Open Recommendations

We recommend the CISA Director consolidate and assign responsibilities for managing the Cybersecurity Retention Incentive program to an office with the authority to make program decisions.

We recommend the CISA Director develop, update, and implement its policies for the Cybersecurity Retention Incentive program to: • document if employees are likely to leave Federal service if they do not receive a retention incentive and have the completed approval on file; • annually review whether each employee is still eligible for the Cybersecurity Retention Incentive; • define unusual and extraordinary circumstances for back pay and ensure the reasons for back pay are documented; • update and publish the eligible cybersecurity certifications list annually; and • track internal transfers and resubmissions of Cybersecurity Retention Incentive eligibility forms in a…

We recommend the CISA Director conduct further analysis and evaluation to resolve the $1.41 million in unallowable back pay given to Cybersecurity Retention Incentive recipients.

We recommend the CISA Director determine whether it is appropriate to seek repayment of improper incentive payments to ineligible employees and recover those co

We recommend the DHS Office of the Chief Human Capital Officer periodically review and monitor CISA’s Cybersecurity Retention Incentive program to ensure it meets programs goals and is in compliance with DHS policy, DHS directives, and the DHS Cybersecurity Retention Incentive Plan.

Ensure the Palo Alto major construction project (project number 640-424) is brought into the Acquisition Program Management Framework.

Ensure the activities and artifacts required during the verify phase of the Acquisition Program Management Framework are completed for the Palo Alto major construction project (project number 640-424)—including a business case with cost, schedule, and performance goals approved by the Secretary.

Ensure a decision event to verify the need of the acquisition is conducted for the Palo Alto major construction project (project number 640-424) and a determination is made to terminate or continue this project based on VA’s strategic needs and the VA Palo Alto Health Care System’s clinical needs.

Ensure processes and guidance are in place for the director of the Office of Construction and Facilities Management to provide appropriate oversight and management over minor construction projects consistent with the authority and responsibilities described in 38 U.S.C. 312A.

Revise the Veterans Health Administration directive on minor construction projects to incorporate 38 U.S.C. 312A requirements and develop a review process for confirming compliance with the Office of Construction and Facilities Managements guidance and any applicable industry standards.

Review the Audie L. Murphy emergency department exam and fast-track rooms for compliance with applicable design and equipment standards and provide any recommendations to the executive director of the South Texas Veterans Health Care System.

Review an assessment by the Office of Construction and Facilities Management of the Audie L. Murphys emergency department for compliance with design and equipment requirements to determine what changes, if any, are necessary and take appropriate corrective action.

Verify that Our Generation Speaks corrects the instances of material noncompliance detailed on pages 22 to 26 of the audit report.

We recommend that the Grantee develop and implement formal written policies and procedures surrounding the management of Federal awards, in accordance with the Uniform Guidance.

We recommend the Vice President, Chief Information and Digital Officer, Information Technology, consistently implement the defined policies, procedures, and processes for developing and maintaining a comprehensive and accurate inventory for public-facing websites.

We recommend the Vice President, Chief Information and Digital Officer, Information Technology, implement, assess, and maintain common secure configuration settings for all information systems.

We recommend the Vice President, Chief Information and Digital Officer, Information Technology, incorporate vulnerability scanning into the Continuous Diagnostics and Mitigation dashboard in accordance with Binding Operational Directive 23-01, in coordination with Department of Homeland Security as necessary.

We recommend the Vice President, Chief Information and Digital Officer, Information Technology, refine the profiles periodically based on known risk exposure and residual risk, align cybersecurity profiles with risk strategy, and periodically monitor and report on progress in reaching TVA’s target profile.

We recommend the Vice President, Chief Information and Digital Officer, Information Technology, verify the data and corresponding metadata in the data inventories are subject to the monitoring processes defined within TVA’s Information Security Continuous Monitoring strategy.

The facility Director ensures staff review primary care panel sizes and capacity levels to ensure they are accurate.

Strengthen oversight to prevent and identify split purchases.

Develop stronger purchase card controls over donated funds to prevent improper purchases.

NSF review the details of the split purchases to determine whether the violations were a
result of a lack of knowledge/misunderstanding or intentional misconduct; and that NSF
address the root cause appropriately.

Document lessons learned from the APMC Chair’s decision to begin Phase C development work prior to formally passing KDP-C and establishing an ABC to the Office of Management and Budget and Congress.

Update Dragonfly’s project plan to reflect baseline commitments.