Open Recommendations

Ensure written notification of the need for supplemental funds for the disaster loan program is submitted to the appropriate congressional committees as soon as SBA anticipates a funding shortfall, in accordance with 15 U.S.C. § 636k(d).

Verify that Project Rozana USA corrects the instance of material noncompliance detailed on pages 16 to 18 of the audit report

FHFA's Chief Information Officer should develop and implement a plan for strong user authentication controls for all external access to the CSP website in coordination with the new owner of the CSP website, the Office of Affordable Housing and Community Investment.

FHFA's Chief Information Officer should restrict access to member bank submission forms and associated documents to only authenticated and authorized users.

FHFA's Chief Information Officer should prevent unauthorized access to internal, CUI, and non-public files through parameter modification in the URL.

FHFA's Chief Information Officer should remove technical and system level information from public-facing code and pages, including references to internal applications, backend functions, and programming details.

FHFA's Chief Information Officer should configure all error messages to suppress internal application details and display only user-appropriate messages.

FHFA's Chief Information Officer should immediately remove all publicly accessible documents containing CUI and review published content for compliance with FHFA’s CUI policy.

FHFA's Chief Information Officer should establish a formal content review and approval process for all documents and content posted to public-facing websites, including checks for CUI data.

FHFA's Chief Information Officer should deploy monitoring and alerting tools to detect unauthorized logins, document access attempts, or suspicious activity on the CSP website.

FHFA's Chief Information Officer should segregate public-facing applications from internal networks by re-architecting the CSP website to isolate external access from internal file storage, databases, and infrastructure.

FHFA's Chief Information Officer should ensure that the security control assessor conducts a comprehensive control assessment that evaluates all components, including the CSP website.

FHFA's Chief Information Officer should reassess the current ATO for the CSP system based on an updated and accurate authorization package and document the resulting authorization decision.

FHFA's Chief Information Officer should update and approve the SSPP to accurately reflect the system’s identification and authentication methods for each user type, describe how the system collects PII, and document that a PIA was completed.

FHFA's Chief Information Officer should update the PIA to describe how external users access the system, including the security and privacy controls for securing non-public information, in coordination with the Senior Agency Official for Privacy.

FHFA's Chief Information Officer should designate a responsible system owner for the CCTV website to ensure it is actively maintained, in coordination with the appropriate FHFA office.

FHFA's Chief Information Officer should immediately remove public internet access to the CCTV website or restrict access through network-based controls such as virtual private network or internet protocol allow listing, ensuring it is only accessible by authorized internal users.

FHFA's Chief Information Officer should update FHFA’s public-facing system inventory to include all externally accessible websites and services and establish procedures to validate inventory accuracy on a recurring basis.

FHFA's Chief Information Officer should apply system hardening measures to the CCTV website by (a) disabling or restricting non-essential ports and services, (b) limiting access to only necessary functionalities, and (c) removing or protecting exposed API from unauthorized use.

FHFA's Chief Information Officer should enforce authentication and access control by (a) implementing account lockout after a defined number of failed login attempts, (b) enabling logging and alerting for authentication events, and (c) requiring multifactor authentication for administrative or remote access, if supported.

FHFA's Chief Information Officer should remediate vulnerabilities by (a) applying all available software and firmware updates to the CCTV platform, (b) replacing or renewing expired website security certificates, and (c) conducting a secure code review to identify and remove hardcoded credentials or unsecure configurations.

We recommend the Director, Division of Information Technology [redacted].

We recommend the Director, Division of Information Technology, limit user access by following the least privilege access principle where appropriate to documents on the cloud service provider [redacted].

We recommend the Director, Division of Information Technology, in coordination with the Director, Division of Depositor and Consumer Protection,[redacted].

We recommend the Director, Division of Information Technology, in coordination with the Director, Division of Depositor and Consumer Protection,[redacted].

We recommend the Director, Division of Information Technology, identify and review the continued need for other [redacted] that provide similar capabilities to launch [redacted].

Rec. 1.a: The DoD OIG recommended that the Under Secretary of Defense for Research and Engineering establish the Defense Quantum Information Science and Technology Research and Development Program by issuing an official policy directive that establishes the roles and responsibilities of the Under Secretary of Defense for Research and Engineering, Director of Quantum Science, and Deputy Director of Quantum Science for planning, managing, and coordinating the Defense Quantum Information Science and Technology Research and Development Program.

