Open Recommendations

Forest Service needs to update its NDA policies and form(s) to include the required anti-gag provision. Forest Service also needs to review and update active NDAs for current Forest Service Federal employees signed after November 27, 2012, to ensure they include the required anti-gag provision.

National Agricultural Statistics Service needs to update its NDA policy and form(s) to include the required anti-gag provision. National Agricultural Statistics Service also needs to review and update active NDAs for current National Agricultural Statistics Service Federal employees signed after November 27, 2012, to ensure they include the required anti-gag provision.

Office of the Chief Financial Officer needs to update its NDA form(s) to include the required anti-gag provision.

PBGC should implement an enterprise-wide approach to prevent counterfeit components from entering its supply chain and establish performance measures to gauge the effectiveness of its anti-counterfeit policies and procedures. Additionally, PBGC should provide a comprehensive anti-counterfeit training for its personnel.

PBGC should manage Active Directory certificate template settings effectively by hardening and auditing existing templates in the environment. Privileges should also be assessed for all templates to prevent unauthorized changes to the configuration settings.

PBGC should establish robust network segmentation and configure firewalls with default rules to ensure the guest wireless network is effectively isolated from internal resources.

PBGC should establish a comprehensive system for monitoring, analyzing, and reporting on quantitative performance measures to evaluate the effectiveness of its Data Breach Response policies and procedures.

PBGC should implement an effective specialized security training program that includes steps to identify and prevent phone-based social engineering for all employees.

PBGC should strengthen its controls around verifying the identity of PBGC personnel prior to temporarily disabling their requirement for MFA for remote access should a user purportedly have a malfunctioning PIV card or other MFA token.

We recommend that OESPIM develop a SORN for all applicable systems.

We recommend that OPM obtain feedback on its security awareness and training program and use the information to make improvements to the IT security training program.

Develop and distribute nationwide policy that addresses personal belongings on the workroom floor.

identify all cameras not functioning and develop a plan to restore them to operational status.

develop and implement a strategic, nationwide plan that includes continuous monitoring of the operational status of cameras and diagnosing and addressing camera failures timely.

We recommend that the Assistant Secretary for the Office of Elementary and Secondary Education require the AlaskaDepartment of Education to require Yukon-Koyukuk to determine whether the $24,386 that Yukon-Koyukuk charged toARP ESSER for the three expenditures made without maintaining proper documentation of the competitive procurementprocess was reasonable when compared to the costs of suitable alternatives, and if not, require appropriate correctiveactions.

We recommend that the Assistant Secretary for the Office of Elementary and Secondary Education require the AlaskaDepartment of Education to require Yukon-Koyukuk to ensure that LEA officials responsible for making and documentingpurchasing decisions receive sufficient training on Federal procurement requirements, including those covered under 2C.F.R. sections 200.318(i) and 200.320 (methods of procurement to be followed).

HUD OCIO should a) resolve the conflicts between its Inventory of Automated Systems (IAS) policy and web applications policy to clarify if web applications will be inventories in IAS, the web application Sharepoint site, or both; and b) implement the chosen resolution to this conflict to develop a consistent inventory of web applications (IG FISMA metric 1).

HUD OCIO should implement an automated governance, risk, and compliance tool to manage risk from all sources across the three tiers of the organization in a timely manner. This recommendation updates FY 2021 FISMA recommendation number 5 (IG FISMA metrics 5, 9, and 10).

HUD OCIO should employ automation to maintain a timely and accurate view of security configuration information for all systems connected to its network (IG FISMA metric 20).

HUD OCIO should demonstrate that it can implement its defined security responses if a baseline configuration is changed without authorization. This can be shown by either a response to a real incident if one happens or through a testing exercise if there are no applicable incidents (IG FISMA metric 23).

Implement additional policies, processes, and/or procedures to ensure that NSF assigns program element, thematic, account, budget object class, and/or other codes consistent with its Guidance for Coding of Mid-scale Research Infrastructure Awards for all awards NSF includes within its Mid-scale Research Infrastructure portfolio.

Update and/or develop external Mid-scale Research Infrastructure guidance for proposing organizations to identify and/or clarify NSF’s expectations for the proposal, award, monitoring, and reporting activities required for different types of Mid-scale Research Infrastructure awards.

Implement a formal process for documenting NSF’s oversight, as well as the performance of the activities funded under Mid-scale Research Infrastructure awards, and for appropriately storing and archiving this documentation within NSF’s eJacket system (or another appropriate system) on a timely basis.

Produce and provide additional training to Integrated Project Teams responsible for overseeing Mid-scale Research Infrastructure awards.

We recommend that USAID's Office of Acquisition and Assistance Cost, Audit and Support Division/Contract Audit Management Branch verify that ICF Macro, Inc., corrects the one material weakness in
internal control detailed on page 8 of the audit report.