Open Recommendations

[Description omitted; DOJ has determined that this recommendation contains information that is limited official use or classified.]

[Description omitted; DOJ has determined that this recommendation contains information that is limited official use or classified.]

(U) Rec. 3: The DoD OIG recommended that the Under Secretary of Defense for Intelligence and Security review and update any applicable counterintelligence guidance and policy documents, including DoD Instruction C-5240.08 and DoD Instruction 5240.04, to address Anomalous Health Incident-related information and counterintelligence investigation requirements; and provide information security advice to the Office of the Under Secretary of Defense for Policy for the development of a Security Classification Guide for Anomalous Health Incidents.

Complete a usage study and document a decision regarding if the IRS will mandate that participants use the TFA IVES system.

FHFA should develop and maintain a complete and accurate cloud system component inventory, as required by NIST SP 800-53.

FHFA should develop and implement a solution to encrypt all data-at-rest on the cloud system as required by National Institute of Standards and Technology SP 800-53.

We recommend the CISA Director update CISA’s Continuity of Operations Plan and develop and implement an information system contingency plan, to ensure availability of redundant systems, capabilities, and communication methods to use if primary systems or networks are compromised.

We recommend the CISA Director require the facility and operations staff conduct an assessment to determine whether secure facility space is appropriately sized and configured to meet operational needs and document any changes necessary for staff to obtain and maintain appropriate access to intelligence information.

We recommend the CISA Director require an assessment to document the levels of staffing, resources, and intelligence access needed for operational divisions, cyber detection and mitigation capabilities, and support functions.

We recommend the CISA Director create and implement a long-term plan for the Cybersecurity Division that includes provisions for ownership, operations, and maintenance of the National Cybersecurity Protection System’s data analytics capabilities.

We recommend the Assistant Secretary for Occupational Safety and Health: Modify the Field Operations Manual to include a policy for mandatory interviews of complainants and witnesses or document the rationale for lack thereof and provide training to Compliance Safety and Health Officers on the updated requirements.

We recommend the Assistant Secretary for Occupational Safety and Health: Update the Field Operations Manual to require documented case file review and approvals by supervisors and provide training for Compliance Safety and Health Officers to ensure complete documentation of significant decisions and actions.

We recommend the Assistant Secretary for Occupational Safety and Health: Establish controls and provide training of Field Operations Manual abatement certification and documentation requirements and create a monitoring process that is reviewed and approved by a supervisor.

We recommend that OPM develop and maintain a list of services that can be provided via telehealth and require carriers to place edits in their claims systems that will check telehealth claims against this list. Any telehealth claims with procedure codes indicating services not on this list should pend for medical review prior to payment. OPM could start with the list maintained by CMS, expanding the allowed services if desired.

We recommend that OPM specify the telehealth technology laws and regulations with which FEHBP providers must comply or create its own list of requirements, if preferred, and require FEHBP carriers to ensure providers are implementing these requirements.

We recommend that OPM consult with the Office of the General Counsel (OGC) to determine the legal sufficiency of OPM's preemptive authority to implement a uniform framework requiring FEHBP providers to obtain informed consent from all parties before recording audio or video telehealth sessions. Should OGC conclude that OPM's preemptive authority is not sufficient to require FEHBP providers to obtain informed consent in all circumstances, then we recommend that OPM issue guidance to FEHBP carriers recommending that FEHBP providers obtain informed consent, where required by existing and applicable authorities. Regardless of OGC's determination, we also recommend that the guidance OPM…

We recommend that the Deputy Assistant Secretary for Public Housing and Voucher Programs enhance SEMAP or develop a new performance measurement process that would identify PHAs with underperforming HCV Programs, which should include an assessment of PHAs' ability to maximize assistance to house families.

We recommend that the Deputy Assistant Secretary for Field Operations provide training and guidance to field office program staff on SEMAP scoring, rating, and verification procedures, including confirmatory reviews, quality control reviews, and adjustments, as appropriate, for the revised SEMAP process.

Establish a formal process to monitor and track expenditures when grantees’ expenditures exceed the $750,000 threshold to identify if compliance audits are required and verify that the audits, past due and future, are performed.

Provide refresher or updated training to staff regarding the requirements and processes for reviewing auditees’ reporting packages.

Ensure Contracting Officers make a determination on the allowability of any questioned costs from past due audits when completed.

Establish a formal process to monitor and track expenditures when grantees’ expenditures exceed the $750,000 threshold to identify if compliance audits are required and verify that the audits, past due and future, are performed.

Ensure Contracting Officers make a determination on the allowability of any questioned costs from past due audits when completed.

Ensure that Department Order 470.5 is updated to provide more descriptive guidance for LITWGs and add the roles and responsibilities for the Office of Insider Threat.

