Recommendation: The Under Secretary for Management should ensure that the Office of Program Accountability and Risk Management and component heads execute the Component Acquisition Executive nomination and designation process consistently, as described in its guidance. This should include nominating and designating Component Acquisition Executives to oversee all acquisition programs. (Recommendation 1)

Agency: Department of Homeland Security
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Under Secretary for Management should ensure that the Component Acquisition Executives that are responsible for oversight of acquisition programs comply with Department of Homeland Security direction to complete Component Acquisition Executive support staffing plans. (Recommendation 2)

Agency: Department of Homeland Security
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Under Secretary for Management should identify, in policy or guidance, the expertise that constitutes critical acquisition positions for effective Component Acquisition Executive oversight. (Recommendation 3)

Agency: Department of Homeland Security
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Under Secretary for Management should direct the Office of Program Accountability and Risk Management to establish a time frame for completing its assessment of the Investment Evaluation, Submission, and Tracking (INVEST) system data fields for which the Component Acquisition Executive certification is necessary, based on current use and reporting requirements, and take appropriate actions based on the results. (Recommendation 4)

Agency: Department of Homeland Security
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The FAA Administrator should direct the Associate Administrator for Aviation Safety to conduct a risk assessment of avionics systems cybersecurity to identify the relative priority of avionics cybersecurity risks for its oversight program compared to other safety concerns and develop a plan to address those risks. (Recommendation 1)

Agency: Department of Transportation: Federal Aviation Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The FAA Administrator should direct the Associate Administrator for Aviation Safety, based on the assessment of avionics cybersecurity risks, to identify staffing and training needs for agency inspectors specific to avionics cybersecurity, and develop and implement appropriate training to address identified needs. (Recommendation 2)

Agency: Department of Transportation: Federal Aviation Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The FAA Administrator should direct the Associate Administrator for Aviation Safety, based on the assessment of avionics cybersecurity risks, to develop and implement guidance for avionics cybersecurity testing of new airplane designs that includes independent testing. (Recommendation 3)

Agency: Department of Transportation: Federal Aviation Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The FAA Administrator should direct the Associate Administrator for Aviation Safety, based on the assessment of avionics cybersecurity risks, to review and consider revising its policies and procedures for monitoring the effectiveness of avionics cybersecurity controls in the deployed fleet to include developing procedures for safely conducting independent testing. (Recommendation 4)

Agency: Department of Transportation: Federal Aviation Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The FAA Administrator should direct the Associate Administrator for Aviation Safety to develop a mechanism to ensure that avionics cybersecurity issues are appropriately tracked and resolved when coordinating among internal stakeholders. (Recommendation 5)

Agency: Department of Transportation: Federal Aviation Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The FAA Administrator should direct the Associate Administrator for Aviation Safety, based on the assessment of avionics cybersecurity risks, to review and consider the extent to which oversight resources should be committed to avionics cybersecurity. (Recommendation 6)

Agency: Department of Transportation: Federal Aviation Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The FTA Administrator should include the known limitations and intended uses of its TAM performance data in its public reports such as its annual NTD summary and other reports for decision-makers. This action should include clarifying the context of state of good repair data in TAM reports in relation to similar data in DOT's Condition and Performance Report and how they differ. (Recommendation 1)

Agency: Department of Transportation: Federal Transit Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The FTA Administrator should develop a plan for how FTA intends to analyze, implement, and communicate any identified TAM program improvements moving forward. The plan should describe how FTA intends to address:

• relying on a single performance measure per asset category,

• potential limited use of investment scenarios by transit agencies in making asset decisions, and

• shorter-term planning horizons than those used by other planning counterparts. (Recommendation 2)

Agency: Department of Transportation: Federal Transit Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Under Secretary for Health should ensure the RCS Chief Officer evaluates Vet Center productivity expectations for counselors, including (1) obtaining systematic feedback from counselors on any potentially negative effects on client care, and (2) determining whether directors and counselors need additional training or guidance on how the expectations are calculated. (Recommendation 1)

Agency: Department of Veterans Affairs
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Under Secretary for Health should ensure the RCS Chief Officer develops a plan and time frames for periodically reassessing its productivity expectations for counselors, and implementing any needed changes as appropriate. (Recommendation 2)

Agency: Department of Veterans Affairs
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Under Secretary for Health should ensure the RCS Chief Officer develops and implements a Vet Center staffing model that incorporates key practices in the design of staffing models. (Recommendation 3)

Agency: Department of Veterans Affairs
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Under Secretary for Health should ensure the RCS Chief Officer establishes a plan and time frames for assessing and updating its staffing model regularly, and for implementing any needed changes as warranted. (Recommendation 4)

Agency: Department of Veterans Affairs
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The NNSA Administrator should direct the W87-1 program to ensure consistent, reliable, and objective assessments of remaining feature and component design decisions in Phase 6.2 by developing study plans for remaining design studies consistent with the guidelines for such plans in NNSA's AOA procedure, including documenting and justifying deviations from best practices. (Recommendation 1)

Agency: Department of Energy: National Nuclear Security Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The NNSA Administrator should direct the Office of Defense Programs to revise its program execution instruction to require that design studies for warhead life extension and replacement programs follow AOA best practices, such as by having a study plan, or to justify and document deviations from best practices. (Recommendation 2)

Agency: Department of Energy: National Nuclear Security Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The NNSA Administrator should direct the Office of Defense Programs' plutonium program office to ensure that the integrated master schedule in development for pit production meets NIMS standards, consistent with best practices for schedule development. (Recommendation 3)

Agency: Department of Energy: National Nuclear Security Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The NNSA Administrator should direct the W87-1 program to prioritize the development and documentation of a risk mitigation strategy to address the risk that pit production may be insufficient to meet W87-1 production needs. (Recommendation 4)

Agency: Department of Energy: National Nuclear Security Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Associate Commissioner of the Administration for Children and Families Children's Bureau within the Department of Health and Human Services should develop a process to assess the reliability of grantee performance information contained within annual performance reports for tribal recipients of its Stephanie Tubbs Jones Child Welfare Services Program. (Recommendation 1)

Agency: Department of Health and Human Services
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of the Department of the Interior's Bureau of Indian Education should take steps to alert grantees of the Native Language Immersion Cooperative Agreement when they are late in submitting performance reports. (Recommendation 2)

Agency: Department of the Interior: Bureau of Indian Education
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of the Department of the Interior's Bureau of Indian Education should develop a process to assess the quality and reliability of a sample of grantee performance data for the Native Language Immersion Cooperative Agreement. (Recommendation 3)

Agency: Department of the Interior: Bureau of Indian Education
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The NNSA Administrator should require the W80-4 program, when it issues its baseline cost report prior to entry into phase 6.4, to adopt a date for the delivery of a first production unit, and dates for other key program milestones, based on the program's current schedule risk analysis, or document its justification for adopting alternative schedules and milestones based on other factors. If necessary, the Administrator should alert the Secretary of Energy to the need to engage in the extension or notification processes identified in statute for adopting a first production unit delivery date after September 2025. (Recommendation 1)

Agency: Department of Energy: National Nuclear Security Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The NNSA Administrator should revise the Program Execution Instruction or other related directives to require future LEPs and nuclear weapon modernization programs of similar complexity, when they issue a WDCR or baseline cost report, to establish program schedules and key milestone dates (including the FPU delivery date) on the basis of a formal schedule risk analysis that aligns with best practices, or document the justification for any decision to adopt alternative schedules and milestones based on other factors. (Recommendation 2)

Agency: Department of Energy: National Nuclear Security Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The U.S. commissioners of the International Joint Commission should work with the Canadian commissioners to update the Lake Ontario-St. Lawrence River Board communications plan and ensure that the plan incorporates best practices for public relations efforts, in particular defining target audiences and developing mechanisms to monitor and inform adjustments to strategies, and generally accepted principles for communicating risk-related information. (Recommendation 1)

Agency: International Joint Commission--United States and Canada
Status: Open

Comments: The International Joint Commission (IJC) agreed with our recommendation. IJC stated that it intends to develop an updated communications plan that incorporates best practices for public relations efforts by December 31, 2020. We will continue to monitor IJC's actions in response to this recommendation.

Recommendation: The U.S. commissioners of the International Joint Commission should work with the Canadian commissioners to develop and enter into written agreements with entities that the Great Lakes-St. Lawrence River Adaptive Management Committee identifies as having information or resources that the committee needs to effectively monitor and evaluate the impacts of Plan 2014. (Recommendation 2)

Agency: International Joint Commission--United States and Canada
Status: Open

Comments: The International Joint Commission (IJC) agreed with our recommendation. IJC is compiling a list of entities with which it shares information to explore formal data and information sharing arrangements with them. We will continue to monitor IJC's actions in response to this recommendation.

Recommendation: The U.S. commissioners of the International Joint Commission should work with the Canadian commissioners to ensure that IJC fully incorporates the key elements and essential characteristics of the adaptive management process into a comprehensive adaptive management strategic plan for Plan 2014. (Recommendation 3)

Agency: International Joint Commission--United States and Canada
Status: Open

Comments: The International Joint Commission (IJC) agreed with our recommendation. IJC plans to produce a comprehensive adaptive management strategic plan that fully incorporates the key elements and essential characteristics of the adaptive management process by December 31, 2020. We will continue to monitor IJC's actions in response to this recommendation.

Recommendation: The Secretary should ensure that the Director of Strategic Technology Management (STM), in collaboration with other members of the Information Technology Program Management Center of Excellence (ITPM COE), identifies the skills and resources needed to complete the work intended for the upcoming fiscal year, including the availability of supplementary staff, such as subject matter experts. (Recommendation 1)

Agency: Department of Homeland Security
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary should ensure that the Executive Steering Committee overseeing the activities of the ITPM COE establishes target measures for the department's desired outcomes of its transition to Agile development. (Recommendation 2)

Agency: Department of Homeland Security
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary should ensure that the DHS Chief Information Officer (CIO) defines a process and associated set of controls to ensure that Agile programs and projects are reporting a set of core required performance metrics for monitoring and measuring Agile adoption. (Recommendation 3)

Agency: Department of Homeland Security
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary should ensure that the ITPM COE, in coordination with the CIO, begins measuring results associated with the transition to Agile and the success of the transition based on its impact on the department. (Recommendation 4)

Agency: Department of Homeland Security
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary should ensure that the CIO, in collaboration with the Chief Procurement Officer, through the Homeland Security Acquisition Institute, establish Agile training requirements for senior stakeholders. (Recommendation 5)

Agency: Department of Homeland Security
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary should ensure that the Chief Human Capital Officer, in collaboration with the CIO, consider modifications to the current employee recognition and performance management governance to ensure that teamwork and team performance of Agile programs and projects are incentivized. (Recommendation 6)

Agency: Department of Homeland Security
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary should ensure that the CIO, in collaboration with the Chief Procurement Officer, through the Homeland Security Acquisition Institute, establish Agile training requirements for staff outside of the acquisition workforce but assigned to Agile programs. (Recommendation 7)

Agency: Department of Homeland Security
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary should ensure that the CIO, upon establishing a set of core performance metrics, tracks and monitors the pace of Agile team development. (Recommendation 8)

Agency: Department of Homeland Security
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary should ensure that the CIO, in collaboration with the Executive Director of the Office of Program Accountability and Risk Management (PARM), update or develop new guidance on Agile methodologies to describe how Agile teams can estimate the relative complexity of user stories. (Recommendation 9)

Agency: Department of Homeland Security
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary should ensure that the CIO, upon establishing a set of core performance metrics, sets expectations for automated testing and code quality, and tracks and monitors against those expectations. (Recommendation 10)

Agency: Department of Homeland Security
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of State should ensure that State/INL establishes procedures that verify that monitoring officials for Mérida Initiative projects follow the key practices. (Recommendation 1)

Agency: Department of State
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The USAID Administrator should establish procedures to ensure that monitoring officials for Mérida Initiative projects develop monitoring plans that address risks. (Recommendation 2)

Agency: United States Agency for International Development
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The OUSD (A&S) should direct the F-35 program office to provide information that is similar to that which is statutorily required after the milestone C review to Congress ahead of the milestone C review (full-rate production decision). This submission should include an evaluation of the production risks associated with critical production processes that are not in control, reliability and maintainability (R&M) targets that are not met, and supplier readiness—particularly for those replacing Turkish suppliers, along with the steps it is taking to address those risks. (Recommendation 1)

Agency: Department of Defense
Status: Open

Comments: DOD did not concur with this recommendation, citing updates the F-35 program office provides to oversight entities within DOD. We maintain that the program office should provide these same updates to Congress as well. Without a substantive assessment highlighting specific production risks, as well as the steps DOD will take to mitigate them, Congress may not have key insights into the risks that remain with the program and to the overall effort to deliver F-35s to the warfighter. DOD has agreed to keep the Congress apprised of these matters in its quarterly briefings to the defense committees.

Recommendation: The OUSD (A&S) should direct the F-35 program office to establish a Block 4 cost estimate baseline that includes all Block 4 costs, including incurred costs and future costs in its reports to Congress as required by the NDAA for Fiscal Year 2017, so that Congress has a complete understanding of all Block 4 costs and can compare this baseline to future cost estimates and performance. (Recommendation 2)

Agency: Department of Defense
Status: Open

Comments: DOD concurred with this recommendation. In response to our report, DOD stated that future reports to Congress will include prior and future costs, outside of the Future Years Defense Program costs. As of September 15, 2020, DOD has not yet issued an updated report to Congress. We will monitor DOD's efforts to address this recommendation once it releases its next report.

Recommendation: The OUSD (A&S) should direct the F-35 program office to complete a program office level, product-oriented work breakdown structure for the next update to its Block 4 cost estimate to ensure that the estimate meets the comprehensive leading practices. (Recommendation 3)

Agency: Department of Defense
Status: Open

Comments: Though DOD did not concur with this recommendation, in response to this report, DOD agreed to evaluate moving to a program-level, product-oriented work breakdown structure in 2021. We will continue to monitor DOD's efforts to address this recommendation.

Recommendation: The OUSD (A&S) should direct the F-35 program office to conduct risk and uncertainty analyses for the next update to its Block 4 cost estimate to ensure that the estimate meets the credible leading practices. (Recommendation 4)

Agency: Department of Defense
Status: Open

Comments: DOD concurred with this recommendation. In response to this report, DOD stated that the F-35 program office estimate is aligned with the DOD's Cost Assessment and Program Evaluation's approach and methodology for performing development cost estimates. However, DOD did not identify specific actions it plans to take to include risk and uncertainty into its next Block 4 cost estimate update. We will continue to monitor any actions DOD takes in this regard.

Recommendation: The OUSD (A&S) should direct the F-35 program office to consider the results of its future technology readiness assessment of all Block 4 technologies and incorporate the cost and schedule risks of developing those technologies in the next update to its Block 4 cost estimate to ensure that the estimate meets the comprehensive leading practices. (Recommendation 5)

Agency: Department of Defense
Status: Open

Comments: DOD concurred with this recommendation. In response to this report, DOD stated that it continues to evaluate technology readiness levels for Block 4. It noted that Office of the Under Secretary of Defense for Research and Engineering would conduct and independent technology readiness assessment of the Block 4 effort, which the program would use to inform future cost estimates. In May 2020, the F-35 Program Office issued a Technology Readiness Assessment Plan for Block 4. This plan outlines an incremental assessment approach aligned with Block 4 capability drops beginning with the drop scheduled for April 2021. We will continue to monitor DOD's efforts to address this recommendation.

Recommendation: Congress should consider revising Section 224(d) of the National Defense Authorization Act for Fiscal Year 2017, Pub. L. No. 114-328, to extend DOD's Block 4 reporting requirement until all Block 4 capabilities are fielded to ensure that Congress is aware of cost and schedule growth beyond 2023. (Matter for Consideration 1)

Agency: Congress
Status: Open

Comments: Congress has not extended the Block 4 reporting requirement in Section 224(d) of the National Defense Authorization Act for Fiscal Year 2017. We will continue to monitor any action the Congress may take in this regard.

Recommendation: The Commissioner of Internal Revenue should modify the title of IRS's employment-related identity theft action code 525 to reflect the type of employment-related identity fraud encompassed by this action code. (Recommendation 1)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commissioner of Internal Revenue should assess and document the feasibility of incorporating additional checks into its automated checks of employment-related identity fraud for populations at risk of employment-related identity fraud, such as children, elderly, deceased persons, and individuals associated with multiple wage records. (Recommendation 2)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commissioner of Internal Revenue should assess and document the costs and benefits of using the Withholding Compliance Program (WHC) to address compliance risks posed by potential employment-related identity fraudsters who owe taxes and take appropriate action, as needed. (Recommendation 3)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commissioner of Internal Revenue should modify Automated Underreporter (AUR) to include wage discrepancy checks for victims of employment-related identity fraud once IRS has updated AUR's legacy programming code. (Recommendation 4)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commissioner of Internal Revenue should, in collaboration with the Commissioner of Social Security, develop and document a plan for updating future Combined Annual Wage Reporting (CAWR) MOUs. The plan should identify actions, time frames, and responsible parties, including executive leadership. (Recommendation 5)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commissioner of Internal Revenue should, in collaboration with the Commissioner of Social Security, develop and implement goals and performance measures for the CAWR MOU. (Recommendation 6)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commissioner of Internal Revenue should, in collaboration with the Commissioner of Social Security, develop and document a strategy for assuring that the reviews required by the updated MOU are completed within the specified time frames. (Recommendation 7)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commissioner of Internal Revenue should, in collaboration with the Commissioner of Social Security, clearly define data elements they exchange with SSA. (Recommendation 8)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commissioner of Social Security should, in collaboration with the Commissioner of Internal Revenue, develop and document a plan for updating future CAWR MOUs. The plan should identify actions, time frames, and responsible parties, including executive leadership. (Recommendation 9)

Agency: Social Security Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commissioner of Social Security should, in collaboration with the Commissioner of Internal Revenue, develop and implement goals and performance measures for the CAWR MOU. (Recommendation 10)

Agency: Social Security Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commissioner of Social Security should, in collaboration with the Commissioner of Internal Revenue, develop and document a strategy for assuring that the reviews required by the updated MOU are completed within the specified time frames. (Recommendation 11)

Agency: Social Security Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commissioner of Social Security should, in collaboration with the Commissioner of Internal Revenue, clearly define the data elements they exchange with IRS. (Recommendation 12)

Agency: Social Security Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of OMB, working with DHS, should develop a government-wide communications strategy to inform and, as appropriate, involve Congress, employees, and other stakeholders in implementation of the reform proposal to solve the cybersecurity workforce shortage. (Recommendation 1)

Agency: Executive Office of the President: Office of Management and Budget: Office of the Director
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of OMB, working with DHS, should establish a dedicated government-wide leadership team with responsibility for implementing the reform proposal to solve the cybersecurity workforce shortage. (Recommendation 2)

Agency: Executive Office of the President: Office of Management and Budget: Office of the Director
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of OMB, working with DHS, should develop a government-wide implementation plan with goals, timelines, key milestones, and deliverables to track and communicate implementation progress of the reform proposal to solve the cybersecurity workforce shortage. (Recommendation 3)

Agency: Executive Office of the President: Office of Management and Budget: Office of the Director
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of OMB, working with DHS, should provide additional information to describe how the projects and activities associated with the reform proposal to solve the cybersecurity workforce shortage will address our high-risk issues related to ensuring the cybersecurity of the nation. (Recommendation 4)

Agency: Executive Office of the President: Office of Management and Budget: Office of the Director
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of OMB, working with DHS, should develop a government-wide workforce plan that assesses the effects of the reform proposal to solve the cybersecurity workforce shortage on the current and future federal workforce. (Recommendation 5)

Agency: Executive Office of the President: Office of Management and Budget: Office of the Director
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of OMB should assess the costs and benefits of options for operating the GEAR Center. (Recommendation 6)

Agency: Executive Office of the President: Office of Management and Budget: Office of the Director
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of OMB should develop an implementation plan that includes outcome-oriented goals, timelines, key milestones, and deliverables to track and communicate implementation progress of the reform proposal to establish the GEAR Center. (Recommendation 7)

Agency: Executive Office of the President: Office of Management and Budget: Office of the Director
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of NHTSA should document an evaluation plan for the Crash Injury Research and Engineering Network pedestrian pilot program that includes criteria for determining whether and how to scale the pilot program to ensure that the piloted data-collection and analysis procedures will address NHTSA's data needs related to pedestrian injuries and vehicle characteristics. (Recommendation 1)

Agency: Department of Transportation: National Highway Traffic Safety Administration
Status: Open

Comments: As of July 2020, NHTSA reported that it plans to develop an evaluation plan for the CIREN pedestrian pilot program by April 30, 2021 to inform decisions about further investigative pedestrian crash studies. According to NHTSA this plan will address research needs categorized as either crash worthiness, crash avoidance, or behavioral in nature, and will include criteria for investigative study elements and the scope or scalability of those studies. NHTSA also reported that in developing the evaluation plan it will consider input from stakeholders, including the first-hand experience from the CIREN pilot study sites. GAO will continue to monitor NHTSA's progress in addressing this recommendation.

Recommendation: The Administrator of NHTSA should document the overall process for making changes to NCAP, including established criteria and milestones for decisions, and share this process with external stakeholders. (Recommendation 2)

Agency: Department of Transportation: National Highway Traffic Safety Administration
Status: Open

Comments: In July 2020, NHTSA reported that it is developing proposed updates to NCAP, which it plans to publish in a notice in the Federal Register by the end of 2020. According to NHTSA this notice will clarify the process by which NHTSA updates NCAP, and after receiving and responding to comments, NHTSA plans to update its website to provide information to stakeholders on how the agency considers and finalizes changes to NCAP. GAO will continue to monitor NHTSA's actions to address this recommendation.

Recommendation: The Administrator of NHTSA should decide whether to include pedestrian safety tests in NCAP and NHTSA should communicate this decision and rationale to relevant stakeholders and the public. (Recommendation 3)

Agency: Department of Transportation: National Highway Traffic Safety Administration
Status: Open

Comments: In July 2020, NHTSA reported that it is developing its proposal on planned changes to NCAP, which is expected to include pedestrian safety tests, and is working to publish a notice to the Federal Register by the end of 2020. According to NHTSA, this process will include receiving public comment on the proposal, which the agency will consider in deciding and communicating NHTSA's next stages. As stated in GAO's report, in the absence of a decision on whether to include pedestrian safety testing in NCAP, and the rationale for that decision, stakeholders lack clarity on whether NHTSA is using all of the policy tools at its disposal to address emerging safety risks and to achieve its strategic objectives. GAO will continue to monitor NHTSA's efforts to address this recommendation.

Recommendation: The Assistant Secretary of the Air Force for Acquisition, Technology and Logistics should direct the Chief Architect to develop a plan to attain mature technologies when needed for each ABMS development area, which includes an initial list of technologies and an assessment of their maturity that is updated to reflect changes, and update Congress quarterly. (Recommendation 1)

Agency: Department of Defense: Department of the Air Force: Office of the Assistant Secretary of the Air Force (Acquisition)
Status: Open

Comments: DOD agreed with this recommendation but, as of August 2020, has not yet taken any action to implement it. Officials indicated that in the first quarter of fiscal year 2021 the department expects to provide Congress with an initial list of technologies and an assessment of their maturity, and a plan to attain mature technologies for each development area. We will continue to monitor DOD's actions to implement this recommendation.

Recommendation: The Assistant Secretary of the Air Force for Acquisition, Technology and Logistics should direct the Chief Architect to prepare a cost estimate that is developed in accordance with cost estimating leading practices, to include regularly updating the estimate to reflect ABMS changes and actual costs, and update Congress quarterly. (Recommendation 2)

Agency: Department of Defense: Department of the Air Force: Office of the Assistant Secretary of the Air Force (Acquisition)
Status: Open

Comments: DOD agreed with this recommendation but, as of August 2020, has not yet taken any action to implement it. Officials indicated that in the first quarter of fiscal year 2021 the department expects to provide Congress with a cost estimate of ABMS development activities. We will continue to monitor DOD's actions to implement this recommendation.

Recommendation: The Assistant Secretary of the Air Force for Acquisition, Technology and Logistics should direct the Chief Architect to prepare an affordability analysis that should be regularly updated, and update Congress quarterly. (Recommendation 3)

Agency: Department of Defense: Department of the Air Force: Office of the Assistant Secretary of the Air Force (Acquisition)
Status: Open

Comments: DOD agreed with this recommendation but, as of August 2020, has not yet taken any action to implement it. Officials indicated that in the fourth quarter of fiscal year 2020 the department expects to provide Congress with the affordability analysis for the fiscal year 2021 budget request. In addition, the department plans to provide an affordability analysis as part of the fiscal year 2022 budget request submission to Congress. We will continue to monitor DOD's actions to implement this recommendation.

Recommendation: The Assistant Secretary of the Air Force for Acquisition, Technology and Logistics should formalize and document acquisition authority and decision-making responsibilities of the Air Force offices involved in the planning and execution of ABMS, to include the Chief Architect. This document should be included as part of the submission to Congress in June 2020 and communicated to the Air Force offices that support ABMS. (Recommendation 4)

Agency: Department of Defense: Department of the Air Force: Office of the Assistant Secretary of the Air Force (Acquisition)
Status: Open

Comments: DOD agreed with this recommendation but, as of August 2020, has not yet taken any action to implement it. Officials indicated that in the fourth quarter of fiscal year 2020 the department expects to provide Congress with documentation of decision-making authorities. We will continue to monitor DOD's actions to implement this recommendation.

Recommendation: The Secretary of Defense should ensure that the DOD CIO takes appropriate steps to ensure implementation of the DC3I tasks. (Recommendation 1)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open
Priority recommendation

Comments: The Department of Defense partially concurred with this recommendation. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Defense should ensure that DOD components develop plans with scheduled completion dates to implement the four remaining CDIP tasks overseen by DOD CIO. (Recommendation 2)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open
Priority recommendation

Comments: The Department of Defense partially concurred with this recommendation. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Defense should ensure that the Deputy Secretary of Defense identifies a DOD component to oversee the implementation of the seven CDIP tasks not overseen by DOD CIO and report on progress implementing them. (Recommendation 3)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open
Priority recommendation

Comments: The Department of Defense did not concur with this recommendation. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Defense should ensure that DOD components accurately monitor and report information on the extent that users have completed the Cyber Awareness Challenge training as well as the number of users whose access to the network was revoked because they have not completed the training. (Recommendation 4)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open

Comments: The Department of Defense partially concurred with this recommendation. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Defense should ensure that the DOD CIO ensures all DOD components, including DARPA, require their users to take the Cyber Awareness Challenge training developed by DISA. (Recommendation 5)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open

Comments: The Department of Defense concurred with this recommendation. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Defense should direct a component to monitor the extent to which practices are implemented to protect the department's network from key cyberattack techniques. (Recommendation 6)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open
Priority recommendation

Comments: The Department of Defense did not concur with this recommendation. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Defense should ensure that the DOD CIO assesses the extent to which senior leaders' have more complete information to make risk-based decisions—and revise the recurring reports (or develop a new report) accordingly. Such information could include DOD's progress on implementing (a) cybersecurity practices identified in cyber hygiene initiatives and (b) cyber hygiene practices to protect DOD networks from key cyberattack techniques. (Recommendation 7)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open
Priority recommendation

Comments: The Department of Defense partially concurred with this recommendation. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commissioner of the Food and Drug Administration, in coordination with the Secretary of Agriculture, should more fully incorporate the seven leading practices for effective collaboration in the agencies' interagency agreement for the joint oversight of cell-cultured meat. (Recommendation 1)

Agency: Department of Health and Human Services: Food and Drug Administration
Status: Open

Comments: FDA and USDA partially concurred with this recommendation. FDA stated that it concurred with the intent of incorporating the seven leading practices into the interagency agreement, and both agencies said that they are open to incorporating the practices into their development of the structure for joint oversight of cell-cultured meat. However, the agencies stated that they did not agree to revise the agreement at this time. FDA and USDA stated that the agreement is a general framework and that incorporating the leading practices would constitute an inappropriate level of detail. Instead, the agencies stated that they believe it would be most valuable to incorporate the leading practices into a more detailed joint framework or standard operating procedure they plan to issue. We appreciate the agencies' willingness to incorporate the leading practices for effective collaboration into their efforts. The March 2019 interagency agreement states that the agencies have the ability to modify it as needed and will review the agreement every 3 years to determine whether they should modify or terminate it. Therefore, the agencies are due to revisit the agreement in March 2022, if not sooner. Regarding the agencies' concern that incorporating the leading practices in the interagency agreement would add an inappropriate level of detail, we note that, as we state in our report, the existing agreement already partially incorporates each of the seven leading practices. We continue to believe that FDA and USDA should more fully incorporate the seven leading practices for effective collaboration into their interagency agreement for the joint oversight of cell-cultured meat. Developing a more detailed joint framework or standard operating procedure in accordance with the existing interagency agreement that incorporates those leading practices would meet the intent of our recommendation to improve the effectiveness of the agencies' collaboration.

Recommendation: The Secretary of Agriculture, in coordination with the Commissioner of the Food and Drug Administration, should more fully incorporate the seven leading practices for effective collaboration in the agencies' interagency agreement for the joint oversight of cell-cultured meat. (Recommendation 2)

Agency: Department of Agriculture
Status: Open

Comments: FDA and USDA partially concurred with this recommendation. FDA stated that it concurred with the intent of incorporating the seven leading practices into the interagency agreement, and both agencies said that they are open to incorporating the practices into their development of the structure for joint oversight of cell-cultured meat. However, the agencies stated that they did not agree to revise the agreement at this time. FDA and USDA stated that the agreement is a general framework and that incorporating the leading practices would constitute an inappropriate level of detail. Instead, the agencies stated that they believe it would be most valuable to incorporate the leading practices into a more detailed joint framework or standard operating procedure they plan to issue. We appreciate the agencies' willingness to incorporate the leading practices for effective collaboration into their efforts. The March 2019 interagency agreement states that the agencies have the ability to modify it as needed and will review the agreement every 3 years to determine whether they should modify or terminate it. Therefore, the agencies are due to revisit the agreement in March 2022, if not sooner. Regarding the agencies' concern that incorporating the leading practices in the interagency agreement would add an inappropriate level of detail, we note that, as we state in our report, the existing agreement already partially incorporates each of the seven leading practices. We continue to believe that FDA and USDA should more fully incorporate the seven leading practices for effective collaboration into their interagency agreement for the joint oversight of cell-cultured meat. Developing a more detailed joint framework or standard operating procedure in accordance with the existing interagency agreement that incorporates those leading practices would meet the intent of our recommendation to improve the effectiveness of the agencies' collaboration.

Recommendation: As the three cell-cultured meat working groups move forward, the Commissioner of the Food and Drug Administration, in coordination with the Secretary of Agriculture, should more fully incorporate the seven leading practices for effective collaboration, such as identifying specific outcomes and a way to monitor and evaluate progress toward outcomes. (Recommendation 3)

Agency: Department of Health and Human Services: Food and Drug Administration
Status: Open

Comments: In March 2020, FDA officials agreed with this recommendation. We will follow up to determine what steps they take to implement the recommendation.

Recommendation: As the three cell-cultured meat working groups move forward, the Secretary of Agriculture, in coordination with the Commissioner of the Food and Drug Administration, should more fully incorporate the seven leading practices for effective collaboration, such as identifying specific outcomes and a way to monitor and evaluate progress toward outcomes. (Recommendation 4)

Agency: Department of Agriculture
Status: Open

Comments: In March 2020, USDA officials agreed with this recommendation. We will follow up to determine what steps they take to implement the recommendation.

Recommendation: The Commissioner of the Food and Drug Administration, in coordination with the Secretary of Agriculture, should clearly document in their interagency agreement, or other publicly available document, which agency will oversee cell-cultured seafood other than catfish. (Recommendation 5)

Agency: Department of Health and Human Services: Food and Drug Administration
Status: Open

Comments: In March 2020, FDA officials agreed with this recommendation. We will follow up to determine what steps they take to implement the recommendation.

Recommendation: The Secretary of Agriculture, in coordination with the Commissioner of the Food and Drug Administration, should clearly document in their interagency agreement, or other publicly available document, which agency will oversee cell-cultured seafood other than catfish. (Recommendation 6)

Agency: Department of Agriculture
Status: Open

Comments: In March 2020, USDA officials agreed with this recommendation. We will follow up to determine what steps they take to implement the recommendation.

Recommendation: The TSA Administrator should update the BASE cybersecurity template to ensure it reflects cybersecurity key practices, including the Detect and Recover functions outlined in the NIST Cybersecurity Framework. (Recommendation 2)

Agency: Department of Homeland Security: Transportation Security Administration
Status: Open

Comments: TSA concurred with this recommendation and said it would take steps to implement it by updating the BASE Cybersecurity Security Action Item section to ensure it reflects the NIST Cybersecurity Framework Detect and Recover functions. When we confirm what actions TSA has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Defense should ensure that the Assistant Secretary of Defense for Sustainment collaborates with the military departments and the Defense Logistics Agency to collect consistent information on the time to complete key steps in the pre-award contracting process for privatizing utility services. (Recommendation 1)

Agency: Department of Defense: Deputy Secretary of Defense
Status: Open

Comments: DOD concurred with the recommendation. In July 2020, the Assistant Secretary of Defense for Sustainment noted that the Secretary of Defense has drafted an updated policy to direct military departments, their contract agencies, and Defense Logistics Agency-Energy to collect pre-award contract data and utilize DOD's Utilities Privatization Working Group to discuss and share data. According to DOD officials, the Department will finalize the policy by December 2021.

Recommendation: The Secretary of Defense should ensure that the Assistant Secretary of Defense for Sustainment collaborates with the military departments and the Defense Logistics Agency to develop a mechanism to store and archive lessons learned regarding the pre-award contracting process for privatizing utility services. (Recommendation 2)

Agency: Department of Defense: Deputy Secretary of Defense
Status: Open

Comments: DOD concurred with the recommendation. In July 2020, the Assistant Secretary of Defense for Sustainment noted that the Secretary of Defense will collaborate with the military departments, to include the Defense Logistics Agency-Energy, to select and utilize an existing federal government information technology platform to collect, analyze, archive, and share key data, lessons learned, and best practices pertaining to pre-award contracting processes and oversight of utilities privatization contracts. The Department will select a platform by December 2021.

Recommendation: GSA should assess and address the reliability of the information used to calculate reported cost savings for the broker program. (Recommendation 1)

Agency: General Services Administration
Status: Open
Priority recommendation

Comments: In June 2020, GSA said the agency would validate system data through regional and broker outreach and fully utilize validated system data to manage the broker program. The agency also said it will develop a quality control plan and follow-up on outcomes. We will continue to monitor GSA's progress with implementing this recommendation.

Recommendation: GSA should develop outcome-based metrics to evaluate the effectiveness of using brokers to supplement the GSA's leasing workforce. (Recommendation 2)

Agency: General Services Administration
Status: Open

Comments: Although GSA initially did not concur with this recommendation, the agency stated in June 2020 that it agrees with the recommendation and will take steps to implement it. Specifically, GSA plans to revise the broker performance standards and document broker effectiveness through lease cost avoidance, timely lease replacement, and earned commission credits. We will continue to monitor GSA's progress with implementing this recommendation.

Recommendation: The Secretary of the Department of Agriculture should direct the Assistant Secretary for Civil Rights to publicize promising practices for Title IX compliance on its websites for their university grantees. (Recommendation 1)

Agency: Department of Agriculture
Status: Open

Comments: USDA agreed with the recommendation. In its March 2020 formal comment letter, the department stated that it will ensure promising practices information is posted to websites for the Office of the Assistant Secretary for Civil Rights (OASCR) and the National Institute of Food and Agriculture. Additionally, a notice will be sent to universities to ensure they are aware the information is available, along with specifics regarding access to the same.

Recommendation: The Secretary of Energy should direct the Director of the Office of Economic Impact and Diversity to publicize promising practices for Title IX compliance on its websites for their university grantees. (Recommendation 2)

Agency: Department of Energy: Office of the Secretary
Status: Open

Comments: DOE agreed with the recommendation. In its February 2020 formal comment letter, the department stated that the Office of Civil Rights and Diversity (OCRD) has identified promising practices on an ongoing basis in its Title IX compliance review reports. OCRD will develop and publicize a promising practices guide on its website for reference by university grantees. The estimated completion date is June 1, 2020. GAO will review this action once it receives documentation from DOE.

Recommendation: The Secretary of the Department of Health and Human Services should direct the Director for the Office for Civil Rights to publicize a stand-alone list of promising practices for Title IX compliance on its websites for their university grantees. (Recommendation 3)

Agency: Department of Health and Human Services: Office of the Secretary
Status: Open

Comments: HHS agreed with the recommendation. In its February 2020 formal comment letter, the department stated the Office for Civil Rights will incorporate effective practices from materials posted on its website and external sources in a stand-alone list of effective practices to help universities comply with Title IX. The Office for Civil Rights will also draw from its Title IX enforcement work to update the effective practices list on an ongoing basis.

Recommendation: The Secretary of Energy should direct the Director of the Office of Economic Impact and Diversity to finalize and publish Title IX complaint procedures, consistent with DOJ's regulations. (Recommendation 4)

Agency: Department of Energy: Office of the Secretary
Status: Open

Comments: DOE agreed with the recommendation. In its February 2020 formal comment letter, the department stated that the Office of Civil Rights and Diversity (OCRD) has developed a draft outline of complaint procedures. OCRD is benchmarking these procedures against NASA and NSF external civil rights complaint procedures. OCRD will finalize and publish Title IX complaint procedures, consistent with the Department of Justice's regulations. The estimated completion date is October 31, 2020.

Recommendation: The Secretary of the Department of Agriculture should direct the Assistant Secretary for Civil Rights to finalize and publish revised Title IX complaint procedures. (Recommendation 5)

Agency: Department of Agriculture
Status: Open

Comments: USDA agreed with the recommendation to finalize and publish Title IX complaint procedures. According to the department's March 2020 formal comment letter, USDA's Departmental Regulation (DR) 4330-002, Nondiscrimination in Program and Activities Receiving Federal Financial Assistance from USDA, addresses processing Title IX administrative complaints filed with the Department in any program or activity receiving financial assistance from USDA. The Departmental Regulation (DR) 4330-002 was revised in 2019 and is currently in the clearance process for publication.

Recommendation: The Secretary of the Department of Agriculture should direct the Assistant Secretary for Civil Rights to clarify on its website that individuals on USDA-funded grants can file Title IX complaints through the Assistant Secretary for Civil Rights—including clarifying who is considered "customers." (Recommendation 6)

Agency: Department of Agriculture
Status: Open

Comments: USDA agreed with this recommendation. According to the department's March 2020 formal comment letter, USDA's Office of the Assistant Secretary for Civil Rights (OASCR) will add language on its website to make clear recipients of USDA-funded grants are included in the definition of a customer and, as such, may file Title IX complaints through OASCR. Additionally, the requested information will be added to the Frequently Asked Questions section on OASCR' s website.

Recommendation: The Secretary of the Department of Health and Human Services should direct the Director for the Office for Civil Rights to assess the feasibility of receiving and reviewing concerns of sex discrimination—including sexual harassment—and communicating to individuals on agency-funded grants the option to notify the agency of these concerns, outside of the Title IX complaint process. (Recommendation 7)

Agency: Department of Health and Human Services: Office of the Secretary
Status: Open

Comments: HHS agreed with the recommendation. In its February 2020 formal comment letter, the department stated that outside of the Title IX enforcement process, the Office for Civil Rights updated its sex discrimination web pages to inform persons on how to file complaints of discrimination directly to the Office for Civil Rights, including complaints of sexual harassment. The Office for Civil Rights has also incorporated information about Title IX rights and obligations in outreach material used on university campuses, including information addressing sexual harassment.

Recommendation: The Secretary of Energy should direct the Director of the Office of Economic Impact and Diversity to assess the feasibility of receiving and reviewing concerns of sex discrimination—including sexual harassment—and communicating to individuals on agency-funded grants the option to notify the agency of these concerns, outside of the Title IX complaint process. (Recommendation 8)

Agency: Department of Energy: Office of the Secretary
Status: Open

Comments: DOE agreed with the recommendation. In its February 2020 formal comment letter, the department stated that the Office of Civil Rights and Diversity (OCRD) will evaluate the feasibility of receiving and reviewing concerns of discrimination, including sexual harassment, outside of the Title IX complaint process described in DOE's Title IX regulations, as well as communicating this option to individuals on DOE funded grants. The estimated completion date is December 31, 2020.

