Open Recommendations

Recommendation 9: We recommended the Assistant Administrator for Protective Services, in coordination with the Ames Protective Services Office Chief and Ames Center Director: Within the next 3 years, conduct a Center-wide security vulnerability risk assessment, including the districts outside Ames Campus, to ensure compliance with federal and NASA requirements. 

Recommendation 10: We recommended the Assistant Administrator for Protective Services, in coordination with the Ames Protective Services Office Chief and Ames Center Director: Identify and implement mitigation strategies and resource requirements to address the security vulnerability assessment risks.

Review unprocessed felony referrals identified in this report, take corrective action as needed, and report the efforts taken to the OIG.

Update and publish VA directives and handbooks associated with the Homeland Security Presidential Directive 12 Program and VA’s personnel security and suitability program as required by VA’s enterprise directives management procedures.

Determine the allowability of the questioned transactions and recover $7,148,093, if applicable.

Develop a framework for directing DHS components to deploy staff to support missions, including non-centrally funded, unplanned, or emergency operations, for which DHS resources are needed.

Develop a volunteer deployment strategy that includes provisions for supporting volunteers, regardless of funding source.

Enforce requirements for components to obtain authority to operate, resolve critical and high-risk vulnerabilities, and apply sufficient resources to mitigate security weaknesses.

Revise DHS 4300A Policy, Handbook, and Ongoing Authorization methodology to incorporate applicable changes from NIST SpecialPublications, including SP 800-37, Revision 2, SP 800-53 Revision 5, and SP 800-137A to maintain consistency between the documents.

Develop PIAs for the five untracked PII systems identified: HC Dashboard, APEC ABTC, DC One Card ID, Pentagon Contractors ID Card, and TWIC®.

Identify the mechanism to document confidentiality impact levels and document the confidentiality impact levels for all GPO PII systems.

Implement a process to conduct BU PII inventories and share the results with the Privacy Officer.

Conduct biennial Privacy Compliance Reviews in accordance with GPO’s Privacy Program directive.

Review all stored records to identify and mark which records contain or may contain PII.

Update the PIRT Framework and Procedures to incorporate the guidance for incident response plans from NIST Special Publication 800-122 and include comprehensive guidance, such as: a) defining team member roles and responsibilitiesb) defining key termsc) developing communication templatesd) ensuring notification of the appropriate individuals and organizations by identifying points of contact, including external entities, and how to contact them.

Update the PIHG to incorporate the guidance for incident response plans from NIST Special Publication 800-122 including comprehensive guidance, such as: a) ensuring the proper notification of the appropriate individuals and organizations when evaluating and responding to a suspected PII breach, by identifying points of contact, including external entities, and how to contact themb) stating what information is to be provided to US-CERT and the reporting method, such as through a phone call, email, or a websitec) stating how to document that the information was reported to US-CERT.

Develop and/or identify the one definitive method to report suspected PII breach incidents.

Implement a central training method to ensure employees and contractors receive PII training before accessing GPO’s information system. This method should include reassigning the responsibility for annual training to a single BU, likely Information Technology, and assigning BUs with the responsibility for specialized PII training.

Update the Privacy Program directive to reflect changes resulting from these recommendations.

The Chief Information Officer update ITD’s current policy for accountable IT property, to include the incorporation of defined program personnel roles, requirements aligned with the property management lifecycle and all current program procedures.

The Chief Information Officer continue pursuit of transitioning to a single asset management system that addresses its program needs to track accountable and consumable IT property and establish a detailed implementation plan with target dates to transition to a single asset management system for accountable and consumable IT property as currently captured in Cireson and Jumpstock.

The AOC revise the Board of Survey Process with codified punitive actions to act as a deterrent against future instances of employee negligence and misconduct regarding the loss of AOC property, including both IT mobile devices and personal property.

Enact a formal procedure to review all VBA compensation awards not already reviewed by the OIG that were completed since January 1, 2020, with debts due to reduced disability levels, take corrective action as appropriate, and report the results to the OIG.

Develop a mechanism to review the effectiveness of the recommendations periodically and a process for determining what additional measures, if any, are needed.

Embassy Oslo should require the Embassy Employee Association board to conduct its oversight responsibilities in accordance with Department standards.