Open Recommendations

Implement a continuous monitoring governance, risk, and compliance tool that enables the integration of cybersecurity risk management into the enterprise risk management reporting tool. Capture lessons learned to make any necessary adjustments to the process.

Implement a process to detect and prevent the use of untrusted removable media on the EAC’s network.

Fully document and implement a process that includes a clear business reason for risk acceptance in the event that untrusted removable media must be introduced on the EAC’s network.

Develop compensating controls to reduce the risk that vulnerabilities can be exploited that are caused by the use of untrusted removable media on the EAC’s network.

Schedule and complete annual contingency planning tests. Retain supporting documentation to demonstrate compliance during audits.

Develop a plan to ensure manual journal vouchers are justified, documented, and approved before they are entered into the Financial Management System and that they are reviewed after posting to verify accuracy and support compliance, transparency, and audit readiness.

Require ongoing training for all staff who prepare, review, or approve manual journal vouchers, including a process to ensure that new employees complete initial training and that refresher courses are provided when policies or tools are updated.

Clarify expectations for using macro-enabled journal voucher tools by defining when the standardized macro must be used; establishing a process to communicate macro tool updates and prompt the adoption of newly released versions; and providing guidance, training, and user support to promote correct and consistent application of the tools.

Define and communicate clear oversight responsibilities for Veterans Integrated Service Network financial managers by requiring routine monitoring of documentation and compliance at facilities.

Design and implement Cyber Governance policies, procedures, and processes that address National Institute of Standards and Technology Special Publication 800-53, Rev. 5.1, Rel. 5.1.1 control requirements and OMB Circular A-130.

Design and implement risk management and general support system policies, procedures, and processes that address National Institute of Standards and Technology Special Publication 800-53, Rev. 5.1, Rel. 5.1.1 control requirements and standard industry practices from the National Institute of Standards and Technology Special Publications 800-39 and 800-18. This includes developing and implementing a system security plan for the Postal Regulatory Commission's general support system.

(U) Rec. 1: The DoD OIG recommended that the Assistant Director for the Office of Strategy, Plans, and Policy, Defense Security Cooperation Agency, review and update the Security Assistance Management Manual to incorporate efficiencies identified while supporting a contingency environment in Ukraine that could improve the overall Foreign Military Sales process, including unique circumstances or exceptions to requirements needed during contingency operations.

Ensure privileged user access reviews for the [redacted] system are performed in accordance with FDIC policy.

Define the accounts, permissions, and roles that are considered privileged within [redacted].

Ensure privileged user access reviews for [redacted] are performed in accordance with FDIC policy.

Ensure a complete and accurate user listing is utilized for the [redacted] user access review as required by FDIC policy.

The Chief Information Officer ensures that the actions shared with the agency in the detailed technical report are taken to properly configure and fully utilize anti-phishing protections.

The Chief Information Officer ensures that the actions shared with the agency in the detailed technical report are taken to properly configure and fully utilize anti-phishing protections.

The Chief Information Officer implements continuous improvement and emphasize a “Zero Click” mindset throughout the organization to reduce the threat from phishing campaigns.

Work with states to strengthen waiver approval processes to prevent the improper waiving of UI overpayment recoveries when federal dollars are at stake.

Work with the Office of the Chief Financial Officer (OCFO) to develop and implement a specific process designed to detect when states have improperly waived UI overpayment recoveries, providing time for states to course correct and minimize the risk of financial loss.

Work with Michigan to ensure proper post-investigative actions are taken for the five confirmed fraud cases identified in this report.

Remedy the $240,926,764 in questioned costs.

Work with state workforce agencies to ensure they retroactively submit accurate and complete information related to overpayment recovery waiver amounts for FPUC, PUA, and PEUC, for all pandemic-related reporting periods.

Strengthen controls in the Office of the Assistant Director to ensure inclusion of staffing monitoring contract requirements, in coordination with the contracting officer, to meet gradual staffing level goals during start-up periods in future community-based outpatient clinic contracts.