Open Recommendations

We recommend the Director, Division of Information Technology [redacted].

We recommend the Director, Division of Information Technology, limit user access by following the least privilege access principle where appropriate to documents on the cloud service provider [redacted].

We recommend the Director, Division of Information Technology, in coordination with the Director, Division of Depositor and Consumer Protection,[redacted].

We recommend the Director, Division of Information Technology, in coordination with the Director, Division of Depositor and Consumer Protection,[redacted].

We recommend the Director, Division of Information Technology, identify and review the continued need for other [redacted] that provide similar capabilities to launch [redacted].

We recommend the Director, Division of Information Technology coordinate with the vendor to mitigate the impact of [redacted].

We recommend the Director, Division of Information Technology, coordinate with the vendor to fix the [redacted].

We recommend the Director, Division of Information Technology, coordinate with the vendor to re-examine the need to [redacted].

We recommend the Director, Division of Information Technology, coordinate with the vendor to [redacted].

Reassess the operational effectiveness of contract file management processes and controls, making improvements as applicable.

Develop a centralized location for COR contract files that is accessible to the Office of Procurement.

Establish a process to monitor COR certifications and confirm CORs are appropriately certified before they perform COR responsibilities for a contract.

Review agency guidance and update applicable policies to emphasize the requirement to handle, store, and dispose of contract files in accordance with the NARA General Records Schedule 1.1, Financial Management and Reporting.

Determine the extent to which the required contractor performance evaluations have not been completed and entered into CPARS and take steps to address noncompliance.

Develop controls to ensure required contractor performance evaluations are completed.

We recommend that the DNFSB finalize its project plan and procedures for developing and maintaining current and target CSF profiles.

We recommend that the DNFSB develop current and target CSF profiles.

We recommend that the DNFSB coordinate with its software producers to obtain Secure Software Development Attestation Forms. If the DNFSB is unable to obtain the attestation forms, it should request POA&Ms from the software producers, in accordance with OMB Memorandum M-23-16.

We recommend that the DNFSB submit POA&Ms and risk-based waiver requests to OMB for approval in accordance with OMB Memorandum M-23-16.

We recommend that the DNFSB document policies and procedures for developing and maintaining a comprehensive and accurate inventory of data and the corresponding metadata for the DNFSB’s data types.

We recommend that the DNFSB create and maintain a comprehensive inventory of data and corresponding metadata.

We recommend that the DNFSB prioritize and conduct an annual security control assessment and update the GSS’ System Security Plan, Security Assessment Report, Privacy Impact Assessment, and Information System Contingency Plan in accordance with the DNFSB Risk Management Framework Handbook.

The OIG recommends that the Executive Director for Operations establish policies, procedures, and a centralized information system to consistently manage, track, and monitor staff qualifications records.

The OIG recommends that the Executive Director for Operations update inspection manual chapters and office instruction(s) addressing qualification programs to include guidance about reminding staff of required refresher training.

The OIG recommends that the Executive Director for Operations implement a centralized, automated information system to ensure compliance with mandatory refresher training requirements.