Open Recommendations

Work with the relevant components to better align metrics across the Department and to determine what metrics for the ransomware threat, including metrics tracking disruption efforts, are most impactful, and which demonstrate the effectiveness of its actions to combat the ransomware threat.

Assess the U.S. Attorneys' Offices (USAO) implementation of the deconfliction policy, for ransomware cases, to ensure that federal prosecutors have a consistent understanding of the policy and comply with its requirements.

Rec. 1: The DoD OIG recommended that the Deputy Commandant, Manpower and Reserve Affairs, Headquarters, U.S. Marine Corps, develop and disseminate guidance providing a consistent approach for documenting and uploading dwell waiver requests to the Service member's Electronic Service Record to ensure that a Service member's consent to mobilization while in dwell is properly documented and maintained.

Rec. 4: The DoD OIG recommended that the Deputy Chief of Staff for Personnel, Headquarters, Department of the Army, develop and issue guidance applicable to the Army National Guard and the Army Reserve for maintaining documentation supporting Service members consent to mobilization while in dwell.

We recommend that USAID's Chief Information Officer develop and implement written guidance for performing and documenting cost-benefit and alternative analyses for cloud acquisitions before procuring cloud services.

We recommend that USAID's Chief Information Officer develop and implement a written procedure to document the Chief Information Officer's review and approval of all cloud service acquisition plans.

We recommend that USAID's Chief Information Officer develop and implement a written process for defining and reviewing service level agreements to determine whether they meet Agency needs.

We recommend that USAID's Chief Information Officer develop additional procedures to hold system owners accountable for noncompliance with continuous monitoring reporting requirements. This may include actions other than denying a system authority to operate, such as a negative performance evaluation or disciplinary action.

We recommend that USAID's Chief Information Officer develop additional procedures to hold system accountable for noncompliance with plan of action and milestones requirements. This may include actions other than denying a system authority to operate, such as a negative performance evaluation or disciplinary action.

We recommend that USAID's Chief Information Officer revise Agency procedures to address how system owners should document their monitoring of cloud service providers' remediation activities.

We recommend that the Federal Acquisition Service Commissioner consolidate and improve contract security classification guidance to provide more detail and clarity for AAS contracting personnel.

We recommend that the Federal Acquisition Service Commissioner update existing controls to monitor and ensure compliance with contract security classifications by including a review of the security classification level in contract file transfer checklists; verifying compliance with AAS security classification policies during existing internal contract reviews; and updating briefing templates to use consistent terminology.

We recommend that the Federal Acquisition Service Commissioner implement Assisted Services Shared Information System controls to ensure accuracy and integrity of contract security classifications by prioritizing the development of edit history for immediate visibility of changes to the contract security classification level; and limiting the ability to edit contract data to only the assigned acquisition personnel and their supervisory chain.

We recommend that the Federal Acquisition Service Commissioner strengthen AAS policy to require AAS Level 3 contracting officers to have adequate security clearances and establish a plan to initiate the security clearance process for affected contracting officers.

We recommend that the Federal Acquisition Service Commissioner provide AAS contracting personnel with training on any updated policies or guidance implemented in response to the audit findings.

USAID/Nepal determine the allowability of $45,026 in questioned costs ($39,909 ineligible, $5,117 unsupported) on pages 13 to 14 and pages 33 to 41 of the audit report and recover any amount that is unallowable.

USAID/Nepal verify that the Government of Nepal's Department of Health and Services and Other Implementing Government Agencies corrects the 1 material weakness in internal control detailed on pages 25 to 26 of the audit report.

USAID/Nepal verify that the Government of Nepal's Department of Health and Services and Other Implementing Government Agencies corrects the 11 instances of material noncompliance detailed on pages 33 to 45 of the audit report.

We recommend the Executive Assistant Commissioner of CBP’s Office of Field Operations develop and implement policies and procedures requiring regular comprehensive assessments of operations across all land ports of entry. These policies and procedures should also include key elements such as the designated office or official for conducting comprehensive assessments, assessment criteria, frequency of assessments, and related records retention requirements.

We recommend the Executive Assistant Commissioner of CBP’s Office of Field Operations conduct an initial comprehensive assessment of land port of entry operations, issue a report on the findings to identify areas of efficiencies, develop a corrective action plan to eliminate inefficiencies, and avoid wasting funds. This report should also document the rationale for strategic decisions including, but not limited to:• maintaining current land port of entry operations;• reducing or expanding land port of entry operational hours; and• permanently closing land ports of entry.