Recommendation: The Administrator of NASA should assess the feasibility of receiving and reviewing concerns of sex discrimination—including sexual harassment—and communicating to individuals on agency-funded grants the option to notify the agency of these concerns, outside of the Title IX complaint process. (Recommendation 9)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: NASA agreed with the recommendation. According to the agency's February 2020 formal comment letter, NASA plans to assess the feasibility of receiving and reviewing concerns of sex discrimination and harassment and communicating to individuals on agency-funded grants the option to notify the agency of these concerns. In conducting the feasibility assessment, NASA will benchmark with agencies that currently have the capability to receive and review concerns of sex discrimination, including sexual harassment. NASA will also examine internal resources to ensure successful implementation. NASA estimates completion by September 20, 2020.

Recommendation: The Secretary of the Department of Agriculture should direct the Assistant Secretary for Civil Rights to assess the feasibility of receiving and reviewing concerns of sex discrimination—including sexual harassment—and communicating to individuals on agency-funded grants the option to notify the agency of these concerns, outside of the Title IX complaint process. (Recommendation 10)

Agency: Department of Agriculture
Status: Open

Comments: USDA agreed with this recommendation. According to the department's March 2020 formal comment letter, USDA is to direct the Office of the Assistant Secretary for Civil Rights (OASCR) to assess the feasibility of receiving and reviewing concerns of sex discrimination (including sexual harassment) and including language in agency-funded grants on the option to notify the agency of harassment issues outside of the Title IX complaint process. The Office of the Mission Area Liaison within OASCR will assess the feasibility of creating a tracking system to capture inquiries and concerns outside of the Title IX complaint process. If feasible, the system will serve as a risk assessment tool to identify issues, potential violations, trends, risks, and areas prime for focused compliance review, according to USDA's formal comment letter.

Recommendation: The Secretary of the Department of Health and Human Services should direct the Director for the Office for Civil Rights and the Director of NIH to develop and implement formal procedures for sharing relevant information about Title IX (compliance reviews, violations, and complaints) and sex discrimination concerns, including sexual harassment. For example, HHS components should internally share information regarding findings of Title IX violations, concerns of sex discrimination, including sexual harassment, and Title IX compliance review reports. (Recommendation 11)

Agency: Department of Health and Human Services: Office of the Secretary
Status: Open

Comments: HHS agreed with the recommendation. In its February 2020 formal comment letter, the department stated that the Office for Civil Rights and NIH will review the current procedure for sharing information, and development and implement (as necessary) formal procedures for sharing relevant information about Title IX and sexual harassment concerns. Furthermore, an action plan to address the recommendation will be provided in the department's 180-day letter response to Congress.

Recommendation: The Secretary of Energy should establish goals and an overall plan to assess all of the agency's sexual harassment prevention efforts for their university grantees, including methods to regularly monitor and evaluate its sexual harassment prevention policies and communication mechanisms (e.g. Title IX or sex discrimination websites). (Recommendation 12)

Agency: Department of Energy: Office of the Secretary
Status: Open

Comments: DOE agreed with the recommendation. In its February 2020 formal comment letter, the department stated that the Office of Civil Rights and Diversity will conduct research into best practices for harassment prevention efforts for university grantees and benchmark with other federal agencies. The estimated completion date for establishment of goals is January 31, 2021 and the estimated completion date for establishment of an overall plan is August 31, 2021.

Recommendation: The Secretary of the Department of Health and Human Services should establish goals and an overall plan to assess all of the agency's sexual harassment prevention efforts for their university grantees, including methods to regularly monitor and evaluate its sexual harassment prevention policies and communication mechanisms (e.g. Title IX or sex discrimination websites). (Recommendation 13)

Agency: Department of Health and Human Services: Office of the Secretary
Status: Open

Comments: HHS agreed with the recommendation. In its February 2020 formal comment letter, the department stated that NIH has created goals for all NIH grantee sexual harassment prevention efforts, as noted in GAO's report. NIH will develop a plan to assess progress towards achieving those goals, including methods to regularly monitor and evaluate policies and communication methods. To the extent Title IX enforcement and outreach efforts may prevent sexual harassment, the Office for Civil Rights will develop a plan for leveraging enforcement efforts and outreach communications to help HHS grantees implement prevention efforts. HHS will submit an action plan that fully address department efforts regarding this recommendation in its 180-day letter response to Congress.

Recommendation: The Administrator of NASA should establish goals and an overall plan to assess all of the agency's sexual harassment prevention efforts for their university grantees, including methods to regularly monitor and evaluate its sexual harassment prevention policies and communication mechanisms (e.g. Title IX or sex discrimination websites). (Recommendation 14)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: NASA agreed with the recommendation. According to the agency's February 2020 formal comment letter, NASA accepts its responsibility to establish policies and communication mechanisms to help university grantees to prevent sexual harassment, and the agency is committed to ongoing monitoring and evaluation of these efforts. At the same time, NASA judges that the most effective way to discharge these responsibilities is to adopt the approach now being developed by the National Science and Technology Council. NASA will establish goals, plans, and methods pursuant to this recommendation by adopting the policies and approaches developed through the interagency process. The estimated completion is to be determined based on timelines and milestones established by the Office of Science and Technology Policy's Safe and Inclusive Research Environments Subcommittee Subcommittee.

Recommendation: The Director of NSF should establish goals and an overall plan to assess all of the agency's sexual harassment prevention efforts for their university grantees, including methods to regularly monitor and evaluate its sexual harassment prevention policies and communication mechanisms (e.g. Title IX or sex discrimination websites). (Recommendation 15)

Agency: National Science Foundation
Status: Open

Comments: NSF agreed with the recommendation. According to the agency's February 2020 formal comment letter, NSF is embarking on an assessment process to improve its policies and practices continually in order to achieve the goal of safe and inclusive research environments.

Recommendation: The Secretary of the Department of Agriculture should establish goals and an overall plan to assess all of the agency's sexual harassment prevention efforts for their university grantees, including methods to regularly monitor and evaluate its sexual harassment prevention policies and communication mechanisms (e.g. Title IX or sex discrimination websites). (Recommendation 16)

Agency: Department of Agriculture
Status: Open

Comments: USDA agreed with this recommendation. According to the department's March 2020 formal comment letter, USDA will consider developing language to include in university grantees' terms and conditions regarding allegations of sexual harassment. Additionally, the Office of the Assistant Secretary for Civil Rights (OASCR) will reach out to other agencies within the Title IX Quarterly Working Group to assess best practices for monitoring and evaluating sexual harassment prevention policies and communication mechanisms. Finally, USDA will increase its communication with university grantees and increase oversight through compliance reviews.

Recommendation: In consultation with DOE, HHS, NASA, NSF, and USDA, the Assistant Attorney General for the Department of Justice should direct the responsible Civil Rights Division sections to fully adopt two federal interagency leading practices—agree on agency's roles and responsibilities and develop mechanisms to monitor, evaluate, and report results of collaborative efforts, for its Quarterly Title IX STEM discussion group. (Recommendation 17)

Agency: Department of Justice: Office of the Assistant Attorney General for Administration
Status: Open

Comments: DOJ generally agreed with the recommendation. According to the department's February 2020 formal comment letter, the Civil Rights Division (CRT) is prepared to delineate agencies' roles and responsibilities within the Quarterly Title IX STEM Discussion Group and is willing to develop an enhanced process for evaluating, monitoring, and reporting on the group's collaborations in enforcing Title IX that is achievable within DOJ's current resource allocation, or if more resources become available.

Recommendation: The Secretary of Defense should ensure the Under Secretary of Defense for Acquisition and Sustainment, in consultation with the F-35 Program Executive Officer, develops a program-wide process for measuring, collecting, and tracking information on how ALIS is affecting the performance of the F-35 fleet to include, but not be limited to, its effects on mission capability rates. (Recommendation 1)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Defense should ensure the Under Secretary of Defense for Acquisition and Sustainment, in consultation with the F-35 Program Executive Officer, develops and implements a strategy for the re-design of ALIS. The strategy should be detailed enough to clearly identify and assess the goals, key risks or uncertainties, and costs of re-designing the system. (Recommendation 2)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of BLM should establish outcome-oriented performance measures to assess the effectiveness of the reorganization. (Recommendation 1)

Agency: Department of the Interior: Bureau of Land Management
Status: Open

Comments: The department neither agreed nor disagreed with our recommendation. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of BLM should develop an implementation plan for the reorganization that includes milestones and deliverables to track and communicate implementation progress. (Recommendation 2)

Agency: Department of the Interior: Bureau of Land Management
Status: Open

Comments: The department neither agreed nor disagreed with our recommendation. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of BLM should complete a strategic workforce plan that addresses how it will recruit for and fill vacant positions resulting from the relocations. (Recommendation 3)

Agency: Department of the Interior: Bureau of Land Management
Status: Open

Comments: The department neither agreed nor disagreed with our recommendation. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of the Interior should ensure its bureau leadership incorporates key practices for effective agency reforms prior to implementing reorganization activities at other Interior bureaus. (Recommendation 4)

Agency: Department of the Interior: Office of the Secretary
Status: Open

Comments: The department neither agreed nor disagreed with our recommendation. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Under Secretary of Defense for Research and Engineering should direct the Laboratories and Personnel Office to take steps to ensure that the details of the pilot program's data protections are incorporated into the existing agreements. (Recommendation 1)

Agency: Department of Defense: Office of the Under Secretary of Defense for Research and Engineering
Status: Open

Comments: The Under Secretary of Defense for Research and Engineering (OUSD(R&E)), Laboratories and Personnel Office (L&PO) concurred with this recommendation. In May 2020, OUSD(R&E)/L&PO stated it will require the Primary Sponsor for each applicable federally funded research and development center (FFRDC) to provide documentation that shows that the details of the pilot program's data protections have been incorporated into existing sponsoring agreements and contracts, and estimated these actions would be completed in early Fall 2020.

Recommendation: The Under Secretary of Defense for Research and Engineering should direct the Laboratories and Personnel Office to take steps to ensure that the FFRDCs and sponsors are implementing the pilot program's protections for sensitive data. (Recommendation 2)

Agency: Department of Defense: Office of the Under Secretary of Defense for Research and Engineering
Status: Open

Comments: The Under Secretary of Defense for Research and Engineering (OUSD(R&E)), Laboratories and Personnel Office (L&PO) concurred with this recommendation. In May 2020, OUSD(R&E)/L&PO stated it will task the Primary Sponsor for each applicable federally funded research and development center (FFRDC) to provide a report detailing the FFRDC's plan for implementing the pilot program's protections for sensitive data and confirming that the FFRDC is adhering to that plan. OUSD(R&E)/L&PO estimated these actions would be completed in early Fall 2020.

Recommendation: The Under Secretary of Defense for Research and Engineering should direct the Laboratories and Personnel Office to establish a monitoring and oversight mechanism to ensure that primary sponsors submit complete information on pilot projects, as required by DOD's guidance for the pilot program. (Recommendation 3)

Agency: Department of Defense: Office of the Under Secretary of Defense for Research and Engineering
Status: Open

Comments: The Under Secretary of Defense for Research and Engineering (OUSD(R&E)), Laboratories and Personnel Office (L&PO) concurred with this recommendation. In May 2020, OUSD(R&E)/L&PO stated it will develop a monitoring and oversight plan, and estimated it would be completed in early Fall 2020.

Recommendation: The Under Secretary of Defense for Research and Engineering should direct the Laboratories and Personnel Office to develop a plan that outlines the methodology by which DOD will assess the pilot and how and when information collected will be analyzed to evaluate the pilot program. (Recommendation 4)

Agency: Department of Defense: Office of the Under Secretary of Defense for Research and Engineering
Status: Open

Comments: The Under Secretary of Defense for Research and Engineering (OUSD(R&E)), Laboratories and Personnel Office (L&PO) concurred with this recommendation. In May 2020, OUSD(R&E)/L&PO stated it will develop and coordinate a plan that outlines the methodology by which DOD will assess the pilot as well as the methodology for collecting and analyzing information to evaluate the pilot program. OUSD(R&E)/L&PO estimated these actions would be completed in early Fall 2020.

Recommendation: The Under Secretary of Defense for Research and Engineering should direct the Laboratories and Personnel Office to develop a plan to identify and evaluate lessons learned from the pilot program. (Recommendation 5)

Agency: Department of Defense: Office of the Under Secretary of Defense for Research and Engineering
Status: Open

Comments: The Under Secretary of Defense for Research and Engineering (OUSD(R&E)), Laboratories and Personnel Office (L&PO) concurred with this recommendation. In May 2020, OUSD(R&E)/L&PO stated it will develop a plan to identify and evaluate lessons learned from the pilot program, and estimated the plan would be completed in early Fall 2020.

Recommendation: The Under Secretary of Defense for Research and Engineering should direct the Laboratories and Personnel Office to develop a plan for obtaining input from stakeholders on the pilot program. (Recommendation 6)

Agency: Department of Defense: Office of the Under Secretary of Defense for Research and Engineering
Status: Open

Comments: The Under Secretary of Defense for Research and Engineering (OUSD(R&E)), Laboratories and Personnel Office (L&PO) concurred with this recommendation. In May 2020, OUSD(R&E)/L&PO stated it will develop a plan to obtain stakeholder inputs for use in evaluating the pilot program, and estimated the plan would be completed in early Fall 2020.

Recommendation: The Commandant of the Coast Guard should establish a systematic mechanism to track implementation and measure the Coast Guard's progress in achieving organizational change goals. (Recommendation 1)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: The Coast Guard concurred with this recommendation and said it would establish a policy requiring that requests to change organizational structure include a plan, and establish a mechanism to track implementation and measure progress in achieving organizational change goals. The Coast Guard stated that this will be completed by December 31, 2020.

Recommendation: The Commandant of the Coast Guard should establish a mechanism to periodically seek and monitor employee satisfaction with organizational change efforts. (Recommendation 2)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: The Coast Guard concurred with this recommendation and agreed that mechanisms to periodically seek and monitor employee satisfaction with organizational change efforts are valuable. However, they stated that their current feedback mechanisms capture this information therefore they requested we close the recommendation. The Coast Guard also stated its preference to add questions to existing surveys rather than create new survey instruments. However, we found that the Coast Guard's current surveys do not capture employee's perspectives as organizational changes are implemented. This recommendation remains open pending Coast Guard providing evidence of its actions to modify existing surveys with added questions that monitor employee satisfaction with organizational changes.

Recommendation: The Commandant of the Coast Guard should update its Manpower Requirements Manual with guidance for how to execute its manpower requirements determination process, and take steps to ensure the process is implemented. (Recommendation 3)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: The Coast Guard concurred with this recommendation and said it would develop a Tactics, Techniques and Procedures document to provide guidance for executing the manpower requirements determination process. This would provide additional guidance on the overall manpower requirements determination process, including explicit directions for the collection and analysis of manpower data, and the establishment of enterprise standards for key factors and allowances used when conducting analysis. The Coast Guard stated that this will be completed by September 30, 2020.

Recommendation: The Commandant of the Coast Guard should track and document the extent to which it has completed manpower requirements analyses and determinations for each unit type. (Recommendation 4)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: The Coast Guard concurred with this recommendation and said it would initiate the process to document and track Manpower Requirements in the Coast Guard's human resources system. The Coast Guard stated that this would be completed by December 31, 2020.

Recommendation: The Commandant of the Coast Guard should update its April 2018 Manpower Requirements Plan to include time frames and milestones for completing manpower requirements analyses and determinations for all positions and units. (Recommendation 5)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: The Coast Guard concurred with this recommendation and said it would update its Manpower Requirements Plan during the next required periodic report submitted to Congress, in fiscal year 2022. The Coast Guard stated that this would be completed by March 31, 2022.

Recommendation: The Commandant of the Coast Guard should determine the resources its manpower requirements determination program needs, both staff and funding, to achieve its goal of completing manpower requirements determinations for all positions and units. (Recommendation 6)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: The Coast Guard concurred with this recommendation and said it would review its 2010 manpower requirements analysis that determined the resources the Coast Guard required for its manpower requirements determination program. Its Office of Human Resources Strategy and Capability will then re-validate the inputs and update the findings for the manpower requirements analysis to reflect the currents needs of the manpower requirements determination program. The Coast Guard stated that this will be completed by September 30, 2020.

Recommendation: The Director of NIST should establish time frames for completing NIST's initiatives, to include the information security measurement program and the cybersecurity framework starter profile, to enable the identification of sector-wide improvements from using the framework in the protection of critical infrastructure from cyber threats. (Recommendation 1)

Agency: Department of Commerce: National Institute of Standards and Technology: Office of the Director
Status: Open

Comments: In written comments provided in July 2020, the Department of Commerce (Commerce) stated that it agreed with our recommendation. It noted that to further establish its Cybersecurity Measurement program, the National Institute of Standards and Technology (NIST) will document its Cybersecurity Measurement program's scope, objectives, and approach, including an inventory of existing measurement resources. Additionally, to further amplify small business awareness of cybersecurity, and of the Cybersecurity Framework, it noted that NIST will develop and publish two Cybersecurity Framework starter profiles tailored toward risk management of business processes important to small business owners. The expected completion date is September 2020.

Recommendation: The Secretary of Agriculture, in coordination with the Secretary of Health and Human Services, should take steps to consult with respective sector partner(s), such as the SCC, DHS, and NIST, as appropriate, to collect and report sector-wide improvements from use of the framework across its critical infrastructure sector using existing initiatives. (Recommendation 2)

Agency: Department of Agriculture
Status: Open

Comments: In written comments provided in April 2020, the United States Department of Agriculture (USDA) stated that it concurred with our recommendation. The department stated that it routinely shared framework guidance provided by the Department of Homeland Security and discussed the framework as part of its monthly Sector conference calls and biannual Sector Meetings. It also added that the department will continue to strengthen its coordination efforts.

Recommendation: The Secretary of Defense should take steps to consult with respective sector partner(s), such as the SCC, DHS, and NIST, as appropriate, to collect and report sector-wide improvements from use of the framework across its critical infrastructure sector using existing initiatives. (Recommendation 3)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open

Comments: In written comments provided in July 2020, the Department of Defense concurred with our recommendation. The department noted that it had developed processes and resources to help determine the type of framework adoption across the Defense Industrial Base. These include conducting assessments on the implementation of NIST Special Publication (SP) 800-171 , "Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations;" and releasing the Defense Industrial Base Implementation Guide for the NIST Cybersecurity Framework. However, the department has yet to report on sector-wide improvements using these processes and resources. Until it does so, its critical infrastructure sector may not fully understand the value of the framework to better protect its critical infrastructure from cyber threats. The expected completion dates are in September and November 2020.

Recommendation: The Secretary of Energy should take steps to consult with respective sector partner(s), such as the SCC, DHS, and NIST, as appropriate, to collect and report sector-wide improvements from use of the framework across its critical infrastructure sector using existing initiatives. (Recommendation 4)

Agency: Department of Energy: Office of the Secretary
Status: Open

Comments: In written comments provided in February 2020, the Department of Energy (DOE) stated that it partially agreed with our recommendation. It noted that DOE will coordinate with the Energy Sector to develop an understanding of sector-wide improvements from use of the framework. The expected completion date is December 2021.

Recommendation: The Administrator of the Environmental Protection Agency should take steps to consult with respective sector partner(s), such as the SCC, DHS, and NIST, as appropriate, to collect and report sector-wide improvements from use of the framework across its critical infrastructure sector using existing initiatives. (Recommendation 5)

Agency: Environmental Protection Agency
Status: Open

Comments: In written comments provided in July 2020, the Environmental Protection Agency (EPA) stated that it agreed with our recommendation. It noted that it will consult with the Water Sector Coordinating Council, the Department of Homeland Security, and the National Institute of Standards and Technology, as appropriate, to investigate options to collect and report sector-wide improvements, consistent with statutory requirements and the Sector's willingness to participate. However, the department did not provide a timeframe for completing these actions.

Recommendation: The Administrator of the General Services Administration, in coordination with the Secretary of Homeland Security, should take steps to consult with respective sector partner(s), such as the Coordinating Council and NIST, as appropriate, to collect and report sector-wide improvements from use of the framework across its critical infrastructure sector using existing initiatives. (Recommendation 6)

Agency: General Services Administration: Office of the Administrator
Status: Open

Comments: In April 2020, the General Services Administration (GSA), in coordination with its co-SSA, the Department of Homeland Security (DHS), provided documentation demonstrating that it had initiated steps to collect and report on sector-wide improvements from use of the NIST Cybersecurity Framework across its critical infrastructure sector. Specifically, the agencies from the government sector had submitted their risk management reports to DHS and OMB that described agencies' action plans to implement the framework, as required under Executive Order 13800 and evaluated the agencies against the five functions of the NIST Cybersecurity Framework: Identify, Detect, Protect, Respond, and Recover. The risk management reports are included as part of OMB's FISMA Annual Report to Congress. According to OMB's FISMA Annual Report to Congress, OMB and DHS determined that 71 of 96 agencies (74 percent) have cybersecurity programs that are either at risk or high risk. As a result, improvements were identified in the form of four core actions in the Federal Cybersecurity Risk Determination Report and Action Plan, which include: (1) Implementing the Cyber Threat Framework to increase cybersecurity threat awareness among Federal agencies, (2) Standardize IT and cybersecurity capabilities, (3) Consolidate agency SOCs to improve incident detection and response capabilities, and (4) Drive accountability across agencies through improved governance processes, recurring risk assessments, and OMB's engagements with agency leadership. We are waiting for additional information from GSA and DHS on the status of the four core actions.

Recommendation: The Secretary of Health and Human Services, in coordination with the Secretary of Agriculture, should take steps to consult with respective sector partner(s), such as the SCC, DHS, and NIST, as appropriate, to collect and report sector-wide improvements from use of the framework across its critical infrastructure sector using existing initiatives. (Recommendation 7)

Agency: Department of Health and Human Services: Office of the Secretary
Status: Open

Comments: In written comments provided in January 2020, the Department of Health and Human Services (HHS) stated that it concurred with our recommendation. The department noted that it would work with the appropriate entities to refine and communicate best practices to the sector.

Recommendation: The Secretary of Homeland Security should take steps to consult with respective sector partner(s), such as the SCC and NIST, as appropriate, to collect and report sector-wide improvements from use of the framework across its critical infrastructure sectors using existing initiatives. (Recommendation 8)

Agency: Department of Homeland Security: Office of the Secretary
Status: Open

Comments: In written comments provided in February 2020, the Department of Homeland Security (DHS) stated that it agreed with our recommendation. It noted that in coordination with the IT Sector Coordinating Council, the department recently issued a survey to small and mid-sized IT sector partners to better understand framework adoption and use within the IT sector. Once the results of the survey are received, DHS's Cybersecurity and Infrastructure Security Agency will determine the feasibility of issuing similar surveys to other sectors, and the potential timelines for completing sector-specific survey modifications, issuing surveys, compiling responses, and developing white papers on the status of framework adoption for each sector. The department expects completion of this work by December 31, 2021.

Recommendation: The Secretary of Transportation, in coordination with the Secretary of Homeland Security, should take steps to consult with respective sector partner(s) such as the SCC and NIST, as appropriate, to collect and report sector-wide improvements from use of the framework across its critical infrastructure sector using existing initiatives. (Recommendation 9)

Agency: Department of Transportation: Office of the Secretary
Status: Open

Comments: In written comments provided in April 2020, the Department of Transportation (DOT) stated that it concurred with our recommendation. It noted that the department (through the Office of the Secretary, Office of Intelligence, Security, and Emergency Response) and the Department of Homeland Security (through the Transportation Security Administration and United States Coast Guard) will coordinate as Co-Sector-Specific Agencies for the Transportation Systems Sector to finalize the development and distribution of a survey instrument to determine the level and type of framework adoption in the Sector. The department expects completion of this work by December 31, 2021.

Recommendation: The Secretary of the Treasury should take steps to consult with respective sector partner(s), such as the SCC, DHS, and NIST, as appropriate, to collect and report sector-wide improvements from use of the framework across its critical infrastructure sector using existing initiatives. (Recommendation 10)

Agency: Department of the Treasury: Office of the Secretary
Status: Open

Comments: In written comments provided in January 2020, the Department of the Treasury (Treasury) stated that it agreed with our recommendation. The department noted that it will assess using the identified initiatives and their viability for collecting and reporting sector-wide improvements from the use of the NIST Framework. The department did not provide a timeframe for completing these actions.

Recommendation: The Secretary of Homeland Security should identify the information about family members apprehended together that its components collectively need to process those family members and communicate that information to its components. (Recommendation 1)

Agency: Department of Homeland Security
Status: Open

Comments: According to DHS, in June 2020, DHS's Office of Immigration Statistics launched a Family Status Data Standards Community of Interest (COI) under the purview of the DHS Immigration Data Integration Initiative. In August 2020, DHS reported that the Family Status COI includes subject matter experts and data system managers from DHS components, the Department of Health and Human Services, and the Executive Office for Immigration Review. The COI's mandate includes drafting common DHS-wide and interagency data standards (common codes, common definitions, common formats) for all topics related to family status, including codes to identify the reasons for family separation, members apprehended together, and unaccompanied children. DHS expects to complete these actions by September 30, 2020. Identifying and communicating department-wide information needs with respect to family members who have been apprehended together should help provide DHS with greater assurance that its components are identifying all individuals who may be eligible for relief from removal from the United States based on their family relationships.

Recommendation: The Secretary of Homeland Security should ensure that, at the time of apprehension, CBP collects the information that DHS components collectively need to process family members apprehended together. (Recommendation 2)

Agency: Department of Homeland Security
Status: Open

Comments: In commenting on a draft of our report, DHS reported that its Office of Immigration Statistics (OIS) will work with relevant components and offices to ensure all required information is collected at the time of apprehension on the Form I-213 when processing family members apprehended together. As of August 2020, DHS reported that DHS OIS continues to work with relevant components and offices to ensure all required information is collected at the time of apprehension on Form I-213 when processing family members apprehended together. DHS expects to complete these actions by September 30, 2020. Collecting information about the relationships between family members apprehended together and documenting that information on the Form I-213 could help address fragmentation among DHS components and improve the information available to other agencies.

Recommendation: The Secretary of Homeland Security should ensure that CBP documents the information that DHS components collectively need to process family members apprehended together on the Form I-213. (Recommendation 3)

Agency: Department of Homeland Security
Status: Open

Comments: In commenting on a draft of our report, DHS reported that, upon implementation of the steps the department plans to take in response to our second recommendation, CBP will issue guidance to the field to ensure that CBP agents and officers document the information that DHS components collectively need to process family members. In August 2020, DHS reported that component agencies continue to collaborate to define the process of family members apprehended together, as will be reflected on CBP Form I-213. DHS estimates issuing this guidance by March 31, 2021. Collecting information about the relationships between family members apprehended together and documenting that information on the Form I-213 could help address fragmentation among DHS components and improve the information available to other agencies.immigration or other proceedings.

Recommendation: The Secretary of Homeland Security should evaluate options for developing a unique identifier shared across DHS components' data systems to link family members apprehended together. (Recommendation 4)

Agency: Department of Homeland Security
Status: Open

Comments: In commenting on a draft of our report, DHS reported that its Office of Immigration Statistics (OIS) plans to work with relevant components to develop a unique shared identifier linking family members apprehended together. According to DHS, DHS OIS launched the Family Status Community of Interest (COI) in June 2020, and the COI has since established a bi-weekly meeting schedule. The COI's initial focus is on standard codes describing the reasons for family separations. Upon completing the family separation reason standard, DHS reported that the COI will prioritize developing common codes to identify family members apprehended together. DHS estimates completing these actions by March 31, 2021. Evaluating options for developing a shared unique family member identifier across components that would allow each component access to certain information about family members apprehended together would help bridge the information gaps about family relationships between components caused by DHS's fragmented data systems.

Recommendation: The TSA Administrator should direct T&D and Security Operations to monitor for instances of TSO non-compliance by individual commercial airports across fiscal years that could potentially warrant corrective action at the headquarters level. (Recommendation 2)

Agency: Department of Homeland Security: Transportation Security Administration
Status: Open

Comments: In January 2020, TSA's formal comment letter in response to our draft report stated that T&D will begin recording instances of noncompliance and work with Security Operations to monitor trends at individual airports and with specific courses. TSA also reported that T&D had developed a repository in its iShare database for this information at the end of 2019 and the agency is currently testing various options for reporting and pulling data. Once options are chosen and incorporated into its standard operating procedures, TSA reports that T&D will begin sharing the reports with Security Operations on a monthly basis. In July 2020, TSA officials told us that T&D had begun sharing training compliance reports from their database with Security Operations and discussing the results with them on a monthly basis. This database allows T&D to recognize trends at individual airports and specific courses throughout the fiscal year. Going forward, this process will enable T&D to identify noncompliance trends across fiscal years. We will continue to montior these efforts to verify that the T&D is montioring trends across fiscal years and work with TSA towards closure of this recommendation.

Recommendation: The Secretary of Defense, in collaboration with the Secretaries of the military departments, should expand the scope of the department's centralized database on problematic sexual behavior in children and youth, which is under development, to also track information on all incidents involving the abuse of a child (physical, sexual, emotional, and neglect) reported to the Family Advocacy Program or investigated by a military law enforcement organization, regardless of whether the offender was another child, an adult, or someone in a noncaregiving role at the time of the incident. (Recommendation 1)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open

Comments: DOD did not concur with this recommendation. As of April 2020, this recommendation remains open.

Recommendation: The Secretary of Defense, in collaboration with the Secretaries of the military departments, should, as part of the ongoing development of the centralized database, identify and define the elements to be tracked by each responsible organization, such as the Family Advocacy Program and military law enforcement. (Recommendation 2)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open

Comments: DOD concurred with this recommendation. As of April 2020, this recommendation remains open.

Recommendation: The Secretary of Defense, in collaboration with the Secretaries of the military departments, should develop a plan for how it will use the data it will collect in the centralized database to help ensure data-driven decision-making is used to inform program efforts. (Recommendation 3)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open

Comments: DOD concurred with this recommendation. As of April 2020, this recommendation remains open.

Recommendation: The Secretary of Defense, in collaboration with the Secretaries of the military departments, should establish a reliable schedule for the development and implementation of the centralized database on problematic sexual behavior in children and youth that includes key activities, the timeframes and resources needed to execute them, and GAO-identified practices for developing and maintaining a reliable schedule. (Recommendation 4)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open

Comments: DOD concurred with this recommendation. As of April 2020, this recommendation remains open.

Recommendation: The Secretary of Defense, in collaboration with the Secretaries of the military departments, should direct the service Family Advocacy Programs and military law enforcement organizations to document in their respective databases the date that they notified the other entity of a reported incident of child abuse. (Recommendation 5)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open

Comments: DOD partially concurred with this recommendation. As of April 2020, this recommendation remains open.

Recommendation: The Secretary of Defense, in collaboration with the Secretaries of the military departments, should issue guidance that describes the process through which the service Family Advocacy Programs are to receive and incorporate information into their central registries regarding child abuse allegations and determinations involving their servicemembers and dependents that were recorded by another service's installation Family Advocacy Program. Such guidance should include a mechanism to monitor that the process is occurring consistently. (Recommendation 6)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open

Comments: DOD partially concurred with this recommendation. As of April 2020, this recommendation remains open.

Recommendation: The Secretary of the Army should develop a process to monitor how reported incidents of child abuse are screened at installations to help ensure that all reported child abuse incidents that should be presented to an Incident Determination Committee are consistently presented and therefore tracked. (Recommendation 7)

Agency: Department of Defense: Department of the Army: Office of the Secretary
Status: Open

Comments: The Army concurred with this recommendation. As of April 2020, this recommendation remains open.

Recommendation: The Secretary of the Navy should develop a process to monitor how reported incidents of child abuse are screened at installations to help ensure that all reported child abuse incidents that should be presented to an Incident Determination Committee are consistently presented and therefore tracked. (Recommendation 8)

Agency: Department of Defense: Department of the Navy: Office of the Secretary
Status: Open

Comments: The Navy concurred with this recommendation. As of April 2020, this recommendation remains open.

Recommendation: The Secretary of the Navy should ensure that the Commandant of the Marine Corps develops a process to monitor how reported incidents of child abuse are screened at installations to help ensure that all reported child abuse incidents that should be presented to an Incident Determination Committee are consistently presented and therefore tracked. (Recommendation 9)

Agency: Department of Defense: Department of the Navy: Office of the Secretary
Status: Open

Comments: The Navy concurred with this recommendation. As of April 2020, this recommendation remains open.

Recommendation: The Secretary of the Air Force should develop a process to monitor how reported incidents of child abuse are screened at installations to help ensure that all reported child abuse incidents that should be presented to an Incident Determination Committee are consistently presented and therefore tracked. (Recommendation 10)

Agency: Department of Defense: Department of the Air Force: Office of the Secretary of the Air Force
Status: Open

Comments: The Air Force concurred with this recommendation. As of April 2020, this recommendation remains open.

Recommendation: The Secretary of Defense should ensure that the Under Secretary of Defense for Personnel and Readiness, in coordination with the Director of the Department of Defense Education Activity, clarifies Department of Defense Education Activity guidance to define what types of incidents must be reported as "serious incidents" to help ensure that all serious incidents of which Department of Defense Education Activity leadership needs to be informed are accurately and consistently reported by school administrators. (Recommendation 11)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open

Comments: DOD concurred with this recommendation. As of April 2020, this recommendation remains open.

Recommendation: The Secretary of Defense, in collaboration with the Secretaries of the military departments, should expand the voting membership of the Incident Determination Committee to include medical personnel with the requisite knowledge and experience. (Recommendation 12)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open

Comments: DOD partially concurred with this recommendation. As of April 2020, this recommendation remains open.

Recommendation: The Secretary of the Army should establish efforts to comprehensively inform victims' families about how reported incidents of child abuse will be addressed following the report, such as a comprehensive guide that explains the process the Family Advocacy Program and military law enforcement organizations will follow, and available victim services. (Recommendation 13)

Agency: Department of Defense: Department of the Army: Office of the Secretary
Status: Open

Comments: The Army concurred with this recommendation. As of April 2020, this recommendation remains open.

Recommendation: The Secretary of the Navy should establish efforts to comprehensively inform victims' families about how reported incidents of child abuse will be addressed following the report, such as a comprehensive guide that explains the process the Family Advocacy Program and military law enforcement organizations will follow, and available victim services. (Recommendation 14)

Agency: Department of Defense: Department of the Navy: Office of the Secretary
Status: Open

Comments: The Navy concurred with this recommendation. As of April 2020, this recommendation remains open.

Recommendation: The Secretary of the Navy should ensure that the Commandant of the Marine Corps establishes efforts to comprehensively inform victims' families about how reported incidents of child abuse will be addressed following the report, such as a comprehensive guide that explains the process the Family Advocacy Program and military law enforcement organizations will follow, and available victim services. (Recommendation 15)

Agency: Department of Defense: Department of the Navy: Office of the Secretary
Status: Open

Comments: The Navy partially concurred with this recommendation. As of April 2020, this recommendation remains open.

Recommendation: The Secretary of the Air Force should establish efforts to comprehensively inform victims' families about how reported incidents of child abuse will be addressed following the report, such as a comprehensive guide that explains the process the Family Advocacy Program and military law enforcement organizations will follow, and available victim services. (Recommendation 16)

Agency: Department of Defense: Department of the Air Force: Office of the Secretary of the Air Force
Status: Open

Comments: The Air Force concurred with this recommendation. As of April 2020, this recommendation remains open.

Recommendation: The Secretary of Defense, in collaboration with the Secretaries of the military departments, should clarify, in guidance, the circumstances under which commanders may exercise their authority to remove a child from a potentially unsafe home on an overseas installation. (Recommendation 17)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open

Comments: DOD concurred with this recommendation. As of April 2020, this recommendation remains open.

Recommendation: The Secretary of Defense should ensure that the Under Secretary of Defense for Personnel and Readiness, in coordination with the Director of the Defense Health Agency, establishes processes that help ensure children who are sexually abused overseas have timely access to a certified pediatric sexual assault forensic examiner to conduct the examination. Initiatives could include certifying pediatricians or adult sexual assault forensic examiners as pediatric examiners during mandatory training or establishing shared regional assets. (Recommendation 18)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open

Comments: DOD concurred with this recommendation. As of April 2020, this recommendation remains open.

Recommendation: The Secretary of Defense, in collaboration with the Deputy Attorney General, should seek avenues to improve communication between the military criminal investigative organizations and United States Attorneys for relevant cases involving child victims to help ensure that investigators are notified when prosecution is declined, including the reasons for the declination when appropriate, such as details about any investigative deficiencies. (Recommendation 19)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open

Comments: DOD concurred with this recommendation. As of April 2020, this recommendation remains open.

Recommendation: The Secretary of the Army should seek to develop a memorandum of understanding with the National Children's Alliance that makes children's advocacy center services available to all Army installations and thereby increase awareness of those services across the department. (Recommendation 20)

Agency: Department of Defense: Department of the Army: Office of the Secretary
Status: Open

Comments: The Army partially concurred with this recommendation. As of April 2020, this recommendation remains open.

Recommendation: The Secretary of the Navy should continue to develop a memorandum of understanding with the National Children's Alliance that makes children's advocacy center services available to all Navy installations and thereby increase awareness of those services across the department. (Recommendation 21)

Agency: Department of Defense: Department of the Navy: Office of the Secretary
Status: Open

Comments: The Navy partially concurred with this recommendation. As of April 2020, this recommendation remains open.

Recommendation: The Secretary of the Navy should ensure that the Commandant of the Marine Corps continues to develop a memorandum of understanding with the National Children's Alliance that makes children's advocacy center services available to all Marine Corps installations and thereby increase awareness of those services across the service. (Recommendation 22)

Agency: Department of Defense: Department of the Navy: Office of the Secretary
Status: Open

Comments: The Navy concurred with this recommendation. As of April 2020, this recommendation remains open.

Recommendation: The Secretary of the Air Force should seek to develop a memorandum of understanding with the National Children's Alliance that makes children's advocacy center services available to all Air Force installations and thereby increase awareness of those services across the department. (Recommendation 23)

Agency: Department of Defense: Department of the Air Force: Office of the Secretary of the Air Force
Status: Open

Comments: The Air Force concurred with this recommendation. As of April 2020, this recommendation remains open.

Recommendation: The Chairman of FCC should develop specific, measurable goals and performance measures for its efforts to monitor the performance of new WEA capabilities, such as enhanced geo-targeting and expanded alert message length. (Recommendation 1)

Agency: Federal Communications Commission
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of the IPAWS program should document how it plans to address key actions needed to educate alerting authorities in their use of IPAWS and implement a mechanism that will allow FEMA to regularly and systematically obtain and analyze feedback on alerting authorities' educational needs. (Recommendation 2)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of the IPAWS program should establish procedures to prioritize pending IPAWS applications and to follow up with applicants to address these applications. (Recommendation 3)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commandant of the Coast Guard should direct the Assistant Commandant for Engineering and Logistics and Assistant Commandant for Prevention Policy to update the Coast Guard's ATON-related initiatives to include the specific outcomes to be achieved and associated time frames. (Recommendation 1)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: DHS concurred with our recommendation and stated that the Coast Guard plans to review and update ATON-related initiatives to include specific outcomes with associated implementation milestones by December 31, 2020.

Recommendation: The FEMA administrator should revise FEMA's cost-estimating guidance for Public Assistance projects to fully align with all 12 steps in the GAO Cost Estimating and Assessment Guide. (Recommendation 1)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: The agency agreed with the recommendation and is working to address it.

Recommendation: The FEMA administrator should develop a repository for all current applicable Public Assistance policies and guidance for Puerto Rico and make it available to all recovery partners, including subrecipients. (Recommendation 2)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: The agency agreed with the recommendation and is working to address it.

