Open Recommendations

Implement Information Security Continuous Monitoring roles and responsibilities.

Develop mechanisms to ensure Information Security Continuous Monitoring stakeholder accountability.

Define and implement event logging requirements in accordance with Office of Management and Budget Memorandum 21-31, Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents.

Develop and implement policies and procedures for maintaining a Continuity of Operations Plan and conducting organizational and system level Business Impact Analyses in accordance with current federal guidance. (e.g., National Institute of Standards and Technology Special Publication 800- 34/53, Federal Continuity Directive 1, National Institute of Standards and Technology Cybersecurity Framework, and National Archive and Records Administration guidance).

Update the Continuity of Operations Plan, or other documentation supporting the CPSC contingency planning efforts, to provide traceability from the statutory requirements to the Mission Essential Functions and to include all necessary information, for example: (1) a list of systems that support the Mission Essential Functions, (2) a list of systems necessary for essential supporting activities, and (3) a list of records essential for the CPSC’s continuity of operations.

Integrate documented contingency plans with the newly developed Continuity of Operations Plan and organizational Business Impact Analyses.

Test the set of documented contingency plans.

Treasury OIG follow-up on the missing documentation and make a determination whether to conduct a full-scope audit of Point Hope. In addition, Treasury OIG personnel determine whether to take further action, up to and including recoupment of Point Hope’s CRF proceeds, based on the scope limitation and potential noncompliance with the records retention requirement.

We recommend the Acting Assistant Secretary for Employment and Training specify within its policy the information states must include in their documentation to support compliance with the requirements to receive grant funds prior to disbursement of the funds.

We recommend the Acting Assistant Secretary for Employment and Training remedy the $136,353,567.50 in questioned costs.

Conduct a cost-benefit analysis of either appointing personnel with full travel authority and oversight responsibility or allowing travelers to be responsible for submitting, tracking, and supporting their travel actions and expenses in eTravel.

Update the travel policy to reflect the needs of the Postal Regulatory Commission and align with agency priorities.

Create a training program about the travel process and require employees that travel to complete this training and retake as needed when changes to the process occur.

FHFA should update FHFA’s Supply Chain Risk Management Strategy to include past due OMB M-22-18 requirements including: i. Obtaining a self-attestation from the software producer before using the software; ii. Obtaining from software producers artifacts that demonstrate conformance to secure software development practices, as needed; iii. Establishing a system to store self-attestation letters from the software producer that are not publicly available in a central location; andiv. Assessing and developing training for reviewing and validating self-attestation letters.

FHFA should consider request for an extension or waiver in accordance with OMB M-22-18 and/or OMB M-23-16 if FHFA is unable to meet the requirements in OMB M-22-18 and/or OMB M-23-16 in a timely manner. If FHFA requests a waiver, FHFA should consider documenting a risk-based decision, and document any compensating controls.

FHFA should remediate past due exploitable vulnerabilities in accordance with CISA’s BOD 22-01 and the OTIM Vulnerability Management Process.

FHFA should develop POA&Ms to track the remediation of past due CISA known exploitable vulnerabilities that cannot be remediated in a timely manner (within 14 days) in accordance with CISA’s BOD 22-01 and OTIM Vulnerability Management Process. Consider implementing compensating controls (i.e., isolating systems with un-remediated vulnerabilities) to mitigate the risk of the vulnerabilities.

FHFA should mplement requirements across all EL maturity tiers to ensure events are logged and tracked in accordance with OMB M-21-31.

FHFA should identify and implement solutions, in coordination with vendors, where a solution does not exist for systems to natively forward event logs to the SIEM tool. If there are no viable solutions, perform a risk assessment and cost benefit analysis. Based on the risk assessment, document any risk-based decisions, including compensating controls, for systems not in compliance with OMB M-21-31.

FHFA should update the Disaster Recovery Procedures for FHFA Production Systems to include JPP and its servers, and ensure they are included in the annual contingency testing.

1. The FLRA CIO should develop, review and update, as necessary, the followinginformation security program policies and procedures in accordance with NIST and agencyrequirements:a. Personnel Security policy.b. Security Assessment policy.c. Identification and Authentication policy.d. Access policy.

We recommend the Department of Homeland Security Under Secretary for Management update or create departmental policy for components to follow when a contractor requests extraordinary relief under Public Law 85-804.

State of Ohio management should provide missing supporting documentation and make necessary reporting corrections.

State of Ohio management should provide missing supporting documentation and make necessary reporting corrections.

State of Ohio management should provide missing supporting documentation and make necessary reporting corrections. Additionally, Treasury Office of Inspector General should obtain information to determine if there are other ineligible severance pay transactions in addition to those already identified as part of the desk review.