Open Recommendations

The New York/New Jersey VA Health Care Network Director conducts a review of system leaders responses to repeated concerns regarding delayed community care consult scheduling for patients with serious health conditions to determine whether leaders actions were in alignment with patient safety and high reliability organizational principles, and take action as warranted.

The New York/New Jersey VA Health Care Network Director ensures VA Western New York Health Care System Director develops community care consult practices and procedures for managing consults deemed high-risk or complex, implements an effective process to ensure consistency with processing consults within Veterans Health Administration timeliness requirements, and audits for compliance.

The VA Western New York Health Care System Director ensures system community care leaders develop and implement standardized operating procedures for consult management consistent with Veterans Health Administration standards, provide training to community care staff, monitor compliance, and evaluate effectiveness

Develop and formalize a quality program for Plant Operations that emphasizes a culture of measurement and continuous improvement.

Determine if any of the potential metrics highlighted in this report would benefit Plant Operations and its stakeholders, and if so, track and report on those metrics.

Create new workflow diagrams, with cycle times, for each type of product identified in Title 44.

Use Plant Operations Manufacturing System (POMS) to replace the manual tracking of information, track complaints and issues, and generate metrics reports.

Design and implement risk management and general support system policies, procedures, and processes that address National Institute of Standards and Technology Special Publication 800-53, Rev. 5.1, Rel. 5.1.1 control requirements.

Design and implement Supply Chain Risk Management policies, procedures, and processes that address National Institute of Standards and Technology Special Publication 800-53, Rev. 5.1, Rel. 5.1.1 control requirements.

Develop and implement agency-wide Configuration Management policies, procedures, and processes, that address applicable National Institute of Standards and Technology Special Publication 800-53, Rev. 5.1, Rel. 5.1.1, control requirements.

Develop and implement agency-wide identity access management policies, procedures, and processes that address applicable National Institute of Standards and Technology Special Publication 800-53, Rev 5, Rel. 5.1.1, controls requirements.

Develop and implement agency-wide data protection and privacy policies, procedures, and processes that address applicable National Institute of Standards and Technology Special Publication 800-53, Rev. 5, Rel. 5.1.1 control requirements.

Develop and implement agency-wide Security Training policies, procedures, and processes that address applicable National Institute of Standards and Technology Special Publication 800-53, Rev. 5.1, Rel. 5.1.1, control requirements.

Finalize and implement its Information Security Continuous Monitoring plan and update the plan and any additional procedures and processes to address applicable National Institute of Standards and Technology Special Publication 800-53, Rev. 5, Rel. 5.1.1, control requirements.

Develop and implement agency-wide incident response policies, procedures, and processes that address applicable National Institute of Standards and Technology Special Publication 800-53, Rev. 5, Rel 5.1.1, control requirements.

Develop and implement agency-wide contingency planning policies, procedures, and processes that address applicable National Institute of Standards and Technology Special Publication 800-53, Rev. 5, Rel 5.1.1, control requirements.

Consider requesting a class deviation to Federal Acquisition Regulation 52.203-13, Contractor Code of Business Ethics and Conduct to expand contractors’ business ethics awareness and compliance programs and internal control systems to include sexual harassment and sexual assault prevention and reporting, as well as sexual harassment investigations.

For the upcoming contract award for the management of the U.S. Antarctic Program, require as a contract deliverable, and maintain, contractor policies related to sexual harassment prevention, reporting, and investigations.

Remediate the vulnerabilities identified through the penetration testing using NSF’s vulnerability management procedure.

Reconcile departure reports received from Human Capital to the asset managementinventory system, on a regular basis (e.g., monthly, quarterly, etc.) to ensure updates arebeing made in a timely manner and are accurate to reflect separated or transferredemployees and contractors.

Perform a reconciliation of all NARA hardware asset inventories to ensure all data such asassignments and status are accurately and completely stated, investigating any unusual orpotentially duplicate entries, and making revisions as needed.

Ensure IT policies, procedures, methodologies, and supplements are reviewed andapproved in accordance with NARA Directive 111.

Implement a process to ensure accounts with access to the Domain Administrators groupare appropriately assigned based on job responsibilities. If determined that an account canbe configured with more restrictive access, then implement a process to revoke the DomainAdministrator group membership and apply the most restrictive access.

Develop and implement policies and procedures for network user accounts to:• Create unique passwords for each service account.• Maintain a list of commonly used, expected, or compromised passwords.• Update the list on an organization defined timeframe and when organizationalpasswords are suspected to have been compromised directly or indirectly.• Verify (such as through regular password audits or system configurations), when userscreate or update passwords, that the passwords are not found on the list of commonlyused, expected, or compromised passwords.