Recommendation: The Assistant Administrator for EPA's Office of Enforcement and Compliance Assurance should clearly document in guidance to the regional offices how they should use the definition of informal enforcement actions to collect data on these actions. (Recommendation 1)

Agency: Environmental Protection Agency
Status: Open

Comments: In written comments reproduced in appendix I of this report, EPA stated that it agreed with this recommendation. In July 2020, EPA stated that in a September 30, 2019 guidance document, the agency defined an informal enforcement action. However, on March 24, 2020, the Office of Enforcement and Compliance Assurance (OECA) suspended the September guidance because informal enforcement actions as defined appear to be inconsistent with Section 6 of the White House's Executive Order (EO) 13892, Promoting the Rule of Law Through Transparency and Fairness in Civil Administrative Enforcement and Adjudication, issued on October 9, 2019. EPA said that it would amend the September 2019 guidance to be consistent with the Executive Order. Our recommendation focused on guidance on how regional offices should use the definition of informal enforcement action and we will continue to monitor EPA's implementation of this recommendation.

Recommendation: The Assistant Administrator for EPA's Office of Enforcement and Compliance Assurance should clearly document in guidance to the regional offices that they should collect data on compliance assistance activities and specify which mechanism to use to maintain the data, such as ICIS. (Recommendation 2)

Agency: Environmental Protection Agency
Status: Open

Comments: In written comments reproduced in appendix I of this report, EPA stated that it agreed with this recommendation and would collect data on compliance assistance for each of the National Compliance Initiatives and maintain those data in ICIS. Specifically, in July 2020, the agency stated that in order to further its compliance assistance efforts, the Office of Enforcement and Compliance Assistance (OECA) is including a compliance assistance tool as an important part of each of EPA's National Compliance Initiatives. According to EPA, data on compliance assistance efforts that are part of the NCI will be collected and tracked for management review in the Integrated Compliance Information System. In addition, EPA stated it has collected data in the past on webpage visits related to its national Compliance Assistance Centers and would continue to do so in the future. We will continue to monitor the status of EPA's implementation of this recommendation.

Recommendation: The Assistant Administrator for EPA's Office of Enforcement and Compliance Assurance should include the known limitations of data in its annual reports and provide information on the intended use of EPA's data. (Recommendation 3)

Agency: Environmental Protection Agency
Status: Open

Comments: In written comments reproduced in appendix I of this report, EPA stated that it agreed with this recommendation and acknowledged the importance of providing information about a dataset to facilitate proper interpretation. For that reason, EPA said that, in time for its fiscal year 2020 report, the agency will create a webpage to describe how best to interpret the data presented in its "Fiscal Year EPA Enforcement and Compliance Annual Results" report and include a reference to that webpage in the report itself as well as the "Year in Review" report. In July 2020, EPA reiterated its written comments on the report. We will update the status of EPA's implementation of this recommendation upon the release of its annual reports.

Recommendation: The Commissioner of Internal Revenue should designate a dedicated entity to provide oversight of agency-wide efforts to detect, prevent, and resolve business IDT, consistent with leading practices. This may involve designating one business unit as a lead entity or leveraging cooperative relationships between business units to establish a business IDT leadership team. This entity should have defined responsibilities and authority for managing fraud risk. (Recommendation 1)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open
Priority recommendation

Comments: In January 2020, IRS agreed to designate a dedicated entity to provide oversight of agency-wide business IDT efforts and stated that it will determine the appropriate oversight structure and scope of authority.

Recommendation: The Commissioner of Internal Revenue should develop a fraud risk profile for business IDT that aligns with leading practices. This should include (1) identifying inherent fraud risks of business IDT, (2) assessing the likelihood and impact of inherent fraud risks, (3) determining fraud risk tolerance, and (4) examining the suitability of existing fraud controls. (Recommendation 2)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open
Priority recommendation

Comments: In January 2020, IRS agreed but did not provide details on the actions it plans to take to address the recommendation.

Recommendation: The Commissioner of Internal Revenue should develop, document, and implement a strategy for addressing fraud risks that will be identified in its fraud risk profile. (Recommendation 3)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: In January 2020, IRS agreed but did not provide details on the actions it plans to take to address the recommendation.

Recommendation: The Commissioner of Internal Revenue should ensure that IRS collects additional data on business IDT by identifying and implementing new fraud filters consistent with its fraud risk profile. This should include prioritizing IDT filters for tax forms determined to be most at risk based on an analysis of risk tolerances. (Recommendation 4)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: In January 2020, IRS agreed but did not provide details on the actions it plans to take to address the recommendation.

Recommendation: The Commissioner of Internal Revenue should identify and implement methods to address delays in resolving business IDT cases due to correspondence-based authentication. This could involve using different methods for taxpayer authentication based on the risk level of the return. (Recommendation 5)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS agreed with the recommendation. In January 2020, IRS stated that it will complete an analysis of other authentication methods.

Recommendation: The Commissioner of Internal Revenue should establish customer service-oriented performance goals for resolving business IDT cases. (Recommendation 6)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS neither agreed nor disagreed with our recommendation to establish customer service-oriented performance goals for resolving business identity theft cases. In January 2020, IRS stated that it will review its customer service-oriented performance goals and modify them, as warranted, to address the resolution of business identity theft cases. Doing so would meet the intent of our recommendation.

Recommendation: The Under Secretary of Defense for Acquisition and Sustainment should ensure that the Deputy Assistant Secretary of Defense for Materiel Readiness create, share, and maintain a comprehensive and up-to-date list of all DOD sharing venues (i.e., working groups), including points of contact, related to depot maintenance. (Recommendation 1)

Agency: Department of Defense: Office of the Secretary of Defense: Office of the Under Secretary of Defense for Acquisition and Sustainment
Status: Open

Comments: DOD concurred with this recommendation. In response to our report, the Deputy Assistant Secretary of Defense for Materiel Readiness will create, share, and maintain a comprehensive and up-to-date list of all DOD sharing venues related to depot maintenance with associated points of contact. The estimated completion date is August 2020. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of the Army should ensure that Army Materiel Command reestablish and maintain organizations dedicated to sharing materiel best practices and lessons learned, as required by Army regulations. (Recommendation 2)

Agency: Department of Defense: Department of the Army: Office of the Secretary
Status: Open

Comments: DOD concurred with this recommendation. In response to our report, the Army is working to update policies to accurately reflect current activities for capturing, preserving, and distributing lessons learned and best practices throughout the organic industrial base. The estimated completion date is no later than December 2022. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Defense should ensure that the Chief Management Officer identify and document specific implementation steps to advance a collaborative culture, consistent with our leading practices for mergers and organizational transformations.

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open

Comments: DOD concurred with this recommendation. In its concurrence, DOD stated that it intended to identify and document specific implementation steps to advance a collaborative culture through, among other things, the Chief Management Officer's forthcoming detailed implementing guidance on Secretary of Defense-empowered cross-functional teams and revisions to the DOD issuance regarding senior governance forums that are intended to advance a collaborative culture. As of July 2020, these efforts were still in progress, according to an OCMO official. We will continue to monitor DOD's efforts to address this recommendation.

Recommendation: The DEA Administrator should develop and implement additional ways to use algorithms in analyzing ARCOS and other data to more proactively identify problematic drug transaction patterns. (Recommendation 1)

Agency: Department of Justice: Drug Enforcement Administration
Status: Open
Priority recommendation

Comments: DOJ agreed with this recommendation and DEA stated it will continue to examine a variety of technologies to analyze ARCOS and other data and implement additional ways to use algorithms to more proactively identify problematic drug transaction patterns.

Recommendation: The DEA Administrator, in coordination with the department-wide efforts on data strategy, should establish and document a data governance structure to ensure DEA is maximizing its management of industry-reported drug transaction data. (Recommendation 2)

Agency: Department of Justice: Drug Enforcement Administration
Status: Open
Priority recommendation

Comments: DOJ agreed with this recommendation. As of September 2019, DEA officials stated that its Office of Information Systems' Chief Data Officer just recently started to work with DOJ and other components to develop a data strategy in response to the recently released department wide strategy, and has begun efforts to develop a governance structure. In November, 2019 DEA indicated it will continue to mature its data governance structure. The intent of this recommendation is for DEA to establish a formalized data governance structure to manage its collection and use of data used to support the Diversion Control Division's mission.

Recommendation: The DEA Administrator should establish outcome-oriented goals and associated measurable performance targets related to opioid diversion activities, using data it collects, to assess how the data it obtains and uses supports its diversion control activities. (Recommendation 3)

Agency: Department of Justice: Drug Enforcement Administration
Status: Open
Priority recommendation

Comments: DOJ neither agreed nor disagreed with this recommendation but DEA stated in November 2019, that it recognizes that measurable performance targets related to opioid diversion activities can serve as leading practices at different organizational levels including the program, project, or activity level. Our recommendation is intended to ensure that DEA can demonstrate the usefulness of the data it collects and uses to support its opioid diversion control activities.

Recommendation: The DEA Administrator, in consultation with industry stakeholders, should identify solutions to address the limitations of the ARCOS Enhanced Lookup Buyer Statistic Tool, to ensure registrants have the most useful information possible to assist them in identifying and reporting suspicious orders to DEA. (Recommendation 4)

Agency: Department of Justice: Drug Enforcement Administration
Status: Open
Priority recommendation

Comments: DOJ agreed with this recommendation and in November 2019, stated it has consulted with industry stakeholders and identified solutions to address the limitations of the tool.

Recommendation: FirstNet's Chief Executive Officer should take steps to ensure that the integrated master schedule for the program is developed and maintained in accordance with the best practices provided in GAO's Schedule Assessment Guide. (Recommendation 1)

Agency: Department of Commerce: National Telecommunications and Information Administration: First Responder Network Authority
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: FirstNet's Chief Executive Officer should identify additional information about the program, including FirstNet's oversight and monitoring activities, that can be shared with public-safety stakeholders and periodically communicate and report this information to them. (Recommendation 2)

Agency: Department of Commerce: National Telecommunications and Information Administration: First Responder Network Authority
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: FirstNet's Chief Executive Officer should share relevant portions of the accepted state-specific commitment reports with the states, as specified in the contract. (Recommendation 3)

Agency: Department of Commerce: National Telecommunications and Information Administration: First Responder Network Authority
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: FirstNet's Chief Executive Officer should, in consultation with public-safety stakeholders and its contractor, as appropriate, identify and obtain periodic information or meaningful indicators on end-users' satisfaction that would serve as a metric to gauge performance quality, including the effect of the FirstNet network and products on public-safety operations. (Recommendation 4)

Agency: Department of Commerce: National Telecommunications and Information Administration: First Responder Network Authority
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: We recommend the Secretary of the Air Force issue policy emphasizing the following three key reliability practices when planning and executing acquisition programs: (1) leveraging reliability engineers early and often, (2) establishing realistic reliability requirements, and (3) employing reliability engineering activities to improve a system's design throughout development. (Recommendation 1)

Agency: Department of Defense: Department of the Air Force: Office of the Secretary of the Air Force
Status: Open

Comments: The Air Force agreed with this recommendation and told us they will be updating Air Force Instruction AFI63-101/20-101 to ensure the inclusion of key practices to improve weapon system reliability, including leveraging reliability engineers early and often, establishing realistic reliability requirements, and employing reliability engineering activities to improve a system's design throughout development. The Air Force said it plans to complete this effort by December 31, 2020.

Recommendation: We recommend the Secretary of the Navy issue policy emphasizing the following three key reliability practices when planning and executing acquisition programs: (1) leveraging reliability engineers early and often, (2) establishing realistic reliability requirements, and (3) employing reliability engineering activities to improve a system's design throughout development. (Recommendation 3)

Agency: Department of Defense: Department of the Navy: Office of the Secretary
Status: Open

Comments: The Navy agreed with this recommendation and told us they plan to address GAO's recommendation in two ways. First, they are developing a guidebook for program managers and leadership to emphasize the importance of leveraging reliability engineers early and often, establishing realistic reliability requirements, and employing reliability engineering activities to improve a system's design throughout development. The Navy anticipates the guidebook will be completed by the end of fiscal year 2021. Second, the Navy plans to update the SECNAV 5000.2 when it is open for changes. They noted, this is dependent on the Office of the Secretary of Defense (OSD) completing its ongoing update to DOD-wide acquisition guidance. The Navy anticipates OSD's efforts will be completed by end of calendar year 2020.

Recommendation: The Administrator of GSA should direct the Office of Government-wide Policy (1) to incorporate into its guidance approaches or practices that agencies could use to assess utilization of and the ongoing need for property—approaches such as recommendations for periodic justifications, data analytics, and utilization reviews—and (2) to develop a plan and timelines for communicating the guidance to agencies government-wide. (Recommendation 1)

Agency: General Services Administration: Office of the Administrator
Status: Open

Comments: As of April 2020, GSA indicated in its 180-day letter that it had published on its website draft guidance in response to the Federal Personal Property Management Act of 2018. In addition, GSA identified several actions it planned to take in the coming months, such as publishing a comprehensive plan and timelines to address GAO's recommendation, publishing a request for information in the Federal Register to seek comments and suggestions, and engaging additional subject matter experts and related associations and standards group to improve upon the draft guidance. GAO will continue to monitor GSA's efforts to implement this recommendation.

Recommendation: The Commissioner of the IRS should ensure that information is collected on taxpayers' experiences with all online services and the extent to which the services are meeting taxpayers' needs. (Recommendation 1)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS agreed with this recommendation. In June 2020, IRS reported that it intends to "implement new surveys to better capture customer experience data" with its online services. To this end, IRS in March 2020 published a notice in the Federal Register stating that it intends to seek approval from the Office of Management and Budget (OMB) on collecting information in a manner consistent with section 280 of OMB's Circular A-11 intended to improve the customer experience with federal services. Among other requirements, section 280 of Circular A-11 directs agencies to collect feedback from customers. IRS states that it intends to complete this process and fully address the recommendation by the end of calendar year 2021. We will continue to monitor IRS's efforts to address this recommendation.

Recommendation: The Commissioner of the IRS should ensure that information collected on taxpayers' experiences with online services is summarized in the document serving as IRS's performance plan and report. (Recommendation 2)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS agreed with this recommendation. In June 2020, IRS reported that it is working to "implement new surveys to better capture customer experience data" and intends to publish this information on Performance.gov. Further, IRS states that it "will evaluate and identify the most appropriate medium each year for publication of data based on statutory and other requirements" and expects to fully address this recommendation by November 15, 2022. Section 280 of the Office of Management and Budget's Circular A-11 states that in addition to publishing this information on Performance.gov, agencies should also summarize this information in performance plans and reports. We will continue to monitor IRS's efforts to address this recommendation.

Recommendation: The Commissioner of the IRS should direct the Director of OLS and the Chief Research and Analytics Officer to work together to analyze the potential effects of online services on taxpayer burden. (Recommendation 3)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS agreed with this recommendation. In June 2020, IRS reported two planned actions to address this: 1) IRS will conduct comparative analyses of the current Individual Taxpayer Burden and Taxpayer Compliance Burden surveys and expects to complete this by September 30, 2020; and 2) IRS will implement new customer experience surveys to better capture comparative data relating to user perceptions of the ease and effectiveness of both online and traditional interactions and expects to complete this by the end of calendar year 2021. We will continue to monitor IRS's efforts to address this recommendation.

Recommendation: The Commissioner of the IRS should ensure that taxpayer input is included as an element of IRS's identification and prioritization process for new online services. (Recommendation 4)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS agreed with the recommendation. In June 2020, IRS reported that it plans to introduce new survey methods to obtain taxpayer input regarding potential new online services. One specific example IRS provided was testing a new version of the irs.gov satisfaction survey. This new version, which was launched in January 2020, asks respondents what additional online services taxpayers would like and solicits suggestions from taxpayers for improving IRS's online services. IRS stated that it is currently evaluating this new survey method. IRS expects to fully address the recommendation by the end of calendar year 2021. We will continue to monitor IRS's efforts to address this recommendation.

Recommendation: The Commissioner of the IRS should work with relevant officials to set a target to reduce taxpayer burden through the development of new online services. (Recommendation 5)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS did not agree with this recommendation. In June 2020, IRS stated that it will analyze the effect of online services on taxpayer burden in response to recommendation number 3 of this report. However in regards to setting a target, IRS reiterated its view that its "taxpayer burden measurement methodology is not designed to evaluate the effect of specific online services or web site enhancements." Further, IRS states that changes in tax policy (e.g., the Tax Cuts and Jobs Act of 2017) can affect taxpayer burden and it believes other factors, such as ease of use of online services, are more important to the taxpayer experience. Our report recognized that it may take time for the relevant IRS offices to review how online services may be affecting taxpayer burden. However, we continue to believe that this recommendation has merit because IRS has previously stated that it expects online services to reduce taxpayer burden, thereby contributing to one of IRS's strategic goals. Since IRS has already stated it plans to analyze the effect of online services on taxpayer burden in response to recommendation number 3, we believe it would be relatively easy for IRS to use the results of that analysis to set a more specific goal. For example, IRS in its June 2020 update refers to the time taxpayers spend using online services. A potential research question could be the extent to which taxpayers are more efficiently completing tasks using IRS's online services as IRS makes improvements to these services. We will continue to monitor IRS's efforts to address this recommendation.

Recommendation: The Commissioner of the IRS should direct the Chief Information Officer and the Director of OLS to ensure that planned future capabilities of digital communication platforms are tested or piloted before deployment with a particular focus on mitigating the risks that were identified in prior pilots of digital communication services, such as challenges in establishing common objectives and enrolling taxpayers. (Recommendation 6)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS agreed with this recommendation. In June 2020, IRS reported that it will apply multiple user preference and usability testing methods to the design of Taxpayer Digital Communications. For example, IRS said it surveyed visitors to IRS.gov about their views towards digital communications in the winter of 2019-2020 and in March 2020 conducted remote testing sessions with taxpayers to obtain feedback on two possible design options. IRS says additional testing may be done and expects to fully address this recommendation by November 30, 2020. We will continue to monitor IRS's efforts to address this recommendation.

Recommendation: The Commissioner of the IRS should direct the Commissioner of W&I to work with the Director of OLS to ensure that future decisions regarding whether to renew the Free File agreement incorporate findings from a comprehensive examination of the benefits and costs of the agreement as it relates to long term plans for IRS's online services, including plans to file amended returns electronically. (Recommendation 7)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: Our report identified IRS's pledge to "not enter the tax preparation software and e-filing services marketplace" as a potential cost of IRS's agreement with Free File, Inc. to provide services to eligible taxpayers. Shortly after our report was issued, the Commissioner of the Wage and Investment Division signed on December 23, 2019 an addendum to the most recent agreement between IRS and Free File, Inc. which among other provisions struck the language prohibiting IRS from offering its own online filing services. Under the terms of the addendum, companies participating in Free File, Inc. will continue to provide services to eligible taxpayers subject to some new requirements, such as a prohibition on companies excluding their services from internet search engines and surveying a sample of taxpayers about their experiences. The agreement between IRS and Free File, Inc. remains scheduled to expire in October 2021. While the deletion of the language prohibiting IRS from offering its own online filing services removes a cost for IRS, our recommendation was for any future renewal of the agreement to be based on a comprehensive examination of the benefits and costs of the agreement as it relates to IRS's plans to expand online services. IRS agreed with our recommendation. In June 2020, IRS said that it "would continue to coordinate with appropriate stakeholders to assess the costs and benefits derived from the Free File agreement and incorporate findings in future agreements". In addition, several new developments have occurred related to Free File: 1) IRS used Free File, Inc. in the spring of 2020 to develop a website to identify Americans who were not required to file a 2019 tax return and may be eligible for economic impact payments pursuant to the Coronavirus Aid, Relief, and Economic Security Act; 2) IRS announced in May 2020 that taxpayers will soon be able to electronically file an amended return using tax software and IRS's announcement of this planned capability refers to its agreement with Free File, Inc.; and 3) one of the ten companies which had been participating in Free File, Inc. announced it plans to leave in October 2020. We will continue to monitor IRS's efforts to address the recommendation.

Recommendation: The Chair of the Securities and Exchange Commission should direct the Chief Operating Officer to develop and implement safeguards to better ensure transparency and fairness in SEC's new performance incentive bonus program. Such safeguards could include multiple levels of review of performance ratings and pay decisions and publishing aggregate data on the results of the performance cycle that allow employees to compare results across various groups within the agency while protecting the confidentiality of individual ratings and pay decisions. (Recommendation 1)

Agency: United States Securities and Exchange Commission
Status: Open
Priority recommendation

Comments: SEC stated that it concurred with, and plans to implement, our recommendation. In August 2020, SEC officials stated that they were continuing to design the performance incentive bonus program's framework and in the process of acquiring consultative services to assist in validating that its design, communication strategy, and operating practices reflect leading practice and support achieving desired outcomes. We will continue to monitor SEC's progress in ensuring transparency and fairness in its performance incentive bonus program.

Recommendation: The Secretary of Defense should ensure that the Under Secretary of Defense for Acquisition and Sustainment develop and implement a plan to guide and coordinate efforts to implement the Wideband AOA recommendations to support timely, informed decisions on its next wideband satellite communications architecture. (Recommendation 1)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open

Comments: DOD concurred with our recommendation, but as of July 2020 is still working to implement its corrective action plan.

Recommendation: The NASA Administrator should ensure that the NASA Associate Administrator for Human Exploration and Operations directs the Advanced Exploration Systems division to define and determine a schedule for synchronization reviews, including the role of the proposed Lunar Exploration Control Board, to help ensure that requirements between mission and program levels are reconciled. (Recommendation 1)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: NASA agreed with this recommendation and stated that the Advanced Exploration Systems division will review program life-cycle review plans to ensure enterprise and program requirements are reconciled across the mission. NASA is in the process of determining the organizational structure of the Human Exploration and Operations Mission Directorate. Following this completion, NASA officials stated that the appropriate control board and division structures for review and program direction will become active.

Recommendation: The NASA Administrator should ensure that the NASA Associate Administrator for Human Exploration and Operations directs the Gateway program to conduct a joint cost and schedule confidence level at the program level for the Artemis III mission. (Recommendation 2)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: NASA agreed with this recommendation and stated it would conduct a joint cost and schedule confidence level analysis or equivalent. The Gateway program is planning to conduct a series of project- and program-level reviews and assessments aligned with key decision point reviews. This includes conducting a joint cost and schedule confidence level analysis or equivalent of the Gateway initial configuration to support a program key decision point planned for fall 2021. NASA has not yet taken action on this recommendation.

Recommendation: The NASA Administrator should ensure that the NASA Associate Administrator for Human Exploration and Operations directs the Gateway program to update its overall schedule for 2024 to add a KDP II to occur before system integration. (Recommendation 3)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: NASA agreed with this recommendation, but has not yet taken action on it. NASA stated that it would provide a schedule for future reviews, including whether there will be a Key Decision Point (KDP) II, at the KDP-I review currently scheduled for fall 2021.

Recommendation: The NASA Administrator should ensure that the NASA Associate Administrator for Human Exploration and Operations creates a life-cycle cost estimate for the Artemis III mission. (Recommendation 4)

Agency: National Aeronautics and Space Administration
Status: Open
Priority recommendation

Comments: NASA agreed with the recommendation and stated that the agency will provide a preliminary cost estimate for the Artemis III mission by the end of 2020. Further, NASA stated that it will provide an updated cost estimate for the Artemis III mission after it establishes cost and schedule commitments for some of the projects that compose the lunar mission, currently planned for the Spring of 2021. To fully implement this recommendation, NASA will need to provide a cost estimate.

Recommendation: The NASA Administrator should ensure that the NASA Associate Administrator for Human Exploration and Operations directs the Advanced Exploration Systems division to commit to a completion date and finalize a cohesive document outlining the rationale for selecting its current lunar architecture and lunar programs. (Recommendation 5)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: NASA agreed with this recommendation and stated that it is developing a document that will summarize the trades and architectural studies, but the document is not yet complete.

Recommendation: The NASA Administrator should ensure that the Office of the Chief Engineer determines under what conditions it is appropriate to complete an analysis of alternatives, particularly when there are multiple pathways—including architectures or programs—that NASA could pursue in the future, and document the justification for not completing an analysis. (Recommendation 6)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: NASA agreed with this recommendation, but has not yet taken any action on it. NASA stated that it will provide additional clarifying guidance for conducting analyses of alternatives for new programs in the next update to NASA Procedural Requirements 7120.5E, "NASA Space Flight Program and Project Management Requirements." NASA plans to complete the update of the procedural requirement in September 2021.

Recommendation: The OJJDP Administrator should set performance targets for individual grant programs. (Recommendation 1)

Agency: Department of Justice: Office of Juvenile Justice and Delinquency Prevention
Status: Open

Comments: In June 2020, DOJ reported that OJJDP is engaged in a comprehensive effort to improve performance measures. The final step of this process will be the development of performance targets. According to DOJ, OJJDP anticipates setting initial targets for its discretionary grant programs by October 2021 and for the Title II Formula Grant program by March 2023. We believe these actions, when effectively completed, will address our recommendation. We plan to provide an update on OJP's progress in late 2021.

Recommendation: The Assistant Attorney General for Administration should ensure that future department-level fraud risk profiles (1) determine the department's fraud risk tolerance for DOJ grants—which include OJJDP grant programs, and (2) prioritize residual fraud risks based on an assessment against that tolerance, consistent with leading practices in GAO's Fraud Risk Framework. (Recommendation 2)

Agency: Department of Justice: Office of the Assistant Attorney General for Administration
Status: Open

Comments: In June 2020, DOJ reported that it awarded a new contract in January 2020 that includes a requirement to continue conducting annual fraud risk assessments and update associated fraud risk profiles using the GAO Fraud Risk Framework. DOJ further reported that it will develop a fraud risk tolerance for DOJ grants and prioritize residual fraud risk against that tolerance when it conducts this assessment. We believe these actions, when effectively completed, will address our recommendation. We plan to follow-up with DOJ and provide an update in early 2021.

Recommendation: The Secretary of Energy should direct the Assistant Secretary of the Office of Environmental Management to take steps to manage the three GDPs as an integrated program and follow relevant program management leading practices (developing a GDP-wide program management plan; an integrated master schedule; and a reliable, integrated, comprehensive life-cycle cost estimate.) (Recommendation 1)

Agency: Department of Energy: Office of the Secretary
Status: Open

Comments: In June 2020, DOE officials told us that its Office of Environmental Management (EM) Portsmouth/Paducah Project Office (PPPO) is in the process of developing a program management master plan, to include site-integrated master schedules and life-cycle cost estimates, for the Portsmouth and Paducah gaseous diffusion plants (GDPs). Officials stated that the plan will incorporate program management leading practices as appropriate. According to DOE officials, EM will direct PPPO to use actual collected cost and schedule information for integration of relevant lessons learned from ETTP cleanup into integrated program plans, schedules, and estimates. DOE officials estimated that this effort would be completed by December 31, 2020.

Recommendation: The Secretary of Energy should direct the Assistant Secretary of the Office of Environmental Management to track consistent and detailed expenditure information on cleanup activities across the three GDPs. (Recommendation 2)

Agency: Department of Energy: Office of the Secretary
Status: Open

Comments: In June 2020, DOE officials told us that its Office of Environmental Management (EM) is assessing and identifying an appropriate mechanism for tracking expenditures for both the Portsmouth and Paducah GDP sites, using a standardized approach with an Earned Value Management System (EVMS) reporting on, at a minimum, an annual basis. According to DOE officials, PPPO is in the process of using the ETTP data as a basis of comparison for contractor estimates and assessing the potential development of cost estimating tools for independent cost estimating. DOE officials estimated that this effort would be completed by December 31, 2020.

Recommendation: The Secretary of Energy should direct the Assistant Secretary of the Office of Environmental Management to ensure the site-specific life-cycle cost estimates for the cleanup of each of the GDPs fully incorporate best practices for cost estimation. (Recommendation 3)

Agency: Department of Energy: Office of the Secretary
Status: Open

Comments: In June 2020, DOE officials told us that its Office of Environmental Management (EM) has directed the Portsmouth and Paducah GDP sites to review and incorporate the practices from GAO's Cost Estimating Guide (GAO-20-195G), as appropriate, into the next revision of each site's life-cycle cost baselines. According to DOE officials, Oak Ridge is in the process of procuring a follow-on cleanup contract, which includes the scope to complete the cleanup of ETTP. According to DOE officials, given that the cleanup of the ETTP GDP is nearly complete, the baseline for the entire ETTP GDP will not be included in the life cycle cost estimate review. Officials stated the remaining scope of work for the ETTP GDP will, however, become part of the performance baseline for the next Oak Ridge cleanup contractor. DOE officials estimated that this effort would be completed by December 31, 2020.

Recommendation: The Secretary of Energy should direct the Assistant Secretary of the Office of Environmental Management to work—in conjunction with EPA and Kentucky and Tennessee state regulators—with an independent, third-party facilitator to help resolve disagreements over cleanup priorities, cleanup remedies, and cost estimation assumptions. (Recommendation 4)

Agency: Department of Energy: Office of the Secretary
Status: Open

Comments: In June 2020, DOE officials told us that its Office of Environmental Management (EM) has incorporated the use of an independent facilitator on a case-by-case basis to help resolve any disagreements, in conjunction with the Environmental Protection Agency (EPA), and Kentucky and Tennessee state regulators over cleanup priorities, remedies, and cost estimation assumptions. Officials stated that most recently, the Paducah GDP site used an independent facilitator to resolve disagreements with EPA Region IV and Kentucky state regulators. According to DOE officials, in the future, EM will continue the use of an independent facilitator, as deemed appropriate. DOE officials estimated that this effort would be completed by December 31, 2020.

Recommendation: The Secretary of Energy should regularly report on the status of the D&D Fund and cleanup efforts at the three GDPs with current information that contains details on challenges in reaching agreement with regulators and a clear scope of work. (Recommendation 5)

Agency: Department of Energy: Office of the Secretary
Status: Open

Comments: In June 2020, DOE officials told us that its Office of Environmental Management (EM) has prepared the triennial Uranium Enrichment Decontamination and Decommissioning Fund Report, providing accomplishments through fiscal year 2019 and disclosing the most recent environmental liability estimate associated with remaining challenges and scope of cleanup at the GDPs. Officials stated that the report is being circulated for approval. DOE officials estimated that this effort would be completed by December 31, 2020.

Recommendation: The Deputy Director for Management of OMB, in conjunction with the PMPC, should develop program and project management standards to include (1) a minimum threshold for determining the extent to which agencies have met the standards, (2) how standards apply differently at the program and project levels, (3) how standards are interrelated to work in a synchronized way, and (4) how standards should be applied across the life cycle of a program or project. (Recommendation 1)

Agency: Executive Office of the President: Office of Management and Budget: Deputy Director for Management
Status: Open

Comments: Awaiting 180-day letter.

Recommendation: The Deputy Director for Management of OMB, in conjunction with the PMPC, should create a governance structure to further develop and maintain program and project management standards that fully aligns with key practices for governance structures. (Recommendation 2)

Agency: Executive Office of the President: Office of Management and Budget: Deputy Director for Management
Status: Open

Comments: Awaiting 180-day letter.

Recommendation: The Deputy Director for Management of OMB should, when expanding PMIAA to additional program types, design pilot efforts to follow leading practices so that OMB can optimize its efforts to improve and broaden portfolio reviews across a full range of program types. (Recommendation 3)

Agency: Executive Office of the President: Office of Management and Budget: Deputy Director for Management
Status: Open

Comments: Awaiting 180-day letter.

Recommendation: The Deputy Director for Management of OMB should communicate program areas and timeframes, and expectations pertinent to annual program portfolio reviews, to be reviewed in future program portfolio reviews. (Recommendation 4)

Agency: Executive Office of the President: Office of Management and Budget: Deputy Director for Management
Status: Open

Comments: Awaiting 180-day letter.

Recommendation: The Deputy Director for Management of OMB should clarify for agencies how the different definitions of a "program" relate to each other in OMB guidance. (Recommendation 5)

Agency: Executive Office of the President: Office of Management and Budget: Deputy Director for Management
Status: Open
Priority recommendation

Comments: We added this recommendation as a priority in our OMB priority recommendation letter in April 2020. We recommended that OMB clarify for agencies how different definitions of a "program" relate to each other in OMB guidance. Clarifying the definitions could help agencies and OMB increase transparency and identify synergies across related laws, such as GPRAMA and the Program Management Improvement Accountability Act of 2016.

Recommendation: The Deputy Director for Management of OMB should convene trilateral meetings between OMB, relevant agencies, and us for addressing all high-risk areas during each two-year high-risk cycle (Recommendation 6).

Agency: Executive Office of the President: Office of Management and Budget: Deputy Director for Management
Status: Open
Priority recommendation

Comments: We added this recommendation as a priority in our OMB priority recommendation letter in April 2020. OMB should convene trilateral meetings between OMB, relevant agencies, and us for addressing all areas on our High Risk List during each two-year high-risk cycle. Doing so would better position OMB to enhance the leadership commitment needed to make greater progress on high-risk areas. Meetings with senior OMB and agency officials on individual high-risk areas have proven in the past to be helpful to making progress. These meetings would also help OMB meet statutory requirements to conduct portfolio reviews of programs on GAO's high-risk list.

Recommendation: The Deputy Director for Management of OMB, in conjunction with PMPC, should ensure PMPC meeting agendas include time for discussing high-risk areas during meetings and provide time for the PMPC to make recommendations to OMB about addressing high-risk areas. (Recommendation 7)

Agency: Executive Office of the President: Office of Management and Budget: Deputy Director for Management
Status: Open

Comments: Awaiting 180-day letter.

Recommendation: The Deputy Director for Management of OMB, in conjunction with PMPC, should establish measures to assess outcomes of PMIAA, such as establishing a baseline of information on programs or collecting trend data. (Recommendation 8)

Agency: Executive Office of the President: Office of Management and Budget: Deputy Director for Management
Status: Open

Comments: Awaiting 180-day letter.

Recommendation: The Director of OMB should develop and implement a plan with GSA that outlines the actions needed to fully recover the TMF Program Management Office's operating expenses with administrative fee collection in a timely manner. (Recommendation 1)

Agency: Executive Office of the President: Office of Management and Budget: Office of the Director
Status: Open

Comments: The Office of Management and Budget (OMB) has not yet taken any actions to implement our recommendation. We will continue to monitor OMB's progress in implementing this recommendation.

Recommendation: The Director of OMB should work with GSA to clarify the requirement in the TMF guidance that agencies follow the cost estimating process outlined in Circular A-11 (that references GAO's cost estimating guidance discussed in this report), when developing the proposal cost estimate. (Recommendation 2)

Agency: Executive Office of the President: Office of Management and Budget: Office of the Director
Status: Open

Comments: The Office of Management and Budget (OMB) has not yet taken any actions to implement our recommendation. We will continue to monitor OMB's progress in implementing this recommendation.

Recommendation: The Administrator of General Services should develop and implement a plan with OMB that outlines the actions needed to fully recover the TMF Program Management Office's operating expenses with administrative fee collection in a timely manner. (Recommendation 3)

Agency: General Services Administration
Status: Open

Comments: The General Services Administration (GSA) has not yet taken any actions to implement our recommendation. We will continue to monitor GSA's progress in implementing this recommendation.

Recommendation: The Administrator of General Services should work with OMB to clarify the requirement in the TMF guidance that agencies follow the cost estimating process outlined in Circular A-11 (that references GAO's cost estimating guidance discussed in this report), when developing the proposal cost estimate. (Recommendation 4)

Agency: General Services Administration
Status: Open

Comments: The General Services Administration (GSA) has not yet taken any actions to implement our recommendation. We will continue to monitor GSA's progress in implementing this recommendation.

Recommendation: The Administrator of General Services should develop detailed guidance for completing the Technology Modernization Fund project cost estimate template, including information on the data elements and the fields required to be completed, in order to help ensure the accuracy and completeness of the provided information. (Recommendation 5)

Agency: General Services Administration
Status: Open

Comments: In comments on our report, the General Services Administration (GSA) concurred with our recommendation but has not yet taken any actions to implement our recommendation. We will continue to monitor GSA's progress in implementing this recommendation.

Recommendation: The Director, MDA should coordinate with the defense intelligence community on the agency's collective priorities for threat assessments and work with the defense intelligence community to determine if additional resources are needed to support the agency's threat assessment needs. (Recommendation 1)

Agency: Department of Defense: Office of the Secretary of Defense: Missile Defense Agency
Status: Open

Comments: DOD concurred with our recommendation, stating that MDA will continue to follow established processes to identify threat assessment needs and to determine if additional resources are required. However, we have yet to see sufficient evidence that MDA is collectively prioritizing its threat assessment requests. We understand that MDA prioritizes its threat assessment requests within the distinct lanes of intelligence product types. We have yet to see evidence that shows MDA has taken steps to also prioritize amongst those lanes. For example, MDA could coordinate with the intelligence community to establish a formal process or venue through which such macro-level prioritization could be conveyed and discussed. In April 2020, MDA told us that it did not plan to transfer funds to the intelligence community in fiscal year 2021 for any unique MDA intelligence needs. By not taking actions to collectively prioritize its threat assessment needs or providing the intelligence community with resources, MDA continues to run the risk of not receiving the threat assessments it needs when it needs them.

Recommendation: The Director, MDA should fully engage the defense intelligence community on key threat-related missile defense acquisition processes and decisions, including providing insight into and obtaining input from the defense intelligence community on the threat space MDA establishes for the BMDS and the threat parameters and threat models MDA assigns to BMDS elements as design requirements and test cases. (Recommendation 2)

Agency: Department of Defense: Office of the Secretary of Defense: Missile Defense Agency
Status: Open

Comments: DOD concurred with our recommendation, stating that MDA will continue to fully engage the intelligence community on key threat-related Ballistic Missile Defense System (BMDS) acquisition processes and decisions. We have observed improvements in MDA including the intelligence community in some of these key threat-related processes and decisions, some of which were discussed in our report. Also, the National Defense Authorization Act for Fiscal Year 2020 included a provision requiring the Secretary of Defense to submit a report to the congressional defense committees on the NGI and include in the report, among several items, updated threat assessments by the intelligence community informing system threshold and objective requirements. To this end, we are aware that MDA consulted with the intelligence community on the threat space and threat-related requirements that are being considered for the Next Generation Interceptor (NGI). The Office of the Under Secretary of Defense for Research and Engineering stated in a September 2019 memo to GAO that MDA also coordinates in weekly Technical Interchange Meetings with the intelligence community on the threat space bounds for parameters that have high uncertainty. We are also aware of ongoing efforts between MDA and the intelligence community to jointly model missile threats that could directly be used in MDA ground tests. These efforts address much of our recommendation; however, we have yet to see whether MDA will coordinate with the intelligence community on the threat parameters assigned to BMDS elements in the BMD System Specification. We intend to follow up with MDA to determine the extent to which MDA has implemented our recommendation.

Recommendation: The Secretary of Defense should require the Director, MDA and the Director, DIA to coordinate on establishing a process for MDA to obtain validation of its threat models. (Recommendation 3)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open

Comments: DOD concurred with our recommendation, stating that the department will re-examine the most cost-effective approach to meet the intent of DIA validation to support development and fielding of effective Ballistic Missile Defense System (BMDS) elements. We have observed significant progress on this recommendation, primarily through the joint coordination occurring through the Defense Intelligence Ballistic Missile Analysis Committee (DIBMAC) Joint Modeling Tiger Team, where multiple pathways are being explored. Our recommendation calls for the intelligence community and MDA to coordinate on establishing a process for MDA to obtain validation of its threat models. We are also open to other pathways, such as intelligence community and MDA jointly producing threat models or MDA making direct use of threat models built by the intelligence community. Our objective is that MDA use threat models that are validated by the intelligence community when such models are necessary to inform formal BMDS processes, products, and decisions. Any pathway that MDA and the intelligence community agree upon that yields this result meets the intent of our recommendation. We believe that through the tiger team initiative, such coordination is occurring and therefore the closure of this recommendation as implemented in imminent. We are waiting to see: (1) whether MDA and intelligence community establish a formal process and/or jointly sign a memorandum of agreement to codify the process; and (2) the production and use of an intelligence community-validated threat model by MDA in a ground test or other Models and Simulation application.

Recommendation: The Chief Executive Officer of CNCS should develop an approach to ensure that all relevant participants are involved in the agency-wide process for prioritizing evidence needs. (Recommendation 1)

Agency: Corporation for National and Community Service
Status: Open

Comments: In comments on a draft of this report, the Corporation for National and Community Service (CNCS) neither agreed nor disagreed with this recommendation. Subsequently, in a June 2020 letter, CNCS stated that it agreed with our recommendation and described planned actions to strengthen its agency-wide evidence prioritization process. Among these planned actions were proposed changes to CNCS's approach for involving key participants from across the agency in the process. However, as of October 2020, CNCS had not yet provided us with documentation that would allow us to (1) assess the extent to which they address our recommendation and (2) confirm that these proposed changes were approved. We will continue to monitor CNCS's actions to address this recommendation.

