Open Recommendations

We recommend the Vice President and Chief Information and Digital Officer, Technology and Innovation, update TVA’s SharePoint® training to provide site owners with the knowledge they need to properly protect TVA nonpublic critical and sensitive information.

We recommend the Vice President and Chief Information and Digital Officer, Technology and Innovation, create a process to identify SharePoint® site owners and require them to complete initial and periodic refresher training.

The Chief Information Officer should re-establish the Technology Retirement Office or implement a similar enterprise-wide program to identify, prioritize, and decommission legacy systems.

Follow up with Department of Labor on the wage determination requirement and bring all active freight auction contracts into compliance with both the Service Contract Act and wage determination requirements.

Communicate the security, trailer loading, and team driver requirements to facility management and suppliers, and develop a process to monitor dock personnel and freight auction drivers to verify they are following the requirements.

Develop a plan of action and milestones for revising the trailer utilization-calculated percentages in Surface Visibility to account for stacked containers and cubic feet.

Review prior freight auction payments made during fiscal years 2022 and 2023 to identify loads without reliable proof of delivery information and recover inaccurate payments and implement a periodic review process going forward.

Initiate recovery of U.S. Postal Service Office of Inspector General-identified overpayments.

Conduct a comprehensive review to identify requirements for streamlining proof of delivery validation, minimize manual payments, improve accuracy, and make system enhancements as necessary.

Re-evaluate and adjust supplier performance requirements and enforce supplier compliance.

Recover COVID-19 EIDL funds provided to the two ineligible borrowers.

We recommend that GSA’s Chief Financial Officer and Chief Information Officer conduct a comprehensive assessment of GSA’s CIO-IT Security-19-97, IT Security Procedural Guide: Robotic Process Automation (RPA) Security, (RPA policy) to ensure, among other things, that its monitoring controls are effectively designed and implemented.

We recommend that GSA’s Chief Financial Officer and Chief Information Officer develop oversight mechanisms to enforce compliance with the RPA policy and ensure that controls are operating effectively.

We recommend that GSA’s Chief Financial Officer and Chief Information Officer require system security plans to be updated as part of the RPA security approval process to address bot and non-person entity access.

We recommend that GSA’s Chief Financial Officer and Chief Information Officer review all system security plans that bots currently interact with to determine if they address bot and non-person entity access. Update the system security plans, as needed.

We recommend that GSA’s Chief Financial Officer and Chief Information Officer establish procedures as part of the RPA security approval process that ensure system owners consider updating the security controls identified in Appendix A of the RPA policy.

We recommend that GSA’s Chief Financial Officer and Chief Information Officer review all system security plans that bots currently interact with to determine if the security controls need to be updated. Update the system security plans, as needed.

We recommend that GSA’s Chief Financial Officer and Chief Information Officer develop a comprehensive process for removing bot custodian and bot developer access for decommissioned bots and GSA systems that: aligns with GSA’s CIO-IT Security-01-07, IT Security Procedural Guide: Access Control (AC) (access control policy); tracks and documents that access has been removed; and incorporates the process into the RPA policy.

Make ERM implementation a priority by providing the ERM team the resources it needs to ensure ERM reaches maturity no later than the planned date of FY 2028, in accordance with its current ERM Implementation Plan.

Ensure as SSA is working toward reaching maturity that the ERMC is providing leadership over the ERM program and that key Circular A-123 requirements are completed. For example, key requirements should include regular evaluation of SSA’s risk appetite and risk tolerance levels and ERMC communications in support of an Agency-wide risk culture.

Perform a risk-based allocation of resources based on system categorization.

Incorporate the system level risk assessment results into the organization-wide cybersecurity and privacy risk assessment.

Integrate the information security architecture with the development lifecycle.

Implement qualitative or quantitative measures to measure, report on, and monitor the information security and SCRM performance of organizationally defined products, systems, and services provided by external providers.

Implement qualitative or quantitative measures used to gauge the effectiveness of its component authenticity policies and procedures and ensures that data supporting the metrics is obtained accurately, consistently, and in a reproducible format.