Open Recommendations

Ensure the agency follows the policy to perform security control assessments annually, either on a rolling 365-day basis or aligned with the fiscal year ending on September 30.

Update the SBA Standard Operating Procedure (SOP) 20 21 4, The Small Business Administration Acquisition and Procurement Program, January 16, 2025, Appendix C — Cybersecurity and Supply Chain Risk for IT Acquisitions, to reflect the new process in which third-party supply chain risks will be continuously monitored through the Office of the Chief Information Officer.

Implement policies, procedures, and processes for developing and maintaining an accurate inventory of data and its corresponding metadata from third parties.

Improve the governance, risk, and compliance systems to track cybersecurity risks.

Develop and implement a process to monitor program offices’ completion of required annual reviews of interconnection security agreements and ensure program officials review and sign the agreements prior to their expiration.

Improve the existing process to manage personal identity verification exemptions.

Ensure that system owners perform annual privileged user access reviews in accordance with SBA policies.

Provide system owners and individuals with training or other communication emphasizing requirements for approving privileged user access prior to granting access.

Ensure program offices review all system security plans and confirm they are updated, approved, and signed annually by the system owner, information systems security officer, and the information systems security manager.

Document procedures, roles, and responsibilities for performing an annual functional test to ensure that the alternative backup site keeps the system operational in accordance with SBA policy and procedures.

Annually perform functional testing to include failover testing in accordance with SBA policy and procedures.

Establish procedures to monitor program officials’ compliance with SOP 90 47 6, Cybersecurity and Privacy Policy, requirements to ensure information system contingency plans are developed, tested annually, and updated as needed.

Review and update the information system contingency plans and business impact assessments and ensure that key attributes are included.

Update the information system contingency plans and business impact assessments at least once a year and include the recovery priority and lessons learned.

Conduct the information system contingency plans to include a business impact assessment at least annually.

We recommend the Senior Director, Labor and Employee Relations, develop measures to evaluate the impact of completed actions on the probability of occurrence and financial impact.

We recommend the Senior Director, Labor and Employee Relations, take steps to ensure risk information in the ERM system of record is accurate.

The Chief Information Officer should implement a process to review vendor usage reports for overseas mobile device activity. Further, take appropriate actions to sanitize the devices transported overseas in accordance with existing IRS procedures.

The Chief Information Officer should update Form 1321 to include the name and other identifiable features of mobile devices being taken outside the country.

We recommend that USAID verify that Moi Teaching and Referral Hospital in Kenya corrects the two instances of material noncompliance detailed on pages 36 to 39 of the audit report.

Work with ARC to resolve the questioned costs of $13,480 for non-ARC match cost share.

Establish a process to reconcile actual expenditures to the reported expenditures to ensure accurate reporting in accordance with the Uniform Guidance and exclude unsupported costs from the amounts reported.

Work with ARC to resolve the questioned cost totaling $13,618 of non-ARC matching cost share.

Establish policies and procedures to ensure timely preparation and submission of financial and progress reports in accordance with the Uniform Guidance and ARC grant agreement requirements.

The open recommendation relates to enhancing the Board's online threat monitoring capabilities.