Recommendation: The Chief Executive Officer of CNCS should define roles and responsibilities for all relevant participants involved in the agency-wide process for prioritizing evidence needs. (Recommendation 2)

Agency: Corporation for National and Community Service
Status: Open

Comments: In comments on a draft of this report, the Corporation for National and Community Service (CNCS) neither agreed nor disagreed with this recommendation. Subsequently, in a June 2020 letter, CNCS stated that it agreed with our recommendation and described planned actions to strengthen its agency-wide evidence prioritization process. Among these planned actions were workforce planning and hiring based on the knowledge, skills, and abilities needed for CNCS to address its evidence priorities. The letter stated that once those actions were completed, CNCS would revisit the roles and responsibilities of participants involved in the agency's evidence-building activities. We will continue to monitor CNCS's actions to address this recommendation.

Recommendation: The Chief Executive Officer of CNCS should revise written guidance for the agency-wide process for prioritizing evidence needs to ensure it identifies all relevant participants and their respective roles and responsibilities. (Recommendation 3)

Agency: Corporation for National and Community Service
Status: Open

Comments: In comments on a draft of this report, the Corporation for National and Community Service (CNCS) neither agreed nor disagreed with this recommendation. Subsequently, in a June 2020 letter, CNCS stated that it agreed with our recommendations and described planned actions to strengthen its agency-wide evidence prioritization process. However, as of October 2020, CNCS had not yet provided us with documentation that would allow us to (1) confirm that these proposed changes were approved and (2) assess the extent to which written guidance for the revised process addresses our recommendation. We will continue to monitor CNCS's actions to address this recommendation.

Recommendation: The Secretary of Labor should develop an approach to ensure that all relevant participants are involved in the department-wide process for prioritizing evidence needs. (Recommendation 6)

Agency: Department of Labor
Status: Open

Comments: In a November 2019 letter providing comments on a draft of this report, the Department of Labor (DOL) agreed with this recommendation. The letter further described actions DOL planned to take to address it. DOL stated that in fiscal year 2020 it would update its written guidance to formalize the involvement of relevant participants in department-wide evidence-building activities. However, as of October 2020, DOL had not yet provided us with documentation that would allow us to assess the extent to which its updated guidance addresses our recommendation. We will continue to monitor DOL's actions to address this recommendation.

Recommendation: The Secretary of Labor should revise written guidance for the department-wide process for prioritizing evidence needs to ensure it identifies all relevant participants and their respective roles and responsibilities. (Recommendation 7)

Agency: Department of Labor
Status: Open

Comments: In a November 2019 letter providing comments on a draft of this report, the Department of Labor (DOL) agreed with this recommendation. The letter further described actions DOL planned to take to address it. DOL stated that in fiscal year 2020 it would update its written guidance to formalize the involvement of relevant participants in department-wide evidence-building activities. However, as of October 2020, DOL had not yet provided us with documentation that would allow us to assess the extent to which its updated guidance addresses our recommendation. We will continue to monitor DOL's actions to address this recommendation.

Recommendation: The Assistant Secretary of the Army for Civil Works should direct the Chief of Engineers and the Commanding General of the U.S. Army Corps of Engineers to strengthen the Corps' internal review process for feasibility studies by including steps to ensure consistency with best practices for transparency, such as verifying that all of the important assumptions and limitations in models and their implications for the economic analysis are consistently, clearly, and fully described. (Recommendation 1)

Agency: Department of Defense: Department of the Army: Office of the Assistant Secretary (Civil Works)
Status: Open

Comments: In its letter dated January 14, 2020, the Department of Defense concurred with GAO's recommendation and provided a corrective action plan in response to the recommendation. According to the corrective action plan, the Corps estimates that guidance will be issued to ensure that Corps reports adequately describe and justify the models, analytical choices, assumptions, and data used such that it is consistent with best practices by December 31, 2020.

Recommendation: The Secretary of the Navy should ensure that the shipyard optimization program office (PMS 555) include all costs—such as costs for program office activities, utilities, roads, environmental remediation, historical preservation, and alternative workspace—when developing its second, more detailed, cost estimate. (Recommendation 1)

Agency: Department of Defense: Department of the Navy
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of the Navy should ensure that the shipyard optimization program office (PMS 555) use cost estimating best practices—as outlined in the GAO Cost Estimating and Assessment Guide—in developing its second cost estimate, including a program baseline, work breakdown structure, a description of the methodology and key assumptions, inflation, fully addressing risk and uncertainty, and a sensitivity analysis. (Recommendation 2)

Agency: Department of Defense: Department of the Navy
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of the Navy should ensure that the shipyard optimization program office (PMS 555) obtain an independent cost estimate of the Naval Shipyards program prior to the start of its project prioritization effort. (Recommendation 3)

Agency: Department of Defense: Department of the Navy
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of the Navy should ensure that the shipyard optimization program office (PMS 555), in coordination with relevant stakeholders, establish clear roles and responsibilities for the shipyards involved in the Shipyard Infrastructure Optimization Plan. (Recommendation 4)

Agency: Department of Defense: Department of the Navy
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Coast Guard should conduct a comprehensive analysis of its Deployable Specialized Forces' workforce needs. (Recommendation 1)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: In November 2019, GAO reported that the Coast Guard did not fully apply a leading practice for using data and evidence when it reorganized its Deployable Specialized Forces because it had not assessed its overall Specialized Forces workforce needs, as recommended by this practice. The Coast Guard, through DHS, concurred with GAO's recommendation that it conduct a comprehensive analysis of its Specialized Forces' workforce needs. In its May 2020 180-day letter response, DHS stated that the Coast Guard identified its Maritime Safety and Security Team as the highest priority Specialized Forces unit for workforce analysis and that it is scheduled to be completed by the end of fiscal year 2021 but noted that the overall completion of all five unit types is subject to available funding and is not estimated to be completed until September 20, 2025. As GAO reported in November 2019, officials from some of these units stated that they experienced periods of underutilization, while other units with the same or similar capabilities turned down operations for lack of available personnel. Without a comprehensive analysis in place, the Coast Guard does not have the assurance that it has the requisite number of personnel in the right units to conduct the required missions. GAO will continue to monitor Coast Guard actions to address this recommendation.

Recommendation: The Coast Guard should assess the extent to which unnecessary overlap or duplication exists among Deployable Specialized Forces' capabilities. (Recommendation 2)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: In November 2019, GAO reported that the Coast Guard did not address potential overlap and duplication within its Specialized Forces. GAO identified some overlap among the capabilities of the different Specialized Forces units and the Coast Guard missions they support. The Coast Guard did not agree with the recommendation in its November 2019 response to GAO's draft report. At that time, DHS stated that GAO's conclusions illustrate a fundamental misunderstanding of the corresponding missions of Specialized Forces units. However, in technical comments provided in March 2020, the Coast Guard indicated that as of February 2020 it had not conducted the analysis necessary to fully identify potential overlap among the units. The Coast Guard stated that it is planning to begin analyzing the units this fiscal year. In its May 2020 180-day letter response, DHS stated that given current funding constrains and competing mission requirements, the Coast Guard could not consider conducting analyses not directly tied to improving mission outcomes. GAO continues to maintain that overlapping capabilities among units could indicate inefficiencies in how units are used as well as missed opportunities for use in others. Further, it is unclear why DHS and the Coast Guard simultaneously agreed to conduct the comprehensive workforce analyses of its Specialized Forces in the same 180-day letter (in response to recommendation #1 for this report), analyses that could inform an assessment of the extent to which unnecessary overlap and duplication exists among these units, while declining to address this recommendation. Without a comprehensive analysis in place, the Coast Guard does not have the assurance that it has the requisite number of personnel in the right units to conduct the required missions. GAO will continue to monitor Coast Guard actions to address this recommendation.

Recommendation: The Director of OCS, in developing the new performance management approach for the CSBG program, should ensure that its performance framework includes information on (1) details for how the national measure is linked to and used to assess the three national program goals, (2) descriptions of how the updated state and local performance outcome measures align with national program goals, and (3) a written plan for how OCS will assess the reliability of state performance outcome data. (Recommendation 1)

Agency: Department of Health and Human Services: Office of Community Services
Status: Open

Comments: HHS agreed with this recommendation and and stated that it plans to take actions to better align its performance measures with the three national performance goals outlined in the new CSBG Theory of Change. We commend HHS for its plans to address this recommendation, but encourage the agency to focus on aligning its performance outcomes with the three national goals of the CSBG program as established by the CBBG Act, which are similar but not identical to the three goals outlined in the new CSBG Theory of Change. HHS also stated that it would implement additional actions to assess the reliability of state performance outcome data.

Recommendation: The Executive Director of the Permitting Council should incorporate selected best practices we have identified (maintaining the baseline schedule and conducting a risk analysis) into the Permitting Council's process for developing performance schedules for the infrastructure sectors covered under FAST-41. (Recommendation 1)

Agency: Federal Permitting Improvement Steering Council
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary for Homeland Security should direct the Director of OTE to revise T&E policy or guidance as necessary to fully meet the key practice for programs to test that components and subsystems work together as a system in a controlled setting before finalizing a system's design. (Recommendation 1)

Agency: Department of Homeland Security
Status: Open

Comments: In providing comments on this report DHS concurred with our recommendation and stated that it planned to update its T&E policy to specify that acquisition programs demonstrate that components and subsystems work together before finalizing a system's design. In July 2020, DHS Test and Evaluation Division (TED) officials said they were in the process of updating the policy and that it was undergoing management review with an anticipated completion in fall 2020. Once finalized, GAO will evaluate the revised policy to determine whether DHS has met the intent of this recommendation.

Recommendation: The Secretary for Homeland Security should direct the Director of OTE, in coordination with OCPO, to develop an assessment process-including establishing performance measures-to help ensure T&E training achieves desired results. (Recommendation 2)

Agency: Department of Homeland Security
Status: Open

Comments: In providing comments on this report, DHS concurred with our recommendation and stated that it planned to assess the knowledge and skill requirements for the T&E workforce and establish performance goals for the training. DHS Test and Evaluation Division (TED), in coordination with OCPO, also plan to develop strategies to address any deficiencies with the current training that do not meet the identified requirements. In April 2020, TED officials said that they developed a new survey process to obtain recurring feedback from participants on the training's impact on their ability to perform T&E duties as assigned over time to inform the annual review of the T&E curriculum. However, this effort is still in a piloting stage so the extent to which this information is used to assess the training is still unknown at this time. As of July 2020, TED was still in the process of executing these efforts.

Recommendation: The Secretary for Homeland Security should direct the Director of OTE to revise T&E policy or guidance as necessary to specify when in the acquisition life cycle a major acquisition program manager should designate a level III certified T&E manager. (Recommendation 3)

Agency: Department of Homeland Security
Status: Open

Comments: In providing comments on this report DHS concurred with our recommendation and stated that it planned to update its T&E policy to specify when in the acquisition lifecycle acquisition program managers should designate a qualified T&E manager. In July 2020, DHS Test and Evaluation Division (TED) officials said they were in the process of revising the policy to include this specification and that it was undergoing management review with an anticipated completion in fall 2020. Once finalized, GAO will evaluate the revised policy to determine whether DHS has met the intent of this recommendation.

Recommendation: The Secretary for Homeland Security should direct the Director of OTE to establish an internal control process to ensure that data collected and maintained on major acquisition programs' T&E managers are reliable. (Recommendation 4)

Agency: Department of Homeland Security
Status: Open

Comments: In providing comments on this report, DHS concurred with our recommendation and stated that it planned to establish an internal control process to reliably collect and maintain data on acquisition programs' assigned test and evaluation managers. In April 2020, DHS Test and Evaluation Division (TED) reported taking steps to ensure the validity of this data including establishing points of contacts within each component to cross-check collected information for accuracy and having the Director review collected data on a quarterly basis beginning in third quarter fiscal year 2020. As of July 2020, TED was still in the process of improving its internal collection process, but had not completed these efforts.

Recommendation: The Secretary for Homeland Security should direct the Under Secretary for Science and Technology to assess OTE's workforce to ascertain the extent to which it has the appropriate number of staff with the necessary skills to fulfill its responsibilities. (Recommendation 5)

Agency: Department of Homeland Security
Status: Open

Comments: In providing comments on this report, DHS concurred with our recommendation and stated that it planned to assess the Test and Evaluation Division's (TED) workforce by reviewing current staffing levels and vacancies against the division's roles and responsibilities. The Senior Official Performing the Duties of the Under Secretary for Science and Technology plans to use the results of this review to inform strategic hiring in future years, if needed. In February 2020, DHS released its fiscal year 2020 strategic guidance memorandum for the Science and Technology (S&T) Directorate which included a statement pertaining to resourcing S&T's test and evaluation capabilities. However, as of July 2020, S&T had not yet conducted its review of TED's workforce.

Recommendation: The Chairman of FCC should ensure that FCC's Office of Managing Director follows the leading practices in GAO's fraud risk framework related to a dedicated entity's management of its antifraud activities, such as serving as the repository of knowledge on fraud risks and coordinating antifraud initiatives. (Recommendation 1)

Agency: Federal Communications Commission
Status: Open

Comments: As of April 2020, FCC reported that the agency was undertaking further improvements of its fraud risk management program consistent with this recommendation. FCC did not indicate a completion date. We will continue to monitor FCC's progress related to establishing a dedicated antifraud management entity.

Recommendation: The Chairman of FCC should plan regular fraud-risk assessments tailored to the high-cost program and assess these risks to determine the program's fraud risk profile, as provided in GAO's fraud risk framework. (Recommendation 2)

Agency: Federal Communications Commission
Status: Open

Comments: As of April 2020, FCC reported that the agency was working with the Universal Service Administrative Company (USAC), which is the entity responsible for the day-to-day administration of the high-cost program, to implement this recommendation. FCC stated that USAC will conduct a fraud risk assessment of the high-cost program, but did not specify a time-frame for this effort. We will continue to review FCC and USAC's progress toward completing this assessment, and any steps taken to routinize this assessment.

Recommendation: The Chairman of FCC should design and implement an antifraud strategy for the high-cost program with specific control activities, based upon the results of fraud-risk assessments and a corresponding fraud risk profile, as provided in GAO's fraud risk framework. (Recommendation 3)

Agency: Federal Communications Commission
Status: Open

Comments: As of April 2020, FCC reported that the agency was working with the Universal Service Administrative Company (USAC), which is the entity responsible for the day-to-day administration of the high-cost program, to implement this recommendation. FCC reported it will ensure the results of the high-cost program's fraud risk assessment, along with other efforts to implement the GAO fraud risk framework, result in an overall fraud risk strategy. FCC did not indicate a completion date for these efforts, and we will continue to track FCC progress in this area.

Recommendation: The Chairman of FCC should assess the model-based support mechanism to determine the extent to which it produces reliable cost estimates. (Recommendation 4)

Agency: Federal Communications Commission
Status: Open

Comments: As of April 2020, FCC reported that it was considering ways to improve the model-based support mechanism for rate-of-return carriers participating in the high-cost program. FCC did not specify a time-frame for this effort. We will continue to review FCC's efforts related to this recommendation, including FCC efforts, if any, to verify the model's cost estimates.

Recommendation: The Chairman of FCC should consider whether to make use of the model-based support mechanism mandatory depending on the results of the assessment. (Recommendation 5)

Agency: Federal Communications Commission
Status: Open

Comments: As of April 2020, FCC reported that it was considering ways to improve the model-based support mechanism for rate-of-return carriers participating in the high-cost program. FCC indicated that any such improvements may help facilitate the transition of carriers from legacy support mechanisms to the model-based support mechanism. FCC did not provide a time-frame for completion of this effort. We will continue to monitor FCC's progress and efforts in regard to this recommendation.

Recommendation: The Secretary of Veterans Affairs should develop a department-wide succession plan for leadership and mission-critical occupations that incorporates key leading practices for succession planning. (Recommendation 1)

Agency: Department of Veterans Affairs
Status: Open

Comments: As of April 2020, VA reported that it is developing a department-wide succession plan for leadership positions and mission-critical occupations. VA estimated it would complete this plan by September 30, 2020. When VA provides us a copy of the completed plan, we will provide updated information.

Recommendation: The Under Secretary for Health should incorporate key leading practices into VHA's succession planning processes, including monitoring and evaluating VHA's succession planning. (Recommendation 2)

Agency: Department of Veterans Affairs: Veterans Health Administration
Status: Open

Comments: As of April 2020, VHA reported that it is developing guidance and metrics, developing a process to assess field-based succession planning actions, and incorporating evaluations and updates of implementation strategies into its succession plan. VHA also indicated that it is developing a new VHA Executive Succession Plan. VHA plans to complete these actions by December 2021. When we receive VHA's updated plans and guidance, we will provide updated information.

Recommendation: The Under Secretary for Benefits should develop a succession planning process for all leadership positions and incorporate key leading practices into VBA's succession planning for leadership positions and mission-critical occupations. These practices include aligning the plans with strategic goals, identifying strategies to close workforce gaps, and monitoring and evaluating VBA's succession planning. (Recommendation 3)

Agency: Department of Veterans Affairs: Veterans Benefits Administration
Status: Open

Comments: As of April 2020, VBA reported that it is developing succession plans that align with VBA's strategic goals and identify succession planning strategies. VBA also indicated that it plans to review, assess, and update the plans annually. According to VBA, its plans will cover mission-critical occupations as well as leadership positions within those mission-critical occupations. However, VBA stated that VA's Corporate Senior Executive Management Office (CSEMO) is responsible for planning related to VBA's senior executives and that VBA will coordinate with CSEMO on succession planning for senior executives. To implement our recommendation, VBA will need to demonstrate that VBA, or CSEMO in coordination with VBA, has developed succession planning processes that cover all leadership positions (including senior executives) and mission-critical occupations. VBA expects to complete its succession plans by September 30, 2020. When we receive VBA's completed plans, we will provide updated information.

Recommendation: The Secretary of Veterans Affairs should update VA's 2003 directive on workforce and succession planning to incorporate relevant legal requirements, including Office of Personnel Management strategic human capital management regulation requirements. (Recommendation 4)

Agency: Department of Veterans Affairs
Status: Open

Comments: As of April 2020, VA reported that its updated directive is going through the Department's internal review and concurrence process. VA estimated it would complete the directive by July 31, 2020. When VA provides us a copy of the directive, we will provide updated information.

Recommendation: The Secretary of Veterans Affairs should ensure that the Under Secretary for Memorial Affairs update its cost-estimating procedures for cemetery construction projects to fully incorporate the 12 steps identified in the GAO Cost Estimating and Assessment Guide: Best Practices for Developing and Managing Capital Program Costs.

Agency: Department of Veterans Affairs
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The NOAA Administrator, in coordination with interagency committee member agencies, should establish a time frame for documenting the committee's membership process. (Recommendation 1)

Agency: Department of Commerce: National Oceanic and Atmospheric Administration
Status: Open

Comments: In February 2020, NOAA stated that its Administrator, in consultation with interagency committee member agencies, will determine criteria and other factors for evaluating federal agency interest and will formalize and document the interagency committee's membership process. NOAA anticipates documenting the process in the committee's charter by August 31, 2020.

Recommendation: The NOAA Administrator, in coordination with interagency committee member agencies, should clarify what is meant by "senior official" in the Marine Debris Act, such as through revisions to its charter. (Recommendation 2)

Agency: Department of Commerce: National Oceanic and Atmospheric Administration
Status: Open

Comments: In February 2020, NOAA stated that the agency, in coordination with interagency committee member agencies, will define the term "senior official" so that it can be consistently applied across all member agencies. NOAA stated it will consider seniority requirements of similar advisory committees and the ability to make decisions on behalf of an agency, among other factors, when developing the definition. NOAA plans to include the definition in the committee's charter by August 31, 2020.

Recommendation: The chair of the interagency committee, in coordination with member agencies, should develop and implement a process to analyze the effectiveness of the interagency committee's recommendations and strategies, and include the results in its biennial reports. (Recommendation 3)

Agency: Interagency Marine Debris Coordinating Committee
Status: Open

Comments: In February 2020, NOAA stated the agency will work with interagency committee member agencies to review and update the committee's recommendations. As part of this process, the committee will develop metrics to analyze the effectiveness of the committee's recommendations and strategies. NOAA stated that the recommendations and assessment of effectiveness will be included in the committee's 2018-2019 biennial report, which NOAA expects to publish by December 31, 2020.

Recommendation: The chair of the interagency committee, in coordination with member agencies, should develop a process to identify recommendations for priority funding needs to address marine debris, and include such recommendations in its biennial reports. (Recommendation 4)

Agency: Interagency Marine Debris Coordinating Committee
Status: Open

Comments: In February 2020, NOAA stated that it will, in coordination with interagency committee member agencies, develop a process to identify priority funding needs which can be reflected in each agency's respective budgeting process and shared in the committee's biennial reports. NOAA expects to publish the committee's 2018-2019 biennial report by December 31, 2020.

Recommendation: The Administrator of CMS should, to the extent feasible, maintain more complete information on both the total amount of funding allocated for quality measurement activities and the extent to which this funding supports each of its quality measurement strategic objectives. (Recommendation 1)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of CMS should develop and implement procedures to systematically assess the measures it is considering developing, using, or removing in terms of their impact on achieving CMS's strategic objectives and document its compliance with those procedures. (Recommendation 2)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of CMS should develop and use a set of performance indicators to evaluate the agency's progress towards achieving its quality measurement strategic objectives. (Recommendation 3)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of USAID should establish outcome-oriented performance measures to assess the effectiveness of USAID's reform projects. (Recommendation 1)

Agency: United States Agency for International Development
Status: Open
Priority recommendation

Comments: USAID concurs with this recommendation, and indicates it will establish a performance-monitoring plan.

Recommendation: The Administrator of USAID should ensure that the agency completes a strategic workforce plan necessary to support its reform efforts. (Recommendation 2)

Agency: United States Agency for International Development
Status: Open

Comments: USAID concurs with this recommendation. It affirmed is in the process of finalizing the strategic workforce plan that it will complete by September 30, 2019 and will submit the plan to Congress as directed. USAID stated it will also provide a framework to meet Congressionally-directed staffing levels across the Foreign Service and Civil Service.

Recommendation: The Secretary of Energy should direct the Assistant Secretary of EM to develop cost estimates for the IWTU reengineering project and the SBW treatment operations that meet best practices for being comprehensive (e.g., account for all costs). (Recommendation 1)

Agency: Department of Energy
Status: Open

Comments: In an update provided in April 2020, DOE said that it had taken steps to ensure the cost estimates will meet best practices for being comprehensive (e.g., account for all costs) as part of contract negotiations for the cleanup project. GAO has requested additional information from DOE and will update the status of this recommendation after it has received and analyzed this information.

Recommendation: The Secretary of Energy should direct the Assistant Secretary of EM to develop schedule estimates for the IWTU reengineering project and the SBW treatment operations that meet best practices for being well-constructed. (Recommendation 2)

Agency: Department of Energy
Status: Open

Comments: In an update provided by DOE in April 2020, DOE said that in negotiating the Idaho Cleanup Project contract it had taken steps to ensure the schedule estimates for the IWTU reengineering project and the SBW treatment operations will meet best practices for being well constructed. Further, DOE stated that the remaining baseline scope and schedule estimate received an external review by its contractor's parent corporation and DOE's Office of Environmental Management to ensure that the schedule meets best practices for being well-constructed. GAO has requested additional information from DOE and will update the status of this recommendation after it has received and analyzed this information.

Recommendation: The Secretary of Energy should direct the Assistant Secretary of EM to follow best practices for ensuring the reliability for the IWTU reengineering project's earned value management system. (Recommendation 3)

Agency: Department of Energy
Status: Open

Comments: In an update provided by DOE in April 2020, DOE said that cost and performance data for the IWTU is being tracked against the cost and schedule baselines incorporated in the core contract for the Idaho Cleanup Project, and that the data meets best practices for reliability. GAO has requested additional information from DOE and will update the status of this recommendation after it has received and analyzed this information.

Recommendation: The Secretary of Energy should direct the Assistant Secretary of EM to develop a strategy, including a timeline, for implementing the actions required to achieve its preferred disposal pathway, or an alternative, for the SBW. (Recommendation 4)

Agency: Department of Energy
Status: Open

Comments: In an update provided by DOE in April 2020, DOE said that EM will assess the range of potential strategies and pathways for disposal of the treated SBW. Once this effort is completed, GAO will review EM's strategy and timeline for achieving its preferred disposal pathway, or an alternative, and update the status of this recommendation accordingly.

Recommendation: The Secretary of Energy should direct the Assistant Secretary of EM to develop a strategy, including a timeline, to identify and develop a treatment approach for the disposal of the calcine waste to ensure that EM meets the milestone for completing the treatment of this waste by the target date of December 31, 2035. (Recommendation 5)

Agency: Department of Energy
Status: Open

Comments: In an update provided by DOE in April 2020, DOE said that DOE's Idaho Operations Office is in the process of chartering a team of subject matter experts to update an analysis of alternatives for calcine treatment and disposal. DOE said that this evaluation will be completed by September 30, 2020. GAO will request additional information from DOE on this analysis once completed and will update the status of this recommendation after it has received and analyzed this information.

Recommendation: The Secretary of Defense should ensure that the CMO meets DOD's September 2019 deadline for review and approval of DOD's training curriculum for cross-functional team members and their supervisors. (Recommendation 3)

Agency: Department of Defense
Status: Open

Comments: DOD concurred with this recommendation. According to an OCMO official, as of April 2020, DOD's training curriculum for cross-functional team members and their supervisors had been approved. However, as of September 2020, DOD has not provided documentation of that approval.

Recommendation: The Secretary of Defense should ensure that the CMO meets DOD's September 2019 deadline for review and approval of DOD's training curriculum for presidential appointees. (Recommendation 4)

Agency: Department of Defense
Status: Open

Comments: DOD concurred with this recommendation. According to an OCMO official, as of April 2020, DOD's training curriculum for cross-functional team members and their supervisors had been approved, and the training had been provided to presidential appointees and their staffs. However, as of September 2020, DOD has not provided documentation of that approval or training.

Recommendation: The Secretary of Defense should ensure that the CMO meets DOD's November 2019 deadline for drafting, review, and approval of DOD's report on the success and failures of cross-functional teams and final submission to the Secretary for review and approval. (Recommendation 5)

Agency: Department of Defense
Status: Open

Comments: DOD concurred with this recommendation. According to an OCMO official, as of April 2020, work on the report on the successes and failures of cross-functional teams was ongoing. We will continue to monitor DOD's process of developing its report; as of September 2020, DOD has not provided documentation of the report being drafted, reviewed, or approved.

Recommendation: The Secretary of Defense should ensure that the CMO and the electromagnetic spectrum operations cross-functional team clarify roles and responsibilities for providing administrative support and funding for the team beyond fiscal year 2019 in accordance with the memorandum establishing the team. (Recommendation 6)

Agency: Department of Defense
Status: Open

Comments: DOD concurred with this recommendation. In its comments on a subsequent report on the department's implementation of section 911, the department stated that funding for all Secretary of Defense-empowered cross functional teams, including the electromagnetic spectrum operations cross-functional team, was in place through fiscal year 2020, and that they were exploring options for dedicated funding for cross-functional teams in future years. As of April 2020, according to an OCMO official, these dedicated funding sources had not been established. DOD has not provided evidence of their funding as of September 2020.

Recommendation: The Director of the Office of Management of Budget should update the Guidelines to include GAO's leading practices of developing monitoring plans that are based on risks, ensuring that monitoring staff have appropriate qualifications, establishing procedures to close-out programs, developing staff skills regarding evaluations, and establishing mechanisms for following up on evaluation recommendations. (Recommendation 1)

Agency: Executive Office of the President: Office of Management and Budget
Status: Open
Priority recommendation

Comments: OMB disagreed with the recommendation and suggested it would be more effective to remind agencies that, in addition to the guidelines, they should follow all other relevant OMB guidance affecting monitoring and evaluation. OMB asserted that this guidance contains provisions relevant to our leading practices not included in the Foreign Assistance Monitoring and Evaluation Guidelines. However, we believe it is important for OMB to incorporate this other guidance into the Foreign Assistance Monitoring and Evaluation Guidelines, if only by reference, to emphasize the importance of these practices in the context of monitoring and evaluation of foreign assistance. As of April 28, 2020, the Office of Management and Budget has not implemented this recommendation. GAO will continue to monitor this issue.

Recommendation: The Secretary of Defense should update the Department's monitoring and evaluation policies to require the agency to conduct impact evaluations on all pilot programs before replicating or expanding, or conduct performance evaluations for those programs and provide a justification for not conducting an impact evaluation. (Recommendation 5)

Agency: Department of Defense
Status: Open

Comments: DOD partially concurred with this recommendation and noted that impact evaluations require a significant resource investment beyond what would be appropriate for more programs. However, DOD is in the process of updating its evaluation guidelines to allow for, but not require, impact evaluations in appropriate cases at all levels of evaluation activities.

Recommendation: The Department of State's U.S. Global AIDS Coordinator, in collaboration with HHS and other implementing agencies, should update the PEPFAR monitoring and evaluation policies to require these agencies to conduct impact evaluations on all pilot programs before replicating or expanding, or conduct performance evaluations for those programs and provide a justification for not conducting an impact evaluation. (Recommendation 6)

Agency: Department of State
Status: Open

Comments: State agreed with the intent of the recommendation (see appendix V for written comments). State explained that impact evaluations are often not feasible in the context of assistance provided under PEPFAR and described its alternative approach to evaluating new initiatives. State indicated it would update appropriate PEPFAR policies to clarify when agencies should conduct impact and/or performance evaluations. These clarifications will reflect how State evaluates PEPFAR programs in practice in accordance with OMB guidance and legislation, according to State.

Recommendation: The Secretary of the Treasury, as Chairperson of the Boards of Trustees, should work with the other trustees to take steps—in consultation with the chief actuaries of SSA and CMS—to improve the management of the report development schedule in order to provide the Trustees reports to Congress by the statutory deadline. These steps could include regularly updating the schedule using actual progress and archiving the final iteration of the schedules. (Recommendation 1)

Agency: Department of the Treasury
Status: Open

Comments: Treasury agreed with the recommendation and said they would work with the other trustees to take steps to improve the management of the report development schedule.

Recommendation: The Secretary of the Treasury, as Chairperson of the Boards of Trustees, should work with the other trustees to establish a policy to inform Congressional committees of jurisdiction when the trustees determine that the reports are expected to miss the issuance deadline. This outreach should include 1) the factors that are contributing to delays, and 2) the reports' expected issuance dates. (Recommendation 2)

Agency: Department of the Treasury
Status: Open

Comments: Treasury agreed with this recommendation. The agency said it would explore the potential for a policy to inform Congressional committees of jurisdiction when the trustees determine that the reports are expected to miss the April 1 deadline.

Recommendation: The Secretary of State should work with IAEA and its member states through the Board of Governors to develop detailed guidelines for prioritizing nuclear security activities. (Recommendation 1)

Agency: Department of State
Status: Open

Comments: The Department of State (State) agreed with this recommendation and it has identified several actions it has taken to implement this recommendation. State also has identified some progress resulting from its actions. Among other actions, State reported in its January 2020 letter to GAO that it is: working with the IAEA to identify ways to better develop and implement strategic planning across the Division of Nuclear Security, potentially including through dedicated staff; conveying to IAEA that it should do more to synthesize information from donor areas of emphasis, member state requests, and the contents of Integrated Nuclear Security Support Plans into a set of inputed priorities; and doing more to coordinate among the larger donors to the Nuclear Security Fund (NSF) to optimize and enhance the way the Division of Nuclear Security prioritizes and carries out its nuclear security activities funded via the NSF. State noted several positive results stemming from these actions, including: (1) an increased emphasis in IAEA's most recent Nuclear Security Report on internal coordination and a more collaborative approach within the IAEA in the implementation of its nuclear security activities, which State believes will help reduce duplication, streamline Agency activities, increase efficiency and effectiveness, and maximize the benefits to IAEA member states; and (2) participation by number of donors to the NSF in a series of informal coordination meetings with the IAEA that included discussing how the Agency views its priorities for its nuclear security activities, which State believes are more likely to result in positive outcomes than priorities negotiated at Board of Governors meetings. GAO will follow up with State in fiscal years 2020 and 2021 to determine the extent to which these efforts lead to more concrete prioritization guidelines for IAEA's nuclear security program.

Recommendation: The Secretary of State should work with IAEA and its member states through the Board of Governors to improve the nuclear security program's performance measures by developing baselines and measurable targets. (Recommendation 2)

Agency: Department of State
Status: Open

Comments: The Department of State (State) agreed with this recommendation and agreed that more could be done by IAEA to define nuclear security program baselines and targets, especially on activities that are mostly or fully within the IAEA's remit. In its January 2020 letter to GAO, State noted that it has advocated for improved program management within the Division of Nuclear Security. State believed the advocacy is having an impact, as is evident in the most recent Nuclear Security Report, which included reference to the continued application of a results-based approach to nuclear security activities which help drive positive outcomes from Agency assistance. State also noted in its letter that it continues to pursue better performance measures during negotiations of the next IAEA Programme and Budget (for 2022-2023) and in the development of the next IAEA Nuclear Security Plan (for 2022-2025). State said that it will continue to encourage IAEA to apply program management best practices, including comprehensively establishing performance measures, documenting baselines, setting clear goals, and measuring outcomes. GAO will follow up with State officials in fiscal years 2020 and 2021 and review the next IAEA Programme and Budget and the 2022-2025 Nuclear Security Plan (which should be issued in September 2021) to assess whether IAEA has improved nuclear security program performance measures, including by incorporating baselines and measurable targets.

Recommendation: The Secretary of State should work with IAEA and its member states through the Board of Governors to improve how the Division of Nuclear Security (DNS) reports to member states by consistently including the results of performance measures in at least one of the reports. (Recommendation 3)

Agency: Department of State
Status: Open

Comments: The Department of State (State) agreed with this recommendation and its January 2020 letter to GAO it indicated that it is working with the IAEA to improve its reporting. Specifically, State reported that in conjunction with its efforts to address recommendation 2, to improve nuclear security program performance measures, it has seen IAEA's Division of Nuclear Security make improvements in an effort to be more consistent and diligent about providing performance measures and reporting results to IAEA member states. In fiscal years 2020 and 2021, GAO will review available IAEA nuclear security reports and will follow up with State to clarify improvements it has observed in IAEA's nuclear security program reporting.

Recommendation: The Secretary of State should work with IAEA and its member states through the Board of Governors to analyze options to stabilize DNS's funding within current fiscal and political constraints to enhance the sustainability of IAEA's nuclear security program. (Recommendation 4)

Agency: Department of State
Status: Open

Comments: The Department of State (State) agreed with this recommendation, and in its January 2020 letter to GAO, State noted that the sustainability of the Division of Nuclear Security's budget remains a major area of focus. State noted that many IAEA member states maintain a position of zero real growth in IAEA's budget and are reluctant to reapportion funding to nuclear security activities from other IAEA programs. State reported that it will advocate for priority areas in IAEA budget negotiations, such as nuclear security, to gain a greater share of any agreed budget increases as an alternative to shifting funds from other programs. State noted that this remains a challenge, but that it will continue to identify options to enhance the sustainability of the IAEA's nuclear security program, including how best to also strengthen governance of the Nuclear Security Fund. GAO will follow up with State in fiscal years 2020 and 2021 regarding the options it has identified and pursued to improve the sustainability of the nuclear security program and its funding.

Recommendation: The Secretary of State should work with IAEA and its member states through the Board of Governors to strengthen the agency's central coordinating role by following key practices for collaboration. (Recommendation 5)

Agency: Department of State
Status: Open

Comments: The State Department (State) agreed with this recommendation, and in its January 2020 letter to GAO it generally stated that it is working with IAEA and its member states to improve collaboration among nuclear security stakeholders and strengthen the Agency's central coordinating role. However, State's letter did not specify actions that State is undertaking in this regard. Instead, State's letter reiterated coordinating actions that IAEA had already been undertaking at the time of our report. GAO will follow up with State in fiscal years 2020 and 2021 to better understand the actions, if any, it is taking or has planned to strengthen IAEA's central coordinating role, as well as any actions IAEA is taking independently to improve its coordinating role consistent with key practices for effective collaboration.

