Open Recommendations

(U) Rec. 1.a.1: The DoD OIG recommended that the National Information Assurance Partnership Director, in coordination with the National Security Agency Cybersecurity Director, revise the product evaluation process to require National Information Assurance Partnership officials to conduct a search of public records for any vulnerabilities disclosed after the Common Criteria Testing Laboratory's last vulnerability search and, if a new vulnerability is discovered, return the product to the Common Criteria Testing Laboratory for additional testing before certifying a product for inclusion on the Product Compliant List.

(U) Rec. 1.a.2: The DoD OIG recommended that the National Information Assurance Partnership Director, in coordination with the National Security Agency Cybersecurity Director, revise the product evaluation process to require National Information Assurance Partnership officials to conduct a review of statutes, executive orders, and other directives applicable to National Security System owners, including National Security Agency directives, to determine whether the product has been prohibited from use before certifying a product for inclusion on the Product Compliant List.

(U) Rec. 1.b: The DoD OIG recommended that the National Information Assurance Partnership Director, in coordination with the National Security Agency Cybersecurity Director revise the National Information Assurance Partnership Product Compliant List website to include, at a minimum: the core features for each product, the full name of the protection profiles for each product, a list of features of each product that have been tested and certified for use on National Security Systems, and a list of features of each product that have not been tested and not certified for use on National Security Systems.

(U) Rec. 1.c: The DoD OIG recommended that the National Information Assurance Partnership Director, in coordination with the National Security Agency Cybersecurity Director immediately remove Ivanti Policy Secure and Ivanti Connect Secure from the Product Compliant List.

(U) Rec. 1.d.2: The DoD OIG recommended that the National Information Assurance Partnership Director, in coordination with the National Security Agency Cybersecurity Director develop and implement policy and procedures to require National Information Assurance Partnership officials to disclose that a product has been suspended or removed, including the reason for the suspension or removal, on the Product Compliant List website.

We recommend MSAC document its procedures for completing award Federal Financial Reports, including how to calculate indirect costs.

We recommend MSAC establish controls to ensure its Federal financial reporting procedures are followed.

We recommend MSAC document and implement payroll reconciliation procedures that verify recorded payroll costs are accurate and supported (2 CFR 200.430(g)(1)(i)).

We recommend MSAC establish controls to ensure its payroll reconciliation procedures are followed.

We recommend MSAC establish document retention controls that ensure its policy is followed.

We recommend MSAC establish and implement Federal financial reporting controls that ensure honorifics are excluded from
all costs included in award financial reports (General Terms 13).

We recommend MSAC document and implement procedures that ensure prompt and accurate compliance with
Federal Financial Accountability and Transparency Act requirements (2 CFR 170, Appendix A).

We recommend MSAC establish controls that ensure its Federal Financial Accountability and Transparency Act procedures are followed.

We recommend MSAC establish and implement controls that ensure Federal and Arts Endowment subawarding notification (2 CFR 200.332(b), General Terms 1 & 22), cost allowability (General Terms 13 & 2 CFR 200 Subpart E), and acknowledgment requirements (General Terms 3) are included in its grant contract documents.

We recommend MSAC strengthen its controls over subaward closeout to ensure all subawards are closed
before submitting the Federal financial report (General Terms 23).

We recommend MSAC establish procedures to evaluate and monitor its compliance with Federal and Arts
Endowment award requirements (2 CFR 200.303(c)).

We recommend MSAC establish controls that ensure compliance evaluations are conducted and gaps are
addressed (2 CFR 200.303(a)).

We recommend the NEA disallow $674,750 in unsupported Federal financial report costs from the 2019 Award.

We recommend the NEA disallow $16,761 of unsupported payroll costs - $4,507 from the 2020 Award; $7,281 from the 2021 Award; and $4,973 from the 2022 Award.

We recommend the NEA disallow $105,000 in honorifics from reported costs- $10,000 from the 2019 Award, $20,000 from the 2020 Award, $15,000 from the 2021 Award, and $60,000 from the 2022 Award.

We recommend the NEA disallow $194,315 in questioned or unallowable subrecipient costs - $41,211 from the 2019 Award FFR; $42,348 from the 2020 Award FFR; $76,387 from the 2021 Award FFR; and $34,369 from the 2022 Award FFR.

We recommend the NEA disallow the $50,000 unallowable ARP cost from the 2020 Award.

We recommend the NEA determine whether a refund is due for costs questioned in recommendation NEA 5.

We recommend that CBP OCIO implement all necessary mobile device configuration settings in accordance with guidance from DHS and the Defense Information System Agency’s Security Technology Implementation Guides.

We recommend that CBP OCIO implement controls to address the identified custom-developed application vulnerabilities and create plans of action or waivers for identified weaknesses.