Open Recommendations

The CIO and NGC should review and document the approval of all agreements for web hosting services.

The CIO should review all of the systems attached to NARANet general support system to determine if there are any others that are not FISMA compliant.

The CIO should coordinate with the CINO to make the web hosting environment FISMA compliant.

The CIO, COO, and CINO should retroactively perform or obtain from the contractor vendor, or partner IT security assessments on vendors that currently host NARA websites.

The CIO develop a process for managing access to shared user accounts.

The CIO should implement the annual compliance check required by the User Account Management Standard Operating Procedure for Administrator accounts to the shared user accounts.

We recommend that NARA incorporate all locations into the NARANet SA&A package by documenting location-specific security controls and ensuring that they are appropriately tested and monitored.

We recommend that, to the extent possible, NARA revisit all site locations and ensure that appropriate and consistent PE, infrastructure, and cabling controls are implemented.  At a minimum, NARA should take the following appropriate steps to remediate the issues identified above, which represent the present risks and flaws applicable to NARA ensure that neat cable management and labeling mechanisms are employed for all sites.

We recommend that, to the extent possible, NARA revisit all site locations and ensure that appropriate and consistent PE, infrastructure, and cabling controls are implemented. At a minimum, NARA should take the following appropriate steps to remediate the issues identified above, which represent the present risks and flaws applicable to NARA Ensure that all server racks, switches, and network equipment are adequately secured from unauthorized access via locked racks.

Rectify the issues, including the systems limitations and unresolved diaries found during this review, causing overpayment to not be resolved.

The Office of Programs should increase the quantity of cases during its quality assurance review for medical examinations and consultative opinions to ensure that the cases reviewed are representative of the number of cases processed each quarter.

The Bureau of Fiscal Operations should strengthen internal controls by establishing a due date for formal responses from all organizations with open obligations to ensure better management of these funds prior to the period of expiration.

The Bureau of Fiscal Operations should establish a follow-up process when responses are not provided within the designated timeframe from all organizations with open obligations.

The Office of Programs should ensure that Palmetto applies statistical analysis and stratified random sampling where practical to the high volume risk categories.

The Office of Programs should work with Palmetto and the Centers for Medicare and Medicaid Services to conduct a thorough cost benefit analysis that will identify the resources needed to maximize timely and efficient recovery of improper payments for chiropractic services over the five year recovery period.

The Office of Programs should work with Palmetto and the Centers for Medicare and Medicaid Services to recover the improper chiropractic service payments for the five year period, where determined to be cost effective based on an accurate cost benefit analysis.

The Office of Programs should work with Palmetto and the Centers for Medicare and Medicaid Services to share information identified during the post-payment reviews as appropriate with the Recovery Audit Contractors and Zone Program Integrity Contractors where it can be used to identify improper or fraudulent non-Railroad Medicare chiropractic service payments.

We recommend WCB develop and implement a plan that ensures the closure of pending appeals in a timely manner, and prioritizes the resolution of appeals filed 2010 and earlier.

The Executive Committee should take all of the necessary steps to prepare and submit the required plans within the 90 day reporting requirement.

The Executive Committee should ensure that the necessary policies and procedures are developed and documented for the agency’s use for the preparation of a risk assessment process that meets Improper Payments Elimination and Recovery Act of 2010 requirements.

The Office of Programs should revise and document their definitions of improper underpayments for the Railroad Retirement Act program in compliance with Improper Payments Elimination Act of 2010 guidance, and if similar definitions are used for other programs, revise them accordingly.

The Office of Programs should develop and document the necessary policies and procedures for the review and validation of the Railroad Unemployment Insurance Act improper payment data to be reported in the Performance and Accountability Report.

The Office of Programs should ensure that the proper controls are in place to make sure that the policies and procedures are followed to properly support the improper payment data reported for Railroad Unemployment Insurance Act program.

To support Digitization Lab infrastructure, we recommend the Chief Innovation Officer and Chief Information Officer develop a longterm strategy for increasing transfer capabilities between various internal storage systems housing digitized records.