Open Recommendations

We recommend that the Deputy Secretary and Chief Operating Officer require OCIO and FSA to ensure that terminated users' network access is removed timely.

We recommend that the Deputy Secretary and Chief Operating Officer require OCIO and FSA to ensure that access agreements for users accessing Department and FSA systems are documented and maintained. (Repeat Recommendation FY 2018 & FY 2019)

We recommend that the Deputy Secretary and Chief Operating Officer require OCIO and FSA to consistently document position risk designations for background investigations.

We recommend that the Deputy Secretary require OCIO to fully implement the Department's ICAM strategy to ensure that the Department meets full Federal government implementation of ICAM. (Repeat Recommendation FY 2018 & FY 2019)

We recommend that the Deputy Secretary require OCIO to ensure that the network access control solution is fully implemented to ensure identification and authentication of devices connected to the network.

We recommend that the Deputy Secretary require OCIO to validate the inactivity settings to ensure sessions time out after 30 minutes of inactivity.

We recommend that the Chief Operating Officer require FSA to fully implement the process for identifying, managing, and tracking activity of privileged user accounts.

We recommend that the Chief Operating Officer require FSA to enforce a two-factor authentication configuration for all user connections to systems and applications.

We recommend that the Chief Operating Officer require FSA to require system owners configure all websites to display warning banners when users login to Departmental resources and ensure that banners include approved warning language by October 31, 2019.

We recommend that the Deputy Secretary and the Chief Operating Officer require OCIO and FSA to incorporate additional measures to, at a minimum, achieve Level 3 Consistently Implemented status of the Data Protection and Privacy program.

We recommend that the Deputy Secretary require OCIO to ensure that Privacy Impact Assessments are reviewed every 2 years.

We recommend that the Deputy Secretary require OCIO to incorporate additional measures to, at a minimum, achieve Level 3 Consistently Implemented status of the Security Training program

We recommend that the Deputy Secretary require OCIO to ensure that all new users complete the mandatory training requirements before they receive access to Departmental systems.

We recommend that the Deputy Secretary and Chief Operating Officer require OCIO and FSA to ensure that the process for ensuring completion of role-based training is fully implemented.

We recommend that the Deputy Secretary and the Chief Operating Officer require OCIO and FSA to incorporate additional measures to, at a minimum, achieve Level 3 Consistently Implemented status of the ISCM program.

We recommend that the Deputy Secretary require OCIO to automate its capabilities for monitoring the security controls effectiveness and overall implementation of the ISCM Roadmap. (Repeat Recommendation FY 2018 & FY 2019)

We recommend that the Deputy Secretary require OCIO to ensure the completion of Phases 1 and 2 of the CDM program. (Repeat Recommendation FY 2018 & FY 2019)

We recommend that the Deputy Secretary require OCIO to implement a process that ensures data reported on the Cybersecurity Framework Risk Scorecard is accurate.

We recommend that the Deputy Secretary require OCIO to incorporate additional measures to, at a minimum, achieve Level 3 Consistently Implemented status of the Incident Response program.

We recommend that the Deputy Secretary require OCIO to ensure that incidents are consistently submitted to the OIG within the required timeframe.

We recommend that the Deputy Secretary require OCIO to ensure that data loss prevention technologies work as intended for the blocking of sensitive information transmission.

We recommend that the Chief Operating Officer require FSA to incorporate additional measures to, at a minimum, achieve Level 4 Managed and Measurable status of the Contingency Planning program.

We recommend that the Chief Operating Officer require FSA to ensure that contingency plans, and other artifacts impacting contingency plans, are documented and updated in a consistent and timely manner.

Develop and implement procedures within FTA's Triennial and State Management Reviews to assess the necessary data to affirm that each grantee undergoing a comprehensive review carries flood insurance that complies with the FDPA. FTA's suggested corrective actions for any grantee deficiency in this area should include, at a minimum, requiring the grantee to submit to FTA documentation showing proof of flood insurance in the aggregate amount of the maximum available NFIP insurance or the amount of the Federal investment (whichever is less) for all structures required to have it.

U.S. Mint (Mint) management should finalize and implement its bureau-wide privacy program that includes a strategic organizational privacy plan for implementing applicable privacy control and procedures in accordance with National Institute of Standards and Technology (NIST) 800-53. (Recommendation #12)