Open Recommendations

Ensure periodic reviews of generated audit logs are performed for each major informationsystem.

12. Ensure password configuration settings for all major information systems are in accordancewith NARA IT Security Requirements.

Ensure the use of shared/group accounts is restricted to only those users with a validbusiness justification, by enhancing user account review procedures to incorporate reviewsof shared/group account membership and reasonableness.

Ensure a process is developed, documented, and implemented to change passwordswhenever users within shared/group accounts change.

Ensure a comprehensive ICAM policy or strategy, which includes the establishment ofrelated Standard Operating Procedures (SOPs), identification of stakeholders,communicating relevant goals, task assignments and measure and reporting progress isdeveloped and implemented.

Implement requirements across all EL maturity tiers to ensure events are logged andtracked in accordance with OMB M-21-31.

OIG recommends that the Office of Crisis Management and Strategy update the Foreign Affairs Handbook to clarify that a Lessons Learned Cable must be produced following every large-scale event, emergency, or crisis, including evacuations that result in a post (1) remaining in ordered departure status for an extended period of time, (2) suspending operations, or (3) closing permanently.

OIG recommends that the Bureau of Diplomatic Security develop and implement a requirement in the Foreign Affairs Manual to produce an After Action Review following every evacuation that results in a suspension of post operations.

OIG recommends that, following the implementation of Recommendations 1 and 2, the Under Secretary for Management, working in conjunction with the Executive Secretariat, develop and implement a process to (1) systematically review After Action Reviews developed in response to post evacuations and Lessons Learned Cables generated in compliance with 12 Foreign Affairs Handbook-1 H-235 and (2) make recommendations for action based on the results of these reviews, including identifying needed changes to Department policies, procedures, and guidance.

Developing a comprehensive risk-based critical spare parts program to include identifying the critical spare parts in inventory, establishing sparing levels and reorder points for those critical spare parts, and staging the critical spare parts at strateg

We recommend that the Assistant Secretary for the Office of Elementary and Secondary Education require the Iowa Department of Education (Iowa) to require Linn-Mar to determine whether the $228,510 that Linn-Mar charged to the ESSER grant without using a competitive procurement process or obtaining price or rate quotations from an adequate number of vendors was reasonable when compared to the costs of suitable alternatives, and if not, require appropriate corrective actions.

We recommend that the Assistant Secretary for the Office of Elementary and Secondary Education require the Iowa Department of Education (Iowa) to require Linn-Mar to ensure that LEA officials responsible for making and documenting purchasing decisions receive sufficient training on Federal procurement requirements, including those covered under 2 C.F.R. sections 200.318(i) and 200.320 (methods of procurement to be followed).

CMS should take steps to confirm that all States cover required services from maternal health providers for Medicaid managed care enrollees.

CMS should clarify the requirement that States have a provider-specific OB/GYN network adequacy standard.

CMS should support States in tailoring their network adequacy standards to better address maternal health care needs.

We recommend the Office of Homeland Security Situational Awareness Director and the Intelligence and Analysis Under Secretary, with the support of the DHS Chief Information Officer, establish a recurring process to coordinate internally and with external partners to identify needed Homeland Security Information Network functionality improvements and provide the DHS Chief Information Officer with Homeland Security Information Network improvement recommendations.

We recommend the DHS Chief Information Officer create and implement a plan for outreach with external partners to increase awareness of Homeland Security Information Network capabilities, such as trainings and updates, and available resources, including stakeholder engagement specialists, to fusion centers.

We recommend the DHS Chief Information Officer conduct a cost benefit analysis to evaluate partners’ Homeland Security Information Network use versus cost to modernize and determine if modernization is the best solution for Homeland Security Information Network based on fiscal responsibility, mission objectives, and user feedback.

Install area of refuge signage in accordance with NFPA 101 standards and remove any signage showing incorrect or outdated emergency information.

Assess the force required to open fire doors leading to areas of refuge under a range of conditions, and as practicable, adjust fire door opening force to the minimum allowable level.

Develop and implement more frequent limited-scope drills, emphasizing roles and responsibilities for personnel needing or rendering emergency evacuation assistance.

Establish processes to ensure that the company decides on and implements a program's management structure early enough to provide strong, continuous oversight for the entire life of a program.

Establish processes to ensure that program teams have sufficient staff before the company transitions a program from the Strategy and Planning department to the Capital Delivery department.

Ensure timely steps are taken to approve and implement a modernization strategy which covers SSA modernization efforts and comprehensively addresses legacy system risks for the upcoming years.

