Open Recommendations

We recommend that the Commissioner of CBP finalize the draft CBP Integrated SWB Mass Irregular Migration Contingency Plan.

We recommend that the Commissioner of CBP establish a comprehensive, formal policy to: • consistently document the use of all available information to make informed facility planning decisions; • conduct and document analysis of all possible alternative options before establishing temporary facilities; and • regularly reassess the continued need for existing temporary facilities and evaluate the cost-effectiveness of maintaining existing temporary facilities.

Create a performance standard that requires that teleservice center managers and other employees who conduct service observations conduct a minimum of three service observations for each qualified 800-number employee per month, as required by SSA policy.

Create policy to ensure all problematic calls identified through speech analytics are referred to regional management and regional management intervenes with the 800-number employees referred within defined timeframes to ensure prompt interventions address problematic and/or inadequate customer service.

Develop and implement a feedback process for external threat sharing activities.

Develop performance measures to assess the effectiveness of its external threat and vulnerability information sharing activities

Ensure that all data sets within the FDIC that contain relevant threat and vulnerability information are assessed and natural language processing or alternative technological capabilities are considered for enhancing threat and vulnerability information sharing operations.

OCSS should Bolster State agency resilience during emergencies.

OCSS should create forums for identifying and sharing State agency best practices in providing paternity establishment services.

We recommend the TSA Chief Information Officer require the selected High Value Asset system owner to document an approved secure baseline configuration and perform testing to verify that all approved settings are implemented.

We recommend the TSA Chief Information Officer enforce the requirement for the selected High Value Asset system owner to apply security updates and service patches to remediate vulnerabilities on all devices, as required by applicable DHS policies.

We recommend the TSA Chief Information Officer require the selected High Value Asset system owner to develop and implement a supply chain risk management plan to address and mitigate risks associated with the hardware components and software being used on the selected High Value Asset system.

We recommend the TSA Chief Information Officer direct the selected High Value Asset system owner to strengthen its user account management procedures to ensure user access agreements are developed and signed by users before users are given access to the selected High Value Asset system or when the agreement is revised.

We recommend the TSA Chief Information Officer require the selected High Value Asset system owner develop and implement detailed procedures on granting system access, including emergency or temporary access. In addition, the TSA Chief Information Officer should require the selected High Value Asset system owner to maintain a current list of system users and remove or disable inactive accounts according to applicable DHS and TSA policies.

We recommend the TSA Chief Information Officer direct the selected High Value Asset system owner to require all non-privileged users’ system access requests be reviewed, authorized, and documented before granting system access. In addition, users’ system access should be reviewed periodically and removed if it is no longer needed.

We recommend the TSA Chief Information Officer direct the selected High Value Asset system owner to review and document the approval of all privileged users’ system access before granting system access. In addition, privileged users’ system access should be reviewed and removed according to applicable DHS and TSA requirements if it is no longer needed.

We recommend the TSA Chief Information Officer require the selected High Value Asset system owner to develop and implement procedures to remove system access for separated users.

We recommend the TSA Chief Information Officer direct the selected High Value Asset system owner to require all system users sign Computer Access Agreements to acknowledge the rules of behavior when accessing the system.

We recommend the TSA Chief Information Officer direct the selected High Value Asset system owner to enforce users to receive security awareness training when they are given system access and annually thereafter.

We recommend the TSA Chief Information Officer direct the selected High Value Asset system owner to strengthen its system-level Information Security Continuous Monitoring by ensuring (1) security documents contain current and accurate information about the system; (2) relevant policies and procedures are developed, reviewed, and approved; and (3) Plans of Action and Milestones are remediated promptly and include all required information.

We recommend the TSA Chief Information Officer require the selected High Value Asset System’s Contingency Plan and Contingency Plan Test to be reviewed and approved in accordance with DHS and National Institute of Standards and Technology guidance.

We recommend that the Chief Operating Officer for Federal Student Aid (FSA) require USC to— 1.1 Calculate the actualamount of improper Pell and any other Title IV payments made to the 13 students for whom it did not apply professionaljudgment other than dependency override in accordance with section 479A of the HEA and return those funds to theDepartment.

We recommend that the Chief Operating Officer for Federal Student Aid (FSA) require USC to— 1.2 Review its records forthe 6,062 students for whom the school reported that it applied professional judgment other than dependency override foraward year 2019–2020 or award year 2020–2021 but were not included in our sample and (a) identify those students forwhom it improperly adjusted the value of data items affecting AGI based on allowances or expenses unrelated to specialcircumstances, (b) provide FSA with a listing of the improperly disbursed Title IV funds and the records associated withthose students for whom financial aid administrators improperly applied…

We recommend that the Chief Operating Officer for FSA require USC to— 2.1 Review its records for the 6,162 studentsfor whom the school reported that it applied professional judgment other than dependency override for award year2019–2020 or 2020–2021; identify records adequately documenting the use of professional judgment; and provide therecords for any students with inadequately documented professional judgment to FSA along with a listing of the amount ofTitle IV funds, if any, that were improperly awarded and disbursed to students.

We recommend that the Chief Operating Officer for FSA require USC to— 3.1 Provide additional records that adequatelydocument the financial aid administrators’ determinations of independence for the six students or return to the Department$3,700 in Pell funds and $26,200 in Direct Loan funds.