Ensure that the ARC is receiving insider threat information from LITWGs to be collected and integrated to generate referrals for detection, mitigation, and analysis for the ITP to respond to insider threats

Implement cross-organizational communication and collaboration with LITWGs to ensure that referrals with the ARC are addressed, as required

Implement cross-organizational communication and collaboration with LITWGs to ensure that referrals with the ARC are addressed, as required.

Ensure that Department Order 470.5 is updated to provide more descriptive guidance for LITWGs and add the roles and responsibilities for the Office of Insider Threat.

Ensure that the ARC is receiving insider threat information from LITWGs to be collected and integrated to generate referrals for detection, mitigation, and analysis for the ITP to respond to insider threats.

We recommend that the Director of CPD's Office of Disaster Recovery adopt LMI benchmarking to ensure that grantees budget adequate funds to LMI at significant milestones in the grant lifecycle.

We recommend that the Director of CPD's Office of Disaster Recovery make changes to the action plan process so that the action plan calculates an overall LMI percentage.

We recommend that the Florida Agency for Health Care Administration invoice for, and collect from manufacturers, an estimated $57,700 ($35,126 Federal share) in rebates for single-source physician-administered drugs and refund the Federal share of rebates collected.

We recommend that the Florida Agency for Health Care Administration ensure that all physician-administered drugs eligible for rebates after our audit period are processed for rebates.

We recommend that the Administration for Children and Families work with State agencies to ensure compliance with Federal requirements to report missing children episodes to NCMEC in a timely manner.

We recommend that the Assistant Director, Office of Investigations, United States Secret Service develop and implement internal controls to ensure cell-site simulator users differentiate between cell-site simulator-policy defined exigent circumstances and 18 U.S.C. 3125-defined emergency situations to comply with 18 U.S.C. 3121, et seq., Pen Registers and Trap and Trace Devices.

We recommend that the Assistant Director, Office of Investigations, United States Secret Service develop and implement internal controls to ensure cell-site simulator users differentiate between cell-site simulator-policy defined exigent circumstances and 18 U.S.C. 3125-defined emergency situations to comply with 18 U.S.C. 3121, et seq., Pen Registers and Trap and Trace Devices.

We recommend that the Assistant Director, Cyber and Operational Technology, U.S. Immigration and Customs Enforcement develop and implement internal controls to ensure cell-site simulator users differentiate between cell-site simulator policy-defined exigent situations and 18 U.S.C. 3125-defined emergency circumstances to comply with 18 U.S.C. 3121, et seq., Pen Registers and Trap and Trace Devices.

We recommend that the Assistant Director, Cyber and Operational Technology, U.S. Immigration and Customs Enforcement develop and implement internal controls to ensure cell-site simulator data deletion is accurately documented in the Incident Case Management system.

We recommend that the Assistant Director, Cyber and Operational Technology, U.S. Immigration and Customs Enforcement develop and implement internal controls to ensure cell-site simulator data deletion is accurately documented in the Incident Case Management system.

We recommend that the Assistant Director, Cyber and Operational Technology, U.S. Immigration and Customs Enforcement develop and implement internal controls to ensure privacy compliance documentation is completed and approved before developing or procuring information technology that collects, maintains, or disseminates information in identifiable form.

We recommend that the OCIO develop and implement a process to evaluate all systems' Authorizations to Operate annually for accuracy and completeness to ensure systems are operating with a valid authorization determined by actual residual risk.

We recommend that the OCIO develop and implement a process to conduct quality control reviews at least annually to ensure that all systems within the official system of record (Cyber Security Assessment and Management system) have an accurate operating status.

We recommend that the OCIO, in addition to ongoing continuous monitoring, develop and implement a policy to direct system owners to test all of the controls for their systems at least every 3 years.

We recommend that the OCIO develop and implement a policy to verify that bureaus and offices perform control assessments every 3 years.

We recommend that the OCIO develop and implement a review process that includes, at minimum, verifying that system owners have completed required testing for a sample of controls for each system before accepting the annual assurance statement.

We recommend that the FWS require the Department to develop and implement an internal control mechanism to ensure the program income method is properly applied and reported in accordance with grant award approvals and regulations.

We recommend that the FWS require the Department to amend all open subaward agreements to date to include all required elements.

Define and communicate policies and procedures to ensure that its products, system components, systems, and services comply with its cybersecurity and SCRM requirements. This recommendation includes:

PIH in coordination with other HUD offices as necessary, research and address potential causes of the variance in the number of EBLL cases among States on the EBLL tracker and identify solutions that are within HUD's control.

Status

Incorporate the EPA's certification test report expectations set forth in the April 2022 corrective action list into the 2023 revisions to the New Source Performance Standards for residential wood heaters.