Open Recommendations

Review the policies and procedures of its other law enforcement components to ensure that they are sufficient to address the concerns we have identified in the conduct of Operations Wide Receiver and Fast and Furious, particular regarding oversight of sensitive and major cases, the authorization and oversight of "otherwise illegal activity," and the use of information in situations where the law enforcement component also has a regulatory function.

This recommendation contains information about IT deficiencies which, if made public, could endanger NARA systems. Please contact the OIG if you need further information.

We recommend the Executive for Information Services/Chief Information Officer (I), in coordination with the Chief Operating Officer (C) ensure all classified system authorization packages are updated in accordance with NARA policy.

We recommend the Executive for Information Services/Chief Information Officer (I), in coordination with the Chief Operating Officer (C) establish a timeline for review and approval of authorization documents.

We recommend the Executive for Information Services/Chief Information Officer (I), in coordination with the Chief Operating Officer (C) obtain authorizations to operate for each of the classified systems or disallow them in accordance with NARA and Federal policy.

Identify the participants of the CPSC Risk Executive Council and define specific tasks/milestones for implementing the proposed Risk Management Framework.

Develop an Enterprise Architecture that includes a comprehensive IT security architecture using the CIO Council's guidance and incorporate this into the Security Control Documents.

The CIO should conduct the consolidation/virtualization analysis to investigate the impact of consolidating or virtualizing two major application domains (NISP and ERA) and the General Support System (NARANET) as planned, or evaluate other alternatives to increase the average server utilization rate.

Recommendation is not publicly available.

Recommendation is not publicly available.

KPMG recommends that the OPM Director in coordination with the CIO and system owners, including the Chief Financial Officer and system owners in Program offices, ensure that resources are prioritized and assigned to address the information system control environment weaknesses.

(b) Implement the text description functionality in the MyAmeriCorps Portal to allow grantee personnel –to document the Compelling Personal Circumstances justifications. (c) Implement monitoring controls requiring a secondary level of review of each approved partial education award.

The Office of Programs should work with the management control review committee to revise management control documentation to be consistent with Government Accountability Office guidance for internal controls.

Develop short-term, intermediate, and long-term outcome performance measures, and additional output performance measures, with appropriate targets and timeframes, to measure the progress and results of theprogram.

Develop and publish a comprehensive management plan for EDSP, including estimates of EDSP’s budget requirements, priorities, goals, andkey activities covering at least a 5-year period.

Annually review the EDSP program results, progress toward milestones, and achievement of performance measures, including explanations for any missed milestones or targets.

Rec. 2.a: The DoD OIG recommended that the Deputy Commandant, Plans, Policies, and Operations, update the small arms accountability guidance in Marine Corps Order 5530.14A consistent with Marine Corps Bulletin 4440 and the updates to Marine Corps Order 8300.1C.

KPMG recommends that the CIO develop and promulgate entity-wide security policies and procedures and assume more responsibility for the coordination and oversight of Program Offices in completing certification and accreditation and other information security requirements and activities.

KPMG recommends that the CIO identify common controls, control responsibilities, boundaries and interconnections for information systems in its system inventory.

Establish Procedures to Track Source of Facts Provided to the Public and Congress.

Require Identification of Federal Crime as Part of Documenting Predication.

Consider Revising Attorney General's Guidelines and DIOG to Reinstate Prohibition on Retention of Irrelevant First Amendment Material from Public Events.

Clarify When First Amendment Cases Should Be Classified as "Acts of Terrorism" Matters.

Develop a systematic approach to identify which states have outdated or inconsistent memorandums of agreements; renegotiate and update those Memorandums of Agreements using the Memorandum of Agreements template; and secure the active involvement and final,documented concurrence of headquarters to ensure national consistency.