Open Recommendations

The Chief Information Officer ensures that the actions shared with the agency in the detailed technical report are taken to properly configure and fully utilize anti-phishing protections.

The Chief Information Officer ensures that the actions shared with the agency in the detailed technical report are taken to properly configure and fully utilize anti-phishing protections.

The Chief Information Officer implements continuous improvement and emphasize a “Zero Click” mindset throughout the organization to reduce the threat from phishing campaigns.

We recommend that the Orphaned Well Program Office require the Kansas Corporation Commission to determine and document that all wells plugged using Infrastructure Investment and Jobs Act funds were completed in accordance with Kansas Statutes Annotated 55?179 (e.g., the wells were plugged only after the commission determined that no person was legally responsible, or that each legally responsible person was dead, no longer in existence, insolvent, or could no longer be found).

Strengthen controls in the Office of the Assistant Director to ensure inclusion of staffing monitoring contract requirements, in coordination with the contracting officer, to meet gradual staffing level goals during start-up periods in future community‑based outpatient clinic contracts.

Strengthen controls to ensure data used for monitoring contract performance standards are accurate and comply with the methodology required in the contract’s Quality Assurance Surveillance Plan.

Review the medical staff-driven phase of the credentialing process, to ensure action plans implemented to expedite the credentialing process are effective.

Strengthen controls to ensure contracted staff complete required scheduling training before granting them access to VA’s scheduling system and authorizing them to make veteran appointments.

Review the healthcare system’s staffing augmentation plan and coordinate with the contracting officer to ensure the full costs are recovered for all Veterans Health Administration staff who provided services for which the contractor was also compensated.

Review the unilateral memorandum related to staffing augmentation, establish a contract modification in compliance with the Federal Acquisition Regulation provisions regarding contract changes, and ensure relevant documentation is maintained in the contract file.

Recover government funds expended for Veterans Health Administration staff augmented at contracted community-based outpatient clinics using full cost amounts.

Review and enforce staffing contingency plan requirements for the Loma Linda Healthcare System contract, including maximizing the contractor’s use of temporary replacements, or locum tenens, to minimize staffing shortages.

Strengthen oversight mechanisms to ensure the enforcement of staffing requirements during contract start-up in future community‑based outpatient clinic contracts before the clinics become operational.

Ensure that historical factors such as changes in the subsidy rate, frequency of major disasters, and total dollar amount of loan approvals from prior years are taken into consideration when developing the annual budget request for the disaster loan program.

Ensure monthly disaster reports comply with all the requirements of 15 U.S.C. § 636k(a).

Enhance monthly disaster reports to include 1) information that indicates whether sufficient funds are available or if supplemental funds are needed and 2) a narrative with each data table that explains how to read and interpret the monthly disaster reports.

Ensure written notification of the need for supplemental funds for the disaster loan program is submitted to the appropriate congressional committees as soon as SBA anticipates a funding shortfall, in accordance with 15 U.S.C. § 636k(d).

FHFA's Chief Information Officer should develop and implement a plan for strong user authentication controls for all external access to the CSP website in coordination with the new owner of the CSP website, the Office of Affordable Housing and Community Investment.

FHFA's Chief Information Officer should restrict access to member bank submission forms and associated documents to only authenticated and authorized users.

FHFA's Chief Information Officer should prevent unauthorized access to internal, CUI, and non-public files through parameter modification in the URL.

FHFA's Chief Information Officer should remove technical and system level information from public-facing code and pages, including references to internal applications, backend functions, and programming details.

FHFA's Chief Information Officer should configure all error messages to suppress internal application details and display only user-appropriate messages.

FHFA's Chief Information Officer should immediately remove all publicly accessible documents containing CUI and review published content for compliance with FHFA’s CUI policy.

FHFA's Chief Information Officer should establish a formal content review and approval process for all documents and content posted to public-facing websites, including checks for CUI data.

FHFA's Chief Information Officer should deploy monitoring and alerting tools to detect unauthorized logins, document access attempts, or suspicious activity on the CSP website.