Open Recommendations

Document and implement a standard operating procedureto maintain the enterprise-wide data inventory as new datacollections are created and old data collections are retired.

Collaborate with NARA’s Chief Information Officer todocument and implement a standardized process tomonitor service level agreements with cloud-based serviceproviders. The process should include the monitoringresponsibilities of the Contracting Officer’sRepresentatives and actions NARA should take if acontractor does not meet the defined service levels.

Document and implement a process to incorporate theCloud Service Provider's Quality Assurance SurveillancePlan as part of future cloud service contracts. Whereincorporation of a Cloud Service Provider QualityAssurance Surveillance Plan is not anticipated, NARAshould incorporate its own Quality Assurance SurveillancePlan and service level agreements at the solicitationphase, these should align with commercial best practices.

Implement a documented process requiring the assignment of aQuality Assurance Evaluator for future relocation of records project(s).

Ensure a Quality Assurance Surveillance Plan is developed andimplemented requiring onsite supervision to provide proper oversight and compliancewith the PWS.

In collaboration with applicable parties, ensure PWS requirementsare developed to reflect the procedures necessary to protect and account for therelocation of archival records that should include:a. Implementing a documented process requiring the assignment of a QualityAssurance Evaluator for future relocation of records project(s).

In collaboration with applicable parties, ensure PWS requirementsare developed to reflect the procedures necessary to protect and account for therelocation of archival records that should include:Ensuring a Quality Assurance Surveillance Plan is developed, approved, andimplemented requiring onsite supervision to provide proper oversight andcompliance with the PWS.

Develop and implement standard operating procedures to ensurethat Research Services personnel comply with the PWS requirements.

Develop and implement standard operating procedures tocommunicate final PWS requirements to all responsible parties before the contract isawarded.

We recommend that the FAS Commissioner establish an oversight process for CSP-based contracts undergoing consolidation to ensure contracting personnel: (a) comply with General Services Acquisition Regulation 538.270-1, Evaluation of offers without access to transactional data, and FAS Policy and Procedure 2021- 05, Evaluation of FSS Program Pricing; and gather supporting documentation to determine a contractor’s most favored customer pricing for use in negotiation objectives; and (b) evaluate supporting documentation to verify a clear and relevant relationship between supporting documentation and each of the proposed prices it is meant to substantiate.

We recommend that the FAS Commissioner establish an oversight process for TDR pilot contracts undergoing consolidation to ensure contracting personnel do not rely solely on contract-level pricing tools; and, if prices paid data is not available, prioritize obtaining recent invoices or other than certified cost or pricing data from the contractor before relying on non-prices paid information.

We recommend that the FAS Commissioner re-evaluate previously consolidated MAS contracts to ensure that added products or services were evaluated to meet federal regulations and GSA policy requirements.

We recommend that GSA’s Chief Information Officer correct the geospatial data quality deficiencies identified in our report.

We recommend that GSA’s Chief Information Officer implement controls to ensure that the Inventory of Owned and Leased Properties (IOLP) and Federal Real Property Profile Management System (FRPP MS) datasets contain accurate latitude and longitude coordinates based on each property’s physical location except for those properties with a clear exemption for national security.

We recommend that GSA’s Chief Information Officer strengthen the data validation process for the IOLP and FRPP MS datasets to address the geospatial data quality deficiencies identified in our report.

We recommend that GSA’s Chief Information Officer establish a process to ensure GSA searches existing geospatial data before procuring new data, including: ensuring the Geographic Information Systems Center of Excellence is notified of future geospatial data needs prior to awarding a new contract for geospatial data; and improving Agency-wide awareness of the requirement to search existing geospatial data prior to awarding a new contract for geospatial data.

Rec. 1: The DoD OIG recommended that the Under Secretary of Defense for Policy and the Defense Security Cooperation Agency Director conduct a review of the challenges identified during the use of barcode scanners for enhanced end-use monitoring inventories and develop and implement a plan of action and milestones to correct those challenges before making any decisions on whether to use barcode scanners to conduct enhanced end?use monitoring inventories on a broader scale.

"Continue developing a comprehensive fraud prevention plan for the Home Rebates Program, incorporating lessons learned during program execution. This plan should include, at a minimum:

a. Requirements for collecting, analyzing, and using data, per PRAC best practices;
b. Establishing an information-sharing framework to utilize existing Federal databases and other resources that addresses the inevitable State and cross-State fraud schemes; and
c. Validating Applicant income self-certification claims prior to issuing rebate payments."

Modify program guidance and grant standard terms and conditions to institutionalize the critical features of a comprehensive fraud prevention plan.

FAA's Air Traffic Organization System Owners and National Airspace System (NAS) Cyber Operations to implement procedures to perform near real-time cyber monitoring activities on the remaining 62 NAS systems in accordance with DOT and FAA cybersecurity requirements and provide a timeline for completion.

OCIO to implement a process to verify that DOTs operating systems comply with applicable Departmental and Defense Information Systems Agency Security Technical Implementation Guides configuration settings.

OCIO to remediate vulnerabilities or develop other compensating controls in systems supporting DOTs Continuous Diagnostic and Mitigation program, tools, and network endpoints in accordance with the timeframes set forth in Cybersecurity and Infrastructure Security Agencys managed catalog of known exploited vulnerabilities.

