Open Recommendations

4. We recommend that the NOAA Administrator direct the Office of Space Commerce Director to define and document OSC's approach for STM-related responsibilities in the near and long terms to address current and future operational risks and include items such as guidelines, safety standards, behavioral norms, and conjunction prevention protocols.

5. We recommend that the NOAA Administrator direct the Office of Space Commerce Director to develop and regularly update a plan to implement OSC's approach to fulfiling the Department's STM-related responsibilities set in SPD-3.

We recommend the FEMA Administrator, in coordination with DHS and OMB, take action to issue final regulations implementing the State-Administered Direct Housing Grant Program authorized by Section 1211(a) of the Disaster Recovery Reform Act of 2018.

We recommend the FEMA Administrator provide quarterly briefings, consistent with House Report 117-87, to congressional Appropriations Committees on the status of the component’s DRRA implementation efforts, including the State-Administered Direct Housing Grant Program.

We recommend the FEMA Administrator continue to evaluate challenges associated with implementing the State-Administered Direct Housing Grant Program, and then develop and implement new authorities or program changes to address those challenges.

Develop and implement a post-award oversight policy that includes requirements to document site visits and develop a central repository for site visit reports, and controls to ensure these requirements, and existing requirements to update risk registers and assign risk response dates, are met.

The Sheridan VA Medical Center Director ensures that psychiatry or medical officer of the day staff reassess suicidal patients prior to changing a one-to-one observation status order.

As DOJ policy does not address what information Department personnel may include in a statement that is determined to be necessary to reassure the public that the appropriate law enforcement agency is investigating a matter or to protect public safety, we recommend that the Department revise this policy to require that the information contained in a statement released pursuant to JM 1-7.400(C) be reasonably necessary either to reassure the public that the appropriate law enforcement agency is investigating a matter or to protect public safety.

We recommend that the Department make clear whether the Justice Manual's Confidentiality and Media Contacts Policy, Justice Manual 1-7.000, applies to the Attorney General.

We recommend that the Department clarify its policies to address whether any of the provisions of 28 C.F.R. 50.2 remain Department policy in light of the existence of the Confidentiality and Media Contacts Policy contained in the Justice Manual.

If 28 C.F.R. 50.2(b)(9) remains valid Department policy, we recommend that the Department require that requests to the Attorney General or Deputy Attorney General for approval to release information otherwise prohibited from disclosure and any approval to release such information pursuant to 50.2(b)(9) be documented.

We recommend that the Department consider revising its White House communications policy to clarify what information can be disclosed to the White House in situations where the policy permits communication about a contemplated or pending civil or criminal investigation.

USDA OIG has determined that this recommendation contains sensitive information and will not be publicly released due to privacy concerns.

USDA OIG has determined that this recommendation contains sensitive information and will not be publicly released due to privacy concerns.

We recommend Departmental Administration Information Technology Office management enforce multi-factor authentication, or the equivalent thereof, to the application.

We recommend Departmental Administration Information Technology Office management configure the system to generate user listings with the required data elements (e.g., first name, last name, account creation date, and roles or privileges) to support its system of internal controls and operational needs.

We recommend Cybersecurity and Privacy Operations Center management update existing policies and procedures to include repercussions when an individual does not complete their required role-based security training in the designed 45-day time frame.

We recommend the Chief Information Officer perform a cybersecurity resource assessment to identify any technology, people, or tool gaps.

The Phoenix VA Health Care System Director ensures Phoenix VA Health Care System policy is in alignment with Veterans Health Administration Directive 1101.14, Emergency Medicine.

The Phoenix VA Health Care System Director makes certain that investigation and closure of events placed into the Joint Patient Safety Reporting system are completed per the Veterans Health Administrations established time frame, and monitors compliance.

Ensure that a process is in place to validate that all audit trail data elements, including investigative elements provided by TIGTA Office of Investigations, are being captured and can be provided by Login.gov prior to using its identity proofing services for IRS IAL2 applications.

The Chief Information Officer should ensure that appropriate IRS management works in conjunction with Login.gov management to assess the extent and impact that the critical vulnerability had on the users who authenticated via Login.gov to access IRS applications and may have had their Personally Identifiable Information sent to unauthorized locations outside of the United States.

The Hampton VA Medical Center Director conducts focused clinical care reviews in accordance with Veterans Health Administration requirements, and monitors for compliance.

The Hampton VA Medical Center Director ensures that summary suspensions are conducted in accordance with Veterans Health Administration policy, and monitors for compliance.

The Hampton VA Medical Center Director confirms that proposed reduction or revocation of privileges complies with Veterans Health Administration policies and procedures, and monitors for compliance.