Open Recommendations

Software that is no longer supported or receiving regular security updates from the vendor should be upgraded to supported versions with relevant security patches.

KPMG recommends that FAA management require privileged users on the Windows virtual machine environment to authenticate using MFA. If it is not technically feasible, then we recommend that Windows security settings are updated to require a minimum password length for privileged accounts to 16 characters and maximum password age to be updated to 60 days.

KPMG recommends that FAA management design and implement documented control activities to monitor the effective operation of its existing process controls related to:
Provisioning of new access requests for the service organization's system; and
Monitoring FAA employees' access to the service organization's system.

KPMG recommends that FAA management take measures to ensure that FAA has sufficient control operator personnel available to support the annual recertification of FAA employees with system access within the reporting timeline prescribed by DOT.

KPMG recommends that FAA design and implement a procedure to identify and timely record contracting actions within the general ledger that were executed outside of the standard business process (i.e., CO authorizations documented outside of the procurement system).

KPMG recommends that FAA update its procurement policy to define the period of time permitted to document a contractor's oral agreement.

KPMG recommends that FAA reinforce existing controls, to review individual lease payment schedules upon lease commencement or modification to ensure that the schedules are consistent with the underlying terms of the lease.

KPMG recommends that FAA design and implement procedures within its existing PP&E Accrual to obtain a complete listing of trailing costs related to completed assets and accrue for such assets that have remaining CIP balances as of the period-end.

KPMG recommends that management design and implement procedures to verify the completeness and accuracy of the non-LOI accrual average billing cycle data input used in the estimate calculation.

KPMG recommends that ESC management review and update the journal voucher control log reconciliation process to ensure it is properly designed to identify all potential deviations from policy throughout the fiscal year.

KPMG recommends that ESC management create monitoring procedures over the journal voucher control log to ensure complete and accurate documentation over manual journal vouchers is maintained.

KPMG recommends that MARAD management, in conjunction with their accounting service provider, ESC, develop a PP&E roll forward control that contains all activity within the relevant PP&E accounts by disclosure category, including additions, annual cost adjustments, year to date depreciation, capitalizations from construction in progress to other categories, and retirements.

Update the Commission’s compliance policies to incorporate all key elements in the AbilityOne and FAR regulations regarding contract performance which includes product quality. Further, add procedural guidance, including documentation requirements, that is complete and sufficient to implement the policies. Key elements include the following: a. NPA quality systems in place to furnish products that meet Government specificationsunder the contract and correct product deficiencies prior to delivery;b. Reporting of quality complaints including handling of inquiries and disputes; andc. Monitoring and evaluation of NPA compliance with these requirements.

The Commission should determine and develop written documentation of criteria/metrics, data needed from all stakeholders (i.e., NPAs, CNAs, and Federal customers), reporting tools and/or mechanisms, and procedures needed to monitor, evaluate, and assess NPA compliance withcontract performance requirements including strict adherence to quality standards. This should include documentation of this evaluation and assessment of NPA compliance in PLIMS.

Develop and implement written procedures that provide Commission requirements and guidelines to CNAs regarding quality control processes they have established to oversee and assist NPAs to ensure successful contract performance and compliance in furnishing a product to the Government. This should include all key elements (e.g., assessment and tracking of quality complaints, types of technical assistance provided to NPAs, documentation requirements, and frequency of interactions with NPAs) and ensure data provided to the Commission is comparable and sufficient to inform their decision-making.

Allmond recommends that GLS develop written policies and procedures for the annual monitoring of all user accounts. For user accounts relating to service organization systems, GLS should proactively generate or request a listing of user accounts, if one is not already provided by the service organization, and perform a review of the current system users and their permissions. The reviews should be documented and evidence of the review for each system should be retained according to the Agency's document retention policy.

Allmond recommends that GLS should amend its policies and procedures to require the review and retention of external source documentation, such as original receipts, purchase confirmations, and other purchase verification for all purchase card transactions, so that: this information can be compared to the purchase order, purchase card log, and other internally-created documentation during the approval process, and the information is readily available for external review.

HUD OCIO should implement a process to consistently update and maintain its inventory of hardware assets and ensure that the inventory is consistent with the automated discovery scans used to perform vulnerability, configurations, and continuous diagnostics and mitigation scans and use this inventory to consistently remove unauthorized hardware assets from the HUD network (IG FISMA metrics 2, 20, and 21).

HUD OCIO should implement a process to consistently update and maintain its inventory of software assets and ensure that the inventory is consistent with the automated discovery scans used to perform vulnerability, configurations, and continuous diagnostics and mitigation scans and use this inventory to consistently remove unauthorized software assets from the HUD network (IG FISMA metrics 2, 20, and 21).

HUD OCIO should update its software inventory policies and procedures to account for critical software as defined by EO 14028 (IG FISMA metrics 3 and 21).

HUD OCIO should implement policies and procedures to maintain inventories of critical software and software licenses, critical software platforms, and all software installed on critical software platforms (both critical software and noncritical software) and use the inventory of critical software platforms and all software installed on them to ensure that only supported versions of software are used on those critical software platforms (IG FISMA metrics 3 and 21).

HUD OCIO should in coordination with the Chief Risk Officer (CRO), document cybersecurity risk management roles and responsibilities in a consolidated list and; define procedures to hold personnel accountable to their assigned roles in the consolidated list (IG FISMA metric 7)

HUD OCIO should consistently implement personnel accountability procedures to ensure that assigned cybersecurity risk management roles are being performed in an effective manner (IG FISMA metric 7).

HUD's Office of the Chief Financial Officer (OCFO), in coordination with other appropriate program offices, should define and implement a risk-based process to assess and document IT risk management personnel resourcing needs and that those personnel are allocated effectively to support HUD's risk management program (IG FISMA metric 7).

HUD OCFO, in coordination with other appropriate program offices, should define and implement a process to document and allocate non-personnel risk management resources in a risk-based manner, to include but not limited to funding, processes, and technology (IG FISMA metric 7).