Open Recommendations

(U) Rec. 1.b: Recommendation is Classified.

(U) Rec. 1.d: Recommendation is Classified.

(U) Rec. 2: Recommendation is Classified.

OIG recommends that the Peace Corps develops and implements acybersecurity risk register to support the implementation of a fullyintegrated Risk Management and Information Security ContinuousMonitoring (ISCM) program (Metric 10).

OIG recommends that the Peace Corps develops component authenticitypolicies and procedures (Metric 15).

OIG recommends that the Peace Corps periodically evaluates, reviews,and updates its policies and procedures, as necessary, to align with anissued and approved ICAM strategy which includes assigning personnelrisk designations and performing appropriate screening prior to grantingaccess to its systems (Metric 28).

OIG recommends that the Peace Corps conducts, captures, and shareslessons learned in its implementation of the incident response program(Metric 54 and 55).

OIG recommends that the Peace Corps conducts agency-level BusinessImpact Assessments (BIA) and integrates the results into informationsecurity strategies and other plan development efforts (Metric 61).

Develop and implement inspector guidance on how to assess risk within Boeing manufacturing facilities.

Develop and implement a structured oversight approach for planning and performing audits to provide a comprehensive assessment of Boeing production.

Assess the Aircraft Certification Audit Information System to determine whether the system incorporates the functions that the inspectors need to plan and manage effective audits. Based on the assessment results, implement changes to the system as appropriate.

Clarify FAA Order 8120.23A defining isolated and systemic findings and how inspectors should categorize these findings.

Revise guidance to require inspectors to evaluate Boeing's risk assessments of suppliers, including subtier suppliers, and incorporate the results of those assessments into FAA's audit planning.

Enhance inspector guidance to account for the number of Boeing suppliers, including subtier suppliers; what each supplier manufactures; and the number of audits needed to ensure Boeing effectively controls its suppliers

Develop and implement procedures that require FAA to disposition recommendations from joint FAA and industry reviews related to Boeing production and manufacturing.

Develop and implement guidance requiring inspectors to evaluate Boeing's supplier control, including review of first article inspections, to verify suppliers can produce conforming parts.

Assess whether the Compliance and Enforcement Action system has the functionality that inspectors need to manage noncompliances, including the ability to track deadlines and identify potential repetitive issues. Implement changes to the system as appropriate based on the assessment results.

Develop and implement processes used by the Boeing oversight group to evaluate root causes of noncompliances and the associated corrective actions.

Train inspectors on updated guidance and system updates for the Aircraft Certification Audit Information System and the Compliance and Enforcement Action system.

Establish procedures to periodically evaluate Boeing's Safety Management System, including how it interfaces with Boeing's existing quality system.

Establish specific and measurable criteria for Boeing to meet before FAA can return delegation to Boeing's Organization Delegation Authorization (ODA), including criteria from the FAA team overseeing Boeing's ODA.

Enforce requirements for Boeing to report allegations of undue pressure with sufficient detail, in compliance with FAA Notice N 8100.18.

Evaluate the impact of ongoing policy revisions and additional internal review requirements on FAA inspectors' abilities to address allegations of undue pressure in a timely manner. Develop and implement corrective actions based on the evaluation.

Evaluate organizational changes promoting communication across FAA groups overseeing Boeing. Develop and implement corrective actions based on the evaluation.

Develop and implement a formal policy outlining the agency’s process for assessing the per-acrenational maximum payment rate limitations for CRP to determine if revisions are needed.