Open Recommendations

Develop a centralized system and institute a phone log system to modernize and streamline the chartering application process.

Quantify and clarify the deferral process for organizing groups by establishing clear guidelines and milestones to ensure enhanced transparency and understanding.

Post detailed information about the NCUA’s charter deferral process on the agency’s website to clearly communicate expectations and provide organizing groups with a transparent and comprehensive understanding of deferrals within the charter application process.

Establish a structured communication process within the NCUA’s federal credit union chartering process that sets expectations, timeframes, and ownership of responses to inquiries initially directed to the NCUA Board and/or NCUA senior management from charter organizing groups to ensure improved operational effectiveness and customer service.

Include and publish language in the updated version of the AS-701 to clarify the requirements to report lost, stolen, or missing assets or materials to the Postal Inspection Service.

Require facility management to certify supervisors and employees complete formal, and release update, training on Mobile Delivery Device - Technology Refresh functionalities.

Require facility management to provide guidance to supervisors and employees of all major Mobile Delivery Device - Technology Refresh functionality updates.

Develop a deployment plan with actionable milestones for the 24-Hour Arrow Key Management System to all facilities using the Arrow keys nationwide, contingent upon the completion of the pilot program.

Reiterate to facility management the requirement to follow the Arrow Key Standard Work Instructions including reporting lost or stolen keys to the Postal Inspection Service as required.

Review the 187 loans that matched to a related COVID-19 EIDL or PPP loan with a fraud hold code for legitimacy and eligibility. If any of the 187 loans are found to be illegitimate, ineligible, or fraudulent, take appropriate action to 1) prevent disbursement of funds, 2) recover the funds, and 3) refer potentially fraudulent loans to OIG.

We recommend that USAID/Democratic Republic of the Congo determine the allowability of $102,128 in ineligible questioned costs on pages 18 and 21 of the audit report and recover any amount that is unallowable.

We recommend that USAID/Democratic Republic of the Congo verify that SANRU ASBL corrects the one instance of material noncompliance detailed on page 34 of the audit report.

We recommend that the Centers for Medicare & Medicaid Services review noncompliant hospitals associated with our findings and, if CMS determines that the hospitals are noncompliant, execute CMS's enforcement measures, to include issuing warning notices, corrective action plans, and/or civil monetary penalties as applicable.

We recommend that the Centers for Medicare & Medicaid Services use the information in this report and consider implementing changes suggested by hospitals, including providing written guidance clarifying the definition of "shoppable services" and developing a training and compliance program that is tailored for smaller hospitals.

We recommend that the Centers for Medicare & Medicaid Services continue to strengthen its internal controls, to include allocating sufficient resources to maintain a robust program of reviews of the hospitals and their compliance with the HPT rule.

(U) Rec. 1.d: The DoD OIG recommended that the Commander, Naval Facilities Engineering Systems Command, issue guidance to contracting personnel to conduct an after-action review for each Naval Facilities Engineering Systems Command project over budget or behind schedule and include contracting, design, funding, and oversight personnel in the after-action review to discuss lessons learned from pre-award through project completion, establish a method for sharing results across the Command, and require Naval Facilities Engineering Systems Command officials to review the after-action reviews before planning new military construction projects.

(U) Rec. 1.e: The DoD OIG recommended that the Commander, Naval Facilities Engineering Systems Command, review the Land Use Control plan development process and update that process to address coordination with multiple stakeholders, and methods to streamline revisions.

(U) Rec. 1.f: The DoD OIG recommended that the Commander, Naval Facilities Engineering Systems Command, develop and issue Naval Facilities Engineering Systems Command supplemental guidance to the Unified Facilities Guide Specifications, Section 01 91 00.15, "Building Commissioning," that includes developing specific project schedules and establishing a regular schedule to discuss commissioning with all stakeholders early in the military construction process.

(U) Rec. 1.g: The DoD OIG recommended that the Commander, Naval Facilities Engineering Systems Command, coordinate with Marine Corps Headquarters and Manpower Management Officer Assignment Command officials to issue guidance establishing mutual expectations for staffing the Site Activation Task Force to military construction projects to ensure timely and sufficient staffing of future military construction projects.

