Open Recommendations

We recommend that BOR establish and implement a policy to periodically conduct a review of the standard operating procedures and determine whether they need to be updated.

We recommend that BOR update the ratesetting standard operating procedures to reflect the current process for calculating the ratesetting schedules.

We recommend that BOR Develop standard operating procedures for all schedules used in the ratesetting process.

We recommend that BOR implement routine sampling of micropurchase transactions at the Central California, Northern California, and South-Central California Area Offices to ensure compliance with applicable laws, regulations, policies, and procedures.

We recommend that BOR develop a mechanism to enforce the use of the South-Central Area Office's purchase requisition form and ensure the form has the required approvals.

Direct Iowa State University to provide documentation supporting that it repaid or otherwise credited to NSF $8,749 in questioned student tuition, publication, and salary expenses.

Direct Iowa State University to strengthen its internal controls for the allocation of student tuition and salary costs and publication costs charged to sponsored projects.

Direct Iowa State University to provide documentation supporting that it repaid or otherwise credited to NSF $960 in unallowable indirect costs.

Direct Iowa State University to strengthen its internal controls for appropriately applying indirect costs to sponsored projects.

We recommend that the PBS NCR Regional Commissioner take immediate actions to address the fire safety deficiencies at the GSA HQ building by: promptly ensuring that all fire doors are inspected, repaired, or replaced for proper functionality and compliance with safety standards and fire codes; strengthening oversight to ensure that the building’s operations and maintenance contractor is complying with contract requirements, including, but not limited to, fire safety requirements; expediting the corrective action for the fire safety deficiency identified during the Management Analysis and Review System review, dated January 6, 2023, by coordinating pre-fire planning activities with the local fire…

We recommend that the PBS NCR Regional Commissioner take immediate actions to improve management oversight of its facilities to reassess compliance with Architectural Barriers Act Accessibility Standards and Occupational Safety and Health Administration requirements at the GSA HQ building by: reviewing designated wheelchair-accessible restrooms to ensure individuals with disabilities have easy access and adjusting any restroom doors to fall within the acceptable range for accessibility; addressing the functionality and compliance of all elevators, ensuring that each elevator is equipped with an automatic verbal announcement feature; and, stabilizing the handrail for the wheelchair ramp at the entrance of the building.

FHFA’s Chief Information Officer should restrict user access to the folders and files on FHFA’s network in accordance with least privilege principle.

FHFA’s Chief Information Officer should evaluate the need for the software script to generate and record user login records and restrict access to the log files in accordance with least privilege principle.

FHFA’s Chief Information Officer should ensure that the default or initial login passwords are changed for all 179 users whose passwords were compromised in this audit.

FHFA’s Chief Information Officer should ensure that upon initial login, FHFA users establish a new password that meets FHFA requirements for length and complexity and that the password is not a commonly used or a known compromised password.

FHFA’s Chief Information Officer should ensure that standard user accounts and privileged user accounts are not set up with the same default or initial login password.

FHFA’s Chief Information Officer should ensure that personnel are trained on standard and privileged user FHFA authentication and identification policies.

FHFA’s Chief Information Officer should identify and implement a solution, in coordination with vendors, to ensure that multifactor authentication is required to access FHFA’s network. If there are no viable solutions, document any risk-based decisions, including compensating controls.

FHFA’s Chief Information Officer should change the credentials for the compromised cloud administrator account.

FHFA’s Chief Information Officer should use the secure access method recommended by FHFA’s cloud service provider to access the FHFA cloud environment.

FHFA’s Chief Information Officer should identify and implement a solution, in coordination with vendors, to ensure multifactor authentication is required for privileged users to access FHFA’s cloud environment. If there are no viable solutions, document any risk-based decisions, including compensating controls.

FHFA’s Chief Information Officer should identify and implement a solution to detect and monitor the transfer of large amounts of data moving across FHFA’s network.

FHFA’s Chief Information Officer should identify and implement a solution to detect and prevent controlled unclassified information or personally identifiable information from being transferred outside of FHFA’s network to personal accounts on email and cloud-based storage services.

FHFA’s Chief Information Officer should determine whether resources can be made available to implement a data loss prevention system to prevent the exfiltration of controlled unclassified information.

FHFA’s Chief Information Officer should reevaluate the former Acting Chief Information Officer’s risk acceptance related to portable software programs, and implement security controls to detect and prevent users from downloading and running unapproved software on FHFA’s system in accordance with National Institute of Standards and Technology and FHFA’s Rules of Behavior.