Open Recommendations

We recommend that OSM enforce and revise, as appropriate, the TSR-15 requirements so that the directive aligns with the actions resulting from OSM's review and update of its regulations conducted under Recommendation 1.

We recommend that OSM require the preparation and issuance of an AAR after each incident or exercise and require the inclusion of a planned course of action to implement and track the recommended corrective actions in the AAR.

We recommend that BOR revise the "Departmental Manual" to include a uniform approach to monitoring and emergency action planning for non-DOI dams located on DOI lands.

The Archivist of the United States should demonstrate a commitment to the development, implementation, and operation of NARA’s ICP by ensuring Risk management responsibilities are included in the performance plans for program and function owners.

KPMG recommends that the OPM Director in coordination with the CIO and system owners, including the Chief Financial Officer and system owners in Program offices, ensure that resources are prioritized and assigned to address the information system control environment weaknesses.

Recommendation not publicly available.

Recommendation not publicly available.

Recommendation not publicly available.

Recommendation not publicly available.

Recommendation not publicly available.

Recommendation not publicly available.

Recommendation not publicly available.

Review the policies and procedures of its other law enforcement components to ensure that they are sufficient to address the concerns we have identified in the conduct of Operations Wide Receiver and Fast and Furious, particular regarding oversight of sensitive and major cases, the authorization and oversight of "otherwise illegal activity," and the use of information in situations where the law enforcement component also has a regulatory function.

This recommendation contains information about IT deficiencies which, if made public, could endanger NARA systems. Please contact the OIG if you need further information.

We recommend the Executive for Information Services/Chief Information Officer (I), in coordination with the Chief Operating Officer (C) ensure all classified system authorization packages are updated in accordance with NARA policy.

We recommend the Executive for Information Services/Chief Information Officer (I), in coordination with the Chief Operating Officer (C) establish a timeline for review and approval of authorization documents.

We recommend the Executive for Information Services/Chief Information Officer (I), in coordination with the Chief Operating Officer (C) obtain authorizations to operate for each of the classified systems or disallow them in accordance with NARA and Federal policy.

Identify the participants of the CPSC Risk Executive Council and define specific tasks/milestones for implementing the proposed Risk Management Framework.

Develop an Enterprise Architecture that includes a comprehensive IT security architecture using the CIO Council's guidance and incorporate this into the Security Control Documents.

The CIO should conduct the consolidation/virtualization analysis to investigate the impact of consolidating or virtualizing two major application domains (NISP and ERA) and the General Support System (NARANET) as planned, or evaluate other alternatives to increase the average server utilization rate.

Recommendation is not publicly available.

Recommendation is not publicly available.

KPMG recommends that the OPM Director in coordination with the CIO and system owners, including the Chief Financial Officer and system owners in Program offices, ensure that resources are prioritized and assigned to address the information system control environment weaknesses.