Open Recommendations

Review existing financial advisory and consulting services Receivership Basic Ordering Agreements and take appropriate steps to establish an adequate supply of contractors with appropriate resources to address the FDIC’s future procurement needs in the event of financial institution failures and financial crises.

Establish a process to periodically review financial advisory and consulting services Receivership Basic Ordering Agreements to ensure sufficient contractor resources are available to meet the FDIC’s mission-critical needs.

Establish an upfront pricing framework or advanced pricing within all financial advisory and consulting service Receivership Basic Ordering Agreements.

Establish an emergency response acquisition team with appropriate FDIC personnel and ensure that a dedicated team of key individuals (including Technical Monitors) is available to carry out emergency procurement procedures.

Develop and implement periodic emergency procurement testing exercises for appropriate FDIC employees.

Establish a process for emergency procurements to document and maintain analysis, decisions, and commitments, to include, at a minimum, those identified in this report.

Develop and implement a process to analyze and determine when documented deliverables should be required on emergency service contracts to ensure contract personnel have the ability and resources to oversee contractor performance.

Perform retrospective reviews when the FDIC conducts or tests emergency acquisition procedures.

Review the work performed and information used by the four non-U.S. citizens and take appropriate action.

Provide training and guidance to its Executive Management and personnel reinforcing their roles and responsibilities in carrying out and overseeing the FDIC’s emergency acquisition procedures. This training and guidance should include, at a minimum, the following:
• understanding roles and responsibilities;
• initiating and performing emergency and expedited procedures; and
• initiating, modifying, approving, and submitting requirements packages.

OIG recommends that the Bureau of the Comptroller and Global Financial Services, in coordination with the Bureau of International Narcotics and Law Enforcement Affairs and the Office of Foreign Assistance, develop and implement a unique identifier for anti-corruption programs and activities and issue instructions to ensure consistent use by all Department of State bureaus and overseas posts. These instructions should include quality checks on data elements that are at increased risk of being reported incorrectly.

OIG recommends that the Bureau of Administration confirm that all bureaus have designated an official to review the MyGrants Post Award Activities function reports and that Grants Officers and Grants Officer Representatives are complying with oversight requirements.

OIG recommends that the Bureau of Democracy, Human Rights, and Labor implement the Department of State Managing for Results framework and Program Design and Performance Management Toolkit guidance for developing project goals, objectives, and performance indicators.

OIG recommends that the Bureau of International Narcotics and Law Enforcement Affairs implement the Department of State Managing for Results framework and Program Design and Performance Management Toolkit guidance for developing project goals, objectives, and performance indicators.

OIG recommends that the Deputy Secretary of State for Management and Resources, or another Department of State (Department) official with appropriate authority, designate an office, bureau, or individual with necessary knowledge, expertise, and resources the responsibility for developing a Department-wide anti-corruption strategy in accordance with 18 FAM 301.2-4(B). The strategy should clearly establish anti-corruption roles and responsibilities across the Department, define corruption, and frame the Department's efforts in the context of the United States Strategy on Countering Corruption goals and objectives.

Develop and finalize policies and procedures that address cyber threat information
sharing. These policies and procedures should, at a minimum, include:
*Formally documenting internal and external sharing practices, clarifying the
criteria and threshold to inform individual credit unions or external stakeholders
of a cyber threat, and clarifying the method and timing of informing credit unions
or external stakeholders.
*Determining the criteria for internal assessment for escalation and communication
of cyber threat information.

Formally establish and clarify operational roles and responsibilities across offices for
cyber threat information sharing and any delegation of authorities to determine when
issues must be escalated. This should, at a minimum, address:
*Establishing operational responsibilities at all stages of cyber threat-related
events, including pre-incident declaration.
*Clarifying delegation of authorities for efficient and timely decision making and
issue escalation.
*Identifying single point dependencies and addressing appropriate resourcing.
*Determining appropriate communication and coordination protocols between
offices.

Ensure timely finalization and implementation of recommendations identified in the after-action and lessons learned reports for cyber-related incidents, including the draft (b)(8) after-action report and the draft pre-victim notification lessons learned report.

Update and document incident reporting triage protocols to provide consistent and
useable data in the Cyber Incidents for Credit Unions Reporting System.

Document and implement internal data management protocols that ensure the appropriate
sharing, assessment, and response of available cyber threat information.

Evaluate and determine if cyber threat information in suspicious activity reports should
be used in NCUA’s general examination and supervision of credit unions.

Develop a process to assess credit unions' and other stakeholders' feedback on NCUA's cyber threat information sharing and update information sharing processes to reflect any necessary changes.

Ensure the Office of Examination and Insurance provides timely updates to examination and supervisory guidance to address cyber risks.

We recommend FEMA’s Grant Programs Directorate Assistant Administrator develop and implement an agreed-upon process to establish and report Operation Stonegarden grant performance measures and targets to the Office of National Drug Control Policy.

We recommend FEMA’s Grant Programs Directorate Assistant Administrator develop and implement a methodology for estimating the percentage of Operation Stonegarden grant funds used for drug enforcement activities.