Open Recommendations

Remedy $8,897 in unsupported operating costs.

Remedy $2,156 in unallowable operating costs charged to VOCA in error.

Work with Cal OES to ensure that it provides the necessary guidance for its subrecipients to report only VOCA-funded activities in PMT, prorating when appropriate.

Work with Cal OES to establish procedures to verify subrecipients' VOCA performance data to ensure that it is prorated, when appropriate, to prevent duplicative reporting.

Work with Cal OES to enhance its subrecipient monitoring policies and procedures to ensure subrecipients are recording or allocating expenditures by funding source, as required.

1. We recommend the Undersecretary of Commerce for Industry and Security direct BIS’s Chief Information Officer to implement an EDR on Network A.

2. We recommend the Undersecretary of Commerce for Industry and Security direct BIS’s Chief Information Officer to adopt the threat hunting security control and use existing BIS SOC tools to proactively hunt threats and mitigate malicious or unauthorized network activity.

3. We recommend the Undersecretary of Commerce for Industry and Security direct BIS’s Chief Information Officer to establish and implement detailed incident response procedures to detect, contain, eradicate, and recover from threats.

4. We recommend the Undersecretary of Commerce for Industry and Security direct BIS’s Chief Information Officer to implement a method to identify and prevent the exfiltration of PII, BII, and other sensitive data from BIS networks.

5. We recommend the Undersecretary of Commerce for Industry and Security direct BIS’s Chief Information Officer to properly configure network security devices to prevent unauthorized connections from outside BIS networks.

6. We recommend the Undersecretary of Commerce for Industry and Security direct BIS’s Chief Information Officer to properly restrict BIS networks to prevent unauthorized lateral movement between BIS networks.

7. We recommend the Undersecretary of Commerce for Industry and Security direct BIS’s Chief Information Officer to implement a security control to allow only approved software on Network B and consider implementing this control for all BIS networks.

8. We recommend the Undersecretary of Commerce for Industry and Security direct BIS’s Chief Information Officer to review all BIS user access, for networks and applications, to ensure each user is assigned the correct levels of access according to the principle of least privilege.

9. We recommend the Undersecretary of Commerce for Industry and Security direct BIS’s Chief Information Officer to immediately search BIS networks for classified credentials and establish a procedure to regularly search for plain-text credentials.

10. We recommend that the Undersecretary of Commerce for Industry and Security direct BIS’s Chief Information Officer to ensure passwords are disabled for all user accounts as soon as operationally possible.

11. We recommend that the Undersecretary of Commerce for Industry and Security direct BIS’s Chief Information Officer to establish and implement BIS helpdesk procedures for user access issues, including a user verification process.

12. We recommend that the Undersecretary of Commerce for Industry and Security direct BIS’s Chief Information Officer to implement an automated solution to change local administrator credentials after sharing them with BIS users and use different local administrator passwords for each system.

13. We recommend that the Undersecretary of Commerce for Industry and Security direct BIS’s Chief Information Officer to implement a technical control to generate unique, strong passwords for each account created.

Facility leaders develop service-level workflows and processes to monitorcommunication of test results to patients.

USDA OIG has determined that this recommendation contains sensitive information and will not be publicly released due to privacy concerns.

USDA OIG has determined that this recommendation contains sensitive information and will not be publicly released due to privacy concerns.

USDA OIG has determined that this recommendation contains sensitive information and will not be publicly released due to privacy concerns.

Review existing financial advisory and consulting services Receivership Basic Ordering Agreements and take appropriate steps to establish an adequate supply of contractors with appropriate resources to address the FDIC’s future procurement needs in the event of financial institution failures and financial crises.

Establish a process to periodically review financial advisory and consulting services Receivership Basic Ordering Agreements to ensure sufficient contractor resources are available to meet the FDIC’s mission-critical needs.

Establish an upfront pricing framework or advanced pricing within all financial advisory and consulting service Receivership Basic Ordering Agreements.

Develop and implement periodic emergency procurement testing exercises for appropriate FDIC employees.

Establish a process for emergency procurements to document and maintain analysis, decisions, and commitments, to include, at a minimum, those identified in this report.

Develop and implement a process to analyze and determine when documented deliverables should be required on emergency service contracts to ensure contract personnel have the ability and resources to oversee contractor performance.

Perform retrospective reviews when the FDIC conducts or tests emergency acquisition procedures.

Review the work performed and information used by the four non-U.S. citizens and take appropriate action.

