Open Recommendations

We recommend that the audit follow-up official provide the OIG with corrective actions for the 10 open recommendations identified in this finding.

We recommend that Federal Employee Insurance Operations communicate any new or updated MOUs to the appropriate stakeholders.

We recommend that IOC and ARC develop and implement the necessary internal controls to ensure that all recommendations are resolved within a maximum of 6 months after issuance of a final report and that completed final action on each management decision occurs within 12 months after the date of the Inspector General's report.

We recommend that ARC work with the Office of the Chief Financial Officer to develop a process to verify that questioned funds identified in final reports and agreed to be returned to the FEHBP are fully returned to the FEHBP.

The Chief, FMSS, should ***************************************************************************************************************************************************************************.

The Chief, FMSS, ****** ****** **** *** ** ********* ** ******* ******** ** *** *** ******** ******** *** ***** ** ******** **** **********

Complete efforts to document and implement an enterprise-wide risk management strategy that incorporates the review and approval processes set forth in agency policy.

[REDACTED]

Develop and implement a mechanism to enforce recurring privileged user training for applicable personnel.

Incorporate assessments of system recovery time objectives into future disaster recovery exercises.

We recommend that the Puerto Rico Health Department (the Health Department) update its policies and procedures to conform to Federal procurement standards—including policies and procedures related to contracts for leases, goods, and nonprofessional services—and to address the role of the Oversight Lead and the certification process.

We recommend that the Puerto Rico Department of Health (the Health Department) provide training to staff on policies and procedures.

OCIO to develop and implement a plan to remediate all identified critical, high, and medium vulnerabilities identified on OCIO devices providing services to Federal Highway information technology infrastructure within organization defined time periods required by DOT's Security Weakness Management Guide.

OCIO to work with DOT's Operating Administrations and components to ensure least privilege and boundary protection controls are in place to restrict the logical access to only users authenticated to the IT systems and services for which they are authorized.

OCIO to enforce DOT security policy for removal of default credentials and harden the device configurations for all identified compromised devices and devices that could be similarly compromised, including IT shared services/common operating environment network printers per the Departmental Cybersecurity Compendium security requirements to ensure data security.

OCIO to establish a cybersecurity process to comply with NIST Special Publication 800-115, Technical Guide to Information Security Testing and Assessment and the Department Cybersecurity Incident Response Plan requirements to effectively communicate and coordinate with OIG any planned significant changes that could impact an OIG security assessment and penetration testing audit before the audit begins and when taking action to implement said changes, to ensure coordination as per the Rules of Engagement requirements and to prevent interruption of OIG penetration testing activities.

OCIO to establish a cybersecurity process to enforce the Department Cybersecurity Incident Response Plan requirements for departmental officials impacted by an incident to review audit logs and follow containment procedures to adequately support after-the-fact investigations of potential security incidents.

OCIO to enforce DOT policy for audit log retention for the proper timeframe of 12 months.

FHWA to enforce DOT security policy for removal of default credentials and harden the device configurations for all identified compromised devices and devices that could be similarly compromised, including FHWA network printers per the Departmental Cybersecurity Compendium security requirements to ensure data security.

FHWA to conduct incident response exercises with appropriate personnel that test the retrieval of security audit logs in the event of an incident.

We recommend the Assistant Secretary for Employment and Training capture lessons learned from the pandemic and use the information to develop performance standards for prompt payment of UI benefits under temporary UI programs.

We recommend the Assistant Secretary for Employment and Training establish policy that requires officials to issue guidance timely for ETA regional offices to monitor and measure the effectiveness of states' use of staffing to support the implementation of temporary UI programs.

We recommend the Assistant Secretary for Employment and Training establish policy that requires states to develop corrective action plans to address staffing related concerns negatively impacting permanent and temporary UI programs, as identified by regional offices during monitoring reviews.

We recommend the Assistant Secretary for Employment and Training establish policy that requires ETA officials to develop a business case analysis and supporting justification before suspending UI program integrity functions for states to manage workload surges during emergency events.

Ensure that the DEA enforces its policy requirement for Special Agents and Task Force Officers to timely complete the DEA-177 Consensual Encounter Form for each consensual encounter, and ensure that required data is being entered.

Ensure that the DEA fully implements appropriate transportation interdiction training that meets the purpose and intent of the OIG's prior recommendations, incorporates DOJ guidance, and addresses the concerns identified in the DEA Office of Training's report that led the DEA to suspend its Jetway training in April 2023.a. Once implemented, ensure that the DEA enforces its policy requirement for Special Agents and Task Force Officers participating in drug interdiction units at mass transportation facilities to complete transportation interdiction training.b. Assess whether the DEA should provide additional training to DEA Special Agents and Task Force Officers who previously received Jetway training.

Assess whether the DEA's repeated payment of a percentage of cash forfeitures to transportation company employees, based on tips leading to seizures, over a period of years, is consistent with the Limited Use Confidential Source category and appropriate under Department of Justice policy.

