Open Recommendations

NARA Executives ensure:  Monitoring and testing plans are sufficiently reported in the ICP Tool.

NARA Executives ensure:  Results of monitoring and testing plans are achievable within the reporting timeframe.

NARA Executives ensure:  All information is up-to-date and reflects the current control environment.

NARA Executives identify, develop, and include in ICP reports measurable indicators to evaluate functions.

The ICP Official develop and implement a consistent risk assessment process and format for risk ranking, analysis of effect or impact, and risk reporting.

The ICP Official review the ICP reports and make and document  any revisions necessary to the format to ensure all necessary information is obtained in the reports.

We recommend that the Chief Operating Officer\Chief Risk Officer fully implement all components of NARA 160, including developing, documenting, and fully implementing NARA 162, NARA’s Enterprise Risk Management Program.  Within NARA 162, roles and responsibilities for ERM activities should be clearly identified.

We recommend that the Chief Operating Officer\Chief Risk Officer fully implement all components of NARA 160, including Developing, documenting, and fully implementing NARA 163, NARA’s Issues Management.

We recommend that the Chief Operating Officer\Chief Risk Officer develop, document, and implement a formal process to identify and prioritize risks within the organization. Risks should be tied directly to NARA’s strategic plan and mission and prioritized based on their overall importance to the agency.

We recommend that the Chief Operating Officer\Chief Risk Officer develop, document, and implement a formal process to prioritize risk management activities including the use of limited resources based on key risks within the organization. Management’s prioritization should be clearly documented and include formal steps to ensure risks are maintained at an appropriate level.

We recommend that the Chief Operating Officer\Chief Risk Officer Provide additional resources to the Office of Accountability to ensure ICP activities are effectively carried out.

We recommend that the Chief Operating Officer\Chief Risk Officer develop and implement a formal process to review and evaluate the completeness and accuracy of ICP documentation submitted. Validation procedures should include a formal review: To ensure all required documentation has been submitted by the due date. Where documentation has not been provided, NARA should have a formal process in place to follow up and obtain the required documentation. Of ICP documentation submitted to ensure it is both complete and accurate. Where discrepancies are identified, NARA should have a formal process in place to follow up with management so corrections can…

We recommend that the Chief Operating Officer\Chief Risk Officer develop and fully implement a formal ICP training program. NARA’s ICP training program should identify and require individuals who are involved with NARA’s ICP to complete initial training and refresher training periodically thereafter. Further, management should track completion of ICP training to ensure all individuals involved in the ICP process have received adequate training.

We recommend that Indian Affairs create a process to ensure that regional inspectors are consistently addressing these critical factors.

We recommend that Indian Affairs identify BIA-owned school facilities that are not on the BIE school listings, including the Todd County School District schools, and ensure facility responsibilities are clearly delineated and upheld.

We recommend Indian Affairs take immediate action to correct the health and safety issues identified in this report or ensure that the students and staff are adequately protected until these problems are resolved.

We recommend that DOI's Chief Information Officer incorporate and enforce the following items into its newly evolving vulnerability management program- a. enterprise-level monitoring and reporting of all devices and software packages; b. enterprise-level enforcement of consistent assessment, detection, prioritization and remediation techniques; c. required elevated account credential usage for testing; d. enterprise-level monitoring and bureau accountability for patch deployment; and e. enterprise-level quarantining for critically vulnerable systems that are not patched in a pre-defined timeframe.

The Assistant Secretary for Intelligence and Analysis should direct the Deputy Assistant Secretary for Security to update the Treasury Security Manual to include procedures requiring the Office of Security Programs to follow-up and obtain all bureau self-inspection reports.