Open Recommendations

USDA OIG has determined that this recommendation contains sensitive information and will not be publicly released due to privacy concerns.

Not publicly released.

Not publicly released.

Not publicly released.

Share Binghamton, NY, Sorting and Delivery Center (S&DC) successes and continue to equip future S&DCs with the machines and tools necessary before converting. Additionally, determine the feasibility of making incremental changes when deploying future S&DCs.

Direct local management to properly oversee carriers and clerk functions. Also identify the cause of inaccurate distribution of mail and develop a corrective action plan.

Direct local management to regularly communicate to carriers the importance of providing accurate details on Postal Service form 3849.

We recommend Departmental Administration Information Technology Office management enforce the timely completion and update of all security artifacts, including Plan of Actions and Milestones.

USDA OIG has determined that this recommendation contains sensitive information and will not be publicly released due to privacy concerns.

USDA OIG has determined that this recommendation contains sensitive information and will not be publicly released due to privacy concerns.

USDA OIG has determined that this recommendation contains sensitive information and will not be publicly released due to privacy concerns.

USDA OIG has determined that this recommendation contains sensitive information and will not be publicly released due to privacy concerns.

USDA OIG has determined that this recommendation contains sensitive information and will not be publicly released due to privacy concerns.

USDA OIG has determined that this recommendation contains sensitive information and will not be publicly released due to privacy concerns.

We recommend Departmental Administration Information Technology Office management enforce multi-factor authentication, or the equivalent thereof, to the application.

We recommend (REDACTED) management implement a system of quality control to ensure the timely completion of quarterly privileged user access reviews in accordance with USDA Departmental Regulation 3505-003.

We recommend that Departmental Administration Information Technology Office management develop, document, and implement a control to monitor the assigned organization security coordinators complete privileged user access reviews in a timely manner.

We recommend Departmental Administration Information Technology Office management configure the system to generate user listings with the required data elements (e.g., first name, last name, account creation date, and roles or privileges) to support its system of internal controls and operational needs.

We recommend Departmental Administration Information Technology Office management provide training to personnel supporting the application on system administration including their responsibilities in supporting access controls, audits, and assessments.

We recommend (REDACTED) management enable the collection of privileged and non-privileged audit logging events and design and implement a process for monitoring and analyzing significant events for unauthorized or unusual activities.

We recommend Cybersecurity and Privacy Operations Center management update existing policies and procedures to include repercussions when an individual does not complete their required role-based security training in the designed 45-day time frame.

We recommend Cybersecurity and Privacy Operations Center management develop a mechanism to track the completion of role-based security training and verify remedial action has occurred in the event an individual has not taken the training on a timely basis.

We recommend Departmental Administration Information Technology Office management increase the resources dedicated to the assessment and authorization program, as needed, to completely execute all aspects of the program requirements on an on-going basis.

We recommend (REDACTED) management complete a review and update of the (REDACTED) Information System Contingency Plan within the timeframe prescribed by DR 3571-001.

We recommend (REDACTED) management finalize the system’s security categorization and update the information system contingency plan and business impact analysis documents to align with the system’s new categorization requirements.