommendations

(U) Rec. 1.b.i: The DoD OIG recommended that the Under Secretary of Defense (Acquisition and Sustainment), by no later than the next periodic review process, identify and recommend updates to the DoD issuances identified in Recommendation 1.a. or the creation of new issuances to assign roles and responsibilities across the Joint Logistics Enterprise. At a minimum, the recommended updates should establish a DoD wide executive agent or management action group to track and monitor ongoing development and implementation of interoperable systems and tools (as defined in DoD Instruction 8330.01) for forecasting logistics demand across the Joint Logistics Enterprise, with the…

(U) Rec. 1.b.ii: The DoD OIG recommended that the Under Secretary of Defense (Acquisition and Sustainment), by no later than the next periodic review process, identify and recommend updates to the DoD issuances identified in Recommendation 1.a. or the creation of new issuances to assign roles and responsibilities across the Joint Logistics Enterprise. At a minimum, the recommended updates should task existing logistics executive agents and offices of primary responsibility with coordinating and standardizing Joint Logistics Enterprise data, planning factors, tools, and logistics support area processes within their areas of responsibility.

(U) Rec. 1.b.iii: The DoD OIG recommended that the Under Secretary of Defense (Acquisition and Sustainment), by no later than the next periodic review process, identify and recommend updates to the DoD issuances identified in Recommendation 1.a. or the creation of new issuances to assign roles and responsibilities across the Joint Logistics Enterprise. At a minimum, the recommended updates should assign new executive agents and offices of primary responsibility to coordinate and standardize data, planning factors, tools, and logistics support area processes for areas within the Joint Logistics Enterprise that do not currently have an executive agent or office of…

Identify intra-agency points of connection and lines of authority responsible for approving and integrating new UAS technologies, evaluate options to improve working across lines of business, and implement the best option based on the Agency's evaluation.

CMS should Issue new guidance on the appropriate use of MAO clinical criteria in medical necessity reviews.

CMS should Update its audit protocols to address the issues identified in this report, such as MAO use of clinical criteria, and/or examine particular service types.

CMS should direct MAOs to take additional steps to identify and address vulnerabilities that can lead to manual review errors and system errors.

Establish a grievance tracking system to ensure timely responses to all detainee grievances filed at South Texas, with a completegrievance log.

Ensure compliance with segregation standards, including the use of restraints, access to recreation, legal calls, laundry services forbedding and clothing, mail, legal materials, and the law library.

Update NARA 1572, Preventing Theft and Vandalism of NARA Holdings in NARA Facilities, and its Supplement(s) to include documented procedures that include simplified reporting of internal incidents of loss, theft, or damage of NARA holdings.

We recommend that the Massachusetts Executive Office of Health and Human Services, Office of Medicaid continue to coordinate with DDS and DPPC to ensure that all reasonable suspicions of abuse and neglect are properly identified, reported, and investigated as needed.

We recommend that the Massachusetts Executive Office of Health and Human Services, Office of Medicaid require periodic training for DDS and group home staff on reporting reasonable suspicions of abuse and neglect.

HHS OCIO work with all OpDivs to ensure that: All systems on the network have a valid ATO. OpDivs should ensure that security authorization policies and procedures are fully developed and disseminated to the appropriate personnel to ensure that all OpDiv personnel understand the requirements for completing the ATO process.

HHS OCIO work with all OpDivs to ensure that: ISCM strategy and procedures should clearly define critical reporting metrics for reports utilized by internal and external stakeholders. Additionally, OpDivs should coordinate reporting efforts with the OCIO to ensure the definitions and reporting requirements are consistently implemented.

Continue implementation of an automated CDM solution that provides a centralized, enterprise-wide view of risks across all of HHS.

Update the ISCM strategy to include a more specific roadmap; including target dates, for ISCM deployment across the HHS enterprise.

HHS should perform an enterprise risk assessment over known control weaknesses (e.g., Authority to Operate, incomplete OpDiv provided system inventories, lack of OpDiv adherence to HHS information security policies) due to their federated environment and document an appropriate risk response (e.g., accept, avoid, mitigate, share, or transfer).

HHS OCIO work with all OpDivs to: Ensure that all operational systems have SSPs and FIPS 199 categorizations completed for information systems in accordance with HHS policy.

HHS OCIO work with all OpDivs to: Ensure that all OpDivs are completing security controls system assessments and POA&Ms at least quarterly or more frequently as defined by the OpDiv.

HHS OCIO work with all OpDivs to: Develop a management approved Configuration Management policy that addresses purpose, scope, roles, responsibilities, management commitment and coordination among organizational entities. This document should be tailored to the OpDivs' needs and be reviewed and updated according to HHS policy (at least every 3 years).

HHS OCIO work with the OpDivs to ensure that all DpDivs: Update and implement its personnel security policies to clearly articulate the personnel screening process along with the required access agreements that need to be completed prior to being granted system access. In addition, OpDivs should update and implement their procedures for retrieving and archiving user access agreements for internal control purposes.

HHS OCIO work with the OpDivs to ensure that all OpDivs: Develop and implement an ICAM strategy and authenticator management policy to ensure all information systems undergo a digital identity risk assessment to determine which systems require strong authentication. Once a risk assessment is complete, OpDivs should ensure that authentication mechanisms are implemented for all information systems.

HHS OCIO work with the OpDivs to ensure that all OpDivs: Establish a process for the review of privileged users on an annual basis to ensure compliance with HHS Policy. In addition, OpDivs should ensure that this process is created to identify: User access is still needed, User rights subscribe to the principle of least privileged, User actions are captured and monitored appropriately as dictated by HHS policy.

Update POS and MCS to include alerts to notify SSA employees of potential incorrect actions and required subsequent actions.

Update the Title II Redesign System to ensure it generates an alert when SSA has terminated benefits to a child upon attaining age 18; however, the benefit record indicates the individual is a full-time student after they attain age 18.