Open Recommendations

Food and Nutrition Service needs to update its NDA form(s) to include the required anti-gag provision. Food and Nutrition Service also needs to review and update active NDAs for current Food and Nutrition Service Federal employees signed after November 27, 2012, to ensure they include the required anti-gag provision.

Forest Service needs to update its NDA policies and form(s) to include the required anti-gag provision. Forest Service also needs to review and update active NDAs for current Forest Service Federal employees signed after November 27, 2012, to ensure they include the required anti-gag provision.

National Agricultural Statistics Service needs to update its NDA policy and form(s) to include the required anti-gag provision. National Agricultural Statistics Service also needs to review and update active NDAs for current National Agricultural Statistics Service Federal employees signed after November 27, 2012, to ensure they include the required anti-gag provision.

Office of the Chief Financial Officer needs to update its NDA form(s) to include the required anti-gag provision.

PBGC should implement an enterprise-wide approach to prevent counterfeit components from entering its supply chain and establish performance measures to gauge the effectiveness of its anti-counterfeit policies and procedures. Additionally, PBGC should provide a comprehensive anti-counterfeit training for its personnel.

PBGC should manage Active Directory certificate template settings effectively by hardening and auditing existing templates in the environment. Privileges should also be assessed for all templates to prevent unauthorized changes to the configuration settings.

PBGC should establish robust network segmentation and configure firewalls with default rules to ensure the guest wireless network is effectively isolated from internal resources.

PBGC should establish a comprehensive system for monitoring, analyzing, and reporting on quantitative performance measures to evaluate the effectiveness of its Data Breach Response policies and procedures.

PBGC should implement an effective specialized security training program that includes steps to identify and prevent phone-based social engineering for all employees.

PBGC should strengthen its controls around verifying the identity of PBGC personnel prior to temporarily disabling their requirement for MFA for remote access should a user purportedly have a malfunctioning PIV card or other MFA token.

Develop and implement a policy or procedure for NDAs that:• Establishes a standard format for NDAs; and,• Requires the Office of the General Counsel to review all NDAs and confirm they contain required language regarding whistleblower protections.

Develop and document criteria outlining the circumstances under which the agency would ask employees to sign an NDA.

Individually inform current staff members who previously signed NDAs that did not contain the anti-gag provision, in writing, of their whistleblower rights.

Implement a tracking system for storage of the DNFSB’s existing and future NDAs that is consistent with the Privacy Act.

We recommend that OESPIM develop a SORN for all applicable systems.

We recommend that OPM obtain feedback on its security awareness and training program and use the information to make improvements to the IT security training program.

Develop and distribute nationwide policy that addresses personal belongings on the workroom floor.

identify all cameras not functioning and develop a plan to restore them to operational status.

develop and implement a strategic, nationwide plan that includes continuous monitoring of the operational status of cameras and diagnosing and addressing camera failures timely.

Strengthen policies, processes, and procedures within NSF’s excepted service pay system to ensure administratively determined pay bands for administratively determined appointments under the NSF Act are established in accordance with the EX-III and EX-IV statutory limits and to ensure employee salaries are established and maintained in compliance with applicable pay band limits.

Assess and resolve the additional $1,636,333 in past salary payments above applicable salary limitations that were not included in NSF’s prior debt collection waivers, in accordance with applicable law.

We recommend that the Assistant Secretary for the Office of Elementary and Secondary Education require the AlaskaDepartment of Education to require Yukon-Koyukuk to determine whether the $24,386 that Yukon-Koyukuk charged toARP ESSER for the three expenditures made without maintaining proper documentation of the competitive procurementprocess was reasonable when compared to the costs of suitable alternatives, and if not, require appropriate correctiveactions.

We recommend that the Assistant Secretary for the Office of Elementary and Secondary Education require the AlaskaDepartment of Education to require Yukon-Koyukuk to ensure that LEA officials responsible for making and documentingpurchasing decisions receive sufficient training on Federal procurement requirements, including those covered under 2C.F.R. sections 200.318(i) and 200.320 (methods of procurement to be followed).

HUD OCIO should a) resolve the conflicts between its Inventory of Automated Systems (IAS) policy and web applications policy to clarify if web applications will be inventories in IAS, the web application Sharepoint site, or both; and b) implement the chosen resolution to this conflict to develop a consistent inventory of web applications (IG FISMA metric 1).

HUD OCIO should implement an automated governance, risk, and compliance tool to manage risk from all sources across the three tiers of the organization in a timely manner. This recommendation updates FY 2021 FISMA recommendation number 5 (IG FISMA metrics 5, 9, and 10).

HUD OCIO should employ automation to maintain a timely and accurate view of security configuration information for all systems connected to its network (IG FISMA metric 20).

