Open Recommendations

We recommend that the Department of Health and Human Services develop and maintain an inventory of all geospatial data assets in accordance with section 759(b) of the GDA.

We recommend that the Department of Health and Human Services prepare the required annual reports regarding the achievements of the covered agency in preparing and implementing the strategic plan for the National Spatial Data Infrastructure (section 759(a)(1)) and complying with the other requirements in section 759(a).

Ensure that systems are reauthorized to operate on the 3-year schedule until either moved to a continuous monitoring model or retired.

Ensure that the Authorizing Official reviews and approves security control assessment plans prior to the assessments being conducted.

Ensure that all required controls and control enhancements are assessed for implementation and effectiveness as part of the authorization or reauthorization process.

Develop and implement risk assessments that analyze the likelihood of threats and mitigation measures in place specific to transmission systems.

Ensure that critical- and high-risk vulnerabilities are remediated or mitigated in a timely manner.

Develop processes to incorporate the cybersecurity change management board to seek its review and approval prior to making changes to all transmission systems.

Ensure that all substation SSCPs include all information required by NIST SP 800-53, Revision 5, and consider the control overlay provided in NIST SP 800-82, Revision 3.

Determine unnecessary ports, protocols, and services, and disable them to remove additional avenues for an attacker or a malicious user to exploit the system.

Encrypt data at rest on servers and databases, as appropriate, to protect confidentiality and integrity of the data.

Implement software, firmware, and information integrity checking tools, as appropriate, to identify unauthorized changes to all transmission systems.

Implement separation of duties to help prevent issues and minimize errors.

Ensure appropriate audit logs are capturing information necessary to identify changes to the system.

Ensure continuous monitoring of BPA’s information systems and applications to gain assurance that required controls are implemented, working as intended, and continue to operate at an acceptable level of risk, including implementing a formal process.

Develop a contingency training program that covers the appropriate topics associated with transmission systems and provide the training to those with contingency planning roles and responsibilities.

Ensure all information system contingency plans are developed in accordance with Federal requirements.

Develop policies and procedures to facilitate an effective cybersecurity program for the transmission infrastructure through the implementation of security controls in accordance with Federal and Department requirements.

Implement an effective oversight structure at BPA that encompasses transmission program management activities, to include the development and implementation of continuous monitoring, risk management, and governance activities.

Work to ensure adequate resources are available to implement a cybersecurity program for the transmission infrastructure by providing appropriate funding and personnel.

We recommend that the Senior Official Performing the Duties of the Commissioner of CBP conduct a comprehensive analysis of the risks associated with releasing noncitizens into the country without identification and develop and implement policies and procedures to mitigate those risks.

We recommend that the Director of ICE conduct a comprehensive analysis of the risks associated with releasing noncitizens without identification from ICE custody and develop and implement policies and procedures to mitigate those risks.

We recommend that the TSA Administrator use the results of the Requirements and Capabilities Analysis office’s updated CBP OneTM risk assessment to develop and implement policy and procedural changes needed to mitigate risks

Revise USMS Policy Directive 17.11 to reflect the accurate statutory language for the USMS's Title 18 law enforcement authority.

In consultation with the Department, update policies and procedures to reduce the risks of providing special deputation authority to ineligible or inappropriate applicants and ensure that USMS special deputations are only granted for allowable Title 18 purposes. These updates should clarify requirements and strengthen controls to better ensure reasonable and appropriate sponsorships, justifications, law enforcement authorities, eligibility, and timeframes for special deputations.

Implement formal training for the Special Deputation Program (SDP) to effectively oversee the special deputation process and appropriately grant Title 18 law enforcement authority.

Improve program oversight and accountability by formalizing processes to routinely evaluate and ensure special deputations comply with policies, procedures, and guidance, as well as by implementing controls that ensure any exceptions are appropriate and documented consistently.

Evaluate current procedures and mechanisms to determine what improvements are necessary to monitor and prevent special deputation lapses from occurring.

Develop and implement policy and procedures for documenting the reason for the lapse and the decision regarding TFO participation or restrictions on participation on USMS operational activities.

Improve current processes and implement controls within the USMS's case management system to consistently identify TFO investigative activity and ensure accountability and oversight of deputized TFOs.

Enhance its management of TFO misconduct allegations by: (a) reinforcing the policy requirement for reporting misconduct allegations to the USMS Office of Professional Responsibility (OPR) and OIG; (b) developing and implementing a policy regarding the utilization of a TFO who has an active misconduct allegation; and (c) implementing a process to document and track the status and outcome of all TFO misconduct investigations, when appropriate, to support decisions regarding a TFO's retention of special deputation authority.

Develop policies, procedures, and controls to manage court security officer (CSO) special deputations. During the development of this framework, the USMS should ensure the Judicial Security Division (JSD) takes into consideration relevant USMS requirements and processes for all other special deputations, including any updates that are made as a result of this audit.

Update its policy for reporting CSO misconduct to establish stronger controls that better ensure both USMS OPR and the DOJ OIG receive relevant and appropriate information.

Evaluate and update its guidance to the USMS on special deputations to clarify requirements for Department review and approval of special deputation requests.

Determine why the CO failed to ensure that final ceiling amounts were aligned with approved monthly expenses sufficient to cover the extended scope of work on Task Order DE-DT0008328 and implement a process to prevent recurrence of this situation.

Validate contracting personnel receive complete and accurate refresher training of basic contract management to include contract type and standard business practices, and take other additional management actions deemed appropriate.

Evaluate whether new contracting officials should be assigned to oversee Skookum’s contracts with the OST to facilitate and improve the working partnership.

Perform a risk assessment and determine appropriate contract oversite level on the T&M CLINs under Contract 89233119CNA000027.

Determine whether NNSA owes Skookum for work performed on Task Order DE-DT0008328’s 2018 extensions.

Determine whether NNSA owes Skookum for depreciation costs on Contract 89233119CNA000027.

Evaluate procedures over contract documentation and communications to ensure contract files are complete and historical contract knowledge is maintained.

We recommend the Secretary direct the Office of Strategy, Policy, and Plans to ensure the timely development and updates of Department and component strategic guidance.

We recommend the Under Secretary for Strategy, Policy, and Plans:• conduct an inventory of all required Department and component strategic guidance documents and mandated updates; and• implement and track the updates to all strategic guidance documents, and ensure they remain current.

Develop policies and procedures to ensure GL grant expenditures are reconciled with supporting documentation to reflect accurate reporting of financial information on the SF 270.

Work with ARC to resolve the reporting discrepancies of non-ARC matching cost share expenditures to reflect the total cost incurred of $117,326.

The Commissioner, SB/SE Division, should collaborate with the IRS Office of Chief Counsel to develop guidance for the applicability and computation of the failure to file penalty for delinquent Forms 5329.

Begin appropriate enforcement actions, starting with notice issuance, on the population of nonfilers with gambling winnings for TYs 2018 through 2020, prioritizing high-income nonfilers, including the top 100 nonfiler cases identified by TIGTA.

Review the population of nonfilers with gambling winnings for TYs 2018 through 2020 that were not identified by the IMF CCNIP and begin appropriate enforcement actions as warranted.

The Commissioner, SB/SE Division, should expand the wager codes to specifically include sports betting and use the wager code as a tool to identify potential noncompliance of excise taxes.

The Commissioner, SB/SE Division, should conduct an environment scan of the current and potential future conditions of the sports betting and online gambling industries, the industries’ risks, and the impact on tax compliance, and develop a process to identify and address Form 730 nonfilers and underreporter noncompliance.