Open Recommendations

(U) Rec. B.1.c: This recommendation is Controlled Unclassified Information

(U) Rec. B.1.d: The DoD OIG recommended that the Chief Digital and Artificial Intelligence Office Chief Information Officer and Authorizing Official, in coordination with the Defense Information Systems Agency Chief Information Officer, assess the hardware, software, cloud services, networks, and any other tools used by the Defense Digital Service since 2015 to determine whether the hardware, software, cloud services, and other tools were acquired under terms that ensure that the DoD retains ownership of DoD data.

(U) Rec. B.2.a: The DoD OIG recommended that the Chief Digital and Artificial Intelligence Office Chief Information Officer and Authorizing Official, in coordination with the Defense Information Systems Agency Chief Information Officer, conduct a risk assessment of the DoD data stored, processed, or transmitted by the hardware, software, cloud services, networks, and any other tools used by the Defense Digital Service to determine the DoD Component owner, the nature, and classification of the data.

(U) Rec. B.2.b: The DoD OIG recommended that the Chief Digital and Artificial Intelligence Office Chief Information Officer and Authorizing Official, in coordination with the Defense Information Systems Agency Chief Information Officer, conduct a risk assessment of the DoD data stored, processed, or transmitted by the hardware, software, cloud services, networks, and any other tools used by the Defense Digital Service to determine whether the DoD data were and are appropriately protected in accordance with DoD cybersecurity and cloud security policies.

(U) Rec. B.2.c: The DoD OIG recommended that the Chief Digital and Artificial Intelligence Office Chief Information Officer and Authorizing Official, in coordination with the Defense Information Systems Agency Chief Information Officer, conduct a risk assessment of the DoD data stored, processed, or transmitted by the hardware, software, cloud services, networks, and any other tools used by the Defense Digital Service to determine whether any DoD data were spilled, compromised, or potentially compromised, and if so, immediately initiate mitigating and remedial actions to protect DoD information, including personally identifiable information, in accordance with DoD policies.

(U) Rec. B.3: The DoD OIG recommended that after completion of Recommendations B.1 and B.2, the Chief Digital and Artificial Intelligence Officer develop and implement a plan of actions and milestones to bring any out-of-compliance hardware, software, cloud services, networks, and other tools used by the Defense Digital Service and other Office of the Chief Digital and Artificial Intelligence Office Components into compliance with DoD policies.

(U) Rec. B.4.a: The DoD OIG recommended that the Chief Digital and Artificial Intelligence Officer develop and implement a formal process for all Chief Digital and Artificial Intelligence Office directorates to follow when requesting waivers of DoD policies and guidance that, at a minimum, requires documentation of the request, justification for the request, and the approval or denial from the policy's issuing DoD Component.

(U) Rec. B.4.b: The DoD OIG recommended that the Chief Digital and Artificial Intelligence Officer develop and implement a formal process for all Chief Digital and Artificial Intelligence Office directorates to follow when requesting waivers of DoD policies and guidance that, at a minimum, requires documentation of the Office of the Secretary of Defense's approval and notification in writing to the policy's issuing DoD Component of the approval of the waiver, if the Office of the Secretary of Defense overrides the denial of the waiver by the Office of the Secretary of Defense Principal Staff Assistant or DoD Component head…

(U) Rec. B.4.c: The DoD OIG recommended that the Chief Digital and Artificial Intelligence Officer develop and implement a formal process for all Chief Digital and Artificial Intelligence Office directorates to follow when requesting waivers of DoD policies and guidance that, at a minimum, requires maintenance of the documentation created as a result of the implementation of Recommendations B.1.a and B.1.b in accordance with Federal and DoD records management requirements.

(U) Rec. B.5: The DoD OIG recommended that the Chief Digital and Artificial Intelligence Officer implement Recommendations B.1, B.2, and B.3 for all the Chief Digital and Artificial Intelligence Office directorates.

The Mint Director ensures the Mint considers additional procedures to oversee refiners including, but not limited to, obtaining and periodically reviewing documentation from the Mint’s approved refineries, such as the LBMA-required third party audits and supporting documentation, to ensure that refineries are sourcing gold responsibly in accordance with U.S. law and the best interests of the U.S. Government.

