Open Recommendations

Ensure West Virginia JCS updates its policies and procedures to implement a process to collect, verify, maintain, and provide accurate data to the OVC that measures the performance and effectiveness of activities funded by the VOCA awards.

IHS should assess the relative benefits of its current recruitment and retention strategies to guide future staffing plans, as well as exploring new tools to address staffing shortfalls.

IHS should explore options for expanding housing for DSFC staff.

1. We recommend that the Assistant Secretary of Commerce for Communications and Information and NTIA Administrator direct FirstNet Authority’s Chief Executive Officer to ensure that special hardening measures are implemented for the unique threats faced in the Maui region, as required by the contract.

2. We recommend that the Assistant Secretary of Commerce for Communications and Information and NTIA Administrator direct FirstNet Authority’s Chief Executive Officer to hold AT&T accountable for meeting service restoration and recovery time objectives for disaster response, as required by the contract.

3. We recommend that the Assistant Secretary of Commerce for Communications and Information and NTIA Administrator direct FirstNet Authority’s Chief Executive Officer to reevaluate the RTO metric to ensure that it aligns with the NPSBN’s operational purpose of being available during disasters.

4. We recommend that the Assistant Secretary of Commerce for Communications and Information and NTIA Administrator direct FirstNet Authority’s Chief Executive Officer to modify the contract to clearly define the requirements for dispatching emergent deployable assets, including defining deployment types and specifying how to calculate RTO for restoring network coverage and improving existing coverage.

5. We recommend that the Assistant Secretary of Commerce for Communications and Information and NTIA Administrator direct FirstNet Authority’s Chief Executive Officer to take the necessary steps to ensure that FirstNet Authority has access to real-time network data and the ability to actively monitor network services and deployed assets.

6. We recommend that the Assistant Secretary of Commerce for Communications and Information and NTIA Administrator direct FirstNet Authority’s Chief Executive Officer to strengthen disaster recovery oversight by developing and implementing formal processes for: a. actively monitoring AT&T’s disaster response efforts until complete network restoration is confirmed; and b. using FirstNet Authority’s incident response teams to conduct contract surveillance activities with public safety to determine the sufficiency of AT&T’s performance.

7. We recommend that the Assistant Secretary of Commerce for Communications and Information and NTIA Administrator direct FirstNet Authority’s Chief Executive Officer to revoke acceptance of AT&T’s Business Continuity/Disaster Recovery Plan and require AT&T to submit a plan that meets all NPSBN contract requirements. The plan should include: a demonstrated capability to provide uninterrupted access to the NPSBN during the disaster within the RTOs; specific protocols for responding to disasters in rural areas and outside the continental United States (including Hawaii and Alaska); a process for pre-positioning deployables with varying capabilities in isolated and rural regions, as determined necessary; logistics for…

8. We recommend that the Assistant Secretary of Commerce for Communications and Information and NTIA Administrator direct FirstNet Authority’s Chief Executive Officer to develop and implement a system for verifying the accuracy and reliability of data in the D-29 Deployable Units and Temporary Coverage Solutions report before accepting it.

9. We recommend that the Assistant Secretary of Commerce for Communications and Information and NTIA Administrator direct FirstNet Authority’s Chief Executive Officer to require AT&T to self-certify the D-29 Deployable Units and Temporary Coverage Solutions report going forward.

10. We recommend that the Assistant Secretary of Commerce for Communications and Information and NTIA Administrator direct FirstNet Authority’s Chief Executive Officer to ensure that AT&T’s after-action reports are accurate and sufficiently documented, with detailed lessons learned and process and protocol improvements to be implemented, before accepting them.

11. We recommend that the Assistant Secretary of Commerce for Communications and Information and NTIA Administrator direct FirstNet Authority’s Chief Executive Officer to ensure that AAR briefing meeting minutes are documented and maintained in the contract file.

We recommend that the DOI Secretary or designee establish a risk appetite as required in the Office of Management and Budget Circular No. A-123 and implement a process to ensure Departmentwide awareness of the risk appetite.

We recommend that the DOI Deputy Secretary or designee implement a process to periodically reevaluate and adjust risk appetite and tolerance levels to meet DOI's needs in accordance with the Office of Management and Budget Circular No. A-123.

We recommend that the DOI Deputy Secretary or designee create a comprehensive risk profile as required by the Office of Management and Budget Circular No. A-123 and ensure it is properly approved and incorporated into discussions for decision making.

We recommend that the DOI Deputy Secretary or designee establish a risk management council or an equivalent governance system to direct and oversee the establishment of DOI's risk profiles, regularly assess risk, develop appropriate risk responses, and approve the updated risk profile annually.

We recommend that the DOI Deputy Secretary or designee define the enterprise risk management roles and responsibilities for DOI's leadership at the executive, bureau, and office level and ensure those roles and responsibilities are clearly communicated.

Direct U.S. Merchant Marine Academy (USMMA) Sexual Assault Prevention and Response (SAPR) Program officials to work with appropriate USMMA IT officials to ensure that data collected and used for tracking claims and incidents of sexual assault and sexual harassment is secure in accordance with NDAA requirements.

Direct the Maritime Administration's Privacy Officer to complete a privacy impact analysis to ensure personally identifiable information used by the U.S. Merchant Marine Academy (USMMA) Sexual Assault Prevention and Response (SAPR)'s Program is secure based on Federal requirements and verify completion.

Direct U.S. Merchant Marine Academy (USMMA) Sexual Assault Prevention and Response (SAPR) Program officials to work with the USMMA's IT officials to implement the necessary security controls in the following areas: access control, encryption, audit logging, data exfiltration, data integrity, and backup, to mitigate possible cybersecurity risks to the SAPR Program's sensitive information in the interim to the extent possible until a new system is implemented and verify completion.

Treasury OIG should follow-up with Pennsylvania management if the transactions noted as unsupported or ineligible expenditures within the Grants greater than or equal to $50,000, Transfers greater than or equal to $50,000, Direct Payments greater than or equal to $50,000, and Aggregate Reporting less than $50,000 payment types can be supported. If support is not provided, Treasury OIG should recoup the funds or request that Pennsylvania management provide support for replacement expenses, not previously charged, that were eligible during the CRF period of performance. Further, based on Pennsylvania's responsiveness to Treasury OIG's requests and its ability to provide sufficient documentation…

Conduct a file review of the reopened Dependency and Indemnity Compensation claims granted under the PACT Act from January 1 through August 31, 2023, and take appropriate actions to ensure monetary benefits and notification letters are accurate.

(U) Rec. 3: This recommendation is Controlled Unclassified Information