Open Recommendations

We recommend that USAID/Rwanda verify that Never Again Rwanda corrects the one instance of material noncompliance detailed on page 19 of the audit report.

Housing should refine access controls within the FHA Catalyst modules that are dynamic, are tailored to user actions, and require continuous reauthentication to ensure that users have access only to information needed.

Housing should coordinate with HUD's SOC to
a. Ensure that FHA Catalyst user behavior monitoring logs are regularly captured and adequately reviewed for discrepancies in user activities.
b. Establish program office responsibility for the log review process.
?

Develop a supply chain risk management strategy that includes (a) a supply chain risk appetite and tolerance, (b) an enterprise supply chain risk management governance structure, and (c) supply chain risk assessment processes that include migration strategies or controls.

Document and implement a baseline review and escalation process for data loss prevention alerts.

Reinforce the requirements for identifying and documenting system interconnections as part of the Board’s training on its cyber risk management application and require all relevant individuals to take the training.

Evaluate and implement options to enforce the agency’s existing guidance related to identifying and documenting system interconnections.

Develop and implement a mobile application scanning program that includes a vulnerability scanning solution and process to identify and remediate vulnerabilities.

Ensure that the Board’s Incident Notification and Breach Response Plan is reviewed, tested and approved annually.

Develop and implement a role-based privacy training program.

Incorporate targeted phishing exercises into the Board’s security awareness and training program and processes.

Update the Board’s standard contract language in cloud service provider contracts to ensure that it is consistent with Federal Risk and Authorization Management Program’s Incident Communications Procedures incident reporting requirements.

Complete finalization of an agencywide data classification policy that accounts for the sensitivity of the data maintained by the CFPB.

Ensure that data classification and sensitivity labels are incorporated into the CFPB’s data loss prevention program.

Strengthen flaw remediation processes by developing and implementing a process to clearly map identified vulnerabilities to system IP addresses, host names, and remediation owners within the CFPB’s configuration management database.

Ensure that testing of mission-essential functions identified in the CFPB’s continuity of operations plan is periodically performed.

Implement a process that ensures the cyber risk information in the CFPB’s governance, risk, and compliance tool is accurate and maintained.

See the full report for details of the recommendation.

See the full report for details of the recommendation.

See the full report for details of the recommendation.

See the full report for details of the recommendation.

Ensure the responsible office updates 3099-001 to include the required anti-gag provision within the policy.

Agricultural Marketing Service needs to update its NDA form(s) to include the required anti-gag provision.

Agricultural Research Service needs to update its NDA policy to include the required anti-gag provision.

Economic Research Service needs to update its NDA policy to include the required anti-gag provision.