FAAs System Strategy & Performance Service division to develop and implement software asset management policies, including a software inventory for reconciliation process.

FAAs Research and Development division to implement a process to verify that FAAs operating systems comply with applicable Departmental, FAA, and Defense Information Systems Agency Security Technical Implementation Guides configuration settings.

Pay the five unpaid detainees who were released without pay or provide an explanation of the circumstances that prevent payment.

Implement internal controls that ensure timely and appropriate responses to the detainee request process.

Ensure ICE staff respond appropriately to detainee requests.

Identify process gaps and update NUREG-1021 to ensure that guidance in future revisions remains current and addresses emerging issues.

Implement a process to monitor and ensure that reinvestigations occur for the identified employees and contractors not currently enrolled in continuous vetting through either TW or DoD CV until such time as their enrollment is complete.

Implement a technical capability to capture NRC employees’ and contractors’ initial login dates so that the required cybersecurity awareness and role-based training can be accurately tracked and managed by the current process. Also, as part of this recommendation, consider reviewing the current configuration of the EIH and TMS integration—as well as the logic in TMS itself, as necessary—to ensure training assignments are retained (not cancelled) due to inactivity.

Evaluate and document the decision to address past rebate allocations to ensure that funds were appropriately allocated to the proper accounts.

EXIM’s Engineering and Environment Division, in coordination with the Asset Management Division/Special Assets Group, should update EXIM’s enhanced monitoring plan for the Sasan Power Limited Project to incorporate and require more robust compliance monitoring, to include onsite monitoring, of environmental, health, and safety standards, as required by the credit agreement.

EXIM’s Engineering and Environment Division, in coordination with the Asset Management Division/Special Assets Group and the independent consultants, should identify additional information sources about activities or concerns related to the Sasan Project to help provide more robust enhanced monitoring, such as input from the local community.

EXIM’s Asset Management Division/Special Assets Group, in coordination with the Engineering and Environment Division and the Office of General Counsel, should conduct a review of the Sasan Project to determine what additional accountability mechanisms could be included in credit agreements on future EXIM-financed projects to allow for additional accountability or enforcement authority when a borrower or project sponsor does not comply with the terms of the credit agreement.

EXIM’s Engineering and Environment Division, in coordination with Asset Management Division/Special Assets Group, should incorporate routine maintenance and operations into its update of the enhanced monitoring plan, to include clarifying roles and responsibilities, for the Sasan Power Limited Project.

EXIM’s Asset Management Division/Special Assets Group should require Sasan Power Limited, in coordination with Reliance Power Limited as the project sponsor, to have the original manufacturer perform detailed inspections of all transformers at the Sasan Power Limited Project.

EXIM’s Asset Management Division/Special Assets Group should identify any potential financial risks associated with Sasan Power Limited’s ongoing efforts to comply with India’s flue-gas desulfurization requirement and develop risk mitigation actions, as appropriate.

EXIM’s Office of Board Authorized Finance should conduct a review of the Samalkot Power Limited Project’s transaction approval to determine if EXIM properly identified and accounted for the financial risks specific to the absence of a confirmed source of gas to support the project, and if any lessons learned can be applied to future EXIM transactions.

EXIM’s Asset Management Division/Special Assets Group should develop an action plan to assist in the identification of potential buyers for the <redacted> remaining power modules.

EXIM’s Asset Management Division/Special Assets Group should require verification of equipment inspections at a frequency determined by industry standard, Samalkot Power Limited, Reliance Power Limited, and the independent consultants to ensure the equipment is maintained in a manner that allows the equipment to be sold.

Update the Office of Chief Information Officer Cybersecurity Incident Response Plan to incorporate lessons learned from the security incident and ensure that it reviews and updates the plan annually.

Document and implement a plan to issue policy, implementation instructions, procedures, and configuration guidance to support Departmental enterprise event logging in accordance with OMB M-21-31, Improving the Federal Governments Investigative and Remediation Capabilities Related to Cybersecurity Incidents.

Complete the DOT workforce assessment, which includes the entire DOT IT and cybersecurity workforce.

Direct the DOT Information Assurance and Privacy Management Office and Breach Assessment and Response Team to implement annual testing of the Breach Notification Controls, as required by DOT Order 1351.19, Personally Identifiable Information Breach Notification Controls.

Work with the Cyber Security Assessment and Management (CSAM) system owner to resolve the technical issues to ensure the CSAM Plan of Action and Milestones (POA&M) reporting function is accurate and conduct oversight of the Operating Administrations to ensure that the POA&M entries meet the requirements of Information Technology (IT) Implementation Memorandum 2023-010A, DOT Supplemental Requirements for IT Security POA&M Management.

Strengthen procedures for maintaining a comprehensive and accurate cloud system inventory, which includes reconciling CSAM data to the listing of cloud service providers submitted by the Operating Administrations.

Enforce password polices to ensure passwords are harder to guess and extend the timeframe in which individuals can enter the next password. Further, use cryptographically protected channels to transmit passwords.

Document and implement procedures to review on a periodic basis users with administrative rights and privileged groups with access to domain controllers.

Implement protections to restrict access to system tools used to create and manage shadow copies of the hard drive.

Document and implement procedures to analyze user account passwords against lists of commonly used and compromised passwords and require users to reset weak or compromised passwords.