Open Recommendations

We recommend the Vice President, Projects and Outages, coach project managers on the importance of reviewing invoices thoroughly and obtaining input from contracting officers to identify potential unauthorized expenses before approval.

We recommend the Vice President and Controller, Corporate Accounting, develop steps to reinforce the identified areas of noncompliance with TVA Standard Programs and Processes 13.063, Business Meetings & External Relationship Events, and TVA Standard Programs and Processes 28.300, Food Services.

We recommend the Vice President and Controller, Corporate Accounting, modify TVA Standard Programs and Processes 13.063, Business Meetings & External Relationship Events, to define what constitutes acceptable alcohol expenses at external relationship events.

We recommend the Vice President and Controller, Corporate Accounting, consider developing a stronger enforcement policy for individuals identified as having multiple instances of non-compliance with TVA Standard Programs and Processes 13.063, Business Meetings & External Relationship Events.

We recommend the Vice President and Controller, Corporate Accounting, include corporate card charges authorized by the Chief Executive Officer and his direct reports in each executive’s summary in the TVA Board of Directors in the annual Board of Directors, CEO, and Direct Reports [FY] Expense Review Summary.

We recommend the Vice President and Controller, Corporate Accounting, document expenses made by the Chief Executive Officer and his direct reports that do not comply with TVA Standard Programs and Processes 13.063, Business Meetings & External Relationship Events, including justifications, in the annual Board of Directors, CEO, and Direct Reports [FY] Expense Review Summary.

Execute a plan to provide stable leadership at the Indianapolis Regional Processing and Distribution Center.

Staff management positions at the Indianapolis Regional Processing and Distribution Center to authorized levels.

Continue to work with local management and staff to improve employee availability at the Indianapolis Regional Processing and Distribution Center to meet the national goal.

Revise projected savings and identify opportunities to improve efficiency of operations in the Indianapolis, IN, region.

Optimize usage of mail processing equipment at the Indianapolis Regional Processing and Distribution Center, including potential redeployment of underused equipment to facilities that need additional mail processing.

Strengthen inventory controls over surface visibility scanners and evaluate implementing an automated system.

Direct the Indianapolis Regional Processing and Distribution Center Processing and Logistics managers to review daily scan data to identify problem areas and correct issues to achieve current scanning goals.

Review the NIST Cybersecurity Framework 2.0 and formalize documented policies and procedures for developing and maintaining current and target cybersecurity profiles that align with the CSF to include, at a minimum, consideration of AmeriCorps’ mission objectives, threat landscape, and resources (including personnel) and constraints.

Develop, document, and maintain current and target cybersecurity profiles that align with the NIST Cybersecurity Framework 2.0 — including a gap analysis between the current and target cybersecurity posture—that consider anticipated changes in AmeriCorps’ cybersecurity posture.

Document policies and procedures for developing and maintaining a comprehensive and accurate inventory of data and the corresponding metadata for AmeriCorps’ data types.

Develop and maintain a comprehensive and accurate inventory of data and corresponding metadata for AmeriCorps’ data types, to include data obtained from third party providers to meet the requirements of the Open Government Data Act and OMB Memorandum M-25-05.

Perform and document a formal risk assessment associated with the use of the ARC system.

Update the risk assessments for the GSS and eSPAN on an annual basis.

Conduct a security control assessment for the GSS and eSPAN on an annual basis in accordance with AmeriCorps’ Security Control Standard Assessment, Authorization & Monitoring.

Coordinate with relevant stakeholders to align the documented RTOs in the GSS and eSPAN BIAs, and ensure both BIAs are updated accordingly

Implement the approved standard baseline configurations for all servers, workstations, and network devices in the AmeriCorps’ information system environment

Update procedures and provide training to Contracting Officers, Oversight Managers, and Program Office personnel overseeing contracts that use service level metrics that outlines how to a) draft effective and measurable service level metrics, b) monitor contractor compliance with performance requirements and review performance data, and c) review and assess service level metrics to ensure they accurately reflect contractor performance.

Recover service level credits totaling [redacted], so that the funds can be put to better use or provide documentation to justify uncollected credits.

Ensure Contract Management Plans include the controls that will be used by key contract personnel to oversee and manage complex service contracts.