Open Recommendations

FHFA’s Chief Information Officer should monitor and respond to unauthorized software downloads in accordance with FHFA’s Common Control Plan.

FHFA’s Chief Information Officer should identify and secure the resources necessary to remediate identified internal critical, high, and medium exploitable vulnerabilities on the FHFA servers, workstations, and other devices in compliance with Cybersecurity and Infrastructure Security Agency Binding Operational Directive 22-01 and FHFA’s Office of Technology and Information Management Vulnerability Management Process, Revision 2.7 (September 7, 2022).

FHFA’s Chief Information Officer should develop a Plan of Action and Milestones to track the remediation of past due Cybersecurity and Infrastructure Security Agency Known Exploitable Vulnerabilities in accordance with Cybersecurity and Infrastructure Security Agency’s Binding Operational Directive 22-01 and FHFA’s Office of Technology and Information Management Vulnerability Management Process, Revision 2.7 (September 7, 2022). FHFA’s Office of Technology and Information Management should implement compensating controls (i.e., isolating systems with un-remediated vulnerabilities) to mitigate the risk of the vulnerabilities.

FHFA’s Chief Information Officer should prioritize existing Office of Technology and Information Management resources based on the Plan of Action and Milestones to ensure that Cybersecurity and Infrastructure Security Agency Known Exploitable Vulnerabilities are remediated in accordance with Cybersecurity and Infrastructure Security Agency’s Binding Operational Directive 22-01 and FHFA’s Office of Technology and Information Management Vulnerability Management Process, Revision 2.7 (September 7, 2022).

FHFA’s Chief Information Officer should reevaluate the former Chief Information Officer’s risk acceptance related to the device lock policy and implement security controls to ensure that all FHFA laptops adhere to FHFA’s device lock policy in accordance with FHFA System Security and Privacy Plan for the General Support System (June 5, 2023).

FHFA’s Chief Information Officer should emphasize through training an FHFA user’s responsibility to securely lock their unattended devices.

FHFA’s Chief Information Officer should implement security controls to lock down USB ports so that only authorized USB devices are allowed.

FHFA’s Chief Information Officer should review and update the Common Control Plan, on a regular basis, to reflect which wireless networks are authorized to be set to broadcast.

We recommend that EAC require the DOS to implement procedures to ensure property purchased with federal funds is used, managed, and disposed of properly.

We recommend that the Director of BCP, in coordination with DCRO management, more formally integrate its legacy practices, standard operating procedures, and alternative procedures into a single source that clarifies how oversight activities of all contractors interrelate to support DCRO’s goals.

We recommend that the PBS NCR Regional Commissioner improve management oversight to ensure that PBS NCR contracting officers and contracting officer’s representatives: maintain complete contract files; verify that contractor and subcontractor employees are paid in accordance with Construction Wage Rate Requirements; enforce contractor compliance with subcontracting limitations required for sole-source 8(a) program contracts; and, enforce security requirements for contractor employees.

We recommend that the PBS NCR Regional Commissioner train PBS NCR contracting officers and contracting officer’s representatives on their duties and responsibilities with respect to: maintaining complete contract files; verifying that contractor and subcontractor employees are paid in accordance with Construction Wage Rate Requirements; enforcing contractor compliance with subcontracting limitations required for sole-source 8(a) program contracts; and, enforcing security requirements for contract employees.

We recommend that the PBS NCR Regional Commissioner establish processes or procedures to ensure contractor information changes are communicated to the contracting officer for timely FPDS-NG updates.

We recommend that the PBS NCR Regional Commissioner conduct a review of PBS NCR’s current basic repairs and alterations contracts to ensure that: contract files are complete; contractor and subcontractor employees are paid in accordance with Construction Wage Rate Requirements; contractors are complying with limitations on subcontracting for sole-source 8(a) program contracts; contractor employees have the required security clearances; and, FPDS-NG contains current, complete, and accurate information.

We recommend the Del Rio Sector Chief, Border Patrol, CBP, in coordination with partner agencies, continue to refine current strategies and identify new strategies to manage delays in detainee transfers to partners to minimize detainees’ time in custody and implement throughout the Del Rio sector.

We recommend to the Deputy Executive Assistant Commissioner, Operations Support, Office of Chief Medical Officer, CBP, ensure the number of onsite contract medical staff at short-term holding facilities in the Del Rio sector meets contract requirements to provide quality care to all detainees in custody.

Establish procedures to conduct periodic reviews for compliance with merchant information requirements and address noncompliance within a reasonable timeframe.

Establish procedures to ensure it provides a clear indication of when and where the Postal Service takes custody of all ePostage packages, monitor compliance with its procedures, and notify merchants of noncompliance.

1) Establish automated processes to identify merchants that shortpay,
2) Create and issue automated noncompliance notifications to merchants when applicable, and notify label providers of merchant noncompliance.

Establish automated processes to identify merchants that shortpay, and create and issue automated noncompliance notifications to merchants and label providers, when applicable.

Establish guidelines outlining quantifiable conditions for issuing noncompliance notifications to merchants and related timelines, notifying the label provider of mailer noncompliance, and suspending mailers' accounts.

Modify processing instructions for priority cases to include appropriate processing timeframes and follow-up procedures to support the Social Security Administration and Disability Determination Services’ monitoring of processing times.

Coordinate with Boeing, the SLS Stages prime contractor, to develop a quality management system training program that is compliant with AS9100D and reviewed by the appropriate NASA officials.

Institute financial penalties for Boeing’s noncompliance with quality control standards.

Perform a detailed cost overrun analysis on Boeing’s Stages contract for EUS development.