Open Recommendations

Review the NIST Cybersecurity Framework 2.0 and formalize documented policies and procedures for developing and maintaining current and target cybersecurity profiles that align with the CSF to include, at a minimum, consideration of AmeriCorps’ mission objectives, threat landscape, and resources (including personnel) and constraints.

Develop, document, and maintain current and target cybersecurity profiles that align with the NIST Cybersecurity Framework 2.0 — including a gap analysis between the current and target cybersecurity posture—that consider anticipated changes in AmeriCorps’ cybersecurity posture.

Document policies and procedures for developing and maintaining a comprehensive and accurate inventory of data and the corresponding metadata for AmeriCorps’ data types.

Develop and maintain a comprehensive and accurate inventory of data and corresponding metadata for AmeriCorps’ data types, to include data obtained from third party providers to meet the requirements of the Open Government Data Act and OMB Memorandum M-25-05.

Perform and document a formal risk assessment associated with the use of the ARC system.

Update the risk assessments for the GSS and eSPAN on an annual basis.

Conduct a security control assessment for the GSS and eSPAN on an annual basis in accordance with AmeriCorps’ Security Control Standard Assessment, Authorization & Monitoring.

Coordinate with relevant stakeholders to align the documented RTOs in the GSS and eSPAN BIAs, and ensure both BIAs are updated accordingly

Implement the approved standard baseline configurations for all servers, workstations, and network devices in the AmeriCorps’ information system environment

Determine the allowability of $68,272 in unsupported questioned costs on pages 20 to 24 of the audit report and recover any amount that is unallowable.

Verify that The Association Network for Building Peace corrects the instance of material noncompliance detailed on pages 37 to 38 of the audit report.

Update procedures and provide training to Contracting Officers, Oversight Managers, and Program Office personnel overseeing contracts that use service level metrics that outlines how to a) draft effective and measurable service level metrics, b) monitor contractor compliance with performance requirements and review performance data, and c) review and assess service level metrics to ensure they accurately reflect contractor performance.

Recover service level credits totaling [redacted], so that the funds can be put to better use or provide documentation to justify uncollected credits.

Ensure Contract Management Plans include the controls that will be used by key contract personnel to oversee and manage complex service contracts.

Use the e-invoicing platform to replace manual invoice processing for future Infrastructure Support Services contracts.

Require Contracting Officers, Oversight Managers, and Program Office personnel to document the methodology for service level metrics calculations on all future managed service contracts before contract award or prior to implementing credits on invoices.

Ensure that Oversight Managers upload the supporting data for invoices to the contract electronic file application and determine whether the [redacted] in questioned costs for resource unit charges are supported and allowable.

Ensure that Oversight Managers communicate to Contractor personnel their responsibilities to follow FDIC policies to safeguard data and procedures for self-reporting related incidents.

Ensure Contracting Officers and Oversight Managers have the appropriate access to review and verify that contractors complete the required Privileged User Rules of Behavior training.

Review the installed applications on all issued laptops/desktops/endpoints to ensure no unauthorized software is present and take appropriate action if unauthorized software is present.

Review the Commission’s "user" setting population to ensure each "user" is properly configured in compliance with Commission's approved Group Policy Objectives (GPO). Make the appropriate corrections to user configurations, as appropriate.

Review and update Active Directory settings and Microsoft Defender and Intune policies to ensure unauthorized software cannot be installed.

We recommend that the Grantee reimburse $6,002 to ARC for the unallowable indirect costs charged to the grant.

We recommend that the Grantee implement its procedures for reporting and reviewing expenses, prior to charging them to the grant.

Revise the AmeriCorps Grants Accrual (IBNR & Advance) SOP, dated September 2024, and Grant Accrual Survey and Lookback Analysis Policy, dated August 15, 2024, and Record-to-Report End-to-End Narrative Version 2.0, dated March 7, 2025, to address:
a. Validating and documenting the accuracy of the grantee survey data provided in support of the grant accrual validation.
b. Procedures for identifying and documenting AmeriCorps’ internal control objective in terms of materiality risk.
c. Procedures to confirm the validation process met AmeriCorps’ internal control objective. If it does not meet the internal control objective, then determine the cause and corrective action to address…

We recommend that the AmeriCorps Chief Information Security Officer, in coordination with the eSPAN and Momentum system owners, implement processes to:
a. ensure user access is documented and approved; and
b. validate that the monthly eSPAN and Momentum recertifications are completed and documented.

