Open Recommendations

We recommend that the Director, United States Secret Service develop and implement controls to ensure compliance with DHS privacy policies, specifically approval of Privacy Impact Assessments, when required, before developing or procuring information technology that collects, maintains, or disseminates information in an identifiable form.

We recommend that the Chief Privacy Officer, DHS Privacy Office ensure compliance with its privacy policies or revise them to include the guidance necessary for program offices to meet the intent of the privacy requirements when, with due diligence, the technology needs to be procured and tested to complete the Privacy Impact Assessment process. The additional guidance, if developed, should address justification for deviating from Privacy Impact Assessment–related privacy policies and restrictions on the operational use of privacy-sensitive information; the guidance should also ensure Privacy Impact Assessments are completed before privacy-sensitive information is collected and used operationally.

We recommend that the Chief Data Officer, Office of Chief Information Officer, Management Directorate develop and implement a department-wide commercial telemetry data policy, including component policy requirements, to ensure oversight of commercial telemetry data use, privacy protection, and applicable legal standards.

We recommend that NRC management reviews all ITI POA&Ms to ensure that they are accurate and contain detailed information on the status of corrective actions, including changes to scheduled completion dates.

We recommend that NRC management increases the current SIEM tool licensing level and acquires funding to adequately support the procurement, onboarding, and implementation of requirements across all EL maturity tiers to ensure events are logged and tracked in accordance with OMB M-21-31.

Work collaboratively with the vendor to identify the risk of future field modification instructions, as well as any modifications needed as a result of the model validation efforts, and develop plans to mitigate their schedule impact.

Direct staff to conduct an analysis to determine suggested policy changes to further reduce the impact of a potential future loss of a Board quorum on EXIM’s medium- and long-term lending.

Direct staff to conduct an analysis to determine what changes should be made to further mitigate the risks to EXIM’s medium- and long-term export credit financing that were generated by the lack of Board quorum.

Direct staff to conduct a study exploring the potential for varying EXIM’s domestic content requirement by industry or sector for all exporters—not just those that qualify under the narrow exceptions of the CTEP program—and adopt policy changes to reflect any modifications or revisions to domestic content requirements based on the results of the study.

Direct the Senior Vice President for Policy Analysis and International Relations to seek updates to EXIM’s MOU with MARAD to reflect changes in EXIM’s policies and priorities and consider revisiting the $20 million threshold for U.S.-flagged shipping.

Develop a comprehensive plan, in coordination with MARAD, to provide clearer and more effective guidance on EXIM’s website for U.S. exporters to assist them in complying with EXIM’s domestic shipping requirements and procedures, including processes for requesting a MARAD waiver on the use of U.S. flagged vessels.

In advance of EXIM’s next reauthorization, engage with interagency stakeholders to develop proposals that address the challenges associated with the impact on EXIM’s competitiveness of requiring exporters to use U.S. flagged shipping vessels.

In advance of EXIM’s next reauthorization, engage with interagency stakeholders to develop legislative proposals that would modify the agency’s charter to address the limitation in Sec. 2(a)(2), which prevents EXIM from matching recent updates to the OECD Arrangement.

Have the Office of General Counsel support efforts to consider recommendation of revisions to the Board’s delegated authority policy to allow for expedited reviews of larger deals, particularly when there is no Board quorum.

Support a study led by the Office of Human Capital, strategic planning, and other internal stakeholders, to identify specific factors impacting EXIM’s ability to attract and retain staff and implement recommendations to address workforce recruitment, retention, and succession planning needs in this area.

Update AmeriCorps' Information System Inventory to include external vendor systems such as Administrative Resource Center Financial System. (New)

Establish policies and procedures to perform an annual review of the inventory to ensure AmeriCorps' Information System Inventory includes all information systems used or operated by an agency, an agency contractor, or another organization on behalf of an agency. (New)

Upgrade to a supported version of the application software and revise the references to the supported software in the Business Impact Analysis or accept the risk of not updating the software by documenting the exposure risk in a formal risk acceptance memo signed by the Authorizing Official. (New)

Develop and implement an effective monitoring mechanism to track the progress of Authorization to Operate letters within the three-year review window and ensure timely approval of the System Security Plans. (New)

Complete an authorization package that covers the Administrative Resource Center Financial System (New)

Enhance and implement core and specialized training to develop competencies in authorization packages for external vendor systems such as Administrative Resource Center Financial System. (New)

Finalize and issue the Incident Response Plan for FY 2023. (New)

Establish and implement a process and an effective monitoring mechanism to track the progress of Incident Response Plan annual reviews ensuring timely completion and updates, adapting the evolving cybersecurity threats, maintaining effective response capabilities, and reflecting the current agency operations and system environment. (New)

Develop a comprehensive project plan and roadmap to meet the logging requirements in accordance with OMB M-21-31. (New)

Upgrade and configure its Security Information and Event Management tool to capture all log requirements in accordance with OMB M-21-31. (New)