Recommendation: The Director of OMB should, in coordination with the Secretary of Homeland Security, establish guidance or other means to facilitate the sharing of successful approaches for agencies to address challenges in the areas of (1) managing competing priorities between cybersecurity and operations, such as when operational needs appear to conflict with cybersecurity requirements; (2) implementing consistent cybersecurity risk management policies and procedures across an agency; (3) incorporating cyber risks into enterprise risk management, and (4) establishing agencies' cybersecurity risk management strategies. (Recommendation 1)

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: The Office of Management and Budget did not say whether or not it concurred with this recommendation. As of January 2020, we had not received information pertaining to this recommendation. Once OMB has provided information, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of Agriculture should develop a cybersecurity risk management strategy that includes the key elements identified in this report. (Recommendation 2)

Agency: Department of Agriculture
Status: Open
Priority recommendation

Comments: The Department of Agriculture did not state whether or not it concurred with this recommendation. As of February 2020, the department stated that it is developing a Risk Management Framework implementation plan, which is to include a comprehensive Cybersecurity Strategy. Once the department has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of Agriculture should update the department's policies to require (1) the use of risk assessments to inform security control tailoring and (2) the use of risk assessments to inform plan of actions and milestones (POA&M) prioritization. (Recommendation 3)

Agency: Department of Agriculture
Status: Open

Comments: The Department of Agriculture did not state whether or not it concurred with this recommendation. As of February 2020, the department stated that it is developing a Risk Management Framework implementation plan which will include updates to USDA's process guide to ensure informed security control tailoring and updates to USDA's Plan of Actions and Milestones (POA&M) Standard Operation Procedure to inform prioritized POA&M mitigation strategies, through a consistent and repeatable security risk assessment process. Once the department has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of Agriculture should establish and document a process for coordination between cybersecurity risk management and enterprise risk management functions. (Recommendation 4)

Agency: Department of Agriculture
Status: Open
Priority recommendation

Comments: The Department of Agriculture did not state whether or not it concurred with this recommendation. As of February 2020, the department stated that it plans to establish a governance framework for USDA Enterprise Risk Management (ERM), which will provide a platform to increase coordination between stakeholders within the cybersecurity and enterprise risk management functions. Once the department has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of Commerce should update the department's policies to require (1) an organization-wide cybersecurity risk assessment and (2) the use of risk assessments to inform POA&M prioritization. (Recommendation 5)

Agency: Department of Commerce
Status: Open

Comments: The Department of Commerce did not state whether or not it concurred with this recommendation. As of January 2020, we had not received information pertaining to planned actions for this recommendation. Once the department states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of Commerce should establish a process for conducting an organization-wide cybersecurity risk assessment. (Recommendation 6)

Agency: Department of Commerce
Status: Open
Priority recommendation

Comments: The Department of Commerce did not state whether or not it concurred with this recommendation. As of February 2020, the department stated that its intends to evaluate whether there are any gaps in its cybersecurity policy pertaining to the establishment of an organization-wide cybersecurity risk assessment and will establish a plan to fill in gaps as necessary. The department added that it is making strides in the implementation of a tool that can aggregate data into a dashboard for a unified visibility across the department. Once the department has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of Energy should develop a cybersecurity risk management strategy that includes the key elements identified in this report. (Recommendation 8)

Agency: Department of Energy
Status: Open
Priority recommendation

Comments: The Department of Energy concurred with this recommendation. As of January 2020, the department stated that it was developing a department-wide risk management plan, to include a risk management strategy, and this would be completed by May 31, 2020. Once the department has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of Health and Human Services should develop a cybersecurity risk management strategy that includes the key elements identified in this report. (Recommendation 10)

Agency: Department of Health and Human Services
Status: Open
Priority recommendation

Comments: The Department of Health and Human Services concurred with this recommendation. As of January 2020, HHS stated that it is drafting a cybersecurity risk management memo that will detail its risk management strategy, including how the department will assess, respond to, and monitor risk. Once the department has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of Health and Human Services should update the department's policies to require (1) an organization-wide cybersecurity risk assessment and (2) the use of risk assessments to inform security control tailoring. (Recommendation 11)

Agency: Department of Health and Human Services
Status: Open

Comments: The Department of Health and Human Services partially concurred with this recommendation. As of January 2020, HHS stated that it is in the process of updating its policies to address the missing elements and plans to finalize the revisions by March 2021. Once the department has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of Health and Human Services should establish a process for conducting an organization-wide cybersecurity risk assessment. (Recommendation 12)

Agency: Department of Health and Human Services
Status: Open
Priority recommendation

Comments: The Department of Health and Human Services concurred with this recommendation. As of January 2020, HHS stated that it is drafting a cybersecurity risk management memo and capability model that will include a process for an organization-wide assessment of cybersecurity risk. Once the department has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of Homeland Security should develop a cybersecurity risk management strategy that includes the key elements identified in this report. (Recommendation 14)

Agency: Department of Homeland Security
Status: Open
Priority recommendation

Comments: The Department of Homeland Security concurred with this recommendation. As of January 2020, the department stated that it was in the process of developing an enterprise-wide Cybersecurity Risk Management Strategy that will define cybersecurity risk tolerance thresholds and promote inclusion of cybersecurity risk management into the Department's overall risk management capabilities. The estimated completion date for this effort is July 31, 2020. Once the department states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of Homeland Security should establish and document a process for coordination between cybersecurity risk management and enterprise risk management functions. (Recommendation 15)

Agency: Department of Homeland Security
Status: Open
Priority recommendation

Comments: The Department of Homeland Security concurred with this recommendation. As of January 2020, the department stated that, once developed, its Cybersecurity Risk Management Strategy will incorporate clarifications of the cybersecurity risk executive's role and will be coordinated with the DHS Office of the Chief Financial Officer, other offices within the DHS Management Directorate, and Department Components, as appropriate. The department estimated completing this effort by July 31, 2020. Once the department has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of Housing and Urban Developing should develop a cybersecurity risk management strategy that includes the key elements identified in this report. (Recommendation 16)

Agency: Department of Housing and Urban Development
Status: Open
Priority recommendation

Comments: The Department of Housing and Urban Development concurred with this recommendation. As of January 2020, the department said it planned to develop a cybersecurity risk management strategy that will determine how cybersecurity risks will be identified, framed, assessed, respond to, and monitored. The Department estimated completing this effort by August 2020. Once the department has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of the Interior should establish and document a process for coordination between cybersecurity risk management and enterprise risk management functions. (Recommendation 20)

Agency: Department of the Interior
Status: Open
Priority recommendation

Comments: The Department of the Interior concurred with this recommendation. As of January 2020, the department stated that it cybersecurity and enterprise risk management teams would establish a process for bi-directional communication and status reporting. The Department estimated completing this effort by July 31, 2020. Once the department has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Attorney General should develop a cybersecurity risk management strategy that includes the key elements identified in this report. (Recommendation 21)

Agency: Department of Justice
Status: Open
Priority recommendation

Comments: In its comments on our draft report, the Department of Justice did not state whether it concurred with this recommendation. As of January 2020, . the department reported that it had an integrated strategy for identifying, prioritizing, assessing, responding to, monitoring, and reporting on cybersecurity risks. Once the department states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Attorney General should fully establish and document a process for coordination between cybersecurity risk management and enterprise risk management functions. (Recommendation 22)

Agency: Department of Justice
Status: Open
Priority recommendation

Comments: In its comments on our draft report, the Department of Justice did not state whether or not it concurred with this recommendation. As of January 2020, the department stated that it is developing an ongoing mechanism to institutionalize coordination between its cybersecurity and ERM functions in fiscal year 2020. Once the department states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of Labor should update the department's policies to require (1) the use of risk assessments to inform control tailoring and (2) the use of risk assessments to inform POA&M prioritization. (Recommendation 23)

Agency: Department of Labor
Status: Open

Comments: The Department of Labor concurred with this recommendation. As of January 2020, we had not received information pertaining to this recommendation. Once the department states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of State should update the department's policies to require (1) an organization-wide risk assessment, (2) an organization-wide strategy for monitoring control effectiveness, (3) system-level risk assessments, (4) the use of risk assessments to inform security control tailoring, and (5) the use of risk assessments to inform POA&M prioritization. (Recommendation 24)

Agency: Department of State
Status: Open

Comments: The Department of State concurred with this recommendation. As of January 2020, the department stated that it is actively working to update the applicable policies and procedures. Once the department has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of State should establish and document a process for coordination between cybersecurity risk management and enterprise risk management functions. (Recommendation 25)

Agency: Department of State
Status: Open
Priority recommendation

Comments: The Department of State concurred with this recommendation. As of January 2020, the department stated that it is actively working to update the applicable policies and procedures. Once the department has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of Transportation should fully develop a cybersecurity risk management strategy that includes the key elements identified in this report. (Recommendation 26)

Agency: Department of Transportation
Status: Open
Priority recommendation

Comments: The Department of Transportation concurred with this recommendation. As of January 2020, the department stated that it would update its cybersecurity risk management strategy to include the identified missing elements. The Department estimated completing this effort by October 1, 2020. Once the department has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of Transportation should update the department's policies to require an organization-wide risk assessment. (Recommendation 27)

Agency: Department of Transportation
Status: Open

Comments: The Department of Transportation concurred with this recommendation. As of January 2020, the department stated that it would update it policies and procedures to require an organization-wide cybersecurity risk assessment. The Department estimated completing this effort by July 1, 2020. Once the department has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of the Treasury should develop a cybersecurity risk management strategy that includes the key elements identified in this report. (Recommendation 29)

Agency: Department of the Treasury
Status: Open
Priority recommendation

Comments: The Department of the Treasury did not state whether or not it concurred with this recommendation. As of January 2020, we had not received information pertaining to this recommendation. Once the department has provided information, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of the Treasury should establish a process for conducting an organization-wide cybersecurity risk assessment. (Recommendation 30)

Agency: Department of the Treasury
Status: Open
Priority recommendation

Comments: The Department of the Treasury did not state whether or not it concurred with this recommendation. As of January 2020, we had not received information pertaining to this recommendation. Once the department has provided information, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of the Treasury should establish and document a process for coordination between cybersecurity risk management and enterprise risk management functions. (Recommendation 31)

Agency: Department of the Treasury
Status: Open

Comments: The Department of the Treasury did not state whether or not it concurred with this recommendation. As of January 2020, we had not received information pertaining to this recommendation. Once the department has provided information, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of Veterans Affairs should develop a cybersecurity risk management strategy that includes the key elements identified in this report. (Recommendation 32)

Agency: Department of Veterans Affairs
Status: Open
Priority recommendation

Comments: The Department of Veterans Affairs concurred with this recommendation. As of January 2020, the department stated that it plans to develop a comprehensive risk management strategy in accordance with its updated cybersecurity program directive and plans to finalize the strategy by June 30, 2020. Once the department has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of Veterans Affairs should update the department's policies to require an organization-wide cybersecurity risk assessment. (Recommendation 33)

Agency: Department of Veterans Affairs
Status: Open

Comments: The Department of Veterans Affairs concurred with this recommendation. As of January 2020, VA stated that it plans to incorporate this requirement into its updated policies by June 30, 2020. Once the department has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of Veterans Affairs should establish a process for conducting an organization-wide cybersecurity risk assessment. (Recommendation 34)

Agency: Department of Veterans Affairs
Status: Open
Priority recommendation

Comments: The Department of Veterans Affairs concurred with this recommendation. As of January 2020, VA stated that it plans to fully document its process for an organization-wide cybersecurity risk assessment by June 30, 2020. Once the department has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of Veterans Affairs should establish and document a process for coordination between cybersecurity risk management and enterprise risk management functions. (Recommendation 35)

Agency: Department of Veterans Affairs
Status: Open

Comments: The Department of Veterans Affairs concurred with this recommendation. As of January 2020, VA described efforts under way to institutionalize coordination between cybersecurity and enterprise risk management functions and stated that this coordination will be documented in detail by June 30, 2020. Once the department has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Administrator of the Environmental Protection Agency (EPA) should fully develop a cybersecurity risk management strategy that includes the key elements identified in this report. (Recommendation 38)

Agency: Environmental Protection Agency
Status: Open
Priority recommendation

Comments: The Environmental Protection Agency did not state whether or not it concurred with this recommendation. As of January 2020, EPA stated that its strategic plans are under review beginning in the fourth quarter of fiscal year 2020. Once the agency has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Administrator of EPA should update the agency's policies to require an organization-wide cybersecurity risk assessment. (Recommendation 39)

Agency: Environmental Protection Agency
Status: Open

Comments: The Environmental Protection Agency did not state whether or not it concurred with this recommendation. As of January 2020, EPA stated that it is establishing a process to review, update, and reissue its policies. Once the agency has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Administrator of EPA should establish a process for conducting an organization-wide cybersecurity risk assessment. (Recommendation 40)

Agency: Environmental Protection Agency
Status: Open
Priority recommendation

Comments: The Environmental Protection Agency did not state whether or not it concurred with this recommendation. As of January 2020, we had not received information pertaining to this recommendation. Once the agency has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Administrator of EPA should fully establish and document a process for coordination between cybersecurity risk management and enterprise risk management functions. (Recommendation 41)

Agency: Environmental Protection Agency
Status: Open

Comments: The Environmental Protection Agency did not state whether or not it concurred with this recommendation. As of January 2020, we had not received information pertaining to this recommendation. Once the agency has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Administrator of General Services should establish a process for conducting an organization-wide cybersecurity risk assessment. (Recommendation 44)

Agency: General Services Administration
Status: Open
Priority recommendation

Comments: The General Services Administration concurred with this recommendation. As of January 2020, the agency stated that it would establish a process for conducting an organization-wide cybersecurity risk assessment. The administration estimated completing this effort by June 30, 2020. Once the administration has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Administrator of the National Aeronautics and Space Administration (NASA) should update the agency's policies to require (1) an organization-wide risk assessment and (2) the use of risk assessments to inform POA&M prioritization. (Recommendation 46)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: NASA concurred with this recommendation. As of January 2020, the agency stated that it is working to address gaps in its cybersecurity policy. Once NASA has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Administrator of NASA should establish a process for conducting an organization-wide cybersecurity risk assessment. (Recommendation 47)

Agency: National Aeronautics and Space Administration
Status: Open
Priority recommendation

Comments: NASA concurred with this recommendation. As of January 2020, NASA stated that the agency is in the process of documenting its process for conducting an organization-wide cybersecurity risk assessment. NASA's planned completion date for this effort is September 30, 2020. Once NASA has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Chairman of NRC should update the agency's policies to require (1) an organization-wide cybersecurity risk assessment and (2) the use of risk assessments to inform POA&M prioritization. (Recommendation 50)

Agency: Nuclear Regulatory Commission
Status: Open

Comments: NRC concurred with this recommendation. As of January 2020, we had not received information pertaining to this recommendation. Once the commission has provided information, we plan to verify whether implementation has occurred.

Recommendation: The Chairman of NRC should establish and document a process for coordination between cybersecurity risk management and enterprise risk management functions. (Recommendation 52)

Agency: Nuclear Regulatory Commission
Status: Open

Comments: NRC concurred with this recommendation. As of January 2020, we had not received information pertaining to this recommendation. Once the commission has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Director of the Office of Personnel Management (OPM) should update the agency's policies to require (1) an organization-wide cybersecurity risk assessment and (2) the use of risk assessments to inform control tailoring. (Recommendation 53)

Agency: Office of Personnel Management
Status: Open

Comments: OPM concurred with this recommendation. As of January 2020, OPM stated that it planned to update its policies to address the missing elements. Once OPM has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Director of OPM should establish a process for conducting an organization-wide cybersecurity risk assessment. (Recommendation 54)

Agency: Office of Personnel Management
Status: Open
Priority recommendation

Comments: OPM concurred with this recommendation. As of January 2020, the office stated that it planned to formalize its process for an organization-wide cybersecurity assessment. Once OPM has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Administrator of SBA should establish a process for conducting an organization-wide cybersecurity risk assessment. (Recommendation 57)

Agency: Small Business Administration
Status: Open
Priority recommendation

Comments: SBA concurred with this recommendation. As of January 2020, SBA stated that it intends to finalize its process for an agency-wide cybersecurity risk assessment by March 31, 2020. Once SBA has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Commissioner of the Social Security Administration should fully establish and document a process for coordination between cybersecurity risk management and enterprise risk management functions. (Recommendation 58)

Agency: Social Security Administration
Status: Open
Priority recommendation

Comments: SSA concurred with this recommendation. As of January 2020, SSA stated that it has initiated a formal process for coordination between its cybersecurity risk management and enterprise risk management teams and that this process should be fully established by the third quarter of FY 2020. Once SSA has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Administrator of EPA should work with the Commissioner of FDA and Secretary of Agriculture to incorporate leading collaboration practices as they implement their interagency FLW reduction strategic plan, to include (1) agreeing on roles and responsibilities; (2) developing mechanisms to monitor, evaluate, and report on results; (3)clearly defining short- and long-term outcomes; (4) identifying how leadership commitment will be sustained; and (5) ensuring that the relevant stakeholders have been included in the collaborative effort.(Recommendation 1)

Agency: Environmental Protection Agency
Status: Open

Comments: The agency agreed with this recommendation. As of June 2020, EPA indicated that its proposed completion date is October 2020. EPA published joint and individual agency accomplishments in each of the six priority areas listed as contributing efforts on EPA's webpage (https://www.epa.gov/sustainable-management-food/winning-reducing-food-waste-federal-interagency-strategy). In addition, EPA indicated that it is coordinating with government and other stakeholders through: (1) monthly high-level check-in calls for senior USDA and FDA officials, in which the meeting chair rotates among agencies; (2) twice a month (or as needed) staff work group meetings, led by the recently appointed USDA food loss and waste liaison, to explore potential activities aligned with the six priority areas in the interagency strategy to reduce food loss and waste; and (3) participation in quarterly meetings with relevant stakeholders, such as ReFED, the Food Waste Reduction Alliance (FWRA), and Further with Food, to coordinate efforts and learn of opportunities to collaborate on reducing food loss and waste. We will continue to follow up with the agency. When we confirm what additional actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commissioner of FDA should work with the Administrator of EPA and Secretary of Agriculture to incorporate leading collaboration practices as they implement their interagency FLW reduction strategic plan, to include (1) agreeing on roles and responsibilities; (2) developing mechanisms to monitor, evaluate, and report on results; (3)clearly defining short- and long-term outcomes; (4) identifying how leadership commitment will be sustained; and (5) ensuring that the relevant stakeholders have been included in the collaborative effort. (Recommendation 2)

Agency: Department of Health and Human Services: Food and Drug Administration
Status: Open

Comments: The agency agreed with this recommendation. As of December 2019, we are following up with the agency. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Agriculture should work with Administrator of EPA and Commissioner of FDA to incorporate leading collaboration practices as they implement their interagency FLW reduction strategic plan, to include (1) agreeing on roles and responsibilities; (2) developing mechanisms to monitor, evaluate, and report on results; (3)clearly defining short- and long-term outcomes; (4) identifying how leadership commitment will be sustained; and (5) ensuring that the relevant stakeholders have been included in the collaborative effort. (Recommendation 3)

Agency: Department of Agriculture
Status: Open

Comments: The agency agreed with this recommendation. As of December 2019, we are following up with the agency. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: NNSA's Energetic Materials Enterprise Manager and relevant NNSA officials and contractor representatives at NNSA sites should take steps to improve the accuracy of FIMS data related to NNSA's infrastructure supporting explosives activities. These steps should include reviewing and updating information about associations of assets with primary and secondary explosives missions; ensuring that those who provide asset information to FIMS administrators understand the data they need to provide; and clarifying how to accurately enter information in FIMS for explosives assets that are not buildings. (Recommendation 1)

Agency: Department of Energy: National Nuclear Security Administration
Status: Open

Comments: As of July 2020, we are currently reviewing agency information and plan to reach out as needed for additional information for this recommendation.

Recommendation: NNSA's Energetic Materials Enterprise Manager, in consultation with members of NNSA's Energetics Coordinating Committee, should, as the agency revises its Defense Programs Strategic Plan for Energetic Materials, include discussion of identified challenges related to explosives activities, such as data quality, workforce levels, and safety as well as any actions to address them, as appropriate, or document the rationale for why identified challenges were not included. (Recommendation 2)

Agency: Department of Energy: National Nuclear Security Administration
Status: Open

Comments: Based on trade press reports, NNSA appears to be taking several actions that, collectively, may serve to close this recommendation as implemented. As of July 2020, we are awaiting information from agency officials and will update the status of this recommendation when the information is received.

Recommendation: NNSA's Energetic Materials Enterprise Manager, in consultation with members of NNSA's Energetics Coordinating Committee, should, as the agency revises its Defense Programs Strategic Plan for Energetic Materials, include fully developed elements of an effective strategic plan, such as a clearly identified mission statement and performance goals that are quantifiable, set time frames for completion, and list responsible parties to carry out specific activities for all strategic goals. (Recommendation 3)

Agency: Department of Energy: National Nuclear Security Administration
Status: Open

Comments: Based on trade press reports, NNSA appears to be making progress implementing this recommendation. As of July 2020, we have requested additional information from agency officials and will update the recommendation status when the information is received.

Recommendation: The Secretary of Commerce should ensure that the Director of the Census Bureau develops and obtains management approval of mitigation and contingency plans for all risks that require them. (Recommendation 1)

Agency: Department of Commerce
Status: Open
Priority recommendation

Comments: As of May 2020, the Bureau's program risk registers included a clear indication of the status of mitigation plans; however, the Bureau's portfolio risk register did not, without which there was not a clear indication of which portfolio risk mitigation plans had been approved by management. As of August 2020, the Bureau's portfolio risk register also included a clear indication of mitigation plan status. At that time, we reviewed the Bureau's program and portfolio risk registers to determine whether the Bureau had developed and obtained management approval of mitigation and contingency plans for all risks that required them. We found six risks that met the Bureau's requirements for a contingency plan but did not have an approved contingency plan in place. We notified the Bureau and asked them to ensure that approved mitigation and contingency plans were in place for all risks that required them. We will continue to monitor the Bureau's actions to implement this recommendation.

Recommendation: The Secretary of Commerce should ensure that the Director of the Census Bureau updates the Bureau's decennial risk management plan to require that risk mitigation and contingency plans, including the risk register descriptions and separate plans, have the seven key attributes for helping to ensure they contain the information needed to manage risk. (Recommendation 4)

Agency: Department of Commerce
Status: Open

Comments: In July 2020, the Bureau updated its decennial risk management plan and, in doing so, implemented this recommendation for six of the seven key attributes we identified. The missing attribute was monitoring plans: a description in each mitigation and contingency plan of how the agency will monitor the risk response-with performance measures and milestones, where appropriate-to help track whether the plan is working as intended. According to Bureau officials, rather than requiring this attribute, they instead noted it as a lesson learned for the 2030 Census and documented it in their knowledge management tool. In August 2020, we requested documentation of these actions. Once received, we will assess whether these actions suffice to close the recommendation.

Recommendation: The Secretary of Defense should direct the Director, Office of Cost Assessment and Program Evaluation to conduct an independent schedule assessment of the full program schedule for the Global Positioning System's next generation operational control system based on progress made through the end of calendar year 2019. (Recommendation 1)

Agency: Department of Defense
Status: Open

Comments: DOD did not concur with our recommendation to conduct an independent assessment of the full OCX program schedule based on progress made through the end of calendar year 2019, citing an independent cost and schedule estimate conducted in September 2018 and other ongoing program assessment and monitoring efforts. GAO continues to affirm that the recommendation is necessary given that DOD has not conducted an assessment of the full schedule since June 2018, since which time program risks have evolved. Additionally, ongoing oversight efforts are limited in scope and do not include the developmental test period after product delivery. As of August 2020, the Air Force position remains a non-concur, based on the same rationale previously noted.

Recommendation: The Chief Operating Officer of EXIM should consider establishing documented policies and procedures for (1) determining medium-term delegated authority lenders' eligibility for continued participation in EXIM's programs and (2) decertifying or taking other appropriate actions for such lenders that do not meet compliance or eligibility standards. (Recommendation 1)

Agency: Export-Import Bank of the United States
Status: Open

Comments: EXIM concurred with our recommendation and stated that it will consider establishing documented policies and procedures for determining medium-term delegated authority lenders' eligibility for continued participation in EXIM's programs and decertifying or taking other appropriate actions for such lenders that do not meet compliance or eligibility standards. If implemented effectively, EXIM's planned actions should address the intent of our recommendation. An EXIM official indicated that actions to address this recommendation would be completed during 2020.

Recommendation: The Chief Operating Officer of EXIM should establish documented policies and procedures for periodically reviewing credit programs in which the government bears more than 80 percent of any loss to determine whether private sector lenders should bear a greater share of the risk. (Recommendation 2)

Agency: Export-Import Bank of the United States
Status: Open

Comments: EXIM concurred with this recommendation and stated that it will establish documented policies and procedures for periodically reviewing credit programs in which the government bears more than 80 percent of any loss to determine whether private sector lenders should bear a greater share of the risk. If implemented effectively, EXIM's planned actions should address the intent of our recommendation. An EXIM official indicated that actions to address this recommendation would be completed during 2020.

Recommendation: The Secretary of Commerce should direct the Director of the Census Bureau to direct the Census Bureau's Chief Information Officer (CIO) to take steps to ensure that identified corrective actions for cybersecurity weaknesses are implemented within prescribed time frames. (Recommendation 1)

Agency: Department of Commerce
Status: Open
Priority recommendation

Comments: Commerce agreed with our recommendation. It provided an action plan in August 2019. We will review the Bureau's progress in addressing this recommendation as part of our ongoing work on the 2020 Census.

Recommendation: The Secretary of Commerce should direct the Director of the Census Bureau to direct the Bureau's CIO to implement a formal process for tracking and executing appropriate corrective actions to remediate cybersecurity weaknesses identified by DHS, and expeditiously address the identified deficiencies. (Recommendation 2)

Agency: Department of Commerce
Status: Open
Priority recommendation

Comments: Commerce agreed with our recommendation. In August 2019, the Bureau stated that it is developing a process for tracking and executing corrective actions identified by governing bodies and external entities. We will review the Bureau's progress in addressing this recommendation as part of our ongoing work on the 2020 Census.

Recommendation: The Secretary of Defense should ensure that the F-35 program office assesses whether the Operational Requirements Document (ORD) R&M targets are still feasible and revise the ORD accordingly. (Recommendation 1)

Agency: Department of Defense
Status: Open

Comments: DOD concurred with our recommendation and stated that it would review its Reliability & Maintainability (R&M) requirements and possibly revise them. In late 2019, the F-35 Program Executive Officer (PEO) developed an initiative to clearly identify what, if any, revisions DOD should make to the ORD. As of July 2020, no additional actions have been taken.

Recommendation: The Secretary of Defense should ensure that the F-35 program office, as it revises its Reliability and Maintainability Improvement Program (RMIP), identifies specific and measurable R&M objectives in its RMIP guidance. (Recommendation 2)

Agency: Department of Defense
Status: Open

Comments: DOD concurred with our recommendation and stated that it would update its Reliability & Maintainability (R&M) RMIP guidance. In late 2019, DOD reported that a revised RMIP will be delivered to program leadership for approval. As of July 2020, no additional actions have been taken.

Recommendation: The Secretary of Defense should ensure that the F-35 program office, as it revises its RMIP, identifies and documents which RMIP projects will achieve the identified objectives of the RMIP guidance. (Recommendation 3)

Agency: Department of Defense
Status: Open

Comments: DOD concurred with our recommendation and stated that it would update its RMIP guidance. In late 2019, DOD reported that a revised RMIP will be delivered to program leadership for approval. As of July 2020, no additional actions have been taken.

Recommendation: The Secretary of Defense should ensure that the F-35 program office prioritizes funding for the RMIP. (Recommendation 4)

Agency: Department of Defense
Status: Open

Comments: DOD concurred with our recommendation and stated that it would plan for R&M funding going forward. In Sept. 2019, the F-35 Program Office reported that it was coordinating with the services to increase its Reliability & Maintainability investment. In Nov. 2019, the F-35 Program Office reported that it would allocate significant additional funding for RMIP for calendar year 2020. As of July 2020, no additional actions have been taken.

Recommendation: The FEMA Administrator should ensure that the GMM program management office finalizes the organizational change management plan and time frames for implementing change management actions. (Recommendation 1)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: DHS concurred with this recommendation. We will continue to monitor the department's efforts to implement it.

Recommendation: The FEMA Administrator should ensure that the GMM program management office updates the program schedule to address the leading practices for a reliable schedule identified in this report. (Recommendation 4)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: DHS concurred with this recommendation. We will continue to monitor the department's efforts to implement it.

Recommendation: The FEMA Administrator should ensure that the FEMA Office of the Chief Information Officer (OCIO) defines sufficiently detailed planned evaluation methods and actual evaluation methods for assessing security controls. (Recommendation 5)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: DHS concurred with this recommendation. We will continue to monitor the department's efforts to implement it.

Recommendation: The FEMA Administrator should ensure that the FEMA OCIO approves a security assessment plan before security assessment reviews are conducted. (Recommendation 6)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: DHS concurred with this recommendation. We will continue to monitor the department's efforts to implement it.

Recommendation: The FEMA Administrator should ensure that the GMM program management office follows DHS guidance on preparing corrective action plans for all security vulnerabilities. (Recommendation 7)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: DHS concurred with this recommendation. We will continue to monitor the department's efforts to implement it.

Recommendation: The FEMA Administrator should ensure that the GMM program management office fully tests all of its security controls for the system. (Recommendation 8)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: DHS concurred with this recommendation. We will continue to monitor the department's efforts to implement it.

Recommendation: The Director of OMB should clarify and document OMB's procedure for changing official data definition standards for DATA Act reporting, for example, by explicitly describing how change procedures developed for other government-wide initiatives apply to DATA Act definition standards in a public source of guidance or information. (Recommendation 1)

Agency: Executive Office of the President: Office of Management and Budget
Status: Open
Priority recommendation

Comments: OMB has taken steps to restructure the federal data ecosystem, including issuing government-wide guidance covering all federal data and creating a Business Standards Council. However, given the complexity of recent changes, OMB needs to explicitly and publicly describe how those changes-developed in the context of other government-wide initiatives-apply to DATA Act data element definitions.

Recommendation: The Director of OMB should ensure that the June 2018 policy changes regarding DATA Act data definition standards are clearly identified and explained in the official repository or another authoritative public source of DATA Act standards and guidance, such as by including a revision history along with the current version of the definitions. (Recommendation 2)

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: In January 2020, OMB staff cited its Federal Spending Transparency Data Standards website and specifically notations on that site regarding the dates of revisions made to those standards as being responsive to this recommendation. However, the specific notations cited by OMB only show changes made back in 2015 and do not reflect nor explain some of the more recent revisions that led to GAO making this recommendation.

Recommendation: Congress should consider taking legislative action to resolve the long-standing issues between the Corps and the Advisory Council on Historic Preservation over the Corps Regulatory Program's procedures for implementing section 106 of the National Historic Preservation Act. (Matter for Consideration 1)

Agency: Congress
Status: Open

Comments: When we determine what steps the Congress has taken, we will provide updated information

Recommendation: The Secretary of Energy should develop a documented policy or clarify existing policy to implement the statutory requirement to consult with Alaska Native Corporations (ANC) on the same basis as Indian tribes under Executive Order 13175. (Recommendation 1)

Agency: Department of Energy
Status: Open

Comments: As of April 2020, the Department of Energy plans to clarify and consolidate its consultation policies and practices for consultation with Alaska Native Corporations by June 2021.

Recommendation: The Administrator of the Environmental Protection Agency should develop a documented policy or clarify existing policy to implement the statutory requirement to consult with ANCs on the same basis as Indian tribes under Executive Order 13175. (Recommendation 2)

Agency: Environmental Protection Agency
Status: Open

Comments: In December 2019, EPA created a draft document, Guiding Principles for Consulting with Alaska Native Claims Settlement Act Corporations, and issued it for consultation with Alaska Native Corporations (ANCs). The draft guiding principles seek to clarify EPA's consultation and coordination practices with ANCs. Additionally, according to agency officials, an EPA working group is in the process of developing an internal, best practices implementation guide. As of April 2020, EPA expects to finalize these guidance documents in 2020

Recommendation: The Secretary of Housing and Urban Development should develop a documented policy or clarify existing policy to implement the statutory requirement to consult with ANCs on the same basis as Indian tribes under Executive Order 13175. (Recommendation 3)

Agency: Department of Housing and Urban Development
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Homeland Security should establish a time frame for developing or updating policy to implement the statutory requirement to consult with ANCs on the same basis as Indian tribes under Executive Order 13175. (Recommendation 5)

Agency: Department of Homeland Security
Status: Open

Comments: In February 2019, the Department of Homeland Security provided GAO documentation supporting a planned time frame of March 2020 for developing and updating its consultation policy to implement the statutory requirement to consult with ANCs in response to this recommendation. We plan to close the recommendation after reviewing documentation that the policy has been updated.

Recommendation: The Assistant to the Secretary of Agriculture for Rural Development should document in the agency's tribal consultation policy how agency officials are to communicate with tribes about how tribal input from consultation was considered in agency decisions on proposed infrastructure projects. (Recommendation 6)

Agency: Department of Agriculture: Rural Development
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of Civil Works of the Corps should document in the agency's tribal consultation policy how agency officials are to communicate with tribes about how tribal input from consultation was considered in agency decisions on infrastructure projects. (Recommendation 7)

Agency: Department of Defense: Department of the Army: Corps of Engineers: Civil Works
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director for the Bureau of Ocean Energy Management should document in the agency's tribal consultation policy how agency officials are to communicate with tribes about how tribal input from consultation was considered in agency decisions on infrastructure projects. (Recommendation 8)

Agency: Department of the Interior: Bureau of Ocean Energy Management
Status: Open

Comments: As of September 2019, Bureau of Ocean Energy Management (BOEM) plans to amend its tribal consultation policy with policies and procedures for communicating with tribes after consultation by December 2020.

Recommendation: The Secretary of Energy should document in the agency's tribal consultation policy how agency officials are to communicate with tribes about how tribal input from consultation was considered in agency decisions on infrastructure projects. (Recommendation 10)

Agency: Department of Energy
Status: Open

Comments: As of April 2020, the Department of Energy indicated that it plans to document policies for communicating about how input from tribal consultation was considered in agency decisions on infrastructure projects by June 2021.

Recommendation: The Administrator of the Federal Highway Administration should document in the agency's tribal consultation policy how agency officials are to communicate with tribes about how tribal input from consultation was considered in agency decisions on infrastructure projects. (Recommendation 14)

Agency: Department of Transportation: Federal Highway Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Homeland Security should document in the agency's tribal consultation policy how agency officials are to communicate with tribes about how tribal input from consultation was considered in agency decisions on infrastructure projects. (Recommendation 16)

Agency: Department of Homeland Security
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Housing and Urban Development should document in the agency's tribal consultation policy how agency officials are to communicate with tribes about how tribal input from consultation was considered in agency decisions on infrastructure projects. (Recommendation 17)

Agency: Department of Housing and Urban Development
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Chairman of the Nuclear Regulatory Commission should document in the agency's tribal consultation policy how agency officials are to communicate with tribes about how tribal input from consultation was considered in agency decisions on infrastructure projects. (Recommendation 19)

Agency: Nuclear Regulatory Commission
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Transportation should document in the agency's tribal consultation policy how agency officials are to communicate with tribes about how tribal input from consultation was considered in agency decisions on infrastructure projects. (Recommendation 20)

Agency: Department of Transportation
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of ICE should build on existing efforts to use data analytics by employing techniques, such as network analysis, to identify potential fraud indicators in schools petitioning for certification. (Recommendation 2)

Agency: Department of Homeland Security: United States Immigration and Customs Enforcement
Status: Open

Comments: As of March 2020, ICE officials indicated that they were in the process of addressing GAO's recommendation and would submit an update including supporting documentation when available. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of ICE should develop an implementation plan for the project aimed at strengthening background checks for DSOs; that plan should outline how the project will be executed, monitored, and controlled. (Recommendation 5)

Agency: Department of Homeland Security: United States Immigration and Customs Enforcement
Status: Open

Comments: As of March 2020, ICE officials indicated that they were in the process of addressing GAO's recommendation and would submit an update including supporting documentation when available. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of ICE should implement mandatory DSO training and verify that the training is completed. (Recommendation 6)

Agency: Department of Homeland Security: United States Immigration and Customs Enforcement
Status: Open

Comments: As of March 2020, ICE officials indicated that they were in the process of addressing GAO's recommendation and would submit an update including supporting documentation when available. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of ICE should complete the development and implementation of its plans for mandatory fraud-specific training for DSOs. (Recommendation 7)

Agency: Department of Homeland Security: United States Immigration and Customs Enforcement
Status: Open

Comments: As of March 2020, ICE officials indicated that they were in the process of addressing GAO's recommendation and would submit an update including supporting documentation when available. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Defense should ensure that the Office of the Under Secretary of Defense for Policy (OUSD (Policy)), the Joint Staff, and the Office of the Director, Cost Assessment and Program Evaluation—in consultation with the services—determine the analytic products needed and the level of detail that is sufficient to serve as a common starting point but flexible to allow for variation of analysis to support senior leader decisions, and update these products to reflect current strategy and intelligence estimates, as well as the anticipated operational approaches needed to address future threats. (Recommendation 1)

Agency: Department of Defense
Status: Open
Priority recommendation

Comments: DOD concurred with this recommendation and, as of January 2020, has taken some steps to address it. Specifically, in May 2019, DOD sent a follow up letter to our final report that said that the Department's position on the report has not substantially changed and that the actions identified in the Department's initial response remain underway. DOD also noted that the FY 2021-2025 Defense Planning Guidance (DPG) signed in April 2019 directly addresses many of the report's recommendations and that the Joint Staff is leading an aggressive effort on joint force innovation and experimentation, with Tri-Chair oversight. In September 2019, we reviewed the DPG and found that it partially addressed our recommendation. In the DPG, DOD identified analytic products that would serve as the department's starting point for analysis in fiscal years 2021-2025. DOD has also begun developing some of these analytic products, including several defense planning scenarios that it developed in December 2018 to reflect some of the threats outlined in the National Defense Strategy. To fully implement this recommendation, DOD will need to develop the additional products it needs for the remaining key threats identified in the National Defense Strategy. Additionally, keeping these products updated will require sustained attention by the department, but the direction provided by DOD was limited to budget guidance for fiscal years 2021-2025. The direction would more closely adhere to the intent of our recommendation if it were provided in an enduring guidance or policy document. We will continue to monitor DOD actions in response to this recommendation.

Recommendation: The Secretary of Defense should ensure that OUSD (Policy) provide specific guidance requiring the services to explore a range of innovative force structure approaches relevant to the key threats identified in the National Defense Strategy, including identifying key assumptions on which the services must conduct sensitivity analyses. (Recommendation 2)

Agency: Department of Defense
Status: Open
Priority recommendation

Comments: DOD concurred with this recommendation and, as of January 2020, has taken some steps to address it. Specifically, in May 2019, DOD sent a follow up letter to our final report that said that the Department's position on the report has not substantially changed and that the actions identified in the Department's initial response remain underway. DOD also noted that the FY 2021-2025 Defense Planning Guidance (DPG) signed in April 2019 directly addresses many of the report's recommendations and that the Joint Staff is leading an aggressive effort on joint force innovation and experimentation, with Tri-Chair oversight. In September 2019, we reviewed the DPG and found that it directed some actions relevant to our recommendation regarding the need to explore a range of innovative force structure approaches. However, it did not directly address the need to require the services to conduct sensitivity analysis on key assumptions. The defense planning scenarios that DOD developed in December 2018 identify critical parameters for analytical exploration and encourage DOD components to conduct excursions and sensitivity analysis of assumptions, which we found has not been sufficient to spur this type of analysis in the past. To fully implement this recommendation, DOD needs to require the services to conduct this analysis. We will continue to monitor DOD actions in response to this recommendation.

Recommendation: The Secretary of Defense should establish an approach for comparing competing analyses and conducting joint analyses for force structure to support senior leaders as they seek to implement the National Defense Strategy. This could include establishing a separate body with these capabilities and/or specifying the organizational responsibilities and processes for conducting these comparisons and analyses. (Recommendation 3)

Agency: Department of Defense
Status: Open
Priority recommendation

Comments: DOD concurred with this recommendation and, as of January 2020, has taken some steps to address it. Specifically, in May 2019, DOD sent a follow up letter to our final report that said that the Department's position on the report has not substantially changed and that the actions identified in the Department's initial response remain underway. DOD also noted that the FY 2021-2025 Defense Planning Guidance (DPG) signed in April 2019 directly addresses many of the report's recommendations and that the Joint Staff is leading an aggressive effort on joint force innovation and experimentation, with Tri-Chair oversight. In September 2019, we reviewed the DPG and found that it included steps that could lay the groundwork for DOD to compare competing analyses and conduct joint force structure analyses. To fully implement this recommendation, DOD needs to establish an approach for doing so, which could include establishing a body or process for conducting comparisons or joint analyses. We will continue to monitor DOE actions in response to this recommendation.

Recommendation: The Commandant of the Coast Guard should direct program managers to establish shore infrastructure performance goals, measures, and baselines to track the effectiveness of maintenance and repair investments and provide feedback on progress made. (Recommendation 2)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: The Coast Guard concurred with this recommendation and said it would take steps to implement it. As of April 2020, the Coast Guard continues to develop and refine its shore infrastructure measures with associated goals and estimates that it will complete these efforts in December 2020. When we confirm actions the Coast Guard has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commandant of the Coast Guard should work with Congress to develop and implement a process to routinely align Coast Guard's shore infrastructure portfolio with mission needs, including by disposing of all unneeded assets. (Recommendation 3)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: The Coast Guard concurred with this recommendation and said it would take steps to implement it. As of April 2020, the Coast Guard continues work to establish a formalized process to assess current and projected operational and mission support needs to identify and recommend disposal of unneeded land, buildings, and structures. The Coast Guard anticipates completing these efforts by December 2020. When we confirm actions the Coast Guard has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commandant of the Coast Guard should establish guidance for planning boards to document inputs, deliberations, and project prioritization decisions for infrastructure maintenance projects. (Recommendation 4)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: The Coast Guard concurred with this recommendation and said it would take steps to implement it. As of April 2020, the Coast Guard is reviewing its existing guidance for planning boards and expects to complete these efforts in December 2020. When we confirm actions the Coast Guard has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commandant of the Coast Guard should employ models for its asset lines for predicting the outcome of investments, analyzing trade-offs, and optimizing decisions among competing investments. (Recommendation 5)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open
Priority recommendation

Comments: In 2019, GAO reported that the Coast Guard generally has not employed models for predicting the outcome of maintenance investments and optimizing among competing investments, as called for in leading practices. GAO found that, in one instance, the Coast Guard used a model to optimize maintenance for its aviation pavement and, according to Coast Guard officials, found that it could save nearly $14 million by accelerating investment in this area (e.g., paving runways) sooner rather than deferring such maintenance. Coast Guard officials told GAO that such modeling could be applied within and across all of its shore infrastructure asset types, but the Coast Guard did not implement the results of this model and does not require their use. Employing models to predict the future condition and performance of facilities could potentially identify and achieve cost savings, according to leading practices. The Coast Guard concurred with GAO's recommendation that it employ models for its asset lines for predicting the outcome of investments, analyzing trade-offs, and optimizing decisions among competing investments. As of January 2020, the Coast Guard has not employed models to evaluate its asset lines. Instead, the Coast Guard reported that it is evaluating alternative models for its asset lines, and estimated that the Coast Guard will complete this analysis by December 31, 2020.