Assess whether the DEA, in connection with its interdiction efforts at mass transportation facilities, should permit, outside the context of a predicated investigation, cash rewards to private company employees for regularly providing, over an extended period, potentially private consumer data without their employer's knowledge and without any legal process.

Consider whether to direct the Department of Justice law enforcement components to expand their body-worn camera policies to require the use of body-worn cameras during pre-planned consensual encounters with travelers at mass transportation facilities.

Prohibit participation in transportation interdiction activities at mass transportation facilities by DEA Special Agents and Task Force Officers who have not received appropriate training.

Update the policy on "Consensual Encounters Conducted at Mass Transportation Facilities" in the DEA Agents Manual to provide additional consensual encounter guidance regarding transportation interdiction activities.

Provide additional training or guidance on the DEA-177 Consensual Encounter Form to ensure that DEA Special Agents and Task Force Officers understand the importance of the form and how to complete it accurately. Update fields or instructions on the form, if needed.

Determine whether transportation interdiction activities and the use of confidential sources for this purpose are an effective use of law enforcement resources, and assess whether the benefits of these actions outweigh the potential legal risks.

We recommend that the Office for Civil Rights expand the scope of its HIPAA audits to assess compliance with physical and technical safeguards from the Security Rule.

We recommend that the Office for Civil Rights document and implement standards and guidance for ensuring that deficiencies identified during the HIPAA audits are corrected in a timely manner.

We recommend that the Office for Civil Rights define and document criteria for determining whether a compliance issue identified during a HIPAA audit should result in OCR initiating a compliance review.

We recommend that the Office for Civil Rights define metrics for monitoring the effectiveness of OCR's HIPAA audits at improving audited entities' protections over ePHI and periodically review whether these metrics should be refined.

We recommend that USAID/Rwanda verify that Society of Women Against AIDS in Africa corrects the two instances of material noncompliance detailed on pages 5 and 9 of the management letter.

USAID/Pakistan determine the allowability of $4.478 million aggregate payments to suppliers and contractors during the audited period as detailed in finding Nos. 4.1.1 and 4.1.2 on pages 19 to 20 of the audit report.

Rec. 1.b: The DoD OIG recommended that the U.S. Naval Forces Africa Commander complete a comprehensive air quality assessment, such as an U.S. Environmental Protection Agency-style or comparable air quality assessment, that provides adequate information to fully characterize the air quality pollution sources and related health risks for Camp Lemonnier, Djibouti deployers.

Rec. 1: The DoD OIG recommended that the Under Secretary of Defense for Acquisition and Sustainment direct the Chief Housing Officer to develop a plan of action and milestones to correct the specific implementation deficiencies in the Fiscal Year 2020, Fiscal Year 2021, and Fiscal Year 2023 National Defense Authorization Acts discussed in this report including current implementation status, a gap analysis of the remaining military housing oversight requirements, and description of the correlation between Department of Defense actions and the language within the National Defense Authorization Acts requirements.

Rec. 2: The DoD OIG recommended that the Under Secretary of Defense for Acquisition and Sustainment update the appropriate Department of Defense 4165 series policies to address policy changes related to the reform requirements in the Fiscal Year 2020, Fiscal Year 2021, Fiscal Year 2023, and Fiscal Year 2024 National Defense Authorization Acts, and incorporate and codify the requirements from outdated memorandums, such as the Under Secretary of Defense, Acquisition, Technology and Logistics Memorandums issued on September 10, 2013, April 16, 2014, and April 29, 2014.

Rec. 3: The DoD OIG recommended that the Chief Housing Officer direct the Deputy Assistant Secretary of Defense (Housing), in coordination with the Military Departments, to perform an assessment and document the feasibility of extending the implementation of military housing oversight requirements in the Fiscal Year 2020, Fiscal Year 2021, and Fiscal Year 2023 National Defense Authorization Acts to government-owned and government-controlled unaccompanied housing where those requirements were not included in the Fiscal Year 2024 National Defense Authorization Act.

Rec. 4: The DoD OIG recommended that the Chief Housing Officer direct the Deputy Assistant Secretary of Defense (Housing), in coordination with the Military Departments and the Department of Defense Comptroller, to develop a plan of action and milestones to correct deficiencies in the condition of Department of Defense government-owned and government-controlled unaccompanied housing, including a comprehensive assessment of the condition of Department of Defense government-owned and government-controlled unaccompanied housing and identification of resources necessary to correct deficiencies in the condition of Department of Defense government-owned and government-controlled unaccompanied housing.

Rec. 5: The DoD OIG recommended that the Chief Housing Officer direct the Deputy Assistant Secretary of Defense (Housing), in coordination with the Military Departments and the Department of Defense Comptroller, to perform an assessment and document the feasibility of alternatives for the future management of funding for government-owned and government-controlled unaccompanied housing, such as the expansion of unaccompanied housing privatization, separate appropriations, and funding targets with accountability standards.

Determine the allowability of the questioned transactions and recover $338,801, if applicable.

Recommendation not publicly available.

Recommendation not publicly available.

Recommendation not publicly available.

Recommendation not publicly available.