We recommend the Executive Vice President, Chief Financial and Strategy Officer, in conjunction with the Vice President, Financial Operations and Performance, ensure all projects are optimized in a consistent and holistic manner to ensure the most value to TVA ratepayers.

We recommend the Executive Vice President, Chief Financial and Strategy Officer, in conjunction with the Vice President, Financial Operations and Performance, ensure economic analyses are (1) performed for all applicable projects and (2) considered in decision making.

We recommend the Executive Vice President, Chief Financial and Strategy Officer, in conjunction with the Vice President, Financial Operations and Performance, provide economic analyses and all known costs to the Tennessee Valley Authority Board when presenting projects for approval.

We recommend the Vice President, Financial Operations and Performance, implement a reverse capital flex list for use in the event of a funding shortfall.

We recommend the Vice President, Financial Operations and Performance, evaluate the control gap to identify solutions to prevent the execution of purchase orders for projects that do not have all required approvals.

Track facilities supply chain personnel vacancies as part of the quality control reviews and take appropriate action.

Develop guidelines that define when facility supply chain management problems require additional interventions and then routinely identify them for network director action.

Ensure facility and network directors work with the Procurement and Logistics Office on a plan to identify resources and milestones to resolve identified supply chain management problems for identified facilities.

Direct the program office to develop a process to provide resources when needed to help networks and facilities resolve persistent supply chain management deficiencies, including those identified in this report.

Continue Procurement and Logistics Office efforts to automate tracking that will accurately capture and monitor all quality control review results, corrective action plans, and implementation of those plans.

Update the Procurement and Logistics Office audits of the quality control program to apply risk-based sampling, evaluate action plan sufficiency and implementation, and use the results to continuously improve quality control review guidance and requirements.

Ensure VSC develops and implements written policies and procedures related to program performance data management, including collecting, documenting, and reporting performance data, and distribute these among the relevant officials and staff.

Ensure VSC implements an adequate accounting system that accurately accounts for federal funds awarded to them, including the ability to account for subaward funds separately.

Remedy $1,940,223 in unsupported costs for subawards 2018/2019-VF-05-32886 and 2021-VF-05-40235.

Ensure remaining subaward funds are accounted for in compliance with the VOCA Guidelines and related costs are allowable and adequately supported.

Ensure VSC develops and implements written policies and procedures to comply with the DOJ Grants Financial Guide and federal award requirements, including financial reporting and maintaining adequate supporting documentation for expenditures

Conduct refresher training for the PCs regarding documenting and maintaining asset management system records in accordance with NCUA policy and procedures.

Update the accountable property policy to implement a process for the PMO to complete a periodic review of the IT asset inventory to validate that the inventory is documented and maintained in accordance with NCUA policy and procedures.

Complete the PRISM risk assessment review on an annual basis and document the results.

Ensure that the annual risk assessment reviews for all third-party NCUA services are completed.

Document and implement a process to track and complete supply chain risk assessments for all third-party systems and service providers.

Implement improved processes for leveraging dashboards in order to monitor and manage patch compliance and remediation of vulnerabilities including the tracking of approved and unapproved software.

Complete the 2024 backlog of overdue reinvestigations.

Document and implement a process for notifying OHR to add the initial role-based security training requirement to the learning profile in the learning management system for new hires requiring the training

Complete implementation of the new alternate processing and storage site to a fully operational state.

Collaborate with the Bureau of Labor Statistics to track and report data specific to mixed earners in the U.S. economy to allow for the provision of timely and useful assistance to the mixed earner population during future emergencies.

Monitor the state workforce agencies’ levels of benefit payment activity and establish timeframes to reduce the remaining allotment to the sufficiently minimal amount required to meet future benefit payment needs and ensure the remaining Mixed Earners Unemployment Compensation funds are expended appropriately or returned to Treasury.

Perform an assessment of previous emergency unemployment insurance (UI) programs and the pandemic-related UI programs to determine an appropriate historically-based time limit for states’ acceptance of emergency program benefit claims after the expiration of the UI programs’ eligibility periods and consider making a legislative proposal to Congress to use the determined the time limit on future emergency programs.

Develop a process to regularly monitor data assets submitted by components to further comply with GDA subsections 759(a)(2) and 759(a)(6), including: (1) ensure data assets are submitted with the appropriate metadata and, (2) are uploaded to the GeoPlatform as required.

We recommend that Novitas develop and deliver education to auditors and supervisors regarding applicable criteria and review requirements.