Recommendation: The Commandant of the Coast Guard should include supporting details about competing project alternatives and report trade-offs in Congressional budget requests and related reports. (Recommendation 6)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: In February 2019, GAO reported that Coast Guard budget requests did not provide Congress with accurate information about its funding needs. Specifically, we found that the Coast Guard did not meet this leading practice as its budget requests (1) have not clearly identified funding allotted for routine shore infrastructure maintenance needs, and (2) have not generally addressed deferred maintenance and repair deficiencies, resulting in increases to its backlogs. Specifically, GAO found that budget requests related to shore infrastructure for fiscal years 2012 through 2019 did not provide Congress with required and complete information, as previously noted, necessary to inform decision-makers of the risks posed by untimely investments in maintenance and repair backlogs. GAO also reported that the Coast Guard annual Unfunded Priorities List does not clearly articulate prioritization decisions, including information about trade-offs among competing project alternatives, as well as the impacts on missions conducted from shore facilities in disrepair that had not been prioritized in previous years, or is it aligned with its requirements-based budget targets for shore infrastructure. DHS concurred with GAO's recommendation that the Coast Guard include supporting details about competing project alternatives and report trade-offs in Congressional budget requests and related reports. In its August 2019 180-day letter response, DHS stated that the Coast Guard Office of Budget and Programs will include additional information in the future Unfunded Priorities Lists. However, when the Coast Guard released its 2020 Unfunded Priorities List to Congress it did not contain additional details on competing priorities. GAO will continue to monitor Coast Guard budget requests and related reports, including the Unfunded Priorities Lists, for additional supporting details about competing project alternatives and trade-offs

Recommendation: The Secretary of Energy should direct the Director of the Office of Project Management and the Assistant Secretary of the Office of Environmental Management to work together to establish requirements for classifying cleanup work as capital asset projects or operations activities. (Recommendation 1)

Agency: Department of Energy
Status: Open

Comments: DOE partially concurred with this recommendation. In August 2019, in a letter to GAO on how EM will address our recommendation, the Senior Advisor for Environmental Management to the Under Secretary for Science stated that DOE developed a draft Cleanup Project Management Policy to clarify the expectations for EM's management of discrete work, such as operations activities that could be considered projects. In February 2020, EM officials stated that they are addressing this recommendation in two steps. First, EM is working with DOE's Office of Project Management to draft a Cleanup Project Management Policy (expected to be completed in spring 2020) to address the Decommissioning and Deactivation (D&D) phase of cleanup. This policy will become an appendix in DOE's Order 413.3B. EM officials further stated that EM plans to develop an additional Cleanup Program Management Policy that would classify the remaining types of activities not covered by the Cleanup Project Management Policy, including what EM currently classifies as operations activities. EM plans to implement this policy by the end of fiscal year 2020.

Recommendation: The Secretary of Energy should direct the Director of the Office of Project Management and the Assistant Secretary of the Office of Environmental Management to work together to asses EM's ongoing operations activities to determine if they should be reclassified as capital asset projects based on the newly established requirements. (Recommendation 2)

Agency: Department of Energy
Status: Open

Comments: DOE partially concurred with this recommendation. In August 2019, in a letter to GAO on how EM will address our recommendation, the Senior Advisor for Environmental Management to the Under Secretary for Science stated that DOE developed a draft Cleanup Project Management Policy to clarify the expectations for EM's management of discrete work, such as operations activities that could be considered projects. In February 2020, EM officials stated that they are addressing this recommendation in two steps. First, EM is working with DOE's Office of Project Management to draft a Cleanup Project Management Policy (expected to be completed in spring 2020) to address the Decommissioning and Deactivation (D&D) phase of cleanup. This policy will become an appendix in DOE's Order 413.3B. EM officials further stated that EM plans to develop an additional Cleanup Program Management Policy that would classify the remaining types of activities not covered by the Cleanup Project Management Policy, including what EM currently classifies as operations activities. EM plans to implement this policy by the end of fiscal year 2020.

Recommendation: The Secretary of Energy should direct the Assistant Secretary of the Office of Environmental Management to review and revise EM's 2017 cleanup policy to include program management leading practices related to scope, cost, schedule performance, and independent reviews. (Recommendation 3)

Agency: Department of Energy
Status: Open
Priority recommendation

Comments: DOE concurred with this recommendation. In August 2019, in a letter to GAO on how EM will address our recommendation, the Senior Advisor for Environmental Management to the Under Secretary for Science stated that EM intends to replace its current EM Cleanup Policy with two separate project and program management policies that will incorporate leading practices related to scope, cost, and schedule, and independent reviews, as appropriate. In February 2020, EM officials stated that EM is working on a Cleanup Project Management Policy (expected to be completed in spring 2020) that will cover the Decommissioning and Deactivation (D&D) phase of cleanup. EM plans to develop an additional Cleanup Program Management Policy (expected to be completed by the end of fiscal year 2020), which will supersede EM's current cleanup policy and include leading program management practices-and possibly also project management practices-related to scope, cost, schedule performance, and independent reviews.

Recommendation: The Secretary of Energy should direct the Assistant Secretary of the Office of Environmental Management to review and revise EM's 2017 cleanup policy to include project management leading practices related to scope, cost, schedule performance, and independent reviews. (Recommendation 4)

Agency: Department of Energy
Status: Open
Priority recommendation

Comments: DOE concurred with this recommendation. In August 2019, in a letter to GAO on how EM will address our recommendation, the Senior Advisor for Environmental Management to the Under Secretary for Science stated that EM intends to replace its current EM Cleanup Policy with two separate project and program management policies that will incorporate leading practices related to scope, cost, and schedule, and independent reviews, as appropriate. In February 2020, EM officials stated that EM is working on a Cleanup Project Management Policy (expected to be completed in spring 2020) that will cover the Decommissioning and Deactivation (D&D) phase of cleanup. EM plans to develop an additional Cleanup Program Management Policy (expected to be completed by the end of fiscal year 2020), which will supersede EM's current cleanup policy and include leading program management practices-and possibly also project management practices-related to scope, cost, schedule performance, and independent reviews.

Recommendation: The Secretary of Energy should direct the Assistant Secretary of the Office of Environmental Management to update its cleanup policy to require that earned value management (EVM) systems be maintained and used in a way that follows EVM best practices. (Recommendation 5)

Agency: Department of Energy
Status: Open

Comments: DOE concurred with this recommendation. In August 2019, in a letter to GAO on how EM will address our recommendation, the Senior Advisor for Environmental Management to the Under Secretary for Science stated that EM intends to replace its current EM Cleanup Policy with two separate project and program management policies that will incorporate earned value management best practices, as appropriate. In February 2020, EM officials stated that EM's forthcoming Cleanup Project Management Policy (expected to be completed in spring 2020) will require capital asset projects covered under the policy to use earned value management (EVM) systems that have been independently certified, which is an EVM best practice. However, EM officials told us that this policy will not require operations activities to follow EVM best practices. EM officials stated that EM is also considering including this requirement in its forthcoming Cleanup Program Management Policy (expected to be completed by the end of fiscal year 2020). In addition, EM officials told is that EM plans to require future end-state contracts to use EVM systems that have either been certified by the DOE Office of Project Management or been subject to a "compliance review" conducted by EM itself, depending on the dollar value of the contract.

Recommendation: The Secretary of Energy should direct the Assistant Secretary of the Office of Environmental Management to develop a policy to ensure that work is categorized as level of effort only in appropriate, specified circumstances, such as when work is not measurable or when measurement is impractical. (Recommendation 6)

Agency: Department of Energy
Status: Open

Comments: DOE concurred with this recommendation. In August 2019, in a letter to GAO on how EM will address our recommendation, the Senior Advisor for Environmental Management to the Under Secretary for Science stated that EM intends to include requirements related to the categorization of level of effort work in the project and program management policies EM is developing.

Recommendation: The Secretary of Energy should direct the Assistant Secretary of the Office of Environmental Management to integrate EVM data into EM's performance metrics for operations activities. (Recommendation 7)

Agency: Department of Energy
Status: Open

Comments: DOE partially concurred with this recommendation. In August 2019, in a letter to GAO on how EM will address our recommendation, the Senior Advisor for Environmental Management to the Under Secretary for Science stated that DOE is in the process of developing a Cleanup Program Management Policy that will, among other things, incorporate changes relative to the integration of EVM data into performance metrics as appropriate. As of February 2020, EM officials told us that the new policy is expected to be completed by the end of fiscal year 2020. In February 2020, EM officials stated that EM plans to begin a new performance review process for operations activities that will include EVM-based performance metrics as part of annual reporting to the Assistant Secretary. The new process is expected to begin in October 2020, but EM officials have not determined whether this will be a requirement included in EM's forthcoming Cleanup Program Management Policy.

Recommendation: The General Manager of WMATA should establish documented policies and procedures for the new capital planning process. These policies and procedures should include methodologies for ranking and selecting capital projects for funding in WMATA's fiscal year 2020 capital budget and fiscal years 2020-2025 Capital Improvement Program and for future planning cycles. (Recommendation 1)

Agency: Washington Metropolitan Area Transit Authority
Status: Open

Comments: As of June 2020, WMATA prepared guidance and briefings for project managers to describe the new capital planning process for WMATA's fiscal year 2021 Capital Improvement Program, as well as for the FY 2021-2030 Capital Plan. WMATA's guidance states that WMATA will prioritize projects based on their alignment with WMATA's strategic and supplemental goals and project readiness. WMATA is currently developing the guidance for the FY 2022 Capital Improvement Program planning cycle, which was delayed by COVID-19. WMATA officials stated that they are also finalizing a Capital Program Planning Policy/Instruction document, and they will provide these guidance documents to GAO once completed. GAO will continue to assess whether these policies and procedures include a methodology for ranking and selecting capital projects for funding in future Capital Improvement Program cycles, as we recommended.

Recommendation: The General Manager of WMATA should develop performance measures to be used for assessing capital investments and the capital planning process to determine if the investments and planning process have achieved their planned goals and objectives. (Recommendation 2)

Agency: Washington Metropolitan Area Transit Authority
Status: Open

Comments: As of June 2020, WMATA is in the process of finalizing the strategic criteria that will be used for the FY 2022 Capital Improvement Program Development process. Once the guidance is approved and issued, copies will be provided to GAO. During the FY 2022 Capital Planning process WMATA is working to define expected outcomes, or key performance indicators describing the success of a capital investment when completed. GAO will continue to assess whether these efforts will develop a means to sufficiently assess WMATA's capital investments and its capital planning process

Recommendation: The General Manager of WMATA should develop a plan for obtaining complete information regarding WMATA's asset inventory and physical condition assessments, including assets related to track and structures. (Recommendation 3)

Agency: Washington Metropolitan Area Transit Authority
Status: Open

Comments: As of June 2020, WMATA is managing three efforts focused on improving WMATA's asset inventory and condition assessment processes. Specifically, WMATA reported that it is developing Data Governance and Standards rules and working with contractors to improve WMATA's asset inventory and condition assessment processes. According to WMATA officials, these efforts should all be complete by the end of 2020. GAO will continue to monitor WMATA's efforts to address this recommendation.

Recommendation: The General Manager of WMATA should conduct a comprehensive risk assessment of the track preventive maintenance program that includes both a quantitative and qualitative assessment of relevant program risks. In addition to considering technical program risks, WMATA should also consider broader program risks, such as the availability of funding for the program and stakeholders' support. (Recommendation 4)

Agency: Washington Metropolitan Area Transit Authority
Status: Open

Comments: As of June 2020, WMATA reiterated information provided to GAO in October 2019 that it was developing and implementing a new Reliability Centered Maintenance process that will largely replace the previously established preventive maintenance program. According to WMATA, the Reliability Centered Maintenance process will enable WMATA to assess risks to its assets and implement strategies to mitigate those risks. However, WMATA reported that implementation of Reliability Centered Maintenance across the entire enterprise will take considerable time. GAO will continue to monitor WMATA's efforts to implement its Reliability Centered Maintenance process, including the degree to which it includes both a quantitative and qualitative assessment of relevant program risks, as we recommended for the previously existing preventive maintenance program.

Recommendation: The General Manager of WMATA should prepare a formal program management plan for the track preventive maintenance program that aligns with WMATA's strategic plan, addresses how the program is linked to overall strategic goals and objectives, and includes program milestones and decision points. (Recommendation 5)

Agency: Washington Metropolitan Area Transit Authority
Status: Open

Comments: As of June 2020 WMATA reported that it was developing and implementing a new Reliability Centered Maintenance process that will largely replace the previously established preventive maintenance program. According to WMATA officials, Reliability Centered Maintenance is not a preventive maintenance program itself, but that some of the programs have evolved from preventive maintenance to planned corrective maintenance, based on evaluation of effectiveness of the programs and recommendations from the engineering and maintenance teams. GAO will continue to monitor WMATA's efforts to implement its Reliability Centered Maintenance process, including: whether WMATA has made sufficient efforts to compile their various asset management strategies into a formal program management plan; whether this process is clearly linked to WMATA's overall strategic goals and objectives; and whether it includes milestones and decision points for its implementation, as we recommended for the previously existing preventive maintenance program.

Recommendation: The Program Director for Financial Integration should collect and document requirements to define project scope and meet project objectives. These requirements should be updated periodically throughout the life of the project. (Recommendation 2)

Agency: Department of Energy: National Nuclear Security Administration
Status: Open

Comments: As of August 2020, NNSA provided a project plan for tasks to be completed for common financial reporting through 2021. However, NNSA has not developed requirements that define specific or detailed requirements for successful implementation of common financial reporting, such as the types of information that program managers need.

Recommendation: The Program Director for Financial Integration should develop a detailed project schedule. The detailed schedule should be documented as part of the annual report to Congress required in the National Defense Authorization Act for Fiscal Year 2017. (Recommendation 3)

Agency: Department of Energy: National Nuclear Security Administration
Status: Open

Comments: As of August 2020, NNSA established a detailed project schedule for the common financial reporting effort through fiscal year 2021. However, NNSA should communicate this detailed project schedule for the effort to Congress on an annual basis.

Recommendation: The Program Director for Financial Integration should develop a formal process to identify risks, document those risks, and plan how to minimize risk exposure. (Recommendation 6)

Agency: Department of Energy: National Nuclear Security Administration
Status: Open

Comments: In June 2020, NNSA developed a risk management plan for common financial reporting which established a framework for identifying and managing risks. GAO will continue to monitor NNSA's efforts to implement the plan, including how NNSA identifies and documents risks and mitigates risk exposure using its management plan.

Recommendation: The Program Director for Financial Integration should develop an approach to effectively engage with all project stakeholders that incorporates their expectations into project decisions. (Recommendation 7)

Agency: Department of Energy: National Nuclear Security Administration
Status: Open

Comments: As of September 2020, NNSA has continued to engage on a regular basis with its M&O contractors. However, similar efforts have not continued with stakeholders of the program offices.

Recommendation: The Secretary of the Army should ensure that the Commanding General of Army Futures Command applies leading practices as they relate to technology development, particularly that of demonstrating technology in an operational environment prior to starting system development. (Recommendation 1)

Agency: Department of Defense: Department of the Army
Status: Open
Priority recommendation

Comments: The Army concurred with this recommendation. Army officials acknowledged the importance of demonstrating technology in an operation environment prior to starting system development and stated that they have taken steps to assist in the identification and removal of infeasible or immature technologies. For example, development of the Integrated Visual Augmentation System includes a series of user engagements where soldiers interact with the system in a field environment and provide feedback to guide development and design. To fully implement this recommendation the Army will need to demonstrate that all of the technologies it is developing are matured in accordance with leading practices. Including soldier engagement in the development of the Integrated Visual Augmentation System is a positive step in that it uses operational experience to determine the utility of technologies on the battlefield. However, demonstrating that those technologies function as expected in an operational environment is equally important. Our past work has shown that demonstrations in an operational environment reduce the risk that technologies will not operate as intended or desired. It is important that the Army continue and expand its efforts to eliminate infeasible, or immature technologies across all of its development programs.

Recommendation: The Secretary of the Army should ensure that the Commanding General of Army Futures Command takes steps to incorporate the experiences of the cross-functional teams in applying leading practices for effective cross-functional teams. (Recommendation 2)

Agency: Department of Defense: Department of the Army
Status: Open

Comments: The Army concurred with this recommendation. According to Army officials, cross-functional teams routinely meet to discuss both successes and challenges. Additionally, senior Army leadership hosts weekly meetings with cross-functional teams to discuss decision points and concerns. Army Futures Command plans to include leadership from all cross-functional teams at future meetings to enhance knowledge sharing and ensure leadership viewpoints are communicated across the enterprise. These actions do incorporate elements of leading practices for cross-functional teams such as open and regular communication and senior management support. To fully implement this recommendation the Army should continue and expand this knowledge sharing as planned as well as ensure other elements of leading practices for effective cross-functional teams are implemented. These include the establishment of well-defined team operations with project-specific rules and procedures as well as appropriate training and learning environments for all cross-functional team members.

Recommendation: The Secretary of the Army should ensure that the Commanding General of Army Futures Command executes a process for identifying and incorporating lessons learned from cross-functional team pilots into the new command. (Recommendation 3)

Agency: Department of Defense: Department of the Army
Status: Open

Comments: The Army concurred with this recommendation. According to Army officials an analyst from the Center for Army Lessons Learned has embedded a permanent analyst at Army Futures Command who is capturing lessons learned and best practices from across the cross-functional teams. The results of this analysis are provided across Army Futures Command and to other stakeholders. Additionally, Army Futures Command has established the Directorate of Systems Integration to act as a repository and action office for lessons learned. This office hosts recurring coordination events to further the communication of lessons learned .

Recommendation: The Secretary of the Army should ensure that the Commanding General of Army Futures Command fully applies leading practices for mergers and organizational transformations as roles, responsibilities, policies and procedures are finalized for the new command. (Recommendation 4)

Agency: Department of Defense: Department of the Army
Status: Open

Comments: The Army concurred with this recommendation. According to Army officials Army Futures Command is applying leading practices for mergers and organizational transformations as it continues to establish the command. These practices include total employee involvement in the transformation process with senior leadership championing the overarching transformation. In addition, the command has worked to identify processes that need improvement as it incorporates the organizations transferred from other commands. It also continues to evolve its staff and functions as needs are identified. According to officials, Army Futures Command continues to select high-performing team members to guide its transformation through selective recruitment and talent management as well as augmenting its growing staff with other Army personnel selected for temporary assignments. The command is also involving employees to obtain their ideas and gain their ownership for the transformation by encouraging them to share their thoughts and ideas. Importantly, according to officials, the command recognizes the need to have an enduring change model to consistently reassess and reorganize the command to consistently deliver products in relevant timeframes. These actions do demonstrate elements of leading practices for mergers and organizational transformations. However, to fully implement this recommendation, Army Futures Command should formalize and institutionalize its authorities, responsibilities, policies and procedures as they relate to these leading practices, especially as leadership within the command and the Army change.

Recommendation: The Secretary of Defense should ensure that the Chief Management Officer establishes a process for identifying and prioritizing available funding to develop and implement initiatives from the cross-functional reform teams. (Recommendation 1)

Agency: Department of Defense
Status: Open
Priority recommendation

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of OMB should determine a government-wide baseline level of progress in meeting physical access control system requirements, including implementation of GSA-approved systems, and should monitor progress in meeting these requirements. (Recommendation 1)

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: In August 2019, GAO contacted OMB to determine if any progress has been made implementing this recommendation. GAO is awaiting OMB's response.

Recommendation: The Secretary of Homeland Security should direct the ISC, in collaboration with member agencies, to assess the extent of, and develop strategies to address, government-wide challenges to implementing physical access control systems. (Recommendation 2)

Agency: Department of Homeland Security
Status: Open

Comments: In August 2019, GAO learned that DHS has recently completed the "Physical Access Control System (PACS) Modernization Working Group Charter." This charter was created under the direction of the Co-Chairs of the Federal Chief Information Security Officer Council, Identity, Credentialing and Access Management Subcommittee, and the Program Director of the DHS Interagency Security Committee. The purpose of the PACS Modernization Working Group is to facilitate the implementation and use of the technology and processes related to modernizing electronic-PACS within the federal government, thereby increasing security, coordination, and compliance with national-level policies and standards. GAO is following up with DHS to obtain additional information about this effort and to determine whether it addresses this recommendation.

Recommendation: The Secretary of the Navy should clarify whether and how to use the laboratory initiated research authority within the Capital Investment Program. (Recommendation 2)

Agency: Department of Defense: Department of the Navy
Status: Open

Comments: In December 2018, DOD agreed with our recommendation. In March 2019, DOD reported that the Navy was working on establishing a process for its laboratories to use the funds made available to them through the laboratory initiated research authority and planned to have this new policy in place by September 1, 2019 but was subsequently changed to a new date of October 1, 2019. However, the Navy was unable to finalize its policy prior to the start of the 2020 fiscal year. In February 2020, a senior USD(R&E) official stated that internal discussions between Navy acquisition officials and Navy financial management officials were ongoing. This official further noted that the Navy planned to finalize its policy by December 1, 2020, in time to influence the Navy's fiscal year 2022 budget request.

Recommendation: The Secretary of Agriculture should amend its analysis of selected data centers to address key elements of a cost-benefit and cost-effectiveness analysis as defined by OMB Circular A-94 and relevant agency guidance. (Recommendation 1)

Agency: Department of Agriculture
Status: Open

Comments: In March 2020, the Department of Agriculture asserted that it has implemented the recommendation but has not provided sufficient evidence to support its assertion.

Recommendation: When amending its analysis of the selected data centers, the Secretary of Agriculture should report on the assessment of each facility's protective measures, as outlined by the Interagency Security Committee guidance. (Recommendation 2)

Agency: Department of Agriculture
Status: Open

Comments: In March 2020, the Department of Agriculture asserted that it has implemented the recommendation but has not provided sufficient evidence to support its assertion.

Recommendation: When amending its analysis of the selected data centers, the Secretary of Agriculture should report on an analysis of the information security controls for each data center, in order to evaluate the data center's information security capabilities. (Recommendation 3)

Agency: Department of Agriculture
Status: Open

Comments: In March 2020, the Department of Agriculture asserted that it has implemented the recommendation but has not provided sufficient evidence to support its assertion.

Recommendation: When amending its analysis of the selected data centers, the Secretary of Agriculture should report on each data center's demonstrated history of restoring continuity of operation functions in the event of a service disruption. (Recommendation 4)

Agency: Department of Agriculture
Status: Open

Comments: In March 2020, the Department of Agriculture asserted that it has implemented the recommendation but has not provided sufficient evidence to support its assertion.

Recommendation: The Secretary of the Treasury should fully comply with OMB's requirements by providing metadata in a single location that are easy to find on the USAspending.gov website. (Recommendation 3)

Agency: Department of the Treasury
Status: Open

Comments: Treasury agreed with the recommendation. As of September 2020, metadata are not available on USAspending.gov.

Recommendation: The Director of OMB should enhance the guidelines for agencies to establish the controls required by FRDAA, by clarifying the difference between FRDAA and ERM requirements, and through collaboration with agencies to determine what additional information agencies need to implement the controls. (Recommendation 1)

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: In March 2020, the Payment Integrity Information Act of 2019 (PIIA) was enacted to improve efforts to identify and reduce government-wide improper payments, including payments that are the result of fraud. PIIA repealed and replaced FRDAA. However, OMB and the other agencies subject to PIIA essentially must satisfy the same requirements established under FRDAA, including adhering to OMB's related guidelines. OMB has not updated its published guidelines for FRDAA as we recommended. If OMB takes additional actions to supplement guidelines under PIIA, we will review the guidelines to determine whether it addresses our recommendation.

Recommendation: The Director of OMB should enhance FRDAA reporting guidelines by directing agencies to report complete and detailed information on each of the reporting elements specified by FRDAA, which should include information related to financial and nonfinancial fraud. (Recommendation 2)

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: In March 2020, the Payment Integrity Information Act of 2019 (PIIA) was enacted to improve efforts to identify and reduce government-wide improper payments, including payments that are the result of fraud. PIIA repealed and replaced FRDAA, but maintained similar reporting requirements for federal agencies regarding fraud risks and also extended the time line for reporting by a year. OMB did not update its previous reporting guidance for FRDAA as we recommended. If OMB takes additional actions to supplement reporting guidelines under PIIA, we will review the guidelines to determine whether it addresses our recommendation.

Recommendation: The Director should update the enterprise governance policy to specify (1) the CIO's current role and responsibilities on the Executive Resources Board, to include developing and reviewing the IT budget formulation and execution; and (2) the Deputy CIO's role and responsibilities on the Enterprise Governance Council. (Recommendation 2)

Agency: Department of Homeland Security: United States Secret Service
Status: Open

Comments: DHS concurred with this recommendation. In March 2020, Secret Service officials stated that the component had drafted a revised enterprise governance policy that outlines the CIO's and Deputy CIO's roles and responsibilities. We will continue to monitor the component's efforts to finalize this policy.

Recommendation: The Director should ensure that the Secret Service develops a charter for its Executive Resources Board that specifies the roles and responsibilities of all board members, including the CIO. (Recommendation 3)

Agency: Department of Homeland Security: United States Secret Service
Status: Open

Comments: DHS concurred with this recommendation. In March 2020, Secret Service officials stated that the component had drafted a charter for its Executive Resources Board that specifies the roles and responsibilities of Board members, including the CIO. We will continue to monitor the component's efforts to finalize this charter.

Recommendation: The Director should ensure that the CIO includes product quality and post-deployment user satisfaction metrics in the modular outcomes and target measures that the CIO sets for monitoring agile projects. (Recommendation 4)

Agency: Department of Homeland Security: United States Secret Service
Status: Open

Comments: Secret Service officials stated that Secret Service acquisition directives require the component to conduct a Post Implementation Review of IT programs after such a program achieves Initial Operating Capability. However, it is unclear whether and how this requirement applies to agile projects, and if the Secret Service has included post-deployment user satisfaction metrics in the modular outcomes and target measures that the CIO sets for monitoring such projects. DHS's draft agile guidance strongly recommends that user satisfaction be assessed at the end of each production deployment, not just one time after Initial Operating Capability. Moreover, the Secret Service has not yet demonstrated that the CIO has included product quality in the modular outcomes and target measures that the CIO sets for monitoring agile projects. We will continue to monitor the department's efforts to implement this recommendation.

Recommendation: The Director should ensure that the CIO identifies all of the required knowledge and skills for the IT workforce. (Recommendation 5)

Agency: Department of Homeland Security: United States Secret Service
Status: Open

Comments: In 2018 and 2019, the Secret Service participated in the Department of Homeland Security's Strategic Workforce Planning initiative, during which the department identified critical competencies and target proficiency levels for various IT workforce roles across the department (e.g., systems analysis, network management). However, it is unclear whether the Secret Service's participation in this initiative included the identification of the required knowledge and skills for all of the roles within the component's IT workforce, or just certain roles. In addition, while the Secret Service also established a standard operating procedure document in December 2019 that, among other things, identified recommended training and certifications for each OCIO division (e.g., network management, cyber security), this procedure document did not identify the required knowledge and skills for the workforce roles within each of those OCIO divisions. We will continue to monitor the component's efforts to implement this recommendation.

Recommendation: The Director should ensure that the CIO regularly analyzes the IT workforce to identify its competency needs and any gaps it may have. (Recommendation 6)

Agency: Department of Homeland Security: United States Secret Service
Status: Open

Comments: According to Secret Service officials, the component analyzed its IT workforce to identify its competency needs, as well as determined the projected staffing and competency gaps that it would have in fiscal year 2019. However, it has not yet provided supporting documentation of the analyses that the CIO conducted to determine these competency needs and projected competency gaps. We will continue to follow-up with the Secret Service for documentation of its efforts to implement this recommendation.

Recommendation: The Director should ensure that, after OCIO completes an analysis of the IT workforce to identify any competency and staffing gaps it may have, the Secret Service updates its recruiting and hiring strategies and plans to address those gaps, as necessary. (Recommendation 7)

Agency: Department of Homeland Security: United States Secret Service
Status: Open

Comments: According to Secret Service officials, the component determined that it had a projected staffing gap for fiscal year 2019 of 35 staff within the 2210 occupational job series (i.e., IT management staff). The officials also said that they had identified projected competency gaps related to positions such as Cyber Intelligence Analyst and Intelligence Research Specialist. While the Secret Service has not yet provided documentation of the analyses it conducted to determine these gaps, the component provided documentation to demonstrate that it targeted its fiscal year 2019 recruiting events to focus on addressing IT staffing and competency gaps. For example, among other things, in fiscal year 2019 the component conducted outreach and recruiting events focused on defense, cyber, IT, and intelligence hiring, as well as conducted a targeted cyber security hiring campaign with a large online job search service. We will continue to follow-up with the Secret Service for documentation of the analyses the OCIO conducted to determine its IT staffing and competency gaps, in order to verify whether the 2019 recruiting events conducted were focused on addressing such gaps.

Recommendation: The Director should ensure that the Office of Human Resources (1) develops and tracks metrics to monitor the effectiveness of the Secret Service's recruitment activities for the IT workforce, including their effectiveness at addressing skill and staffing gaps; and (2) reports to component leadership on those metrics. (Recommendation 8)

Agency: Department of Homeland Security: United States Secret Service
Status: Open

Comments: Secret Service officials stated that the component has conducted recruitment and outreach efforts focused on IT, cyber, and engineering careers, and monitors the effectiveness of these efforts. However, the Secret Service has not yet provided supporting documentation demonstrating that it has (1) developed and tracked metrics to monitor the effectiveness of these recruitment activities, including their effectiveness at addressing skill and staffing gaps within the IT workforce; and (2) reported to component leadership on those metrics. We will continue to monitor the Secret Service's efforts to implement this recommendation.

Recommendation: The Director should ensure that the Office of Human Resources and OCIO adjust their recruitment and hiring plans and activities, as necessary, after establishing and tracking metrics for assessing the effectiveness of these activities for the IT workforce. (Recommendation 9)

Agency: Department of Homeland Security: United States Secret Service
Status: Open

Comments: The Secret Service has not yet demonstrated that it has established and tracked metrics for assessing the effectiveness of its recruitment and hiring plans and activities for the IT workforce. As such, the component is not yet able to demonstrate that its Office of Human Resources and OCIO have adjusted their recruitment and hiring plans and activities based on these metrics. We will continue to monitor the Secret Service's efforts to implement this recommendation.

Recommendation: The Director should ensure that the CIO (1) defines the required training for each IT workforce group, (2) determines the activities that OCIO will include in its IT workforce training and development program based on its available training budget, and (3) implements those activities. (Recommendation 10)

Agency: Department of Homeland Security: United States Secret Service
Status: Open

Comments: In December 2019, the Secret Service established a standard operating procedure document that identifies, among other things, recommended training and certifications for each OCIO division (e.g., network management, cyber security). However, this procedure document does not identify required training for each of these divisions. In March 2020, Secret Service officials stated that OCIO supervisors issued individual development plans to their team members that identified training requirements for continued professional development. However, the Secret Service has not yet provided documentation of these training requirements, nor evidence to support that the planned professional development activities are based on the required training for each IT workforce group. Moreover, the officials stated that, in response to the Coronavirus Disease 2019 (COVID-19), training is suspended. As such, the component is not implementing IT workforce training activities at this time. The officials plan to continue staff training once it is reinstated. We will continue to monitor the component's efforts to implement this recommendation.

Recommendation: The Director should ensure that the CIO ensures that the IT workforce completes training specific to their positions (after defining the training required for each workforce group). (Recommendation 11)

Agency: Department of Homeland Security: United States Secret Service
Status: Open

Comments: While Secret Service officials stated that the component's Office of Training establishes the required curriculum for Secret Service personnel, the component has not yet demonstrated that the CIO has defined the training required for each IT workforce group, as we previously recommended. As such, the component is also not able to demonstrate that it is ensuring that each IT workforce group completes the training specific to their positions, as we also recommended. We will continue to monitor the Secret Service's efforts to implement this recommendation.

Recommendation: The Director should ensure that the CIO collects and assesses performance data (including qualitative or quantitative measures, as appropriate) to determine how the IT training program contributes to improved performance and results (once the training program is implemented). (Recommendation 12)

Agency: Department of Homeland Security: United States Secret Service
Status: Open

Comments: Secret Service officials stated that they are assessing how IT training has contributed to improved performance and results by comparing IT course completion results to the results of related training exercises that the component conducts (for example, the Secret Service may compare the completion rates for an IT security awareness training course to the results of a related IT security awareness exercise that the component conducts). However, the Secret Service has not yet provided supporting documentation of these assessments. We will continue to monitor the component's efforts to implement this recommendation.

Recommendation: The Director should ensure that the CIO updates the performance plans for each occupational series within the IT workforce to include the relevant technical competencies, once identified, against which IT staff performance should be assessed. (Recommendation 13)

Agency: Department of Homeland Security: United States Secret Service
Status: Open

Comments: According to Secret Service officials, the component has implemented a performance management system that enables OCIO supervisors to update the individual performance plans of each IT workforce staff member to include the relevant technical competencies against which each staff member's performance is to be assessed. However, the Secret Service has not yet provided supporting documentation demonstrating that OCIO has updated the performance plans for each IT workforce staff member to include the relevant technical competencies. We will continue to monitor the component's efforts to address this recommendation.

Recommendation: The Secretary of Defense should ensure that the Under Secretary of Defense for Acquisition and Sustainment assesses whether DLA Document Services' single manager role for printing and reproduction provides the best value to the government--as determined by quality, price, and delivery time and in light of DLA Document Services' transformation plan--and whether any additional efficiencies are possible, and use the results of that assessment to inform the revision of DOD Instruction 5330.03. (Recommendation 1)

Agency: Department of Defense
Status: Open

Comments: The Department of Defense (DOD) concurred with GAO's October 2018 recommendation. By July 2019, DOD had completed a study of printing and reproduction services to determine the best value to the department. As of December 2019, according to a DOD official, the Office of the Under Secretary of Defense for Acquisition and Sustainment plans to develop steps toward achieving the best value to the government based on the study results, and update DOD Instruction 5330.03, which describes the mission, responsibilities, functions, and relationships of DLA Document Services by July 2020. Completion of these actions would allow DOD to determine if further efficiencies in its document services are possible.

Recommendation: The Secretary of Defense should ensure that the Under Secretary of Defense for Acquisition and Sustainment assesses whether DOD's current approach to obtaining print devices represents the best value to the government or whether other approaches, such as further consolidations under DLA Document Services as a proposed single manager for print device procurement, would be more cost effective. (Recommendation 2)

Agency: Department of Defense
Status: Open

Comments: The Department of Defense (DOD) concurred with GAO's October 2018 recommendation. In July 2019, DOD had completed a study of printing and reproduction services to determine the best value to the department. As of December 2019, according to a DOD official, the Office of the Under Secretary of Defense for Acquisition and Sustainment plans to develop steps toward achieving the best value to the government based on the study results, and update DOD Instruction 5330.03, which describes the mission, responsibilities, functions, and relationships of DLA Document Services by July 2020. Completion of these actions would allow DOD to determine if further efficiencies in its document services are possible.

Recommendation: The Secretary of Defense should ensure that the DOD Chief Information Officer (CIO) implements controls, such as reporting procedures, to routinely monitor actions to reduce the number of print devices, consistent with department-wide goals for reducing the number of print devices that are included in the CIO's 2012 memorandum. (Recommendation 3)

Agency: Department of Defense
Status: Open

Comments: The Department of Defense (DOD) concurred with GAO's October 2018 recommendation. As of December 2019, DOD had ongoing actions intended to address the recommendation. For example, according to a DOD official, the DOD Chief Information Officer (CIO) will collaborate with the Under Secretary of Defense for Acquisition and Sustainment to define the necessary responsibilities, policy, and procedures in the planned revision of DOD Instruction 5330.03, which describes the mission, responsibilities, functions, and relationships of DLA Document Services. DOD plans to update the instruction by July 2020. Implementing controls, such as clarifying responsibilities, policy, and procedures would better enable DOD to achieve department-wide goals for reducing print devices it established in the CIO's 2012 memorandum.

Recommendation: The Secretary of Defense should ensure that the DOD CIO assigns responsibility for implementing the CIO's 2012 memorandum on optimizing the use of employee information technology devices. (Recommendation 4)

Agency: Department of Defense
Status: Open

Comments: The Department of Defense (DOD) concurred with GAO's October 2018 recommendation. As of December 2019, DOD had ongoing actions intended to address the recommendation. For example, according to a DOD official, the DOD Chief Information Officer (CIO) will collaborate with the Under Secretary of Defense for Acquisition and Sustainment to define the necessary responsibilities, policy, and procedures in the planned revision of DOD Instruction 5330.03, which describes the mission, responsibilities, functions, and relationships of DLA Document Services. DOD plans to update the instruction by July 2020. Implementing controls, such as clarifying responsibilities, policy, and procedures would better enable DOD to achieve department-wide goals for reducing print devices it established in the CIO's 2012 memorandum.

Recommendation: The Secretary of Defense should ensure that the Under Secretary of Defense (Comptroller), in consultation with the military services and DLA, evaluates options to report more accurate funding information and takes steps to improve the accuracy of its budgetary and financial information reporting on document services internally and to Congress, including making distinctions between printing and non-printing-related costs and information on device procurement and electronic content management. This information could be provided as part of DOD's annual Operation and Maintenance budget justification materials. (Recommendation 6)

Agency: Department of Defense
Status: Open

Comments: The Department of Defense (DOD) partially concurred with this recommendation. As of July 2019, DOD had ongoing actions intended to address the recommendation. For example, according to DOD documentation, the offices of the Under Secretary of Defense for Acquisition and Sustainment and Under Secretary of Defense (Comptroller) planned to examine the Service-related definitions of printing and reproduction for potential process improvements. DOD anticipated completing this action by July 2020. Examining opportunities to improve the definitions of printing and reproduction services would better position DOD to report more accurate funding information for document services, as GAO recommended in October 2018

Recommendation: Building on ongoing efforts, the Administrator of FNS should develop and implement additional methods to widely distribute information to state agencies on an ongoing basis about successful efforts to adopt data analytics and strategies to leverage existing data, technology, and staff resources to enhance data analytics. (Recommendation 1)

Agency: Department of Agriculture: Office of the Secretary: Food, Nutrition and Consumer Services: Food and Nutrition Service
Status: Open

Comments: FNS agreed with this recommendation. The agency noted that it has been moving in the general direction of this recommendation and would build on current efforts to address it but noted that state readiness and technical capabilities are limiting factors in the adoption of data analytics.

Recommendation: The Secretary of the VA should direct the Undersecretary for Health to designate a focal point for overseeing VAMCs' pharmacy inventory management system-wide and define the focal point's responsibilities. (Recommendation 1)

Agency: Department of Veterans Affairs
Status: Open

Comments: VA officials provided documentation showing approval as of September 2019 for the procurement of a perpetual inventory management system that would allow VA medical facilities to keep track of inventory for all prescription drugs and assist VA with system-wide oversight. As of January 2020, this contract has yet to be awarded. In January 2020, VA officials also stated that Pharmacy Benefits Management (PBM) Services has been designated as the focal point for overseeing VA medical facilities' inventory management system-wide. VA officials stated that PBM is responsible for developing VA medical facility inventory management policy; however, VA did not provide documentation on PBM's defined responsibilities for system-wide oversight in the absence of an inventory system and once the system is procured. We plan to keep this recommendation open until we receive documentation of PBM's defined responsibilities for overseeing VAMC's pharmacy inventory management system-wide.

Recommendation: As the Subcommittee on Quantum Information Science (QIS Subcommittee) moves forward, the Office of Science and Technology Policy co-chair, in coordination with other co-chairs and participating agency officials, should take steps to fully implement leading practices that enhance and sustain collaboration. (Recommendation 1)

Agency: Executive Office of the President: Office of Science and Technology Policy
Status: Open

Comments: The Office of Science and Technology Policy (OSTP) agreed with GAO's September 2018 recommendation despite expressing some concerns about required resources and, as of January 2020, had taken steps to work with the other co-chairs of the National Science and Technology Council's Quantum Information Science (QIS) Subcommittee to begin implementing it. The QIS Subcommittee, created pursuant to the National Quantum Initiative Act, enacted in 2018, continues to be led by four co-chairs from the Department of Commerce's National Institute of Standards and Technology, Department of Energy, National Science Foundation (NSF), and OSTP. The law requires, among other things, that the QIS Subcommittee develop a 5-year Strategic Plan by December 21, 2019. In January 2020, an NSF official and OSTP staff reported that a draft strategic plan was under review. According to the NSF official, the strategic plan will include an assessment of actions the agencies are taking in support of QIS, and, in particular, the degree to which the agencies have developed mechanisms that enhance and sustain collaboration. The official said the draft plan will be submitted to the National Quantum Initiative Advisory Committee, which conducts independent assessments of and advises the President and QIS Subcommittee on matters related to the National Quantum Initiative. The NSF official reported that the membership of the Advisory Committee will be announced in the spring 2020 timeframe, at which time it will begin its review of the draft strategic plan. In addition to the development of a strategic plan, the National Quantum Initiative Act called for the establishment of a National Quantum Coordination Office to support the QIS Subcommittee, which OSTP formed in March 2019. Following this, in Oct. 2019, the QIS Subcommittee created three interagency working groups: (1) the science working group is working to coordinate the scientific and technical aspects of programs; (2) the workforce, infrastructure, and industry working group is working to identify workforce and technology needs; and (3) the end-user group is working to connect the nation's research and development community, including academics and industry players, to potential early adopters in the federal government. Taking this action will help to enhance and strengthen interagency collaboration and could help ensure that agencies effectively marshal their efforts to maintain U.S. competitiveness in quantum computing. When the strategic plan is finalized and we confirm what additional actions the QIS Subcommittee has taken to fully implement leading practices that enhance and sustain collaboration, we will provide updated information.