The Mint Director ensures the Mint within 30 days of issuance of this report, develops a plan that outlines the steps and controls the Mint will implement to comply with Public Law 99-185 and Public Law 109-145 in the production of gold coins which includes a review of the Mint’s current methodology to ensure it complies with U.S. law. As part of this review, the Mint should publish its procedures for acquiring newly mined U.S. gold in the Federal Register. Furthermore, the Mint needs to update its website for accuracy and its BOAs and operating procedures to ensure that these…

Rec. 2: The DoD OIG recommended that the Under Secretary of Defense for Personnel and Readiness update DoD Directive 1344.10 to include a requirement for the Services and the National Guard Bureau to provide guidance and training on partisan and nonpartisan political activities to all Service members at least each presidential election year.

Review the two loans in our sample that did not receive appropriate servicing and take administrative actions if appropriate.

(U) Rec. A.1: The DoD OIG recommended that the Commander of the U.S. Army Sustainment Command revalidate the Care of Supplies in Storage requirements in Army Technical Manual 38-470 to determine whether the requirements are operationally realistic and cost effective for Army Prepositioned Stock and revise Army Technical Manual 38-470, as appropriate.

(U) Rec. A.2.a: The DoD OIG recommended that the Executive Director for the Army Contracting Command-Rock Island direct the Procuring Contracting Officer for the Army Prepositioned Stock-5 contract to take action to enforce or relieve the Army Prepositioned Stock-5 contractor of Care of Supplies in Storage requirements based on guidance from the Commander of the Army Sustainment Command's implementation of Recommendation A.1 to revalidate Army Technical Manual 38-470 requirements.

(U) Rec. A.2.b: The DoD OIG recommended that the Executive Director for the Army Contracting Command-Rock Island direct the Procuring Contracting Officer for the Army Prepositioned Stock-5 contract to coordinate with the Army Prepositioned Stock-5 Administrative Contracting Officer and Contracting Officer's Representatives to update surveillance procedures to require Contracting Officer's Representatives to conduct periodic checks of the Global Combat Support System-Army to provide reasonable assurance that all pieces of Army Prepositioned Stock-5 equipment have a correct maintenance service plan listed in the system.

We recommend that the Chief Financial Officer for the Department develop and implement procedures to ensure that thesampling populations of drawdowns are complete for the basis of calculating the improper payment and unknown paymentestimates.

We recommend that the Chief Financial Officer for the Department ensure changes made for the query design concerningthe use of three filters, are implemented in subsequent years for programs that are required to produce an improper paymentestimate.

We recommend that the Chief Financial Officer for the Department, for programs that require them, design and implementimproper payment and unknown payment sampling and estimation plans that are appropriate for the sampling of paymentsbased on accurate sampling populations and result in reliable estimates. The improper payment and unknown paymentsampling and estimation plans should also include language stating why sampling populations in Stage 1 may not matchsampling population in Stage 2 and explain the statistical impact on the estimates.

We recommend that the Chief Financial Officer for the Department implement its quality assurance checklist to ensure theproper details from the drawdown population are accurately included on the extrapolation sheet.

We recommend that the Chief Financial Officer for the Department, in conjunction with the acting Chief Financial Officer forFSA, develop sampling and estimation plans for the Pell and Direct Loan programs that will produce reliable estimates.Specifically, the plan should (a) produce appropriate and accurate confidence intervals around a statistically valid pointestimate; (b) consistent with 31 U.S.C. section 3352(c)(1)(A), produce an estimate that is otherwise appropriate using amethodology approved by the Director of OMB; or (c) consistent with OMB Circular A-123 Appendix C, Part II, B(2), include adetailed explanation as to why it is not possible to produce a statistically-valid point…

(U) Rec. 1.a: The DoD OIG recommended that the DoD Chief Information Officer develop, in coordination with the Under Secretary of Defense for Research and Engineering and the Under Secretary of Defense for Acquisition and Sustainment, a DoD?wide Supply Chain Risk Management strategy as required by the National Institute of Standards and Technology guidance.

(U) Rec. 1.b: The DoD OIG recommended that the DoD Chief Information Officer develop, in coordination with the Under Secretary of Defense for Research and Engineering and the Under Secretary of Defense for Acquisition and Sustainment, policies and procedures implementing the DoD-wide Supply Chain Risk Management strategy as required by the National Institute of Standards and Technology guidance, including organizational-wide tools and techniques that allow DoD Components to consistently and effectively manage risks associated with using external providers.

