Open Recommendations

We recommend that the Assistant Secretary for OSERS require RSA to design and document procedures for its annualreview process. The procedures should be in the form of written policies and procedures or protocols, and designed toensure compliance with applicable requirements, including those covered in the Rehabilitation Act of 1973 and theDepartment’s “Guide for Managing Formula Grant Programs.”

We recommend that the Assistant Secretary for OSERS require RSA to strengthen its process for selecting State VRagencies to monitor by (a) incorporating a risk factor that accounts for an agency’s technical assistance needs (such asnumber of requests made or complexity of technical assistance needs) into the accountability model used to help selectagencies and (b) establishing a reasonable time period (for example, 8 to 10 years) during which all agencies must bemonitored (through periodic onsite monitoring or offsite monitoring) by RSA at least once.

CO make a determination regarding the allowability of questioned costs identified in this report, recover those amounts determined to be unallowable, and determine whether additional steps are needed to validate the allowability of costs.

Develop a tool to analyze the data in CBFish and identifying potential issues.

Identify the optimal size of the CO workforce to ensure that it is appropriate for the workload distribution.

Review the seven contracts that remain open as identified in the report, along with the expired contracts and agreements not included in our sample, and addressing the issues resulting in delayed closeout.

Develop and implement additional processes and controls to strengthen BPA’s oversight and monitoring of contracts such as training, tracking task status more accurately, and documenting justification for final disposition of task.

Update BPA’s policies and procedures to include a process for closing out IAAs and to establish specific closeout timeframes.

Evaluate the current design and operating effectiveness of the invoicing practices and revising, developing, or implementing a policy to strengthen and improve BPA’s overall approach to reviewing invoices.

Consider the use of a structured, documented self-assessment process to ensure compliance with applicable requirements and continuous improvement of the Program.

ACF should monitor whether States are conducting credit checks of all three CRAs for children aged 14 or older who are in foster care, as required.

ACF should further assist States in building their capacity to conduct credit checks and to interpret and resolve credit reports effectively.

ACF should seek to partner with other government agencies to develop strategies to address issues that States experienced working with CRAs.

Instruct the Office of Finance to review the $14 million retained by the medical centers to ensure these funds were, or will be, spent in accordance with all applicable VA policies and federal laws.

Define the roles and responsibilities of the appropriate assistant under secretaries, program office staff, and regional and medical center staff in the implementation and monitoring of the substance use disorder hiring initiative and ensure the relative priority of the initiative is communicated; hiring progress is monitored; possible hiring challenges are addressed to the extent possible; and actions are taken as needed to meet the goals of the hiring initiative.

Remediate the 7 findings and 19 associated recommendations identified in Cloud Platform #1 and the applications built on Cloud Platform #1.

Remediate the 8 findings and 11 associated recommendations identified in Cloud Platform #2 and the applications built on Cloud Platform #2.

Remediate the 4 findings and 5 associated recommendations identified in the applications built on Cloud Platform #3.

Remediate the 3 findings and 6 associated recommendations identified in Cloud Platform #4.

Remediate the 4 findings and 7 associated recommendations identified in Cloud Platform #5.

This recommendation is redacted.

Design and implement a plan to prevent, detect, and remediate security weaknesses on FDICcloud platforms and applications related to insecure coding practices, misconfigured securitysettings, least privilege violations, outdated software versions, and ineffective monitoring

OIG recommends that the Bureau of Administration develop and implement a process to formally designate and issue warrants to transportation officers responsible for authorizing tenders of service at overseas posts, as recommended by the Federal Management Regulation. The process should outline the training and experience requirements for obtaining a transportation officer authorization and the conditions for maintaining the authorization. The process should also include a mechanism for tracking and managing the requirements for maintaining the warrant.

OIG recommends that the Bureau of Administration develop and implement a training program for personnel responsible for executing transportation-related acquisitions using tenders of service, as recommended by the Federal Management Regulation. The program should outline baseline and continuing education training requirements for General Services Officers and locally employed transportation staff.

(U) Rec. A.1: The DoD OIG recommended that the Commander of Navy Munitions Command Atlantic emphasize the importance of providing the highest levels of materiel accountability and asset visibility for munitions to all officials at Navy Munitions Command Atlantic Detachment Bahrain who are responsible for munitions at Naval Support Activity Bahrain.

