Open Recommendations

Rec. 2.e: The DoD OIG recommended that the Cybersecurity Maturity Model Certification (CMMC) Program Management Office Director direct the contracting officer to modify the contract with the Cyber Accreditation Body to require the Cyber Accreditation Body (Cyber AB) to:

Verify the employment status of the CMMC certified assessors and certified quality control leads of all previously authorized Cybersecurity Maturity Model Certification Third?Party Assessment Organizations (C3PAOs) using the methodology defined in Recommendation 2 .d within 30 days of the date of this report and revoke the C3PAO's authorization to perform CMMC Level 2 assessments if the employment status cannot be verified.

Rec. 3.a: The DoD OIG recommended that the Cybersecurity Maturity Model Certification (CMMC) Program Management Office Director:

Develop and implement a formal reauthorization process for the Cybersecurity Maturity Model Certification Third?Party Assessment Organizations (C3PAO) that includes a review and verification for all requirements in the C3PAO authorization process.

Rec. 5.b: The DoD OIG recommended that the Cybersecurity Maturity Model Certification (CMMC) Program Management Office Director:

Develop and implement a process to ensure Cybersecurity Maturity Model Certification Third?Party Assessment Organizations (C3PAO) immediately notify both the CMMC Program Management Office and Cyber Accreditation Body of any changes associated with any of the requirements in the C3PAO authorization process.

Rec. 3.c: The DoD OIG recommended that the Cybersecurity Maturity Model Certification (CMMC) Program Management Office Director:

Revise the CMMC assessment guides to further define the requirement for disabling inactive accounts to include group accounts.

The District Director, in conjunction with the Deputy District Director, develops a contingency coverage plan to ensure oversight during periods of vet center director vacancies.

The District Director monitors district leaders compliance with completion of morbidity and mortality reviews for client deaths by suicide, including timeliness, as required.

The District Director ensures district leaders are aware of the Readjustment Counseling Service policy requirements to provide oversight of morbidity and mortality review completion, including panel member assignments, participation of affected vet center staff, report completion, reporting of completion delays, and information dissemination.

The District Director determines reasons vet center counselors did not complete safety plan components for clients assessed at intermediate or high suicide risk level in either acute, chronic, or both categories; ensures completion of safety plans for all active clients assessed at intermediate or high suicide risk levels; and monitors compliance across all zone vet centers.

The District Director determines reasons staff did not document providing safety plans to clients, ensures all active clients assessed at intermediate or high suicide risk levels receives a safety plan, and monitors compliance across all zone vet centers.

The OIG recommends facility leaders ensure staff understand procedures for cleaning equipment and continue to monitor the physical separation of clean and dirty items in storage spaces.

The OIG recommends that primary care leaders incorporate feedback from primary care staff and include them in process improvement projects.

Communicate to locations with electric vehicle infrastructure that policy regarding reporting safety hazards also includes electric vehicle infrastructure.

Continue to recruit and retain individuals with relevant financial management and/or accounting skills, train, as well as cross-train existing resources on financial management standards, concepts, policies, and procedures.

Enhance controls for the Department and the components to identify, analyze, and respond to risks and/or significant changes to operations and financial reporting processes.

Enhance controls for the Department and the components to monitor and evaluate the design and effectiveness of existing controls and enhance communication between the Department and components.

Enhance monitoring capabilities related to existing deficiencies to address existing design deficiencies and improve operating effectiveness of the related controls in a timely manner. Specifically, management should consider a baseline (current year) assessment and compare against management's design (future state) of the internal control system to address the objectives and risks of the Department.

Develop new and/or enhance existing training for procurement personnel and other stakeholders to more accurately respond to the prepayment and accrual data calls and record expenses appropriately, including consideration of the completeness and accuracy of data call responses.

Reinforce existing policies and procedures related to identifying expenses and obligations related to capitalizable projects, including consideration of the spending object code.

Rec 1.a: The DoD OIG recommended that the U.S. Army Corps of Engineers Chief of Engineering and Construction issue a memorandum and provide training to U.S. Army Corps of Engineers personnel emphasizing guidance to:
* Develop accurate construction-related estimates on future military construction contract solicitations.
* Estimate cost and schedule for possible variations in the soil conditions based on a geotechnical report and weather conditions of the location of future military construction projects.
* Use the quality management system, including how to categorize and access lessons learned from previous military construction projects, and the importance of reviewing after-action reviewsto identify…

Rec 1.b: The DoD OIG recommended that the U.S. Army Corps of Engineers Chief of Engineering and Construction review the benefits and limitations of U.S. Army Corps of Engineers Baltimore District officials using the bifurcated solicitation process to determine guidelines for the circumstances in which U.S. Army Corps of Engineers contracting personnel can use the bifurcated solicitation process in future military construction projects.