(U) Rec. 1.c: The DoD OIG recommended that the DoD Chief Information Officer determine when DoD Components should complete a privacy impact assessment for information systems and ensure that all DoD guidance, including DoD Instruction 5400.16, "DoD Privacy Impact Assessment (PIA) Guidance," July 14, 2015, Incorporating Change 1, August 11, 2017, and the DoD Risk Management Framework Knowledge Service guidance, aligns with that determination.

(U) Rec. 1.d: The DoD OIG recommended that the DoD Chief Information Officer direct DoD Components, in coordination with the Chief Information Security Officers, Chief Information Officers, and Authorizing Officials, to require that officials conduct privacy impact assessments for all non-national security systems and update the Enterprise Mission Assurance Support Service, or its equivalent system, as required by DoD guidance.

(U) Rec. 1.e: The DoD OIG recommended that the DoD Chief Information Officer implement a process, in coordination with the DoD Component Chief Information Security Officers, Chief Information Officers, and Authorizing Officials, such as periodic Enterprise Mission Assurance Support Service reviews, to ensure that officials complete privacy impact assessments for all non-national security systems and update the Enterprise Mission Assurance Support Service, or its equivalent system, as required by DoD guidance.

(U) Rec. 1.a: Report is Classified.

(U) Rec. 2.a: Report is Classified.

(U) Rec. 2.b: Report is Classified.

(U) Rec. 3.b: Report is Classified.

(U) Rec. 4: Report is Classified.

(U) Rec. 4: Report is Classified.

Rec. 1.a: The DoD OIG recommended that the Defense Health Agency Director, in consultation with the Defense Civilian Personnel Advisory Service develop and implement a plan to ensure a more competitive pay rate for nursing and other hard to fill medical positions in all Defense Health Agency regions.

Rec. 1.c: The DoD OIG recommended that the Defense Health Agency Director, in consultation with the Defense Civilian Personnel Advisory Service develop and implement a plan to establish qualification requirements for nursing and other hard to fill medical positions if it is determined that it would enhance the DoD's efforts to help recruit and retain health care personnel.

Rec. 3.a: The DoD OIG recommended that the Defense Health Agency Director revise Defense Health Agency Administrative Instruction 5136.03 to establish approval authority for any civilian personnel extensions outside the continental United States beyond a period of 7 years.

Rec. 3.b: The DoD OIG recommended that the Defense Health Agency Director establish maximum time frames to approve civilian personnel extensions outside of the continental United States and require monitoring of extension approval timelines.

Rec. 3.d: The DoD OIG recommended that the Defense Health Agency Director develop and implement a plan to apply strategies and incentives used by other Federal agencies to hire entry-level registered nurses if it is determined the strategies and incentives would enhance the DoD's recruitment efforts.

The Office of the Chief Management Officer and Security Services Office assign the staffing and resources necessary to conduct pending reinvestigations.

The Security Services Office develops and implements adequate internal policies and standard operating procedures.

The Security Services Office develops and implements a required training framework for its Security Specialists and program personnel.

The Security Services Office implements an internal database to house investigation and clearance documentation.

Rec. 1.a: The DoD OIG recommended that the Under Secretary of Defense (Comptroller)/Chief Financial Officer, DoD, ensure DoD Components develop and implement a process to identify the characteristics of the data included in the variances from the universe of transactions.

Develop and implement a plan, including communication strategy and available staff, for the timely deployment and installation of mail theft initiatives nationwide.

Require the New York 2 District Manager to establish procedures to complete annual safety inspections, remediate deficiencies, and document the results for blue collection and green relay boxes.

Develop a process to define roles, responsibilities, and frequency for inspecting green relay boxes, and to record and track the location and condition of green relay boxes.

Review and appropriately resolve hold codes related to the 5,044 7(a) loans to determine impact on 7(a) eligibility and seek remedy or repayment of all 7(a) loans deemed ineligible.

Implement written procedures to test recipients' CARES Act payments using methodologies to sufficiently validate that costs are supported and eligible. These procedures should include guidance for determining the extent of transaction level testing needed to sufficiently validate recipient's payment.

Implement written procedures to test recipients' financial system controls to prevent duplicate payments from Federal, State, and local sources.

Implement a written policy requiring that FTA officials develop and implement enhanced oversight processes to specifically mitigate identified risks associated with any funding appropriation, when applicable.