Assess applications residing on unsupported platforms to identify a list of applications, allservers associated to each application, and the grouping and schedule of applications to bemigrated, with the resulting migration of applications to vendor-supported platforms.

Ensure user system accounts for all systems are periodically reviewed and automaticallydisabled in accordance with NARA policy.

Ensure audit logging is enabled for each major information system.

Ensure periodic reviews of generated audit logs are performed for each major informationsystem.

12. Ensure password configuration settings for all major information systems are in accordancewith NARA IT Security Requirements.

Ensure the use of shared/group accounts is restricted to only those users with a validbusiness justification, by enhancing user account review procedures to incorporate reviewsof shared/group account membership and reasonableness.

Ensure a process is developed, documented, and implemented to change passwordswhenever users within shared/group accounts change.

Ensure a comprehensive ICAM policy or strategy, which includes the establishment ofrelated Standard Operating Procedures (SOPs), identification of stakeholders,communicating relevant goals, task assignments and measure and reporting progress isdeveloped and implemented.

Implement requirements across all EL maturity tiers to ensure events are logged andtracked in accordance with OMB M-21-31.

OIG recommends that the Office of Crisis Management and Strategy update the Foreign Affairs Handbook to clarify that a Lessons Learned Cable must be produced following every large-scale event, emergency, or crisis, including evacuations that result in a post (1) remaining in ordered departure status for an extended period of time, (2) suspending operations, or (3) closing permanently.

OIG recommends that the Bureau of Diplomatic Security develop and implement a requirement in the Foreign Affairs Manual to produce an After Action Review following every evacuation that results in a suspension of post operations.

OIG recommends that, following the implementation of Recommendations 1 and 2, the Under Secretary for Management, working in conjunction with the Executive Secretariat, develop and implement a process to (1) systematically review After Action Reviews developed in response to post evacuations and Lessons Learned Cables generated in compliance with 12 Foreign Affairs Handbook-1 H-235 and (2) make recommendations for action based on the results of these reviews, including identifying needed changes to Department policies, procedures, and guidance.

Identify critical spare parts for its critical assets.

Developing a comprehensive risk-based critical spare parts program to include identifying the critical spare parts in inventory, establishing sparing levels and reorder points for those critical spare parts, and staging the critical spare parts at strateg

Develop and implement an anti-gag policy that assigns oversight roles and responsibilities, provides guidance to PBGC personnel on legal requirements, and describes how to identify non-disclosure forms and agreements that require the inclusion of the anti-gag provision.

We recommend that the Assistant Secretary for the Office of Elementary and Secondary Education require the Iowa Department of Education (Iowa) to require Linn-Mar to determine whether the $228,510 that Linn-Mar charged to the ESSER grant without using a competitive procurement process or obtaining price or rate quotations from an adequate number of vendors was reasonable when compared to the costs of suitable alternatives, and if not, require appropriate corrective actions.

We recommend that the Assistant Secretary for the Office of Elementary and Secondary Education require the Iowa Department of Education (Iowa) to require Linn-Mar to ensure that LEA officials responsible for making and documenting purchasing decisions receive sufficient training on Federal procurement requirements, including those covered under 2 C.F.R. sections 200.318(i) and 200.320 (methods of procurement to be followed).

CMS should take steps to confirm that all States cover required services from maternal health providers for Medicaid managed care enrollees.

CMS should clarify the requirement that States have a provider-specific OB/GYN network adequacy standard.

CMS should support States in tailoring their network adequacy standards to better address maternal health care needs.

We recommend the Office of Homeland Security Situational Awareness Director and the Intelligence and Analysis Under Secretary, with the support of the DHS Chief Information Officer, establish a recurring process to coordinate internally and with external partners to identify needed Homeland Security Information Network functionality improvements and provide the DHS Chief Information Officer with Homeland Security Information Network improvement recommendations.

We recommend the DHS Chief Information Officer create and implement a plan for outreach with external partners to increase awareness of Homeland Security Information Network capabilities, such as trainings and updates, and available resources, including stakeholder engagement specialists, to fusion centers.

We recommend the DHS Chief Information Officer conduct a cost benefit analysis to evaluate partners’ Homeland Security Information Network use versus cost to modernize and determine if modernization is the best solution for Homeland Security Information Network based on fiscal responsibility, mission objectives, and user feedback.

We recommend the Intelligence and Analysis Under Secretary, in coordination with Office of Homeland Security Situational Awareness Director, create and implement a plan of action to expand outreach to other stakeholders, such as fusion centers and external partners, to promote access to DHS technologies including the Virtual Situation Rroom and the common operating picture.

Install area of refuge signage in accordance with NFPA 101 standards and remove any signage showing incorrect or outdated emergency information.

Assess the force required to open fire doors leading to areas of refuge under a range of conditions, and as practicable, adjust fire door opening force to the minimum allowable level.