Ensure timely steps are taken to develop Enterprise Architecture planning documents that directly align with strategic objectives and performance goals noted in the Agency's strategic and Annual Performance Plans.

Review the Information Resource Management Strategic Plan annually and ensure it supports the goals of the Agency Strategic Plan, as required by the Government Performance and Results Modernization Act of 2010, OMB Circular A-130, the Paperwork Reduction Act of 1995, and the Clinger-Cohen Act of 1996.

Ensure legacy system modernization plans include a detailed description of the work needed for modernization, considerations for the disposition of the system, and tracking cost data that covers all aspects of the project.

Regularly perform risk assessments for legacy systems, as required by OMB Circular A-130, Section 5(a)(1)(b)(i) and (c)(ii). Performing assessments regularly will help management identify information systems and components that cannot be appropriately protected or secured. This will ensure that such systems that may be costly or difficult to maintain, are given high priority for upgrade, replacement, or retirement.

Continue to refine the Agency’s inventory of business applications to ensure data elements specifically related to changes, such as retiring or replacing applications, resulting from modernization efforts are tracked/flagged appropriately.

Implement cost monitoring mechanisms to help with the tracking and management costs related to modernization. Additionally, management should conduct cost analyses for modernization projects, considering cost from a risk perspective.

Regularly perform post-implementation reviews on all information technology investments.

The Chief Information Officer should timely remediate or mitigate all vulnerabilities in accordance with IRS policies.

The Chief Information Officer should ensure that systems are in place to reconcile the temporary and unknown repositories to verify that assets are assigned to an established group.

The Chief Information Officer should ensure that systems are in place to reconcile duplicate accounting of assets in the repository.

The Chief Information Officer should evaluate the temporary and unknown repositories to establish ownership of assets.

The Chief Information Officer should resolve configuration compliance settings in accordance with Federal and IRS policies.

The VA Tuscaloosa Healthcare System Director strengthens processes to ensure that providers provide patient education about applicable boxed warnings when prescribing psychiatric medication, and monitors compliance.

The VA Tuscaloosa Healthcare System Director ensures mental health staff conduct suicide risk screenings and assessments as required by the Veterans Health Administration, and monitors compliance.

The VA Tuscaloosa Healthcare System Director strengthens processes to ensure adequate lethal means assessment and lethal means safety counseling with patients.

The VA Tuscaloosa Healthcare System Director conducts a review of the supervisory oversight of the social worker and other clinicians in the posttraumatic stress disorder clinic to ensure the identification and follow-up of clinical concerns for patients with complex mental health needs.

The VA Augusta Health Care System Director develops and implements processes to incorporate veteran input for process improvements.

The VA Augusta Health Care System Chief of Mental Health ensures a minimum of four hours of recovery-oriented, interdisciplinary programming on weekends on the inpatient mental health unit.

The VA Augusta Health Care System Director ensures alignment between involuntary commitment policies and practices, consistency with state laws, and implementation of monitoring processes.

The VA Augusta Health Care System Director ensures that medications listed in discharge instructions include the purpose for each medication and are written in easy-to-understand language.

The VA Augusta Health Care System Director ensures staff comply with lethal means safety training and suicide risk training requirements and monitors for compliance.

Ensure that FCI Lewisburg Executive Leadership and the Central Office's Human Resources Management Division discuss the staffing projection tool methodology and how it compares with FCI Lewisburg Executive Leadership's understanding of its current and potential future mission needs to ensure greater alignment between stakeholder staffing projections.

Ensure that the Health Services Division (Central and/or Regional Office) reviews medication discontinuation practices at FCI Lewisburg and other holdover facilities, including the discontinuation of antidepressants without a clinical encounter, to determine whether such practices are consistent with BOP clinical guidance. If the Health Services Division determines that such practices are inconsistent with BOP clinical guidance, it should work collaboratively with FCI Lewisburg clinicians to identify practical solutions to increase the frequency with which clinicians conduct a clinical encounter with holdover inmates in advance of such decisions so that clinicians can collect complete information about an inmate's condition and the…

Ensure FCI Lewisburg's compliance with existing Central Office guidance for certain employees to carry a cut-down tool when on duty.

Establish written policies and procedures for the Special Agent Hiring panel to include defined roles and responsibilities for individuals serving on the panel and overseeing the panel.

Review its rehire policies and procedures to ensure that the DEA has clear and consistent practices when rehiring former employees for its four core series positions.