Rec. 1.b: The DoD OIG recommended that the Under Secretary of Defense for Research and Engineering establish the Defense Quantum Information Science and Technology Research and Development Program by issuing an official policy directive that Develops a coordinated plan to meet near-, mid-, and long-term challenges and technical goals, as required by section 234 of the FY 2019 National Defense Authorization Act, including definitive milestones and standards for measuring progress, that the Office of the Under Secretary of Defense for Research and Engineering can use to manage quantum information science and technology research and development across the DoD.

Rec. 1.c: The DoD OIG recommended that the Under Secretary of Defense for Research and Engineering establish the Defense Quantum Information Science and Technology Research and Development Program by issuing an official policy directive that establishes and implements reporting requirements for the quantum information science research centers of the Military Departments and other relevant stakeholders to inform the Office of the Under Secretary of Defense for Research and Engineering of progress toward accomplishing prescribed long-term goals and technical challenges using established milestones and standards.

Rec. 1.d: The DoD OIG recommended that the Under Secretary of Defense for Research and Engineering establish the Defense Quantum Information Science and Technology Research and Development Program by issuing an official policy directive that implements records management processes to collect, synthesize, and disseminate critical information on quantum information science research and development in the DoD and support interagency cooperation and collaboration with relevant stakeholders, as defined by the programs purpose in Section 234.

Reassess the operational effectiveness of contract file management processes and controls, making improvements as applicable.

Develop a centralized location for COR contract files that is accessible to the Office of Procurement.

Establish a process to monitor COR certifications and confirm CORs are appropriately certified before they perform COR responsibilities for a contract.

Review agency guidance and update applicable policies to emphasize the requirement to handle, store, and dispose of contract files in accordance with the NARA General Records Schedule 1.1, Financial Management and Reporting.

Determine the extent to which the required contractor performance evaluations have not been completed and entered into CPARS and take steps to address noncompliance.

Develop controls to ensure required contractor performance evaluations are completed.

We recommend that the DNFSB finalize its project plan and procedures for developing and maintaining current and target CSF profiles.

We recommend that the DNFSB develop current and target CSF profiles.

We recommend that the DNFSB coordinate with its software producers to obtain Secure Software Development Attestation Forms. If the DNFSB is unable to obtain the attestation forms, it should request POA&Ms from the software producers, in accordance with OMB Memorandum M-23-16.

We recommend that the DNFSB submit POA&Ms and risk-based waiver requests to OMB for approval in accordance with OMB Memorandum M-23-16.

We recommend that the DNFSB document policies and procedures for developing and maintaining a comprehensive and accurate inventory of data and the corresponding metadata for the DNFSB’s data types.

We recommend that the DNFSB create and maintain a comprehensive inventory of data and corresponding metadata.

We recommend that the DNFSB prioritize and conduct an annual security control assessment and update the GSS’ System Security Plan, Security Assessment Report, Privacy Impact Assessment, and Information System Contingency Plan in accordance with the DNFSB Risk Management Framework Handbook.

The OIG recommends that the Executive Director for Operations establish policies, procedures, and a centralized information system to consistently manage, track, and monitor staff qualifications records.

The OIG recommends that the Executive Director for Operations update inspection manual chapters and office instruction(s) addressing qualification programs to include guidance about reminding staff of required refresher training.

The OIG recommends that the Executive Director for Operations implement a centralized, automated information system to ensure compliance with mandatory refresher training requirements.

We recommend the Vice President, Planning and Investor Relations, verify back testing is performed annually.

We recommend the Vice President, Pricing and Contracts, evaluate the program objective to balance operational and financial risks to determine if it should be eliminated or rewritten to clarify intent.

We recommend the Vice President, Pricing and Contracts, report annually the financial hedging program’s impact on fuel rate volatility and its hedging gains/losses in a more transparent manner to the Tennessee Valley Authority Board of Directors, Tennessee Valley Public Power Association, and Tennessee Valley Industrial Committee.

The OIG recommends the under secretary for health implement procedures to monitor the data used to measure productivity to ensure the data accurately reflect the complete work of clinical resource hub physicians.