Recommendation: As the QIS Subcommittee moves forward, the Department of Commerce co-chair, in coordination with other co-chairs and participating agency officials, should take steps to fully implement leading practices that enhance and sustain collaboration. (Recommendation 2)

Agency: Department of Commerce
Status: Open

Comments: The Department of Commerce agreed with GAO's September 2018 recommendation and, as of January 2020, had taken steps to work with the other co-chairs of the National Science and Technology Council's Quantum Information Science (QIS) Subcommittee to begin implementing it. The QIS Subcommittee, created pursuant to the National Quantum Initiative Act, enacted in 2018, continues to be led by four co-chairs from the Department of Commerce's National Institute of Standards and Technology, Department of Energy, National Science Foundation (NSF), and OSTP. The law requires, among other things, that the QIS Subcommittee develop a 5-year Strategic Plan by December 21, 2019. In January 2020, an NSF official and OSTP staff reported that a draft strategic plan was under review. According to the NSF official, the strategic plan will include an assessment of actions the agencies are taking in support of QIS, and, in particular, the degree to which the agencies have developed mechanisms that enhance and sustain collaboration. The official said the draft plan will be submitted to the National Quantum Initiative Advisory Committee, which conducts independent assessments of and advises the President and QIS Subcommittee on matters related to the National Quantum Initiative. The NSF official reported that the membership of the Advisory Committee will be announced in the spring 2020 timeframe, at which time it will begin its review of the draft strategic plan. In addition to the development of a strategic plan, the National Quantum Initiative Act called for the establishment of a National Quantum Coordination Office to support the QIS Subcommittee, which OSTP formed in March 2019. Following this, in Oct. 2019 the QIS Subcommittee created three interagency working groups: (1) the science working group is working to coordinate the scientific and technical aspects of programs; (2) the workforce, infrastructure, and industry working group is working to identify workforce and technology needs; and (3) the end-user group is working to connect the nation's research and development community, including academics and industry players, to potential early adopters in the federal government. Taking this action will help to enhance and strengthen interagency collaboration and could help ensure that agencies effectively marshal their efforts to maintain U.S. competitiveness in quantum computing. When the strategic plan is finalized and we confirm what additional actions the QIS Subcommittee has taken to fully implement leading practices that enhance and sustain collaboration, we will provide updated information.

Recommendation: As the QIS Subcommittee moves forward, the Department of Energy co-chair, in coordination with other co-chairs and participating agency officials, should take steps to fully implement leading practices that enhance and sustain collaboration. (Recommendation 3)

Agency: Department of Energy
Status: Open

Comments: The Department of Energy agreed with GAO's September 2018 recommendation and, as of January 2020, had taken steps to work with the other co-chairs of the National Science and Technology Council's Quantum Information Science (QIS) Subcommittee to begin implementing it. The QIS Subcommittee, created pursuant to the National Quantum Initiative Act, enacted in 2018, continues to be led by four co-chairs from the Department of Commerce's National Institute of Standards and Technology, Department of Energy, National Science Foundation (NSF), and OSTP. The law requires, among other things, that the QIS Subcommittee develop a 5-year Strategic Plan by December 21, 2019. In January 2020, an NSF official and OSTP staff reported that a draft strategic plan was under review. According to the NSF official, the strategic plan will include an assessment of actions the agencies are taking in support of QIS, and, in particular, the degree to which the agencies have developed mechanisms that enhance and sustain collaboration. The official said the draft plan will be submitted to the National Quantum Initiative Advisory Committee, which conducts independent assessments of and advises the President and QIS Subcommittee on matters related to the National Quantum Initiative. The NSF official reported that the membership of the Advisory Committee will be announced in the spring 2020 timeframe, at which time it will begin its review of the draft strategic plan. In addition to the development of a strategic plan, the National Quantum Initiative Act called for the establishment of a National Quantum Coordination Office to support the QIS Subcommittee, which OSTP formed in March 2019. Following this, in Oct. 2019 the QIS Subcommittee created three interagency working groups: (1) the science working group is working to coordinate the scientific and technical aspects of programs; (2) the workforce, infrastructure, and industry working group is working to identify workforce and technology needs; and (3) the end-user group is working to connect the nation's research and development community, including academics and industry players, to potential early adopters in the federal government. Taking this action will help to enhance and strengthen interagency collaboration and could help ensure that agencies effectively marshal their efforts to maintain U.S. competitiveness in quantum computing. When the strategic plan is finalized and we confirm what additional actions the QIS Subcommittee has taken to fully implement leading practices that enhance and sustain collaboration, we will provide updated information.

Recommendation: As the QIS Subcommittee moves forward, the National Science Foundation co-chair, in coordination with other co-chairs and participating agency officials, should take steps to fully implement leading practices that enhance and sustain collaboration. (Recommendation 4)

Agency: National Science Foundation
Status: Open

Comments: The National Science Foundation agreed with GAO's September 2018 recommendation and, as of January 2020, had taken steps to work with the other co-chairs of the National Science and Technology Council's Quantum Information Science (QIS) Subcommittee to begin implementing it. The QIS Subcommittee, created pursuant to the National Quantum Initiative Act, enacted in 2018, continues to be led by four co-chairs from the Department of Commerce's National Institute of Standards and Technology, Department of Energy, National Science Foundation (NSF), and OSTP. The law requires, among other things, that the QIS Subcommittee develop a 5-year Strategic Plan by December 21, 2019. In January 2020, an NSF official and OSTP staff reported that a draft strategic plan was under review. According to the NSF official, the strategic plan will include an assessment of actions the agencies are taking in support of QIS, and, in particular, the degree to which the agencies have developed mechanisms that enhance and sustain collaboration. The official said the draft plan will be submitted to the National Quantum Initiative Advisory Committee, which conducts independent assessments of and advises the President and QIS Subcommittee on matters related to the National Quantum Initiative. The NSF official reported that the membership of the Advisory Committee will be announced in the spring 2020 timeframe, at which time it will begin its review of the draft strategic plan. In addition to the development of a strategic plan, the National Quantum Initiative Act called for the establishment of a National Quantum Coordination Office to support the QIS Subcommittee, which OSTP formed in March 2019. Following this, in Oct. 2019 the QIS Subcommittee created three interagency working groups: (1) the science working group is working to coordinate the scientific and technical aspects of programs; (2) the workforce, infrastructure, and industry working group is working to identify workforce and technology needs; and (3) the end-user group is working to connect the nation's research and development community, including academics and industry players, to potential early adopters in the federal government. Taking this action will help to enhance and strengthen interagency collaboration and could help ensure that agencies effectively marshal their efforts to maintain U.S. competitiveness in quantum computing. When the strategic plan is finalized and we confirm what additional actions the QIS Subcommittee has taken to fully implement leading practices that enhance and sustain collaboration, we will provide updated information.

Recommendation: As the Interagency Working Group on Synthetic Biology moves forward, the Director of the National Science Foundation, in coordination with participating agency officials, should take steps to fully implement leading practices that enhance and sustain collaboration. (Recommendation 5)

Agency: National Science Foundation
Status: Open

Comments: The National Science Foundation (NSF) agreed with GAO's September 2018 recommendation and, as of January 2020, had taken some steps to implement it. In November 2018, the Interagency Working Group on Synthetic Biology was formally established under the Biological Sciences Subcommittee of the National Science and Technology Council. The co-chairs of the Interagency Working Group on Synthetic Biology are officials from the National Institutes of Health, the National Institute of Standards and Technology, and NSF. The charter for the working group states that the group is to facilitate coordination and collaboration across 16 federal agencies. In October 2019, the working group hosted an Interagency Synthetic Biology Workshop to examine a roadmap that included basic science, enabling technologies, infrastructure and workforce needs in the area of synthetic biology. The workshop included 100 participants across the federal government, academia and industry, according to NSF officials. On the final day of the workshop participants from federal agencies used the input from the workshop to prepare a list of priority areas for investment along with agencies interested in participating in those priority areas. In January 2020, NSF officials reported that among the next steps for the working group was to develop a federal strategic roadmap for synthetic biology. Officials also reported that the working group is actively preparing a memorandum of understanding to create policies that will enable more sharing of information and collaboration. Taking this action will help to enhance and strengthen interagency collaboration and could help ensure that agencies effectively marshal their efforts to maintain U.S. competitiveness in synthetic biology. When we confirm what additional actions the working group has taken to fully implement leading practices that enhance and sustain collaboration, we will provide updated information.

Recommendation: The Secretary of State should determine the estimated effects of cost inflation on planned CSCP embassy construction capacity and time frames and update this information for stakeholders on a regular basis, such as through the annual budgeting process. (Recommendation 1)

Agency: Department of State
Status: Open
Priority recommendation

Comments: State concurred with this recommendation. As of March 2020, State/OBO had developed a worldwide construction inflation rate and had integrated this rate into its bureau budget request for fiscal year 2021. According to OBO officials, OBO is working to update its budget guidance to ensure the inflation rate is updated and integrated into future bureau budget requests on a regular basis. We will continue to monitor State's implementation of this recommendation.

Recommendation: The Secretary of State should ensure that the Director of OBO conducts an OBO-wide workforce analysis to assess staffing levels and workload capacity needed to carry out the full range of OBO's mission goals, to include the CSCP. Such an assessment could provide a basis for broader stakeholder discussion of OBO's human capital needs and potential prioritization of activities. (Recommendation 3)

Agency: Department of State
Status: Open
Priority recommendation

Comments: State concurred with this recommendation. As of March 2020, State/OBO was working with the Institute for Defense Analysis to conduct an OBO-wide workforce analysis, with initial findings and recommendations planned for early 2020. We will continue to monitor State's implementation of this recommendation.

Recommendation: The Director of OMB, working with CFOC, should (1) collect data metrics regularly on the Career Roadmap Builder online tool and Grants Training 101 to determine how widely the resources are being used, and (2) obtain periodic feedback from federal agencies on the usefulness of these tools and any needed improvements. (Recommendation 2)

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: OMB staff provided us with oral comments stating that the agency partially concurred with our recommendations. For our second recommendation, OMB agreed that user feedback data regarding the Career Roadmap Builder and Grants Training 101 is useful. However, OMB stated that while it will continue to collect data on the number of users, it believes that federal agencies should be responsible for collecting specific, detailed user data if they are using those resources. We continue to believe that OMB and CFOC would benefit from collecting specific, detailed user data on these tools, which they devoted time and multiple resources to developing. Collecting detailed data metrics that go beyond the number of users can help OMB and CFOC to better evaluate the effectiveness of these grants training tools. Additionally, OMB stated the agency is committed to working with CFOC to review the Grants Training 101 module to determine how useful it is and if any improvements or adjustments are needed. In May 2019, OMB staff said that no action had been taken to date in response to this recommendation. In January 2020, OMB responded in writing to this recommendation stating that it was continuing to collect data on usage for both training tools on the CFO.gov site. OMB specified, however, that the usage data was for the number of visitors on the two sites and on users by agency. OMB went on to say that each agency is responsible for the professional development of its own workforce, and that Federal agencies can, at their discretion, collect user data if the Roadmap and Grant Training 101 are part of their official training program. In addition, OMB stated it had made the Grants Training 101 available publicly for federal and non-federal personnel on CFO.Gov, and that collecting specific user data is not considered by them to be beneficial to demonstrate the usefulness of the materials. Based on this response, we will continue to inquire as to the availability and use of metrics and effectiveness measures for the Career Roadmap and the Grants Training 101 modules.

Recommendation: The Secretary of HHS should establish a process to monitor and evaluate HHS's grants training at the central office level. This process should include (1) a method for identifying all employees working on grants across the agency, and (2) oversight procedures to evaluate the sufficiency of sub-agencies' grants training efforts including the incorporation of leading practices related to assessing competencies, training approaches, accountability, and training results. (Recommendation 3)

Agency: Department of Health and Human Services
Status: Open

Comments: HHS concurred with our findings and recommendation. In its comment letter, HHS stated that its Office of Grants Policy, Oversight, and Evaluation, within the Office of Grants and Acquisition Policy and Accountability, Division of Grants, in conjunction with the HHS ReInvent Grants Initiative would be developing and implementing a department-wide financial assistance training and certification program to improve the functional effectiveness of the financial assistance management workforce in the areas of internal controls and risk mitigation. The program is designed to support the professional development of the HHS grants management workforce through both instructor-led and online courses. HHS' ReInvent Grants Management (RGM) staff and GAO held a conference call on November 30th, 2018 to discuss how RGM intended to address the recommendation in GAO-18-491 by developing a generalized framework for the Grants Management Training and Certification (GMTC) program for HHS. An HHS official reported that at its December 2019 quarterly meeting, the HHS Division of Workforce Development (DWD) reported they had in the past quarter: briefed the HHS Executive Committee on Grants Administration Policy (ECGAP) on the DWD mission and goals for training the grants workforce; developed briefing documents and presentations based on a RGM developed framework to develop competencies and outline curriculum of the GMTC program; continued to review and refine the program framework to incorporate DWD mission and goals; drafted the initial policy to further inform the structure and procedures of the GMTC program (e.g. certification levels, required coursework, career development requirements), which should be issued by HHS Office of Grants within Federal Fiscal Year 2020; and collaborated with the HHS Grants Closeout Business Process Reengineering Team to discuss current grants closeout status and how DWD can support grant staff and grant recipient closeout training efforts. Given the ongoing nature of HHS efforts, GAO will continue to monitor progress on a quarterly basis.

Recommendation: The Secretary of Education should enroll loan servicers in FSA's continuous monitoring program and, in the interim, require these entities to report the results of security controls testing at an FSA-defined frequency. (Recommendation 1)

Agency: Department of Education
Status: Open

Comments: FSA concurred with this recommendation and the agency stated that loan servicers are scheduled to be enrolled in its ongoing security authorization program beginning in fiscal year 2019. In November 2019, FSA officials told us that this recommendation had been implemented; however, they did not provide documentation to demonstrate actions taken to address the recommendation. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Education should enroll private collection agencies in FSA's continuous monitoring program, and, in the interim, require these entities to test all controls at an FSA-defined frequency and regularly report the results. (Recommendation 2)

Agency: Department of Education
Status: Open

Comments: FSA stated that it concurred with this recommendation, but the actions it said it planned to take would not fully address it. In November 2019, FSA officials told us that this recommendation had been implemented; however, they did not provide documentation to demonstrate actions taken to address the recommendation. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Education should modify FSA's agreements with guaranty agencies to specify a required baseline of security controls based on the impact level of the information shared with these agencies, as determined by FSA. (Recommendation 3)

Agency: Department of Education
Status: Open

Comments: FSA concurred with this recommendation and described planned actions to address it. In November 2019, FSA officials told us that this recommendation has a pending date of 5/31/2020 for completion When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Education should establish a process for continuous monitoring of guaranty agencies' implementation of security and privacy requirements between on-site assessments, to include testing all controls at an FSA-defined frequency and regularly reporting results. (Recommendation 4)

Agency: Department of Education
Status: Open

Comments: FSA partially concurred with this recommendation and described actions it planned to take in response. However, we believe the entire recommendation is still warranted. In November 2019, FSA officials told us that this recommendation had been implemented; however, they did not provide documentation to demonstrate actions taken to address the recommendation. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Education should include specific security and privacy requirements in agreements with the Federal Family Education Loan (FFEL) Program lenders based on FSA's categorization of the information shared with the lenders. (Recommendation 5)

Agency: Department of Education
Status: Open

Comments: FSA stated that it partially agreed with this recommendation; however, if effectively implemented, the planned actions it described would address this recommendation. In November 2019, FSA officials told us that this recommendation had been implemented; however, they did not provide documentation to demonstrate actions taken to address the recommendation. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Education should develop policies and procedures to gain assurance that FFEL lenders have appropriate security and privacy controls in place and that these controls are being regularly tested and monitored. (Recommendation 6)

Agency: Department of Education
Status: Open

Comments: FSA did not concur with this recommendation. However, we believe it is still warranted. In November 2019, FSA officials told us that this recommendation had been implemented; however, they did not provide documentation to demonstrate actions taken to address the recommendation. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Education should establish timeframes for providing states with additional information on allowable expenditures of funds reserved for pre-employment transition services. (Recommendation 1)

Agency: Department of Education
Status: Open

Comments: Education agreed with this recommendation and stated that it would establish projected timeframes for providing states with additional information on allowable expenditures for the provision of preemployment transition services. Education also stated that it intends to provide states with additional information in at least two forums before the end of calendar year 2018 and to review and analyze previous guidance provided to states on allowable expenditures.

Recommendation: The Secretary of Education should take additional steps to provide states assistance on updating and finalizing their interagency agreements with state educational agencies to include pre-employment transition services. These steps could include, for example, accelerating their efforts to discuss the benefits of finalizing interagency agreements, and reminding states of existing technical assistance resources pertaining to updating and finalizing interagency agreements. (Recommendation 2)

Agency: Department of Education
Status: Open

Comments: Education disagreed with this recommendation, in large part, because there is no statutory provision authorizing the agency to identify such states. Nevertheless, Education stated that it is taking some steps as part of its ongoing monitoring of the VR program to provide assistance to states that have not updated their interagency agreements. This is consistent with the intention of our recommendation but we believe more could be done. The agency also noted that it would continue to offer and provide technical assistance if it becomes known through the onsite monitoring of the VR program or through other means that states have not updated their interagency agreements between VR agencies and state educational agencies. In addition, its Rehabilitation Services Administration (RSA) and Office of Special Education Programs will provide information related to sources of technical assistance, as appropriate, to VR agencies and state educational agencies. While these steps may be helpful, given the number of states that have not updated and finalized their agreements and the length of time Education officials say they will take to complete this round of monitoring where Education asks state VR agencies about these agreements, additional action by Education may be needed to help states more efficiently and effectively coordinate services to students with disabilities.

Recommendation: The Secretary of Education should develop a written plan with specific timeframes and activities for identifying and disseminating best practices that address, as appropriate, implementation challenges for pre-employment transition services, such as those identified in this report. (Recommendation 3)

Agency: Department of Education
Status: Open

Comments: Education disagreed with this recommendation believing it is premature to develop a timeline for the dissemination of best practices. The agency stated that the identification of "best" practices, meaning those that are clearly supported by a body of evidence derived from valid and reliable research findings, is still emerging as states implement the requirements. Education stated that as RSA identifies best practices through its monitoring and technical assistance activities, it will, in collaboration with its Office of Special Education Programs, consider when and how best to disseminate this information to state VR and educational agencies. With regard to including specific timeframes and activities in a written plan, by detailing the specific steps Education is taking and plans to take along with the amount of time it expects them to take, Education would be better positioned to complete those steps in a timely manner and meet the statutory requirement that Education highlight best state practices and support state agencies.

Recommendation: The Director of OMB should direct the leaders of the Leveraging Data as a Strategic Asset CAP Goal to ensure future updates to the action plan, and the resulting federal data strategy, provide additional details on improving the use of data, including performance information, more extensively within federal agencies. The action plan should identify performance goals; contributing agencies, organizations, programs, and other activities; those responsible for leading implementation within these contributors; planned actions; time frames; and means to assess progress. (Recommendation 1)

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: As of October 2020, the Office of Management and Budget (OMB), and contributors to the Leveraging Data as a Strategic Asset cross-agency priority (CAP) goal, have taken some actions to address this recommendation. For example, in May 2019 they released a set of recommended practices designed to support agency implementation of the federal data strategy. In particular, several of these practices relate to data-driven decision making, encouraging agencies to "champion data use," "use data to guide decision making," and "use data to increase accountability." However, as of September 2020, the action plans for the implementation of the federal data strategy, and the overall CAP goal, did not include all of the required information. For example, they did not include a means to assess progress related to efforts to improve data-driven decision making in the federal government. We will continue to monitor OMB's actions related to implementing this recommendation.

Recommendation: The Director of OMB, in coordination with the PIC, should prioritize efforts to identify and share among agencies proven practices for increasing, and challenges that hamper, the use of performance information in decision making more extensively within agencies. At a minimum, this effort should involve the agencies that our survey suggests may offer such insights. (Recommendation 2)

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: As of October 2020, the Office of Management and Budget (OMB) and the Performance Improvement Council (PIC) have taken some actions towards addressing this recommendation. For example, in 2018 and 2019, the PIC hosted a series of workshops focused on relevant topics, such as how agency staff can develop performance measures and analyze data, and how data-driven reviews are used across the federal government. However, as of October 2020, they had not yet undertaken efforts to directly address the recommendation. They have not engaged the agencies highlighted by our survey results to identify proven practices that would increase, or challenges that are hampering, data-driven decision making within agencies. We will continue to monitor actions related to implementing this recommendation.

Recommendation: The Commandant of the Coast Guard, in collaboration with the Secretary of the Navy, should direct the polar icebreaker program and NAVSEA 05C to update the HPIB cost estimate in accordance with best practices for cost estimation, including (1) developing risk bounds for all phases of the program lifecycle, and on the basis of these risk bounds, conduct risk and uncertainty analysis, as well as sensitivity analysis, on all phases of the program lifecycle, and (2) reconciling the results with an updated independent cost estimate based on the same technical baseline before the option for construction of the lead ship is awarded. (Recommendation 2)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: In providing comments on this report, the Coast Guard concurred with our recommendation. As of August 2020, Coast Guard officials stated that they are updating the polar icebreaker program's life cycle cost estimate to reflect information provided by the shipbuilder and anticipate completing the update in the fall 2020. We will review the updated life cycle cost estimate at that time and determine if the actions taken meet the intent of this recommendation.

Recommendation: The Commandant of the Coast Guard should direct the polar icebreaker program office to develop a program schedule in accordance with best practices for project schedules, including determining realistic durations of all shipbuilding activities and identifying and including a reasonable amount of margin in the schedule, to set realistic schedule goals for all three ships before the option for construction of the lead ship is awarded. (Recommendation 3)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: In providing comments on this report, the Coast Guard concurred with our recommendation. As of August 2020, Coast Guard officials stated that they updated the polar icebreaker program's schedule for the lead ship and are in the process of developing schedules for the follow-on ships. We will review the updated schedules once the Coast Guard provides them and determine if the actions taken meet the intent of this recommendation.

Recommendation: The DHS Under Secretary for Management should require the Coast Guard to update the HPIB acquisition program baselines prior to authorizing lead ship construction, after completion of the preliminary design review, and after it has gained the requisite knowledge on its technologies, cost, and schedule, as recommended above. (Recommendation 5)

Agency: Department of Homeland Security
Status: Open

Comments: In providing comments on this report, DHS concurred with our recommendation and stated that it will require the Coast Guard to update the HPIB program's acquisition program baselines prior to authorizing lead ship construction. As of August 2020, Coast Guard officials anticipate updating the acquisition program baselines by no later than February 2021. We will review the updated HPIB acquisition program baselines at that time and determine if the actions taken meet the intent of this recommendation.

Recommendation: The Secretary of DHS should ensure that the Commissioner of Customs and Border Protection through the Executive Assistant Commissioner for Operations Support updates the 2013 workforce assessment to account for the independent requirements organization's current workforce needs. (Recommendation 2)

Agency: Department of Homeland Security
Status: Open

Comments: DHS concurred with this recommendation. Customs and Border Protection provided an estimated completion date for their workforce assessment of September 30, 2020.

Recommendation: The Secretary of DHS should ensure that the Administrator of the Federal Emergency Management Agency establishes a policy for requirements development. (Recommendation 4)

Agency: Department of Homeland Security
Status: Open

Comments: DHS concurred with this recommendation. The Federal Emergency Management Agency plans to establish a policy for requirements development by September 30, 2020, about one year after it completes changes to its governance processes.

Recommendation: The Secretary of DHS should ensure that the Director of Immigration and Customs Enforcement establishes a policy for requirements development. (Recommendation 8)

Agency: Department of Homeland Security
Status: Open

Comments: DHS concurred with this recommendation but has not yet taken action to implement it as of August 2020.

Recommendation: The Secretary of DHS should ensure that the Director of Immigration and Customs Enforcement establishes the planned independent requirements development organization within Immigration and Customs Enforcement. (Recommendation 9)

Agency: Department of Homeland Security
Status: Open

Comments: DHS concurred with this recommendation but has not yet taken action to implement it as of August 2020.

Recommendation: The Secretary of DHS should ensure that the Director of Immigration and Customs Enforcement conducts a workforce assessment to account for an independent requirements organization's workforce needs. (Recommendation 10)

Agency: Department of Homeland Security
Status: Open

Comments: DHS concurred with this recommendation but has not yet taken action to implement it as of August 2020.

Recommendation: The Secretary of DHS should ensure that the Director of Immigration and Customs Enforcement establishes component specific training for requirements development. (Recommendation 11)

Agency: Department of Homeland Security
Status: Open

Comments: DHS concurred with this recommendation but has not yet taken action to implement it as of August 2020.

Recommendation: The Secretary of DHS should ensure that the Under Secretary of Homeland Security for the National Protection and Programs Directorate finalizes and promulgates the National Protection and Programs Directorate's draft policy for requirements development. (Recommendation 12)

Agency: Department of Homeland Security
Status: Open

Comments: The National Protection and Programs Directorate changed its name to the Cybersecurity and Infrastructure Security Agency in January 2018. DHS concurred with this recommendation. The Cybersecurity and Infrastructure Security Agency estimates that it will have a final policy by September 30, 2020.

Recommendation: The Secretary of DHS should ensure that the Under Secretary of Homeland Security for the National Protection and Programs Directorate establishes the planned independent requirements development organization within the National Protection and Programs Directorate. (Recommendation 13)

Agency: Department of Homeland Security
Status: Open

Comments: DHS concurred with this recommendation. In January 2018, the National Protection and Programs Directorate changed its name to the Cybersecurity and Infrastructure Security Agency. The Cybersecurity and Infrastructure Security Agency estimates that it will establish an independent requirements organization by September 30, 2020.

Recommendation: The Secretary of DHS should ensure that the Under Secretary of Homeland Security for the National Protection and Programs Directorate conducts a workforce assessment to account for an independent requirements organization's workforce needs. (Recommendation 14)

Agency: Department of Homeland Security
Status: Open

Comments: DHS concurred with this recommendation. In January 2018, the National Protection and Programs Directorate changed its name to the Cybersecurity and Infrastructure Security Agency. The Cybersecurity and Infrastructure Security Agency estimates it will complete an assessment to account for an independent requirements organization's workforce needs by September 30, 2020.

Recommendation: The Secretary of DHS should ensure that the Director of the U.S. Citizenship and Immigration Services establishes the planned independent requirements development organization within U.S. Citizenship and Immigration Services. (Recommendation 21)

Agency: Department of Homeland Security
Status: Open

Comments: DHS concurred with this recommendation. The U.S. Citizenship and Immigration Services estimates that it will establish an independent requirements development organization by September 30, 2020.

Recommendation: The Secretary of Homeland Security should direct Homeland Security's members of the interagency working group for protection of Native American cultural property to implement selected leading collaboration practices, such as taking steps to agree on outcomes and objectives, clarify roles and responsibilities, and document these decisions. (Recommendation 1)

Agency: Department of Homeland Security
Status: Open

Comments: As of August 2019, we have reached out to the Department of Homeland Security and are awaiting a response on actions they may have taken in response to this recommendation.

Recommendation: The Secretary of the Interior should direct Interior's members of the interagency working group for protection of Native American cultural property to implement selected leading collaboration practices, such as taking steps to agree on outcomes and objectives, clarify roles and responsibilities, and document these decisions. (Recommendation 2)

Agency: Department of the Interior
Status: Open

Comments: Since August 2018, Interior's Office of International Affairs has updated its contact list for international repatriation assistance with information on the Department's roles and responsibilities in support of international repatriation. In addition, Interior's interagency working group members have developed a description of the interagency working group. However, the statement does not include outcomes and objectives for the group's work. GAO made the same recommendation to each of the four agencies covered in the review because implementing leading collaboration practices will require the collective participation of group members. GAO will keep the recommendation open until further collaborative actions are taken.

Recommendation: The Attorney General should direct Justice's members of the interagency working group for protection of Native American cultural property to implement selected leading collaboration practices, such as taking steps to agree on outcomes and objectives, clarify roles and responsibilities, and document these decisions. (Recommendation 3)

Agency: Department of Justice
Status: Open

Comments: As of August 2019, we have reached out to the Department of Justice and are awaiting a response on actions they may have taken in response to this recommendation.

Recommendation: The Secretary of State should direct State's members of the interagency working group for protection of Native American cultural property to implement selected leading collaboration practices, such as taking steps to agree on outcomes and objectives, clarify roles and responsibilities, and document these decisions. (Recommendation 4)

Agency: Department of State
Status: Open

Comments: Since August 2018, the Department of State shared a statement of its roles and responsibilities with other working group members. However, the statement does not include outcomes and objectives for the group's work. GAO made the same recommendation to each of the four agencies covered in the review because implementing leading collaboration practices will require the collective participation of group members. GAO will keep the recommendation open until further collaborative actions are taken.

Recommendation: The Secretary of Homeland Security should direct Homeland Security's members of the interagency working group for protection of Native American cultural property to identify and externally communicate to tribes points of contact within the agency that are responsible for responding to tribes' requests for assistance with repatriating cultural items from overseas auctions. (Recommendation 5)

Agency: Department of Homeland Security
Status: Open

Comments: As of August 2019, we have reached out to the Department of Homeland Security and are awaiting a response on actions they may have taken in response to this recommendation.

Recommendation: The Attorney General should direct Justice's members of the interagency working group for protection of Native American cultural property to identify and externally communicate to tribes points of contact within the agency that are responsible for responding to tribes' requests for assistance with repatriating cultural items from overseas auctions. (Recommendation 7)

Agency: Department of Justice
Status: Open

Comments: As of August 2019, we have reached out to the Department of Justice and are awaiting a response on actions they may have taken in response to this recommendation.

Recommendation: The Secretary of Homeland Security should direct Homeland Security's members of the interagency working group for protection of Native American cultural property to collaborate with the interagency working group members from other agencies to assess, in consultation with Indian tribes, whether and how amending the U.S. legal framework governing the export, theft, and trafficking of Native American cultural items would facilitate the repatriation of these items from auctions overseas and report its findings to Congress. (Recommendation 9)

Agency: Department of Homeland Security
Status: Open

Comments: As of August 2019, we have reached out to the Department of Homeland Security and are awaiting a response on actions they may have taken in response to this recommendation.

Recommendation: The Secretary of the Interior should direct Interior's members of the interagency working group for protection of Native American cultural property to collaborate with the interagency working group members from other agencies to assess, in consultation with Indian tribes, whether and how amending the U.S. legal framework governing the export, theft, and trafficking of Native American cultural items would facilitate the repatriation of these items from auctions overseas and report its findings to Congress. (Recommendation 10)

Agency: Department of the Interior
Status: Open

Comments: As of September 2019, Interior is working to develop an assessment of legislative options for discussion with the interagency working group, and plans to meet with tribes later this fall to discuss the assessment. Interior anticipates a September 30, 2020, completion date for the assessment of these legislative options. Interior has also reviewed legislative proposals related to the export, theft, and trafficking of Native American cultural items and has prepared for Congressional hearings on this topic.

Recommendation: The Attorney General should direct Justice's members of the interagency working group for protection of Native American cultural property to collaborate with the interagency working group members from other agencies to assess, in consultation with Indian tribes, whether and how amending the U.S. legal framework governing the export, theft, and trafficking of Native American cultural items would facilitate the repatriation of these items from auctions overseas and report its findings to Congress. (Recommendation 11)

Agency: Department of Justice
Status: Open

Comments: As of August 2019, we have reached out to the Department of Justice and are awaiting a response on actions they may have taken in response to this recommendation.

Recommendation: The Secretary of State should direct State's members of the interagency working group for protection of Native American cultural property to collaborate with the interagency working group members from other agencies to assess, in consultation with Indian tribes, whether and how amending the U.S. legal framework governing the export, theft, and trafficking of Native American cultural items would facilitate the repatriation of these items from auctions overseas and report its findings to Congress. (Recommendation 12)

Agency: Department of State
Status: Open

Comments: In November 2019, the Department of State, in conjunction with other interagency working group members, circulated a draft legal assessment and draft legislative options. The interagency working group members conducted a listening session with tribal members in November 2019, and conducted a tribal consultation in January 2020. GAO will continue monitoring the agencies' efforts toward implementing this recommendation.

Recommendation: FTA should determine which on-demand services qualify as "public transportation" based on the statutory definition and disseminate information to clarify whether and how to report data from such services into the National Transit Database (NTD). (Recommendation 2)

Agency: Department of Transportation: Federal Transit Administration
Status: Open

Comments: DOT concurred with this recommendation. As of September 2018, FTA planned to implement it by updating its NTD manual to include a new data collection field for on-demand services provided by Transportation Network Companies (TNC) in order to track these separately from other types of on-demand services. FTA will post a proposed update to clarify whether and how to report TNC-provided services into the NTD. FTA plans to post the proposed revisions along with specifications for which on-demand services qualify as "Public transportation" to the NTD policy in the Federal Register for comment. As of May 2020, FTA anticipated completing these actions by November 30, 2020.

Recommendation: The NIST Associate Director for Laboratory Programs should update NIST policy to include periodic comprehensive management review of the agency's measurement services to assess gaps and ensure alignment with stakeholders' needs, and take steps to ensure that the Associate Director completes the review of NIST's standards development activities (Recommendation 1).

Agency: Department of Commerce: National Institute of Standards and Technology
Status: Open

Comments: NIST concurred with this recommendation and, as of May 2020, had taken some steps to implement it. Specifically, NIST provided information indicating it uses multiple information sources to identify potential measurement service gaps. For example, the Associate Director for Laboratory Programs (ADLP) reviews quarterly reports from NIST's laboratory divisions that include information on measurement services. The ADLP may identify measurement service gaps as part of this review. Also, the NIST Measurement Services Council serves the ADLP in an advisory role to identify and address NIST-wide issues related to the quality, relevance, performance, operations, and resources allocated to the health and improvement of NIST measurement services. The Council produces an annual report that addresses the health of NIST's measurement services, including potential changes needed to meet future customer needs. Further, NIST employees may suggest new services through processes established in suborder 5901.01. Many of these efforts also include consideration of potential gaps in NIST's participation in standards development activities. Additionally, NIST Order 5301.00 delegates responsibility to review standards activities and participation across several levels of NIST management. Although these actions may help identify gaps in NIST's participation in standards development activities as well as identify gaps in the measurement services it provides, it is not clear how or whether they fulfill the periodic review of the effectiveness of NIST's participation in documentary standards activities that the ADLP is to conduct under NIST's standards participation policy. We will update our evaluation of NIST's implementation of this recommendation when the agency provides additional information on how the activities described above fulfill the effectiveness review called for by NIST's policy, or provides information documenting that the ADLP has conducted such a review.

Recommendation: The Secretary of Defense should ensure that the Under Secretary of Defense for Acquisition and Sustainment clarifies the categories of threats within JIDO's counter-improvised threat mission. (Recommendation 1)

Agency: Department of Defense
Status: Open

Comments: DOD agreed with this recommendation. As of October 2019, DOD indicated that is has begun taking action to implement it. We will update the status of this recommendation once we confirm the actions DOD has taken.

Recommendation: The Secretary of Defense should ensure that the Under Secretary of Defense for Acquisition and Sustainment clarifies JIDO's authorities for countering improvised threats, including the degree to which JIDO is to focus (lead, advocate, and coordinate) departmental efforts in key areas such as research and rapid fielding. (Recommendation 2)

Agency: Department of Defense
Status: Open

Comments: DOD agreed with this recommendation. As of October 2019, DOD indicated that is has begun taking action to implement it. We will update the status of this recommendation once we confirm the actions DOD has taken.

Recommendation: The Secretary of Defense should ensure the DTRA Director establishes a process to routinely obtain permission to release applicable information from organizations connected to JIDO research projects so that JIDO can send the information to Defense Technical Information Center (DTIC). (Recommendation 3)

Agency: Department of Defense
Status: Open

Comments: DOD agreed with this recommendation. As of October 2019, DOD indicated that is has begun taking action to implement it. We will update the status of this recommendation once we confirm the actions DOD has taken.

Recommendation: The Secretary of Defense should ensure the DTRA Director establishes a process to submit information on JIDO's research projects to DTIC. (Recommendation 4)

Agency: Department of Defense
Status: Open

Comments: DOD agreed with this recommendation. As of October 2019, DOD indicated that is has begun taking action to implement it. We will update the status of this recommendation once we confirm the actions DOD has taken.

Recommendation: The acting Bank president and Board chairman should ensure that the Bank evaluates and implements methods to further promote and sustain an antifraud tone that permeates the Bank's organizational culture, as described in GAO's Fraud Risk Framework. This should include consideration of requiring training on fraud risks relevant to Bank programs, for new employees and all employees on an ongoing basis, with the training to include identifying roles and responsibilities in fraud risk management activities across the Bank. (Recommendation 1)

Agency: Export-Import Bank of the United States
Status: Open

Comments: In November 2019, EXIM told us it continues work in this area and will provide us information on this work as it is completed. We will continue to monitor EXIM's progress in this area.

Recommendation: The acting Bank president and Board chairman should ensure that the Bank develops and implements an antifraud strategy with specific control activities, based upon the results of fraud risk assessments and a corresponding fraud risk profile, as provided in GAO's Fraud Risk Framework. (Recommendation 4)

Agency: Export-Import Bank of the United States
Status: Open

Comments: In November 2019, EXIM told us it was in the final stages of its process for completing its antifraud strategy. We will continue to monitor EXIM's efforts in this area.

Recommendation: The acting Bank president and Board chairman should ensure that the Bank identifies, and then implements, the best options for sharing more fraud-related information--including details of fraud case referrals and outcomes--among Bank staff, to help build fraud awareness, as described in GAO's Fraud Risk Framework. (Recommendation 5)

Agency: Export-Import Bank of the United States
Status: Open

Comments: In November 2019, EXIM stated that it is continuing to work with its Inspector General to implement this recommendation. We will continue to monitor EXIM's progress in this area.

Recommendation: The acting Bank president and Board chairman should lead efforts to collaborate with the Bank's OIG to identify a feasible, cost-effective means to systematically track outcomes of fraud referrals from the Bank to the OIG, including creating a means to link the OIG's proven cases of fraud to the specific Bank transactions from which the OIG actions arose. If any such means are found to be feasible and cost-effective, the acting Bank president and Board chairman should direct appropriate staff to implement them, with such information to be used for purposes consistent with GAO's Fraud Risk Framework, such as data analytics. (Recommendation 6)

Agency: Export-Import Bank of the United States
Status: Open

Comments: In November 2019, EXIM stated that it is continuing to work with its Inspector General to implement this recommendation. We will continue to monitor EXIM's progress in this area.

Recommendation: The acting Bank president and Board chairman should ensure that the Bank monitors and evaluates outcomes of fraud risk management activities, using a risk-based approach and outcome-oriented metrics, and that it subsequently adapts antifraud activities or implements new ones, as determined to be appropriate and consistent with GAO's Fraud Risk Framework. (Recommendation 7)

Agency: Export-Import Bank of the United States
Status: Open

Comments: In November 2019, EXIM stated that it is continuing work to implement this recommendation. We will continue to monitor EXIM's progress in this area.