Rec 1.c: The DoD OIG recommended that the U.S. Army Corps of Engineers Chief of Engineering and Construction review the actions of U.S. Army Corps of Engineers Savannah District officials for site preparation to determine whether U.S. Army Corps of Engineers personnel can use these actions in preparation for future military construction projects and issue a memorandum to U.S. Army Corps of Engineers personnel with the results of the review to use as lessons learned.

Rec 1.d: The DoD OIG recommended that the U.S. Army Corps of Engineers Chief of Engineering and Construction review the actions U.S. Army Corps of Engineers Savannah District officials took to determine if U.S. Army Corps of Engineers contracting personnel can use these actions when managing military construction projects and issue guidance for U.S. Army Corps of Engineers contracting personnel on how to incorporate these actions for other military construction projects.

Rec 1.e: The DoD OIG recommended that the U.S. Army Corps of Engineers Chief of Engineering and Construction review the mitigating actions and lessons learned that U.S. Army Corps of Engineers Seattle District officials had for challenges with design changes, security boundaries, and software systems to determine if U.S. Army Corps of Engineers contracting personnel should use these actions when managing other military construction projects.

Rec 2.a: The DoD OIG recommended that the Commander of the U.S. Army Corps of Engineers Baltimore District provide training to U.S. Army Corps of Engineers personnel reinforcing how the costs of the various types of installed building equipment under military construction projects should be included in construction contracts for future Army military construction projects in accordance with Army Regulation 420-1, "Army Facilities Management."

Rec 2.b: The DoD OIG recommended that the Commander of the U.S. Army Corps of Engineers Baltimore District complete an after-action review for the General Instruction Building project, including the benefits and additional efforts required for the bifurcated solicitation process in accordance with U.S. Army Corps of Engineers Engineer Regulations, and make the review available for U.S. Army Corps of Engineers personnel to consider when planning and executing future military construction projects.

Risk Management

Risk Management

Identity Access Management

USAC - Access Controls

USAC - Access Controls

USAC - Access Controls

Supply Chain Risk Management

Configuration Management

Identity Access Management

USAC - Access Controls

FDA should define specific factors that would require FDA's accelerated approval council to advise on certain drug applications.

FDA should take steps to ensure appropriate documentation of meetings with sponsors in drug approval administrative files.

FDA should define specific factors that would require FDA's accelerated approval council to advise on certain drug applications.

FDA should take steps to ensure appropriate documentation of meetings with sponsors in drug approval administrative files.

We recommend the Department design policies and procedures to perform and document a risk assessment of new or revised accounting standards.

We recommend that management across the Department continue to develop and implement policy and standardized procedures in conjunction with the Asset Management Council for tracking fixed asset projects constructed by or with other Federal agencies.

We recommend the Department provide ongoing guidance and training to bureaus and offices to ensure compliance with the standards.

We recommend the Department perform a thorough risk assessment to identify changes needed to internal control processes and controls, including establishment of an information technology solution, to ensure ongoing compliance with SFFAS 54.

We recommend that management across the Department maintain strong communication channels with external Federal agencies involved in constructing assets on the Department's behalf. This should include establishing formal agreements, regular meetings, and periodic reconciliations to ensure all fixed asset transactions are transferred, captured, and recorded timely and accurately.

We recommend that management across the Department establish monitoring controls to regularly review and reconcile fixed asset transactions constructed by other Federal agencies within the financial records. This can involve periodic reviews of project documentation, invoices, and payment records to ensure completeness and accuracy.

We recommend that management across the Department conduct training sessions for relevant personnel involved in financial record-keeping to enhance their understanding of the importance of tracking construction projects performed by or with other Federal agencies. This will help ensure compliance with established procedures and controls.

The Office of Inspector General recommends the Office of Congressional and Public Affairs update Policies and Procedures Manual 201, Information Release Policy, to include the “anti-gag” statement from the Whistleblower Protection Enhancement Act of 2012, as amended.

We recommend that Cattaraugus-Allegany BOCES’ management develop and implement grant management policies and procedures to ensure timely preparation and submission of the required reports.

We recommend that the Florida Agency for Health Care Administration ensure that providers correct the 120 instances of provider noncompliance identified in this report.

We recommend that the Florida Agency for Health Care Administration improve its oversight and monitoring of providers.