(U) Rec. A.2.a: The DoD OIG recommended that the Commander of Navy Munitions Command Atlantic, in coordination with the Commanding Officer of Helicopter Mine Countermeasures Squadron 15 conduct a review of Helicopter Mine Countermeasures Squadron 15's inventory procedures and implement required corrective actions.

(U) Rec. A.2.b: The DoD OIG recommended that the Commander of Navy Munitions Command Atlantic, in coordination with the Commanding Officer of Helicopter Mine Countermeasures Squadron 15 Update the "Memorandum of Understanding in Case of Ammunition and Explosives Accountability" to include responsibilities for providing oversight of inventory procedures for Helicopter Mine Countermeasures Squadron 15.

(U) Rec. B.1: The DoD OIG recommended that the Commander of Navy Munitions Command Atlantic emphasize the importance of providing the highest levels of materiel accountability and asset visibility for munitions to all Navy Munitions Command Atlantic Detachment Bahrain officials responsible for munitions at [Redacted].

Rec. 2: The DoD OIG recommended that the Executive Director of the DoD Explosives Safety Board issue guidance for weapons safety managers to verify, at least quarterly, the net explosive weight totals in munitions storage structures located on installations within the U.S. Central Command area of responsibility.

We recommend that the Executive Assistant Commissioner of CBP’s Office of Field Operations develop and implement a plan to ensure effective oversight and monitoring by assessing the results of the monthly statute of limitations report reviews from the Fines, Penalties, and Forfeitures field offices.

We recommend that the Executive Assistant Commissioner of CBP’s Office of Field Operations implement a plan to ensure effective oversight and monitoring by increasing the frequency of oversight surveys of Fines, Penalties, and Forfeitures field offices. This includes establishing a plan to follow up with field offices with unsatisfactory survey results in a timely manner.

We recommend the TSA Administrator, in coordination with the Secretary and the Office of Management and Budget, work with Congress and the Department to resolve funding shortfalls or request Congress amend or repeal the requirements identified in our report for which TSA did not receive sufficient funding.

We recommend the TSA Administrator, in coordination with the Secretary and the Office of Management and Budget, work with Congress to amend or repeal the requirements identified in our report that TSA indicated it did not plan to implement.

We recommend the TSA Administrator report to Congress on the requirements identified in our report as not fully implemented based on insufficient evidence where TSA disagreed with our assessment.

Develop and implement a formal process to integrate the results of the STB's business impact analysis (BIA) with its enterprise risk management activities.

Update existing methods of resource allocation to account for system categorization.

Perform a cost benefit analysis of introducing automation to support a centralized view of cybersecurity risks, manage risk designations, maintain privileged accounts, and test system contingency plans; and apply the appropriate risk mitigation strategy.

Develop profiles of expected activities on its networks and systems.

Develop a formal process to collect, analyze, and respond to feedback on the performance of its secure configuration policies and procedures and security awareness and training program.

Develop qualitative and quantitative performance measures to evaluate the effectiveness of the following: Configuration management plan and change control activities; Data exfiltration and enhanced network defenses; Data breach response plan; Privacy awareness training program; Incident response capability; ISCM policies, strategy, and processes; Incident detection, analysis, handling, and response activities; Information system contingency plans. For all performance measures, ensure that supporting data is obtained accurately, consistently, and in a reproducible format.

Resume the assessment of the skills and knowledge of its workforce to tailor its awareness and specialized security training.

Obtain access to the appropriate subject matter experts or training to assist with the implementation of secure configuration settings for its information systems.

Implement the logging requirements outlined within OMB's M-21-31.

Correct the processing or payment errors in our sample that resulted in an overage or arrearage to the beneficiaries or incorrect updates to beneficiary records.

Create uniform guidance or policy, providing comprehensive instructions on how to properly process this cyclical workload, possibly using the different training guides already developed by the Social Security Administration.

Re-evaluate this workload with the Centers for Medicare & Medicaid Services (CMS) to determine whether the current process can be improved based on the changes in technology and CMS capabilities.

In coordination with the Strategic Acquisition Center, submit ratifications for any unauthorized commitments following the Federal Acquisition Regulation.

Establish internal controls to help ensure the healthcare system submits national contract requests for waiver and justifications prior to purchasing available product list items from nonmandatory procurement instruments.

In coordination with the Strategic Acquisition Center, submit a ratification for an unauthorized commitment following the Federal Acquisition Regulation.

Develop formalized processes for monitoring and achieving efficiency targets and using available pharmacy data to make business decisions.