HUD OCIO should demonstrate that it can implement its defined security responses if a baseline configuration is changed without authorization. This can be shown by either a response to a real incident if one happens or through a testing exercise if there are no applicable incidents (IG FISMA metric 23).

HUD OCIO should review its security training program and determine whether it should provide general cybersecurity awareness training to external users of its systems and data (IG FISMA metric 44).

Determine the allowability of $103,913 in unsupported questioned costs on page 14 of the audit report and recover any amount that is unallowable.

Implement additional policies, processes, and/or procedures to ensure that NSF assigns program element, thematic, account, budget object class, and/or other codes consistent with its Guidance for Coding of Mid-scale Research Infrastructure Awards for all awards NSF includes within its Mid-scale Research Infrastructure portfolio.

Revise existing internal guidance and procedures that Integrated Project Teams can use to improve the review, approval, and oversight process for Mid-scale Research Infrastructure awards.

Update and/or develop external Mid-scale Research Infrastructure guidance for proposing organizations to identify and/or clarify NSF’s expectations for the proposal, award, monitoring, and reporting activities required for different types of Mid-scale Research Infrastructure awards.

Implement a formal process for documenting NSF’s oversight, as well as the performance of the activities funded under Mid-scale Research Infrastructure awards, and for appropriately storing and archiving this documentation within NSF’s eJacket system (or another appropriate system) on a timely basis.

Produce and provide additional training to Integrated Project Teams responsible for overseeing Mid-scale Research Infrastructure awards.

We recommend that USAID's Office of Acquisition and Assistance Cost, Audit and Support Division/Contract Audit Management Branch verify that ICF Macro, Inc., corrects the one material weakness in
internal control detailed on page 8 of the audit report.

We recommend that USAID's Office of Acquisition and Assistance Cost, Audit and Support Division/Contract Audit Management BranchVerify that Chemonics International, Inc. corrects the material
weaknesses in internal control detailed on pages 11 to 12 of the audit report.

We recommend that National Government Services, Inc. develop and deliver additional education to auditors and audit supervisors regarding applicable criteria and review requirements.

We recommend that National Government Services, Inc. develop and implement enhanced procedures so that supervisors are better qualified to detect incorrect audit adjustments.

We recommend that Novitas develop and implement enhanced procedures so that supervisors are better qualified to detect incorrect audit adjustments.

Develop and enhance procedures for travel charge card terminations to ensure the timely closure of travel charge card accounts for separated employees.

Review and, as necessary, adjust the individually billed accounts to ensure compliance with the established credit limits in the NRC Plan.

Establish a process for conducting periodic reviews of travel charge card accounts to strengthen oversight and monitoring of individually billed accounts and help ensure adherence to the credit limits defined in the NRC Plan.

Develop and implement procedures for periodic reviews of the credit limits for centrally billed travel accounts and adjust these limits, as necessary, for the anticipated operational need.

Determine if the $47,791 in questioned costs for first and business class travel are allowable and provide the corrective actions taken on any costs deemed disallowed.

(U) Rec. 1.a: The DoD OIG recommended that the Commander of the Air Force Life Cycle Management Center direct the C?17 System Program Manager to develop controls to ensure the accuracy of Chief Financial Officer reports.

(U) Rec. 1.b: The DoD OIG recommended that the Commander of the Air Force Life Cycle Management Center direct the C-17 contracting officer to require Boeing to notify the contracting officer of price increases of 25 percent or higher than the proposed price.

(U) Rec. 1.c: The DoD OIG recommended that the Commander of the Air Force Life Cycle Management Center require that the C?17 contracting officer reviews spare parts prices throughout the execution of the C?17 performance?based logistics contract, determine whether price increases of 25 percent or above occurred, and obtain justification of the price increase from Boeing.

(U) Rec. 1.d: The DoD OIG recommended that the Commander of the Air Force Life Cycle Management Center direct that the C?17 contracting officer review or delegate the review of invoices to determine whether spare parts prices are allowable and reasonable before payment.

(U) Rec. 1.e: The DoD OIG recommended that the Commander of the Air Force Life Cycle Management Center direct the C-17 contracting officer to assess and determine whether overpayments were made on the 12 spare parts we determined not to have fair and reasonable prices and implement available options to seek recovery, including voluntary refunds of at least $992,856, in accordance with Defense Federal Acquisition Regulation Supplement 242.71.

(U) Rec. 2: The DoD OIG recommended that the Director of the Defense Contract Management Agency review Service Parts Management to validate the accuracy of the forecasting demands for spare parts and if accuracy issues are identified during the review, require that corrective actions are taken.