Open Recommendations

Require a documented transportation review that tracks the root cause and planned mitigation tactics for facilities not meeting their transportation goals.

We recommend the CISA Director analyze and document the targeted categories of its cybersecurity employees in mission-critical positions that possess unusually high or unique qualifications and limit retention incentives to only those qualified individuals.

We recommend the CISA Director develop and implement consistent policy and guidance on the minimum percentage of time that an employee must perform assignments related to a primary and secondary National Initiative for Cybersecurity Education code to qualify for the Cybersecurity Retention Incentive.

We recommend the CISA Director develop and implement an accurate, reliable, and auditable methodology and process for approving and tracking Cyber Incentive recipients and program use, to ensure that the data tracking needs are adequately addressed.

We recommend the CISA Director consolidate and assign responsibilities for managing the Cybersecurity Retention Incentive program to an office with the authority to make program decisions.

We recommend the CISA Director develop, update, and implement its policies for the Cybersecurity Retention Incentive program to: • document if employees are likely to leave Federal service if they do not receive a retention incentive and have the completed approval on file; • annually review whether each employee is still eligible for the Cybersecurity Retention Incentive; • define unusual and extraordinary circumstances for back pay and ensure the reasons for back pay are documented; • update and publish the eligible cybersecurity certifications list annually; and • track internal transfers and resubmissions of Cybersecurity Retention Incentive eligibility forms in a…

We recommend the CISA Director conduct further analysis and evaluation to resolve the $1.41 million in unallowable back pay given to Cybersecurity Retention Incentive recipients.

We recommend the CISA Director determine whether it is appropriate to seek repayment of improper incentive payments to ineligible employees and recover those co

We recommend the DHS Office of the Chief Human Capital Officer periodically review and monitor CISA’s Cybersecurity Retention Incentive program to ensure it meets programs goals and is in compliance with DHS policy, DHS directives, and the DHS Cybersecurity Retention Incentive Plan.

We recommend the FEMA Region 2 Administrator provide Puerto Rico with additional technical assistance and guidance for submitting detailed scopes of work related to rebuilding fully Puerto Rico’s electric power grid.

We recommend the FEMA Region 2 Administrator provide Puerto Rico with additional technical assistance and guidance for submitting detailed scopes of work related to rebuilding fully Puerto Rico’s electric power grid.

We recommend the FEMA Region 2 Administrator identify lessons learned from the Puerto Rico electrical grid rebuild and incorporate the need for improved guidance and technical assistance to grant recipients into the Agency’s policies and procedures to ensure greater accountability for future permanent projects.

The VA Secretary should ensure the Palo Alto major construction project (project number 640-424) is brought into the Acquisition Lifecycle Framework.

The VA Secretary should ensure the activities and artifacts required during the conceptual phase of the Acquisition Lifecycle Framework are completed for the Palo Alto major construction project (project number 640-424)"including a business case with cost, schedule, and performance goals approved by the Secretary.

The VA Secretary should ensure a decision event to verify the need of the acquisition is conducted for the Palo Alto major construction project (project number 640-424) and a determination is made to terminate or continue this project based on VAs strategic needs and the VA Palo Alto Health Care Systems clinical needs.

Ensure processes and guidance are in place for the director of the Office of Construction and Facilities Management to provide appropriate oversight and management over minor construction projects consistent with the authority and responsibilities described in 38 U.S.C. 312A.

Revise the Veterans Health Administration directive on minor construction projects to incorporate 38 U.S.C. 312A requirements and develop a review process for confirming compliance with the Office of Construction and Facilities Managements guidance and any applicable industry standards.

Review the Audie L. Murphy emergency department exam and fast-track rooms for compliance with applicable design and equipment standards and provide any recommendations to the executive director of the South Texas Veterans Health Care System.

Review an assessment by the Office of Construction and Facilities Management of the Audie L. Murphys emergency department for compliance with design and equipment requirements to determine what changes, if any, are necessary and take appropriate corrective action.

Verify that Our Generation Speaks corrects the instances of material noncompliance detailed on pages 22 to 26 of the audit report.

We recommend that the Grantee develop and implement formal written policies and procedures surrounding the management of Federal awards, in accordance with the Uniform Guidance.

We recommend the Vice President, Chief Information and Digital Officer, Information Technology, consistently implement the defined policies, procedures, and processes for developing and maintaining a comprehensive and accurate inventory for public-facing websites.

We recommend the Vice President, Chief Information and Digital Officer, Information Technology, implement, assess, and maintain common secure configuration settings for all information systems.

We recommend the Vice President, Chief Information and Digital Officer, Information Technology, incorporate vulnerability scanning into the Continuous Diagnostics and Mitigation dashboard in accordance with Binding Operational Directive 23-01, in coordination with Department of Homeland Security as necessary.

We recommend the Vice President, Chief Information and Digital Officer, Information Technology, refine the profiles periodically based on known risk exposure and residual risk, align cybersecurity profiles with risk strategy, and periodically monitor and report on progress in reaching TVA’s target profile.