Open Recommendations

Take corrective action, which should include retraining and increased supervision, to ensure that USP Canaan Front Lobby Officers, Screening Site Officers, and other relevant institution personnel consistently follow BOP policy to: (a) appropriately screen all items before they enter the institution, (b) conduct employee random pat searches, and (c) conduct visitor random pat searches.

Ensure that USP Canaan continues to improve the detection and removal of contraband in housing units and takes steps to ensure that employees remain vigilant to detect and deter the introduction of contraband.

Implement a regular assessment and briefing of all enterprise-level risks, such as through discussion of risk profiles at ERM Council meetings, on a frequency commensurate with risk exposure to monitor that each risk is managed within risk appetite.

Clarify how the ERM Council should communicate risk results to agency officials who implement decisions.

Treasury's Office of Inspector General will recoup the amount of $41,410 and instruct Riverside County to repay that amount to the Federal Government.

The Facility Executive Director ensures staff complete the mental health nursing admission screen note, with veterans’ legal status, for admissions to the inpatient mental health unit and develops a plan to monitor for sustained compliance.

The Chief of Staff ensures documentation of discussions between the prescriber and veteran on the risks and benefits of newly prescribed medications prior to administration and develops a plan to monitor for sustained compliance.

The Chief of Staff ensures veterans’ discharge instructions are written in easy-to-understand language and include the purpose of each medication.

The Facility Executive Director ensures staff complete VA S.A.V.E. training and develops a plan to monitor for sustained compliance.

The Facility Executive Director ensures Interdisciplinary Safety Inspection Team members participate in Mental Health Environment of Care Checklist inspections and develops a plan to monitor for sustained compliance.

The Facility Executive Director ensures all required individuals complete Mental Health Environment of Care Checklist annual training and develops a plan to monitor for sustained compliance.

The Facility Executive Director ensures staff complete the mental health nursing admission screen note, with veterans legal status, for admissions to the inpatient mental health unit and develops a plan to monitor for sustained compliance.

The Chief of Staff ensures documentation of discussions between the prescriber and veteran on the risks and benefits of newly prescribed medications prior to administration and develops a plan to monitor for sustained compliance.

The Chief of Staff ensures veterans discharge instructions are written in easy-to-understand language and include the purpose of each medication.

The Facility Executive Director ensures staff complete VA S.A.V.E. training and develops a plan to monitor for sustained compliance.

The Facility Executive Director ensures Interdisciplinary Safety Inspection Team members participate in Mental Health Environment of Care Checklist inspections and develops a plan to monitor for sustained compliance.

The Facility Executive Director ensures all required individuals complete Mental Health Environment of Care Checklist annual training and develops a plan to monitor for sustained compliance.

The Facility Director ensures the Mental Health Executive Council includes veteran representation.

The Veterans Integrated Service Network Director provides oversight and monitoring of bed utilization.

The Chief of Mental Health ensures a minimum of four hours of recovery-oriented, interdisciplinary programming on weekends on the inpatient mental health unit.

The Facility Director develops and implements written processes to monitor and track compliance with state involuntary commitment requirements.

The Chief of Staff ensures staff use the required admission note template to document legal commitment status.

The Chief of Staff ensures documentation of discussions between prescribers and veterans on the risks and benefits of newly prescribed central nervous system medications.

The Chief of Staff ensures discharge summaries are completed within two business days of discharge.

The Chief of Staff ensures discharge instructions for veterans include appointment locations written in easy-to-understand language.

The Chief of Staff ensures discharge instructions for veterans include an explanation when both trade and generic names are used for the same medication.

The Facility Director directs nonclinical staff to complete VA S.A.V.E. training requirements.

The Facility Director ensures compliance with Veterans Health Administration requirements for the Interdisciplinary Safety Inspection Team, including an assigned lead and recording of meeting minutes and membership.

The Facility Director implements processes to ensure the Interdisciplinary Safety Inspection Team applies Mental Health Environment of Care Checklist standards on the inpatient mental health unit.

The Facility Director directs inpatient unit staff and Interdisciplinary Safety Inspection Team members to complete Mental Health Environment of Care Checklist training requirements.

Develop and implement a comprehensive plan to improve arrow key controls that provides annual Daily Arrow Key Accountability training for all employees with oversight responsibility, including clerks; an accurate 24-Hour arrow key management system dashboard; and review of dashboard metrics to achieve corrective actions for noncompliant conditions.

Implement a process outlining the operational workflow across Retail and Post Office Operations, Delivery Operations, and Delivery and Retail Modernization offices, including defined roles, responsibilities, information handoffs, and system updates involved in high security collection box deployment and tracking

Update the Collection Point Management System Admin Module User's Guide outlining steps for district managers on how to enter the security type for blue collection boxes.

Complete the implementation of a new governance risk and compliance tool to assist in the timely completion of SBA’s annual security control assessments in coordination with the Office of the Chief Financial Officer.

Update SBA policy and procedures to clearly define the term “annual” and specify whether it refers to a period of 365 days or aligns with the fiscal year ending on September 30.

Ensure the agency follows the policy to perform security control assessments annually, either on a rolling 365-day basis or aligned with the fiscal year ending on September 30.

Update the SBA Standard Operating Procedure (SOP) 20 21 4, The Small Business Administration Acquisition and Procurement Program, January 16, 2025, Appendix C — Cybersecurity and Supply Chain Risk for IT Acquisitions, to reflect the new process in which third-party supply chain risks will be continuously monitored through the Office of the Chief Information Officer.

Implement policies, procedures, and processes for developing and maintaining an accurate inventory of data and its corresponding metadata from third parties.

Improve the governance, risk, and compliance systems to track cybersecurity risks.

Develop and implement a process to monitor program offices’ completion of required annual reviews of interconnection security agreements and ensure program officials review and sign the agreements prior to their expiration.

Improve the existing process to manage personal identity verification exemptions.

Ensure that system owners perform annual privileged user access reviews in accordance with SBA policies.

Provide system owners and individuals with training or other communication emphasizing requirements for approving privileged user access prior to granting access.

Ensure program offices review all system security plans and confirm they are updated, approved, and signed annually by the system owner, information systems security officer, and the information systems security manager.

Document procedures, roles, and responsibilities for performing an annual functional test to ensure that the alternative backup site keeps the system operational in accordance with SBA policy and procedures.

Annually perform functional testing to include failover testing in accordance with SBA policy and procedures.

Establish procedures to monitor program officials’ compliance with SOP 90 47 6, Cybersecurity and Privacy Policy, requirements to ensure information system contingency plans are developed, tested annually, and updated as needed.

Review and update the information system contingency plans and business impact assessments and ensure that key attributes are included.

Update the information system contingency plans and business impact assessments at least once a year and include the recovery priority and lessons learned.

Conduct the information system contingency plans to include a business impact assessment at least annually.