Open Recommendations

The Office of Health Servies reviews the efforts of the health unit in North Macedonia to
determine any appropriate recognition.

The Country Director re-engages health unit staff through regular check-ins, a visible
leadership presence, and creates structured opportunities for staff feedback and
collaboration.

The Transportation Division should bring its policy and practices related to legal environment assessments for asset-backed transactions in alignment either by updating the policy to reflect actual practices or by enforcing practices required by the current policy.

The Asset Management Division should bring its policy and practices related to collateral value assessment for agricultural aircraft transactions in alignment either by updating the policy to reflect actual practices or by enforcing practices required by current policy.

The Transportation Portfolio Monitoring Division should implement a periodic inspection schedule and coordinate with the borrowing airlines to assess use, condition, and maintenance records that help preserve the value of EXIM’s collateral.

Implement standardized expectations to ensure that the Board recovers laptops from all departing employees, including options for potential consequences for failure to return a laptop.

Coordinate with the responsible custodial division to ensure that the 677 laptops that were outside of the division’s inventory system from June 2025 to March 2026, worth $1.447 million, are issued to Board staff so that the funds spent on laptops are put to better use.

Establish standard, enterprisewide expectations for managing the Board’s inventory of unassigned laptops and hard drives ready for disposal. Such standardized expectations should incorporate leading practices and include inventorying, tracking, assessing missing, securing, and organizing unassigned laptops and hard drives ready for disposal, as well as time frames for tagging, inventorying, and disposing of hard drives.

Develop a monitoring program that
a. requires custodial divisions to report division-level laptop inventory information using the Board’s IT inventory management system.
b. includes procedures for the Division of IT to ensure that custodial divisions follow the standard, enterprisewide expectations.

Develop and implement training for custodial divisions on the standard, enterprisewide expectations.

Determine and clarify in the Board’s Delegations of Administrative Authority who has the oversight responsibility to manage IT equipment purchased by the divisions.

Establish and implement a process to visually confirm that hard drives are removed before surplussing the laptop shells.

Update the CSIRT Framework and Procedures. Include detailed procedures for the following areas:
a. Handling specific incident types during the Detection and Analysis phase.
b. Incident containment strategies for incident types.
c. Incident eradication activities.

Ensure that Triage Coordinators fully document key information in the incident ticket, including (1) the determination of whether or not the event is a computer security incident and (2) the steps taken for incident containment, eradication, and recovery.

Ensure tickets identified in Tables 1 and 2 are correctly categorized as “Computer Security Incident” or reclassified as “problem” tickets in the service ticketing system.

Evaluate the pre-award documents for the 13 contracts that had missing documents, which have an overall award value of more than $48.2 million in unsupported costs, and document conclusions reached, as applicable.

Establish and implement oversight controls to ensure that contract file documentation is complete and fully complies with Federal laws and regulations.

Restricted due to sensitive information.

Restricted due to sensitive information.

Restricted due to sensitive information.

Restricted due to sensitive information.

Update the relevant handbook, to incorporate a procedure on identified physical security threats.

We recommend the GSA Administrator enforce internal procedures to ensure that the Office of Mission Assurance and Office of Facilities Management perform their required facility security responsibilities.

We recommend the GSA Administrator in conjunction with FPS: a) conduct a nationwide assessment of outstanding deficient security fixtures; b) develop and implement a plan to repair, replace, or install security fixtures identified through the nationwide assessment; c) redacted due to sensitive information related to federal building security; and d) if GSA cannot secure funding to repair, replace, or install security fixtures, work with the Office of Management and Budget to establish a consistent funding stream to address current and future security fixture deficiencies.

Implement guidance and training on the requirements for the additional time tracking data fields in FedEZFile for case managers.