Recommendation: The Director, working with the Study, should ensure that as the Study finalizes its reporting format, it fully incorporates leading practices of performance reporting. (Recommendation 1)

Agency: Environmental Protection Agency
Status: Open

Comments: In June 2020, the Long Island Sound Study (Study) stated that it has incorporated two leading practices into the reporting format for its progress reports. In addition, the Study website shows the progress toward ecosystem targets compared to the recovery plan, and for a preceding period of time when data are available. According to the Study, EPA hired a contractor to develop a report addressing our recommendations. The Study is using the contractor report to finalize its reporting format and plans to develop an online reporting and tracking system that fully incorporates leading practices of performance reporting. We will review the format of the online tracking system when it becomes available and provide updated information as appropriate.

Recommendation: The Director, working with the Study, should develop cost estimates that include analyses of uncertainties for each of the targets in the 2015 plan. (Recommendation 2)

Agency: Environmental Protection Agency
Status: Open

Comments: In June 2020, the Study reported that it had hired a contractor to develop a report including the range of costs, including uncertainty bounds, needed to attain each of the targets in the 2015 plan. The contractor has completed its study. Cost estimates for each ecosystem target were developed by adding up the existing cost ranges for each of the implementation actions in the 2015 plan. The report is posted and accessible to the public on the Long Island Sound Study website (https://longislandsoundstudy.net/2019/11/addressing-gaos-recommendations-liss-performance-reporting-and-cost-estimating/). The report contains recommendations for the Study to continue estimating costs in future reports. We are following up with EPA to determine whether the Study will do this.

Recommendation: The Director, working with the Study, should estimate the range of potential costs for all implementation actions and include the estimates in future supplements to the 2015 plan. (Recommendation 3)

Agency: Environmental Protection Agency
Status: Open

Comments: In June 2020, the Study said that as part of the Plan 2020-2024 implementation action update, it will include a range of costs for implementation actions. We will review the supplemental documents when they are available and provide updated information as appropriate.

Recommendation: The Commissioner of the IRS should ensure the operational analysis for IMF fully addresses greater utilization of technology or consolidation of investments to better meet organizational goals. (Recommendation 1)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: In August 2019, IRS provided its fiscal year 2018 Operational Analysis Results report, dated June 24, 2019. The report demonstrated that IRS, in response to our recommendation, had ensured that the operational analysis for IMF fully addressed greater utilization of technology or consolidation of investments to better meet organizational goals. However, the operational analysis did not reflect IRS's progress to date in modernizing IMF and the associated challenges. As we reported, this omission is concerning given the risk exposure from the agency's continued use of the legacy assembly language code. In order to close the recommendation, IRS needs to update the operational analysis to reflect its progress modernizing IMF.

Recommendation: The Commissioner of the IRS should ensure the operational analysis for Telecommunications Systems and Support (TSS) addresses the extent to which the investments support customer processes as designed, and how well the investments are delivering the goods or services they were designed to deliver. (Recommendation 3)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: In August 2019, IRS provided its fiscal year (FY) 2018 Operational Analysis Results report, dated June 24, 2019. While the report included a summary of the FY 2018 operational analysis for TSS, it did not identify the metrics used to determine whether TSS supported customer processes or delivered the goods and services that it is intended to deliver. To close this recommendation, IRS will need to provide the detailed operational analysis for TSS incorporating these metrics. As of December 2019, IRS has not provided the full TSS operational analysis to GAO. Upon receiving the document, we will review it to determine if IRS has implemented the recommendation.

Recommendation: The Commissioner of the IRS should ensure the operational analysis for TSS includes a comparison of current performance with a pre-established cost baseline. (Recommendation 4)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: In August 2019, IRS provided GAO its fiscal year (FY) 2018 Operational Analysis Results report. While the report included a summary of the FY 2018 operational analysis for the Telecommunications Systems and Support (TSS) investment , including planned and actual cost figures for FY2018, the report did not indicate whether the planned cost figure for FY2018 accounted for reimbursable costs and user fees, as we reported. To address this recommendation, IRS will need to provide a full operational analysis for TSS, as well as documentation showing whether reimbursable costs and user fees are included in the planned cost figure. As of December 2019, IRS has not provided a full TSS operational analysis to GAO. Upon receiving the document, we will review it to determine if IRS has implemented the recommendation.

Recommendation: The Commissioner of the IRS should ensure the operational analysis for End User Systems and Services includes a comparison of current performance with a pre-established cost baseline. (Recommendation 5)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: In August 2019, IRS provided its fiscal year (FY) 2018 Operational Analysis Results report, dated June 24, 2019. While the report included a summary of the FY 2018 operational analysis for End User Systems and Services (EUSS) investment, including planned and actual cost figures for FY2018, it did not specify whether the planned cost figure accounted for multi-year funding and user fees, as we reported. To address this recommendation, IRS will need to provide a full operational analysis for EUSS, as well as documentation showing whether multi-year funding and user fees are included in the planned cost figure. As of December 2019, IRS has not provided the full EUSS operational analysis to GAO. Upon receiving it, we will review it to determine if IRS has implemented the recommendation.

Recommendation: The Commissioner of the IRS should fully implement the risk management key practice associated with preparing for risk management for the IMF investment. (Recommendation 7)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: In September 2018, IRS told GAO it would implement the recommendation by November 2019. As of December 2019, IRS has not provided any updates on the status of the recommendation. When we confirm what actions IRS has taken, we will provide updated information.

Recommendation: The Commissioner of the IRS should fully implement the risk management key practice associated with analyzing risk for the IMF investment. (Recommendation 8)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: In September 2018, IRS told GAO it would implement the recommendation by November 2019. As of December 2019, IRS has not provided any updates on the status of the recommendation. When we confirm what actions IRS has taken, we will provide updated information.

Recommendation: The Commissioner of the IRS should fully implement the risk management key practice for prioritizing risk for the IMF investment. (Recommendation 9)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: In September 2018, IRS told GAO it would implement the recommendation by November 2019. As of December 2019, IRS has not provided any updates indicating whether the agency has implemented the recommendation. When we confirm what actions IRS has taken, we will provide updated information.

Recommendation: The Commissioner of the IRS should fully implement the risk management key practice associated with mitigating risk for the IMF investment. (Recommendation 10)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: In September 2018, IRS told GAO it would implement the recommendation by November 2019. As of December 2019, IRS has not provided any updates on the status of the recommendation. When we confirm what actions IRS has taken, we will provide updated information.

Recommendation: The Commissioner of the IRS should fully implement the risk management key practice associated with monitoring, reporting, and controlling risk for the IMF investment. (Recommendation 11)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: In September 2018, IRS told GAO it would implement the recommendation by November 2019. As of December 2019, IRS has not provided any updates on the status of the recommendation. When we confirm what actions IRS has taken, we will provide updated information.

Recommendation: The Commissioner of the IRS should fully implement the risk management key practice associated with preparing for risk management for the IDRS investment. (Recommendation 12)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: In September 2018, IRS told GAO it would implement the recommendation by November 2019. As of December 2019, IRS has not provided any updates indicating whether the agency has implemented the recommendation. When we confirm what actions IRS has taken, we will provide updated information.

Recommendation: The Commissioner of the IRS should fully implement the risk management key practice associated with analyzing risk for the IDRS investment. (Recommendation 13)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: In September 2018, IRS told GAO it would implement the recommendation by November 2019. As of December 2019, IRS has not provided any updates on the status of the recommendation. When we confirm what actions IRS has taken, we will provide updated information.

Recommendation: The Commissioner of the IRS should fully implement the risk management key practice associated with mitigating risk for the IDRS investment. (Recommendation 14)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: In September 2018, IRS told GAO it would implement the recommendation by November 2019. As of December 2019, IRS has not provided any updates indicating whether the agency has implemented the recommendation. When we confirm what actions IRS has taken, we will provide updated information.

Recommendation: The Commissioner of the IRS should fully implement the risk management key practice associated with monitoring, reporting, and controlling risk for the IDRS investment. (Recommendation 15)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: In September 2018, IRS told GAO it would implement the recommendation by November 2019. As of December 2019, IRS has not provided any updates indicating whether the agency has implemented the recommendation. When we confirm what actions IRS has taken, we will provide updated information.

Recommendation: The Commissioner of the IRS should fully implement the risk management key practice associated with preparing for risk management for the MSSS investment. (Recommendation 16)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: In November 2019, IRS provided its IT Enterprise Operations Mainframe and Servers Services and Support (MSSS) Risk Management Plan, dated October 7, 2019. While the plan addressed most of the activities associated with the preparing for risk management key practice, it did not identify risk constraints, risk assumptions, or risk tolerance for the MSSS investment. Upon receiving further information, we will review it to determine if IRS has fully addressed this recommendation.

Recommendation: The Commissioner of the IRS should fully implement the risk management key practice associated with analyzing risk for the MSSS investment. (Recommendation 18)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: In September 2018, IRS told GAO it would implement the recommendation by October 2019. In November 2019, IRS provided its IT Enterprise Operations Mainframe and Servers Services and Support (MSSS) Risk Management Plan, dated October 7, 2019, along with several other documents associated with the agency's IT risk management process. However, the documents do not demonstrate that IRS has implemented the activities associated with the Analyze Risk key practice. Specifically, while the plan describes a risk analysis process in which risks are classified as high, medium, or low risk, neither the plan nor any of the other documents describes criteria for evaluating and quantifying risk likelihood and severity (impact) levels. Additionally, the Risk Management Plan does not indicate whether analysis of MSSS risks includes both inherent and residual risks. Upon receiving additional information indicating that IRS has addressed these activities, we will review it to determine if IRS has implemented the recommendation.

Recommendation: The Commissioner of the IRS should fully implement the risk management key practice associated with mitigating risk for the MSSS investment. (Recommendation 19)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: In September 2018, IRS told GAO it would implement the recommendation by October 2019. In November 2019, IRS provided its IT Enterprise Operations Mainframe and Servers Services and Support (MSSS) Risk Management Plan, dated October 7, 2019, along with several other documents associated with the agency's IT risk management process. However, the documents do not demonstrate that IRS has established threshold values for MSSS risk categories or alternative courses of action for critical risks. Upon receiving additional information indicating that it has addressed these activities. we will review it to determine if IRS has implemented the recommendation.

Recommendation: The Commissioner of the IRS should fully implement the risk management key practice associated with monitoring, reporting, and controlling risk for the MSSS investment. (Recommendation 20)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: In September 2018, IRS told GAO it would implement the recommendation by October 2019. In November 2019, IRS provided its IT Enterprise Operations Mainframes and Servers Services and Support (MSSS) Risk Management Plan, dated October 7, 2019, along with several other documents associated with the agency's IT risk management process. However, the documents do not demonstrate that IRS has fully implemented all of the activities associated with the monitoring, reporting, and controlling key practice. Specifically, our review of the documents shows that IRS has not established threshold values for MSSS risk categories, and as a result is unable to compare the status of risks to acceptability thresholds to determine the need for implementing a risk mitigation plan. In addition, although the MSSS Risk Management Plan was updated in October 2019, its previous revision occurred in October 2017, indicating that IRS has not yet reviewed all aspects of the risk management program at least once a year. Upon receiving additional information that IRS has addressed these activities, we will review it to determine if IRS has implemented the recommendation.

Recommendation: The Commissioner of the IRS should fully implement IT workforce planning practices, including the following actions (1) setting the strategic direction for workforce planning; (2) analyzing the workforce to identify skill gaps; (3) developing strategies and implementing activities to address skill gaps; and (4) monitoring and reporting on progress in addressing skill gaps. (Recommendation 21)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: In September 2018, IRS told GAO it had initiated efforts to address workforce planning agency-wide. The agency stated that the Human Capital Office in coordination with the Information Technology organization prioritizes critical skills gaps to develop gap mitigation strategies, which are implemented through IT annual training plans and succession planning efforts. IRS also stated that the mitigation plans will be monitored in the current Project and Portfolio Management System and that the Human Capital and Information Technology organizations will monitor resource capacity, skills, assigned work effort, and staff availability. In addition, IRS stated that it would utilize special hiring authorities as a competency and staffing mitigation strategy. The agency noted that the special authorities are subject to the availability of resources and agency approval. Further, IRS stated that, due to the diversion of IT resources to the Tax Cuts and Jobs implementation, development of a plan for scaling and expansion of workforce planning efforts will commence after the opening of Filing Season 2020. IRS stated that, due to those constraints, it could not provide a date for fully implementing the recommendation. As of December 2019, IRS has not provided any updates indicating whether it has implemented the recommendation. When we confirm what actions IRS has taken, we will provide updated information.

Recommendation: The Secretary of the American Battle Monuments Commission should designate a chief FOIA officer at the assistant secretary level or equivalent. (Recommendation 1)

Agency: American Battle Monuments Commission
Status: Open

Comments: American Battle Monument Commission (ABMC) officials stated they are working to implement GAO's recommendations by the end of fiscal year 2020.

Recommendation: The Secretary of the American Battle Monuments Commission should update and publish comprehensive FOIA regulations that include requirements established by law and Justice guidance. (Recommendation 2)

Agency: American Battle Monuments Commission
Status: Open

Comments: American Battle Monument Commission (ABMC) officials stated they are working to implement GAO's recommendations. On February 18, 2020, ABMC published proposed revised FOIA regulations which are pending final rule in the Federal Register.

Recommendation: The Chief Executive Officer and Director of the Broadcasting Board of Governors should update and publish comprehensive FOIA regulations that include requirements established by law and Justice guidance. (Recommendation 3)

Agency: U.S. Agency for Global Media
Status: Open

Comments: The U.S. Agency for Global Media (formally known as the Broadcasting Board of Governors) performed a comprehensive review of its FOIA regulations and updated its regulations in accordance with GAO's recommendation. The agency anticipates publishing proposed updates for notice and comment in spring 2020, followed by a final rule.

Recommendation: The Secretary of DHS should take steps to develop and document a plan that fully addresses best practices with regards to reduction of backlogged FOIA requests. (Recommendation 4)

Agency: Department of Homeland Security
Status: Open

Comments: In April 2018, the Department of Homeland Security initiated a department-wide compliance assessment and stated that it plans to use the results of the assessment to help guide the department in identifying best practices and areas of improvement. The department does not have an estimate for when the plan will be complete.

Recommendation: The Secretary of DOI should take steps to develop and document a plan that fully addresses best practices with regards to reduction of backlogged FOIA requests. (Recommendation 7)

Agency: Department of the Interior
Status: Open

Comments: In August 2018, the Department of Interior informed GAO that the department has created a preliminary backlog reduction plan that includes expanding the use of automation tools, expanding the use of interim responses, and closing the Department's 10 oldest requests. Currently, GAO is awaiting a copy of the Department's backlog reduction plan.

Recommendation: The Chair of EEOC should designate a chief FOIA officer at the assistant secretary level or equivalent. (Recommendation 8)

Agency: Equal Employment Opportunity Commission
Status: Open

Comments: GAO is currently awaiting the agency's response to GAO recommendations..

Recommendation: The Chair of EEOC should take steps to develop and document a plan that fully addresses best practices with regards to reduction of backlogged FOIA requests. (Recommendation 9)

Agency: Equal Employment Opportunity Commission
Status: Open

Comments: GAO is currently awaiting the agency's response to GAO recommendations.

Recommendation: The Attorney General of the United States should take steps to develop and document a plan that fully addresses best practices with regards to reduction of backlogged FOIA requests. (Recommendation 11)

Agency: Department of Justice
Status: Open

Comments: In August 2018, the Department of Justice acknowledged that it plans to reexamine its progress and take steps for continued improvement in reducing its backlog. Currently, GAO is awaiting a response from the Department on a publication date.

Recommendation: The Administrator of NASA should provide agency records of final opinions online. (Recommendation 14)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: In August 2018, NASA agreed to provide agency records of final opinions online. NASA noted that final opinions will be provided online as they are issued and released for public posting. To date, the Department has not posted any final opinions.

Recommendation: The Chairman of NTSB should take steps to develop and document a plan that fully addresses best practices with regards to reduction of backlogged FOIA requests. (Recommendation 16)

Agency: National Transportation Safety Board
Status: Open

Comments: In August 2018, NTSB provided a plan that laid out tasks for reducing its backlog. The plan did not, however provide milestones or dates for when these tasks would be completed. GAO is currently waiting for the finalized backlog FOIA plan.

Recommendation: The Director of OMB should designate a chief FOIA officer at the assistant secretary level or equivalent. (Recommendation 18)

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: GAO is currently awaiting the agency's response to GAO recommendations.

Recommendation: The Director of Pension Benefit Guaranty Corporation should designate a chief FOIA officer at the assistant secretary level or equivalent. (Recommendation 19)

Agency: Pension Benefit Guaranty Corporation
Status: Open

Comments: The Pension Benefit Guaranty Corporation stated that it has designated the deputy director as the chief FOIA officer. It also noted that the director is at the Senior Level. However, this position is not equivalent to the assistant secretary level identified by GAO.

Recommendation: The President of TVA should ensure its FOIA tracking system is compliant with section 508 requirements. (Recommendation 22)

Agency: Tennessee Valley Authority
Status: Open

Comments: In August 2018, TVA provided a response to GAO's recommendation to ensure their FOIA tracking systems is compliant with section 508 requirements. TVA is currently performing an in-depth assessment of their tracking system to identify where updates can be made to ensure 508 compliance. TVA expects the assessment to be completed by the end of January 2020.

Recommendation: The President of the U.S. African Development Foundation should update and publish comprehensive FOIA regulations that inform a requester of limited unusual circumstances fees. (Recommendation 24)

Agency: African Development Foundation
Status: Open

Comments: U.S. African Development Foundation officials have stated that their FOIA regulations are currently under review and expect them to be published in the first half of calendar year 2020.

Recommendation: The Director of NSF should revise the agency's policies for developing schedules for large facilities projects, and for reviewing those schedules, to better incorporate the best practices in GAO's schedule guide. (Recommendation 2)

Agency: National Science Foundation
Status: Open

Comments: NSF agreed with this recommendation and, as of November 2019, had updated its internal guidance to include a new section related to schedule reviews. The updated guidance states that the NSF Large Facilities Office will lead analysis of the schedule for each proposed major facilities project, which will include a technical evaluation by the sponsoring office. As further steps to implement this recommendation, NSF planned to develop (1) a new section of the Major Facilities Guide on schedule development, estimating, and analysis and (2) new internal guidance on including project schedules as part of external panels' oversight reviews. NSF anticipated completing these actions by mid-fiscal year 2020. We will continue to monitor and provide updates on NSF's actions to address this recommendation.

Recommendation: The Secretary of Defense should direct the Under Secretary of Defense for Acquisition and Sustainment to update the policy or guidance for MAIS business programs. Specifically, the update should include the following elements: (1) establishment of initial and current baseline cost and schedule estimates, (2) predetermined threshold cost and schedule estimates to identify the point when programs may be at high risk, and (3) quarterly and annual reports on the performance of programs to stakeholders. (Recommendation 1)

Agency: Department of Defense
Status: Open

Comments: In January 2020, the Under Secretary of Defense for Acquisition and Sustainment issued an updated instruction on defense business systems requirements and acquisition, which included guidance on establishing baseline cost and schedule estimates and considering progress against the baselines at key decision points. However, the instruction does not make a distinction between initial and current baselines. Further, it did not include thresholds for cost and schedule variances or specify periodic reporting of program performance information to stakeholders. According to an official in the office of the Under Secretary of Defense for Acquisition and Sustainment, the office does not intend to add the elements of the recommendation related to thresholds and reporting. Specifically, according to the official, the office considers specifying predetermined threshold cost and schedule estimates and frequency for status reporting to be matters for implementation guidance issued by department components or determined by a program decision authority. However, until the department demonstrates that it has fully addressed the recommendation, it is limited in its ability to ensure that effective system acquisition management controls are implemented for each major business system investment and that stakeholders have the information needed to make informed decisions for managing and overseeing these investments. We will continue to monitor the department's implementation of the recommendation.

Recommendation: The Secretary of Defense should direct the Director of the Defense Health Agency to direct the program manager for the Defense Healthcare Management System Modernization program to: (1) finalize and approve its requirements management plan, (2) identify and document changes that should be made to plans and work products resulting from changes to the requirements baseline, and (3) quantify costs and benefits of risk mitigation within its program-level risk mitigation plans. (Recommendation 2)

Agency: Department of Defense
Status: Open

Comments: As of November 2019, the Department of Defense had made progress addressing the intent of the recommendation related to requirements management; however, it needs to do more to improve DHMSM program risk management. Specifically, in March 2019, the DHMSM program manager approved a requirements management plan, which includes identifying and documenting changes that should be made to plans and work products resulting from changes to the baseline requirements. Specifically, it includes forward and backward configuration and change management of the baselined requirements and managing traceability of requirements to design artifacts, test cases, defects, and change requests. However, the program has not demonstrated that it quantifies costs and benefits of risk mitigation in its risk mitigation plans. Specifically, it did not demonstrate that it had updated its guidance to require that costs and benefits of risk mitigation plans be included in these plans. We will continue to monitor the department's efforts to implement the recommendation.

Recommendation: The Under Secretary for Management should require the Office of Program Accountability and Risk Management to assess the results of major acquisition programs' post-implementation reviews and identify opportunities to improve performance across the acquisition portfolio. (Recommendation 2)

Agency: Department of Homeland Security
Status: Open

Comments: In providing comments on this report, DHS concurred with our recommendation and stated that it planned to update its policy to require more formal reporting requirements and execution criteria for post-implementation reviews. PARM also plans to initiate a study focused on assessing lessons learned and developing a tool to share them across components to improve performance of the acquisition portfolio. In February 2020, PARM approved guidance intended to standardize analysis elements for post-implementation reviews. As of July 2020, PARM was still in the process of developing a tool to share results across components, but in the interim, results from some post-implementation reviews have been shared during meetings with Component Acquisition Executives. GAO will review post-implementation reviews conducted under the new guidance and will monitor DHS's implementation of the tool to ensure the department's actions meet the intent of this recommendation.

Recommendation: The Secretary of the Navy should take steps to ensure that the Marine Corps not enter full-rate production until the Marine Corps has determined that the contractor has achieved an MRL of at least 9 for all risk areas. (Recommendation 2)

Agency: Department of Defense
Status: Open

Comments: DOD partially concurred with this recommendation, stating that it agreed that manufacturing readiness levels (MRL) for the Amphibious Combat Vehicle 1.1 should be assessed prior to the decision to award the option for the second lot of low-rate production, but disagreed that an MRL assessment of any individual risk area, in itself, should delay the contract award. We maintained that achieving an overall MRL-9 by the by the start of full-rate production represents best practice to minimize production risk. According the Marine Corp, the most recent MRL Assessment as of August 2020 assessed the program at an overall MRL-8. The Marine Corps indicated that another MRL assessment is estimated to be completed in November 2020 to support the decision to enter full-rate production, which is planned for December 2020.

Recommendation: The Secretary of Defense should ensure that the Assistant Secretary of Defense for Energy, Installations, and the Environment work with DOD's construction agents, military departments, and other offices to improve DOD's MILCON cost estimating guidance (i.e., DOD's Unified Facilities Criteria) by fully incorporating all the steps needed for developing high-quality reliable cost estimates. (Recommendation 1)

Agency: Department of Defense
Status: Open

Comments: DOD partially concurred with our recommendation to improve its cost estimating guidance by fully incorporating all 12 steps needed for developing high-quality, reliable estimates. DOD stated that it did not believe that it is suitable to fully apply all 12 steps to any construction project due to characteristics of the military construction program that DOD believes differ from those of major system or weapon acquisition programs. However, DOD also stated that it concurred with the intent and general applicability of the twelve steps to military construction and that DOD cost estimating guidance lacks specificity in several of these areas. DOD acknowledged that expanding its cost guidance to more fully incorporate these steps would benefit the military construction program, and told us that it is planning to address this by revising its cost guidance. In our report, we recognize that it may not be appropriate to fully apply all 12 steps to each construction project. For example, it may not be realistic or to the military departments' benefit to conduct a sensitivity and uncertainty analysis or develop an independent cost estimate for all the construction projects they initiate every year, especially for low-cost projects. Accordingly, we did not recommend that DOD fully apply all 12 steps to each construction project, but rather that it fully incorporate the 12 steps into the Unified Facilities Criteria so that, at least, each step is considered for each project. DOD could then choose to establish thresholds-based on, for example, the dollar values of the projects-to determine for which the 12 steps should be fully applied or other circumstances in which some steps might not be applicable. We believe DOD's planned revisions once completed will meet the general intent of our recommendation.

Recommendation: The Secretary of Defense should ensure that the CMO fully address all requirements in section 911 of the NDAA for Fiscal Year 2017 and incorporate leading practices for effective cross-functional teams in guidance on Secretary of Defense-empowered cross-functional teams. (Recommendation 3)

Agency: Department of Defense
Status: Open

Comments: DOD concurred with this recommendation. In December 2019, the Secretary of Defense approved DOD's guidance on cross-functional teams. We found that this two-page guidance addresses most, but not all, of the 911 requirements and leading practices for cross-functional teams. Specifically, it addresses in whole or in part six of the seven section 911 requirements and six of the eight leading practices. The Secretary-approved guidance also directs the Chief Management Officer (CMO) to develop more detailed implementing guidance. According to an Office of the CMO (OCMO) official, OCMO plans to use previously drafted terms of reference as the basis for the CMO's more detailed implementing guidance. Based on our review, when the Secretary of Defense approved guidance is considered along with the draft terms of reference expected to serve as detailed implementing guidance, both documents will fully address all section 911 requirements and leading practices for effective cross-functional teams. To fully implement this recommendation, the CMO will need to develop and issue this detailed implementing guidance to fully address section 911 requirements and our leading practices for effective cross-functional teams. According to an OCMO official, as of April 2020, OCMO was still in the process of developing the detailed implementing guidance.

Recommendation: The Secretary of Defense should ensure that the CMO either: (a) provide training for presidentially-appointed, Senate-confirmed individuals in the Office of the Secretary of Defense that includes the required elements--leadership, modern organizational practice, and collaboration--in section 911 of the NDAA for Fiscal Year 2017, or (b) develop criteria for obtaining a waiver and have the Secretary of Defense request such a waiver from the President for these required elements if the individual possesses--through training and experience--the skill and knowledge otherwise to be provided through a course of instruction. (Recommendation 4)

Agency: Department of Defense
Status: Open

Comments: DOD concurred with this recommendation. In October 2018, an official from the Office of the Chief Management Officer (OCMO) stated that OCMO had revised the draft training curriculum for individuals filling presidentially-appointed, Senate-confirmed positions in the Office of the Secretary of Defense to include all of the required elements in section 911. According to an OCMO official, as of April 2020, the curriculum had been approved and the training had been provided, but as of July 2020, the department had not provided documentation of the updated curriculum or of the training being provided. To fully implement this recommendation, we will need to review the revised training curriculum to determine if it contains all of the required elements in section 911 and obtain documentation that presidential appointees in the Office of the Secretary of Defense have received the training or were granted training waivers.

Recommendation: The NNSA Administrator should revise the scope of the mission need statement to clarify which mission need it seeks to achieve and, as appropriate, adjust the range of options considered in the analysis of alternatives process. (Recommendation 1)

Agency: Department of Energy: National Nuclear Security Administration
Status: Open

Comments: NNSA disagreed with our recommendation and has not taken steps to implement it. In August 2019, GAO requested an update on the status of the small centrifuge project at Oak Ridge since NNSA officials indicated in May 2019 that the status of the small centrifuge project will impact NNSA's ability to complete the analysis of alternatives (AOA) process by December 2019, as originally planned. Early in calendar year 2020, NNSA announced that completion of the AOA would be delayed to the end of fiscal year 2020. In September 2020, NNSA stated that the COVID-19 pandemic had further delayed the AOA and that the agency had not determined a revised target date for completion. We will continue monitoring the AOA process and will review the AOA once it is completed to determine whether we can close this recommendation at that time.

Recommendation: The NNSA Administrator should--following clarification of the scope of the mission need statement--ensure that the agency's cost estimates for whichever options it considers going forward are aligned with the scope of the mission need that the enrichment capability is intended to fulfill and that they are developed consistent with best practices. (Recommendation 2)

Agency: Department of Energy: National Nuclear Security Administration
Status: Open

Comments: NNSA disagreed with our recommendation and has not taken steps to implement it. In August 2019, GAO requested an update on the status of the small centrifuge project at Oak Ridge since NNSA officials indicated in May 2019 that the status of the small centrifuge project will impact NNSA's ability to complete the analysis of alternatives (AOA) process by December 2019, as originally planned. Early in calendar year 2020, NNSA announced that completion of the AOA would be delayed to the end of fiscal year 2020. In September 2020, NNSA stated that the COVID-19 pandemic had further delayed the AOA and that the agency had not determined a revised target date for completion. We will continue monitoring the AOA process and will review the AOA once it is completed to determine whether we can close this recommendation at that time.

Recommendation: The Secretary of the Navy should take steps to address areas of civilian and military program manager training, mentoring, retention, and selection that do not align extensively with leading practices. This could include using approaches already used by the other military services or commercial companies. (Recommendation 6)

Agency: Department of Defense: Department of the Navy
Status: Open

Comments: DOD concurred with this recommendation, and indicated the Department of the Navy plans to improve its civilian and military program manager training, mentoring, retention, and selection programs across the program management community and the acquisition workforce as a whole. Regarding training, in January 2019 the Navy sent its first cohort of participants to a DOD talent exchange program with industry, open to both civilian and military acquisition personnel, and including a focus on the program management workforce. Of the second Navy cohort that started in this program in early 2020, eight were civilians in the program management career field. Regarding mentoring, in October 2018 the Department of the Navy issued a program management career field guidebook that included career path roadmaps and descriptions of skills and competencies - such as mentoring individuals and teams - needed to advance for program management personnel across the Navy. Regarding selection, the Navy is developing a talent management system to enable talent identification, career development, and succession management across the acquisition workforce. A pilot of this system started in 2020, and includes the program management career field. The Navy expects to complete this pilot in fiscal year 2021, and to use data from the system to support the selection of key leadership positions including program managers and deputy program managers.

Recommendation: The Administrator of NNSA should require an independent entity to validate that contractor EVM systems used for LEPs meet the EVM national standard. (Recommendation 1)

Agency: Department of Energy: National Nuclear Security Administration
Status: Open

Comments: In October 2018, NNSA stated that the integrated baseline reviews, internal reviews of earned value management (EVM) systems used by life extension programs (LEP), and other controls over data integration provide a practical and cost-beneficial approach to the validation of contractor EVM systems. However, in early 2019, NNSA conducted a lessons learned study to more fully assess the cost, benefit, mission impacts, and feasibility of implementing our recommendation for possible application to future LEPs. According to NNSA documentation, based on the results of the lessons learned study, NNSA concluded that the effort and expense needed to validate contractor EVM systems against the EVM national standard could be better used providing resources to improve the agency's ability to establish work breakdown structures, schedules, and integration of scope, cost, and schedule. As a result, as of September 2019, NNSA stated that its actions meet the intent of our recommendation. We disagree. As we stated in our report, without requiring an independent entity to validate that contractor EVM systems meet the EVM national standard, NNSA may not have assurance that its LEPs are obtaining reliable EVM data for managing their programs and reporting their status. We will continue to monitor NNSA's activities to address this recommendation.

Recommendation: The Administrator of NNSA should require an independent entity to conduct surveillance reviews of contractor EVM systems used for LEPs to ensure that they maintain compliance with the EVM national standard through program completion. (Recommendation 2)

Agency: Department of Energy: National Nuclear Security Administration
Status: Open

Comments: In October 2018, NNSA stated that it conducts ongoing surveillance through integrated baseline reviews, internal reviews of EVM systems used by LEPs, and other assessments, which consider national standards. However, in early 2019, NNSA conducted a lessons learned study to more fully assess the cost, benefit, mission impacts, and feasibility of implementing our recommendation for possible application to future LEPs. According to NNSA documentation, based on the results of the lessons learned study, NNSA concluded that the effort and expense needed to conduct surveillance reviews of contractor EVM systems to ensure compliance with the EVM national standard could be better used providing resources to improve the agency's ability to establish work breakdown structures, schedules, and integration of scope, cost, and schedule. As a result, as of September 2019, NNSA stated that its actions meet the intent of our recommendation. We disagree. As we stated in our report, without requiring an independent entity to conduct surveillance reviews of contractor EVM systems through program completion, NNSA may not have assurance that its LEPs are obtaining reliable EVM data for managing their programs and reporting their status. We will continue to monitor NNSA's activities to address this recommendation.

Recommendation: The Administrator of NNSA should require its programs to ensure that LEP critical technologies meet specific technology readiness level benchmarks at decision points, or otherwise document with program executive approval their rationale for not meeting these benchmarks. (Recommendation 3)

Agency: Department of Energy: National Nuclear Security Administration
Status: Open

Comments: In October 2018, NNSA stated that it has already incorporated specific benchmarks for technology readiness levels at decision points. As an example, it stated that it recommends a technology readiness level of 5 at the beginning of phase 6.3 for an LEP. As a result, NNSA stated that its actions meet the intent of our recommendation. We disagree. As we stated in our report, it is important for NNSA to establish a requirement, not just a recommendation, that LEP critical technologies meet specific technology readiness level benchmarks at decision points. We will continue to monitor NNSA's activities to address this recommendation.

Recommendation: The Acting Commissioner of Internal Revenue should assess options for improving enforcement of late W-2 filing penalties, for example, by mailing notices before the next filing deadline. (Recommendation 2)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: As of October 2019, IRS continues to disagree with this recommendation. IRS stated that it does not have all the information required for calculating and sending late penalty notifications prior to the beginning of the next filing season. However, in its response, IRS did not consider other options that could be available prior to finalizing penalty calculations, such as communicating with the employers earlier in the process. As noted in our report, quickly responding to employers that filed late increases the potential for compliance, thereby increasing the availability of W-2 data for systemic verification to detect and prevent fraud and noncompliance. We continue to believe that assessing the options for improving enforcement of late W-2 filing penalties, such as through earlier communication, would help IRS identify potential opportunities to encourage compliance with the W-2 filing deadline and verify more wage information before releasing refunds. We will continue to discuss options with IRS regarding this recommendation.

Recommendation: The Acting Commissioner of Internal Revenue should develop an evaluation plan to fully assess the benefits and costs, including taxpayer burden, of modifying the February 15 refund hold, and determine how this effort informs IRS's overall compliance strategy for refundable tax credits and fraud risk management. (Recommendation 3)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: As of January 2020, IRS has assessed the benefits of modifying the refund hold, but it has not assessed the costs, as GAO recommended in January 2018. In November 2018, IRS provided its assessment of the February 15 refund hold. In it, IRS reiterated its findings regarding the benefits of the refund hold. These benefits included potential savings if IRS modified the hold to include all taxpayers, extended the hold to a later date when more W-2 data are available, or made both changes. However, IRS did not include any assessment of costs to achieve these potential savings, such as the costs for IRS to review any additional returns that would be identified under a modified refund hold. It did not assess taxpayer burden, either. IRS also did not determine how the February 15 refund hold informs IRS's overall compliance strategy for refundable tax credits and its fraud risk management strategy. In January 2019, IRS took actions to hold more returns beyond the February 15 refund hold date using a risk-based selection method. Nevertheless, without a complete assessment of the benefits and costs, including taxpayer burden, IRS is making a decision based upon incomplete information. Further, if Congress or Treasury considered making any changes, they too would have incomplete information on which to direct IRS's actions.

Recommendation: Based on the benefits and costs assessment in Recommendation 3, the Acting Commissioner of Internal Revenue should use IRS's existing authority to modify the refund hold such that it minimizes the risk of releasing fraudulent or noncompliant refunds. (Recommendation 4)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: As of January 2020, IRS has taken actions consistent with our recommendations by modifying its filters to hold more returns claiming the Earned Income Tax Credit (EITC) or Additional Child Tax Credit (ACTC) beyond the February 15 refund hold date based on a risk-based selection method. In addition, in May 2019, IRS officials told us they are making similar changes for the 2020 filing season to hold more high-risk returns not claiming EITC or ACTC until W-2 data are available. This action, if taken, would be consistent with our recommendations. In 2018, IRS assessed the benefits of modifying the refund hold, however, it did not assess or document the costs, including taxpayer burden, or determine how the February 15 refund hold informs IRS's overall compliance strategy for refundable tax credits and its fraud risk management strategy. Completing these actions, along with the planned modifications, would fully address our recommendations, which would enable IRS to make decisions based on completed information.

Recommendation: The Acting Commissioner of Internal Revenue should assess the benefits and costs of additional uses and applications of W-2 data for pre-refund compliance checks, such as addressing underreporting, employment fraud, and other fraud or noncompliance before issuing refunds. (Recommendation 5)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: In September 2019, IRS provided results for a pilot encouraging voluntary compliance through expanded systemic verification using W-2 data. In the pilot, IRS sent soft notices to a targeted group of taxpayers whose returns under-reported income compared to W-2 data. In its analysis, IRS reported that some taxpayers voluntarily amended their returns after receiving the soft notice, resulting in a net increase in tax revenue. If IRS determines that the benefits outweigh the costs of adopting this practice based on the pilot results, or assesses additional options to address other fraud and noncompliance before issuing refunds, it would satisfy our recommendation. We will continue to follow IRS's progress on the pilot and its results.

Recommendation: Based on the assessment in Recommendation 5, the Acting Commissioner of Internal Revenue should implement any identified changes to improve pre-refund compliance checks. (Recommendation 6)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: In September 2019, IRS provided an evaluation of a pilot it conducted during tax year 2019. In the pilot, IRS sent soft notices to a targeted group of taxpayers whose returns under-reported income compared to W-2 data. In its analysis, IRS reported that some taxpayers voluntarily amended their returns after receiving the soft notice, resulting in a net increase in tax revenue. IRS told us they intend to continue the pilot during tax year 2020. We will continue to follow IRS's progress on the pilot and its results.

Recommendation: The Secretary of VA should, in collaboration with ISC, review and revise VA's risk management policies for VHA facilities to ensure VA incorporates ISC standards, as appropriate. (Recommendation 1)

Agency: Department of Veterans Affairs
Status: Open

Comments: Shortly after the issuance of the report, VA notified GAO that it was in the process of working with the lnteragency Security Committee (ISC) to update its vulnerability assessment program, with a target completion date of January 2019. Despite multiple attempts, as of June 2020, VA has not provided any information on its progress in updating its program.

Recommendation: The Secretary of VA should develop an oversight strategy that allows VA to assess the effectiveness of risk management programs at VHA facilities system-wide. (Recommendation 2)

Agency: Department of Veterans Affairs
Status: Open

Comments: Shortly after the issuance of the report, VA notified GAO that it had identified OS&LE as the internal entity responsible for conducting a complete review of VA's current risk management policies and processes for VA facilities and that it was reviewing an ISC-certified risk assessment tool for possible implementation consideration. Despite multiple attempts, as of June 2020, VA had not provided an update on its efforts to implement this recommendation.

Recommendation: The Acting Commissioner of Internal Revenue should ensure that the Information Sharing and Analysis Center (ISAC) pilot better aligns with leading practices for effective pilot design. This should include (1) establishing criteria for assessing whether the pilot's objectives have been met before making decisions about its scalability and whether, how, and when to when to proceed to full implementation; and (2) developing a data analysis plan that identifies data sources and criteria necessary for effectively evaluating the pilot. (Recommendation 1)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS transitioned the Information Sharing and Analysis Center (ISAC) from a pilot to full implementation in October 2018. As of June 2020, we have requested documentation from IRS related to this transition to determine if it is consistent with the recommendation to align with leading practices. We will continue to monitor ISAC activities.

Recommendation: The Acting Commissioner of Internal Revenue should ensure that the ISAC Partnership develops an outreach plan to expand membership and improve states' and industry partners' understanding of the ISAC's benefits. (Recommendation 2)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: The ISAC annual report released in April 2018 cites plans to continue to grow member participation from private sector and other government agencies and to provide opportunities to deepen members' participation with clear guidelines. As of June 2020, we have requested additional information about participation levels and ongoing outreach efforts. Developing an outreach plan to broaden membership to non-Security Summit members of industry and financial institutions would further promote stakeholders collaborating and sharing fraud information.

Recommendation: The Administrator of PHMSA should ensure that PHMSA uses other data and information about budgetary resources as they become available to inform and refine its performance goals. (Recommendation 2)

Agency: Department of Transportation: Pipeline and Hazardous Materials Safety Administration
Status: Open

Comments: As of May 2019, we are following up with PHMSA regarding this recommendation and will provide updated information when we confirm agency actions.