Provide training and guidance to its Executive Management and personnel reinforcing their roles and responsibilities in carrying out and overseeing the FDIC’s emergency acquisition procedures. This training and guidance should include, at a minimum, the following:
• understanding roles and responsibilities;
• initiating and performing emergency and expedited procedures; and
• initiating, modifying, approving, and submitting requirements packages.

OIG recommends that the Bureau of the Comptroller and Global Financial Services, in coordination with the Bureau of International Narcotics and Law Enforcement Affairs and the Office of Foreign Assistance, develop and implement a unique identifier for anti-corruption programs and activities and issue instructions to ensure consistent use by all Department of State bureaus and overseas posts. These instructions should include quality checks on data elements that are at increased risk of being reported incorrectly.

OIG recommends that the Bureau of Administration confirm that all bureaus have designated an official to review the MyGrants Post Award Activities function reports and that Grants Officers and Grants Officer Representatives are complying with oversight requirements.

OIG recommends that the Bureau of Democracy, Human Rights, and Labor implement the Department of State Managing for Results framework and Program Design and Performance Management Toolkit guidance for developing project goals, objectives, and performance indicators.

OIG recommends that the Bureau of International Narcotics and Law Enforcement Affairs implement the Department of State Managing for Results framework and Program Design and Performance Management Toolkit guidance for developing project goals, objectives, and performance indicators.

OIG recommends that the Deputy Secretary of State for Management and Resources, or another Department of State (Department) official with appropriate authority, designate an office, bureau, or individual with necessary knowledge, expertise, and resources the responsibility for developing a Department-wide anti-corruption strategy in accordance with 18 FAM 301.2-4(B). The strategy should clearly establish anti-corruption roles and responsibilities across the Department, define corruption, and frame the Department's efforts in the context of the United States Strategy on Countering Corruption goals and objectives.

Develop and finalize policies and procedures that address cyber threat information
sharing. These policies and procedures should, at a minimum, include:
*Formally documenting internal and external sharing practices, clarifying the
criteria and threshold to inform individual credit unions or external stakeholders
of a cyber threat, and clarifying the method and timing of informing credit unions
or external stakeholders.
*Determining the criteria for internal assessment for escalation and communication
of cyber threat information.

Formally establish and clarify operational roles and responsibilities across offices for
cyber threat information sharing and any delegation of authorities to determine when
issues must be escalated. This should, at a minimum, address:
*Establishing operational responsibilities at all stages of cyber threat-related
events, including pre-incident declaration.
*Clarifying delegation of authorities for efficient and timely decision making and
issue escalation.
*Identifying single point dependencies and addressing appropriate resourcing.
*Determining appropriate communication and coordination protocols between
offices.

Ensure timely finalization and implementation of recommendations identified in the after-action and lessons learned reports for cyber-related incidents, including the draft (b)(8) after-action report and the draft pre-victim notification lessons learned report.

Update and document incident reporting triage protocols to provide consistent and
useable data in the Cyber Incidents for Credit Unions Reporting System.

Document and implement internal data management protocols that ensure the appropriate
sharing, assessment, and response of available cyber threat information.

Develop a process to assess credit unions' and other stakeholders' feedback on NCUA's cyber threat information sharing and update information sharing processes to reflect any necessary changes.

Ensure the Office of Examination and Insurance provides timely updates to examination and supervisory guidance to address cyber risks.

We recommend FEMA’s Grant Programs Directorate Assistant Administrator develop and implement an agreed-upon process to establish and report Operation Stonegarden grant performance measures and targets to the Office of National Drug Control Policy.

We recommend FEMA’s Grant Programs Directorate Assistant Administrator develop and implement a methodology for estimating the percentage of Operation Stonegarden grant funds used for drug enforcement activities.

The Office of Programs should develop and document new procedures to reflect the Program Evaluation and
Management Services’ representative payee monitoring responsibilities as a result of Board Order 21-31, or
work with the Bureau of Field Service to update Field Operations Manual 1 1450 to ensure complete and
timely monitoring, for all the annual representative payee monitoring cycles;

The Office of Programs should determine the appropriate number of full-time equivalent Program Evaluation and
Management Services employees that are needed to effectively perform representative payee monitoring each year;

The Office of Programs should if needed, reassign or hire additional employees
to assist with the annual representative payee monitoring;

The Office of Programs should design and implement a process to periodically analyze the results of
representative payee monitoring cycles to ensure the effectiveness of representative payee monitoring.

The Office of Programs Should determine if annual refresher training is needed for its employees assigned
to representative payee monitoring to ensure that representative payee cases are completed timely;