We recommend that the eSPAN System Owner ensure eSPAN accounts are disabled for separated personnel within one working day following termination actions as required by AmeriCorps’ policy.

We recommend that the AmeriCorps Chief Information Security Officer, in coordination with the eSPAN and Momentum system owners, implement processes to:
a. ensure user access is documented and approved; and
b. validate that the monthly eSPAN and Momentum recertifications are completed and documented.

We recommend that the eSPAN System Owner ensure eSPAN accounts are disabled for separated personnel within one working day following termination actions as required by AmeriCorps’ policy.

The Executive Director of Operations for a national cancer testing program ensures the project has met the requirements for Institutional Review Board review for research with human subjects and takes action as needed.

The Executive Director of Operations for a national cancer testing program ensures national cancer prevention, treatment, and research program staff are trained on Institutional Review Board project submission and privacy requirements.

The National Specialty Care Program Office Chief Officer ensures the national cancer prevention, treatment, and research program staff reviews and provides required approvals before the release of protected health information for research.

The National Specialty Care Program Office Chief Officer, in conjunction with the Office of Research & Development ensures that VA privacy officers report privacy incidents involving data obtained from or for national cancer prevention, treatment, and research program activities timely and monitors for compliance.

The Office of Research Oversight Executive Director in conjunction with the Chief Research and Development Officer, VHA Office of Research & Development, reviews the national cancer prevention, treatment, and research program final mitigation plan and ensures corrective actions address system-wide issues for determining whether a national cancer prevention, treatment, and research program project constitutes research, safeguarding privacy when data is shared for projects, and ensuring data security requirements are met.

The National Specialty Care Program Office Chief Officer ensures the national cancer prevention, treatment, and research program has safeguards in place including biostatistician expertise to ensure that data containing sensitive patient information and protected health information is deidentified before sharing outside of VA as required.

The Executive Director of Operations for a national cancer testing program ensures the project has met the requirements for Institutional Review Board review for research with human subjects and takes action as needed.

The Executive Director of Operations for a national cancer testing program ensures national cancer prevention, treatment, and research program staff are trained on Institutional Review Board project submission and privacy requirements.

The National Specialty Care Program Office Chief Officer ensures the national cancer prevention, treatment, and research program staff reviews and provides required approvals before the release of protected health information for research.

The National Specialty Care Program Office Chief Officer, in conjunction with the Office of Research & Development ensures that VA privacy officers report privacy incidents involving data obtained from or for national cancer prevention, treatment, and research program activities timely and monitors for compliance.

The Office of Research Oversight Executive Director in conjunction with the Chief Research and Development Officer, VHA Office of Research & Development, reviews the national cancer prevention, treatment, and research program final mitigation plan and ensures corrective actions address system-wide issues for determining whether a national cancer prevention, treatment, and research program project constitutes research, safeguarding privacy when data is shared for projects, and ensuring data security requirements are met.

The National Specialty Care Program Office Chief Officer ensures the national cancer prevention, treatment, and research program has safeguards in place including biostatistician expertise to ensure that data containing sensitive patient information and protected health information is deidentified before sharing outside of VA as required.

Implement vulnerability management processes to ensure all vulnerabilities are identified and plans of action and milestones are created for vulnerabilities that cannot be mitigated by VA deadlines.

Implement vulnerability management processes to ensure all vulnerabilities are identified and plans of action and milestones are created for vulnerabilities that cannot be mitigated by VA deadlines.

Develop and approve an authorization to operate for the special-purpose systems.

Include facility personnel during the security categorization process to ensure all necessary information types are considered when determining the security categorization for special-purpose systems.

Segregate the pharmacy application administrative access from individuals who are custodians of the pharmaceutical inventory.

We recommend that OJP work with the Louisiana Commission on Law Enforcement to ensure its FYs 2020, 2021, and 2022 Crime Victim State Certification Forms accurately reflect all activity and payments and take necessary steps to recover the excess awarded funds as appropriate.

Facility leaders install detectable warning surfaces where crosswalks transition onto a vehicle roadway.

Facility leaders ensure clinical staff who perform toxic exposure screenings complete mandatory training.

The Director ensures staff implement processes to prevent repeat environment of care findings related to dusty sprinkler heads.