Open Recommendations

We recommend that ARC work with IOC to develop work or corrective action plans, which include timeliness milestones, to resolve any outstanding recommendations directed toward OPM program offices reported in carrier audits.

We recommend that ARC work with the Office of the Chief Financial Officer to develop a process to verify that questioned funds identified in final reports and agreed to be returned to the FEHBP are fully returned to the FEHBP.

We recommend the Vice President, Contracts and Rates Strategy, Pricing and Contracts formalize and update the cost of service study internal guidance, and develop a cadence for review and approval.

We recommend the Vice President, Contracts and Rates Strategy, Pricing and Contracts evaluate the inclusion of Valley Investment Initiative and Performance Grant credits, as well as any other local power company or customer specific costs going forward, as part of the cost of service study.

The Chief, FMSS, should ***************************************************************************************************************************************************************************.

The Chief, FMSS, ****** ***** *** *** ************** ** ********* * **** ** *** *********** *********** ***** ****** **** **** ** **** *** ******* **** *** ************** ** **********

The Chief, FMSS, ****** ****** **** *** ** ********* ** ******* ******** ** *** *** ******** ******** *** ***** ** ******** **** **********

Complete efforts to document and implement an enterprise-wide risk management strategy that incorporates the review and approval processes set forth in agency policy.

[REDACTED]

[REDACTED]

[REDACTED]

Develop and implement a mechanism to enforce recurring privileged user training for applicable personnel.

Update its business impact analysis template to ensure that the SEC assesses all systems using a correct and comprehensive set of mission-essential functions.

Incorporate assessments of system recovery time objectives into future disaster recovery exercises.

We recommend that the Puerto Rico Health Department (the Health Department) update its policies and procedures to conform to Federal procurement standards—including policies and procedures related to contracts for leases, goods, and nonprofessional services—and to address the role of the Oversight Lead and the certification process.

We recommend that the Puerto Rico Department of Health (the Health Department) provide training to staff on policies and procedures.

OCIO to develop and implement a plan to remediate all identified critical, high, and medium vulnerabilities identified on OCIO devices providing services to Federal Highway information technology infrastructure within organization defined time periods required by DOT's Security Weakness Management Guide.

OCIO to work with DOT's Operating Administrations and components to ensure least privilege and boundary protection controls are in place to restrict the logical access to only users authenticated to the IT systems and services for which they are authorized.

OCIO to enforce DOT security policy for removal of default credentials and harden the device configurations for all identified compromised devices and devices that could be similarly compromised, including IT shared services/common operating environment network printers per the Departmental Cybersecurity Compendium security requirements to ensure data security.

OCIO to establish a cybersecurity process to comply with NIST Special Publication 800-115, Technical Guide to Information Security Testing and Assessment and the Department Cybersecurity Incident Response Plan requirements to effectively communicate and coordinate with OIG any planned significant changes that could impact an OIG security assessment and penetration testing audit before the audit begins and when taking action to implement said changes, to ensure coordination as per the Rules of Engagement requirements and to prevent interruption of OIG penetration testing activities.

OCIO to establish a cybersecurity process to enforce the Department Cybersecurity Incident Response Plan requirements for departmental officials impacted by an incident to review audit logs and follow containment procedures to adequately support after-the-fact investigations of potential security incidents.

OCIO to enforce DOT policy for audit log retention for the proper timeframe of 12 months.

FHWA to enforce DOT security policy for removal of default credentials and harden the device configurations for all identified compromised devices and devices that could be similarly compromised, including FHWA network printers per the Departmental Cybersecurity Compendium security requirements to ensure data security.

FHWA to conduct incident response exercises with appropriate personnel that test the retrieval of security audit logs in the event of an incident.

Examine existing Job Corps data regarding its drug control activities to identify appropriate data that aligns with the President's Strategy and the Office of National Drug Control Policy's reporting timelines and identify or develop appropriate and relevant performance measures that demonstrate the effectiveness of its drug control activities as they relate to the President's Strategy.