(U) Rec. 2: The DoD OIG recommended that the Deputy Assistant Secretary of Defense for Infrastructure Modernization and Resilience, in coordination with the Deputy Assistant Secretary of Defense for Environmental Management and Restoration, issue guidance emphasizing to personnel the importance of: 1) identifying situations where Per- and Polyfluoroalkyl Substance-impacted soil and water may be encountered during military construction projects; and 2) including all reasonable costs to manage Per- and Polyfluoroalkyl Substance-impacted soil and water when completing DD Form 1391, "FY _____ Military Construction Project Data," for all future military construction projects.

We recommend that USAID/Rwanda verify that Never Again Rwanda corrects the one instance of material noncompliance detailed on page 19 of the audit report.

Housing should include zero trust requirements as part of the Housing Strategic Roadmap for Housing Modernization.

Housing should refine access controls within the FHA Catalyst modules that are dynamic, are tailored to user actions, and require continuous reauthentication to ensure that users have access only to information needed.

Housing should coordinate with HUD's SOC to a. Ensure that FHA Catalyst user behavior monitoring logs are regularly captured and adequately reviewed for discrepancies in user activities. b. Establish program office responsibility for the log review process. "'

Develop a supply chain risk management strategy that includes (a) a supply chain risk appetite and tolerance, (b) an enterprise supply chain risk management governance structure, and (c) supply chain risk assessment processes that include migration strategies or controls.

Document and implement a baseline review and escalation process for data loss prevention alerts.

Reinforce the requirements for identifying and documenting system interconnections as part of the Board’s training on its cyber risk management application and require all relevant individuals to take the training.

Evaluate and implement options to enforce the agency’s existing guidance related to identifying and documenting system interconnections.

Develop and implement a mobile application scanning program that includes a vulnerability scanning solution and process to identify and remediate vulnerabilities.

Ensure that the Board’s Incident Notification and Breach Response Plan is reviewed, tested and approved annually.

Develop and implement a role-based privacy training program.

Incorporate targeted phishing exercises into the Board’s security awareness and training program and processes.

Update the Board’s standard contract language in cloud service provider contracts to ensure that it is consistent with Federal Risk and Authorization Management Program’s Incident Communications Procedures incident reporting requirements.

Complete finalization of an agencywide data classification policy that accounts for the sensitivity of the data maintained by the CFPB.

Ensure that data classification and sensitivity labels are incorporated into the CFPB’s data loss prevention program.

Strengthen flaw remediation processes by developing and implementing a process to clearly map identified vulnerabilities to system IP addresses, host names, and remediation owners within the CFPB’s configuration management database.

Ensure that adequate resources are allocated to reinvestigate CFPB systems users as required.

Develop and maintain a ransomware strategy and specific procedures that provide a formal, focused, and coordinated approach to responding to ransomware attacks.

Ensure that testing of mission-essential functions identified in the CFPB’s continuity of operations plan is periodically performed.

Renew the authorizations to use for the CFPB’s governance, risk, and compliance tool.

Implement a process that ensures the cyber risk information in the CFPB’s governance, risk, and compliance tool is accurate and maintained.

Reiterate policy requiring project managers to transfer expense purchase card supporting documents to credit card approving officials, and for credit card approving officials to maintain the supporting documents for the duration of the retention period.

Create a centralized, electronic repository for storing facility repair supporting documentation.

Establish guidelines and best practices to require project managers to identify and combine related service ticket requests and solicit contracts for projects that exceed expense purchase card authority threshold.

Establish guidelines and controls to monitor the use of batch payments.

Ensure the responsible office updates 3099-001 to include the required anti-gag provision within the policy.

Agricultural Marketing Service needs to update its NDA form(s) to include the required anti-gag provision.

Agricultural Research Service needs to update its NDA policy to include the required anti-gag provision.

Economic Research Service needs to update its NDA policy to include the required anti-gag provision.

Foreign Agricultural Service needs to review and update active NDAs for current Foreign Agricultural Service federal employees signed after November 27, 2012, to ensure they include the required anti-gag provision.