Open Recommendations

FHFA's Chief Information Officer should update the PIA to describe how external users access the system, including the security and privacy controls for securing non-public information, in coordination with the Senior Agency Official for Privacy.

FHFA's Chief Information Officer should designate a responsible system owner for the CCTV website to ensure it is actively maintained, in coordination with the appropriate FHFA office.

FHFA's Chief Information Officer should immediately remove public internet access to the CCTV website or restrict access through network-based controls such as virtual private network or internet protocol allow listing, ensuring it is only accessible by authorized internal users.

FHFA's Chief Information Officer should update FHFA’s public-facing system inventory to include all externally accessible websites and services and establish procedures to validate inventory accuracy on a recurring basis.

FHFA's Chief Information Officer should apply system hardening measures to the CCTV website by (a) disabling or restricting non-essential ports and services, (b) limiting access to only necessary functionalities, and (c) removing or protecting exposed API from unauthorized use.

FHFA's Chief Information Officer should enforce authentication and access control by (a) implementing account lockout after a defined number of failed login attempts, (b) enabling logging and alerting for authentication events, and (c) requiring multifactor authentication for administrative or remote access, if supported.

FHFA's Chief Information Officer should remediate vulnerabilities by (a) applying all available software and firmware updates to the CCTV platform, (b) replacing or renewing expired website security certificates, and (c) conducting a secure code review to identify and remove hardcoded credentials or unsecure configurations.

We recommend the Director, Division of Information Technology [redacted].

We recommend the Director, Division of Information Technology, limit user access by following the least privilege access principle where appropriate to documents on the cloud service provider [redacted].

We recommend the Director, Division of Information Technology, in coordination with the Director, Division of Depositor and Consumer Protection,[redacted].

We recommend the Director, Division of Information Technology, in coordination with the Director, Division of Depositor and Consumer Protection,[redacted].

We recommend the Director, Division of Information Technology, identify and review the continued need for other [redacted] that provide similar capabilities to launch [redacted].

We recommend the Director, Division of Information Technology coordinate with the vendor to mitigate the impact of [redacted].

We recommend the Director, Division of Information Technology, coordinate with the vendor to fix the [redacted].

We recommend the Director, Division of Information Technology, coordinate with the vendor to re-examine the need to [redacted].

We recommend the Director, Division of Information Technology, coordinate with the vendor to [redacted].

Rec. 1.a: The DoD OIG recommended that the Under Secretary of Defense for Research and Engineering establish the Defense Quantum Information Science and Technology Research and Development Program by issuing an official policy directive that establishes the roles and responsibilities of the Under Secretary of Defense for Research and Engineering, Director of Quantum Science, and Deputy Director of Quantum Science for planning, managing, and coordinating the Defense Quantum Information Science and Technology Research and Development Program.

Rec. 1.b: The DoD OIG recommended that the Under Secretary of Defense for Research and Engineering establish the Defense Quantum Information Science and Technology Research and Development Program by issuing an official policy directive that Develops a coordinated plan to meet near-, mid-, and long-term challenges and technical goals, as required by section 234 of the FY 2019 National Defense Authorization Act, including definitive milestones and standards for measuring progress, that the Office of the Under Secretary of Defense for Research and Engineering can use to manage quantum information science and technology research and development across the DoD.

Rec. 1.c: The DoD OIG recommended that the Under Secretary of Defense for Research and Engineering establish the Defense Quantum Information Science and Technology Research and Development Program by issuing an official policy directive that establishes and implements reporting requirements for the quantum information science research centers of the Military Departments and other relevant stakeholders to inform the Office of the Under Secretary of Defense for Research and Engineering of progress toward accomplishing prescribed long-term goals and technical challenges using established milestones and standards.

Rec. 1.d: The DoD OIG recommended that the Under Secretary of Defense for Research and Engineering establish the Defense Quantum Information Science and Technology Research and Development Program by issuing an official policy directive that implements records management processes to collect, synthesize, and disseminate critical information on quantum information science research and development in the DoD and support interagency cooperation and collaboration with relevant stakeholders, as defined by the program's purpose in Section 234.

Reassess the operational effectiveness of contract file management processes and controls, making improvements as applicable.

Develop a centralized location for COR contract files that is accessible to the Office of Procurement.

Establish a process to monitor COR certifications and confirm CORs are appropriately certified before they perform COR responsibilities for a contract.

Review agency guidance and update applicable policies to emphasize the requirement to handle, store, and dispose of contract files in accordance with the NARA General Records Schedule 1.1, Financial Management and Reporting.

Determine the extent to which the required contractor performance evaluations have not been completed and entered into CPARS and take steps to address noncompliance.