Recommendation: The Secretary of Commerce should align the agency's contingency plan with OMB guidance by including (1) plans for a potential prolonged shutdown; (2) flexibilities available to supervisors if furloughed employees were unable to return to work after the end of the shutdown; and (3) procedures for resuming program activities, including steps to ensure appropriate oversight and disbursement of funds upon the end of a shutdown. (Recommendation 1)

Agency: Department of Commerce
Status: Open

Comments: The Department of Commerce agreed with the recommendation and stated that it will develop an action plan to address the recommendation to better align its contingency plan with OMB guidance. When we confirm what actions Commerce has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Homeland Security should align the agency's contingency plan with OMB guidance by including (1) plans for a potential prolonged shutdown; (2) flexibilities available to supervisors if furloughed employees were unable to return to work after the end of the shutdown; and (3) procedures for resuming program activities, including steps to ensure appropriate oversight and disbursement of funds upon the end of a shutdown. (Recommendation 2)

Agency: Department of Homeland Security
Status: Open

Comments: The Department of Homeland Security agreed with the recommendation and and stated that it has begun to take steps to better address OMB guidance on contingency plans. When we confirm what actions DHS has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commissioner of Internal Revenue should align the agency's contingency plan with OMB guidance by including (1) plans for a potential prolonged shutdown; (2) flexibilities available to supervisors if furloughed employees were unable to return to work after the end of the shutdown; and (3) procedures for resuming program activities, including steps to ensure appropriate oversight and disbursement of funds upon the end of a shutdown. (Recommendation 3)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: The Internal Revenue Service (IRS) partially agreed with the recommendation. IRS agreed with one element of our recommendation to include additional detail in its agency contingency plan and stated that it is in the process of adding procedures for resuming program activities following a government shutdown into its contingency plan. IRS did not agree with the other elements of the recommendation because it believes it has already addressed plans for a potential prolonged shutdown and flexibilities for supervisors if employees are unable to return to work at the end of a shutdown in its contingency plans. We agree that while IRS has included some details on these elements in its plans, we continue to believe that it should provide more detail, such as points in time when the furlough status of an employee may change, how many employees would be affected, and the legal basis for the changes, within its publically available contingency plan to fully address these elements. We will continue to monitor IRS's efforts in this area.

Recommendation: The U.S. Trade Representative, in consultation with EOP as appropriate, should align the component's contingency plan with OMB guidance. This could be accomplished through (1) revisions to the EOP contingency plan; or (2) by creating a separate USTR plan. (Recommendation 4)

Agency: Executive Office of the President: Office of the United States Trade Representative
Status: Open

Comments: The Office of the U.S. Trade Representative (USTR) neither agreed nor disagreed with the recommendation. USTR stated that it has already begun addressing our recommendations on aligning its contingency plan with OMB guidance. When we confirm what actions USTR has taken in response to this recommendation, we will provide updated information.

Recommendation: The Under Secretary for International Trade should document the component's shutdown processes, including roles and responsibilities, planning processes for potential shutdowns, and recall processes for furloughed employees during a shutdown. (Recommendation 5)

Agency: Department of Commerce: International Trade Administration
Status: Open

Comments: The Department of Commerce agreed with the recommendation and stated that the International Trade Administration (ITA) has documented its shutdown planning processes and recall processes for furloughed employees during a shutdown. When we confirm what actions ITA has taken in response to this recommendation, we will provide updated information.

Recommendation: The U.S. Trade Representative should document the component's shutdown processes, including roles and responsibilities, planning processes for potential shutdowns, and recall processes for furloughed employees during a shutdown. (Recommendation 6)

Agency: Executive Office of the President: Office of the United States Trade Representative
Status: Open

Comments: The Office of the U.S. Trade Representative (USTR) neither agreed nor disagreed with the recommendation. USTR stated that it has already begun addressing our recommendations on documenting its shutdown processes. When we confirm what actions USTR has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commissioner of CBP should develop internal controls to track and document which employees worked and what work was performed daily during a government shutdown. (Recommendation 7)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: The Department of Homeland Security agreed with the recommendation and stated that Customs and Border Protection plans to analyze existing systems to determine which is best suited to track and document employee work during a government shutdown and will ensure that the chosen system is available should a future shutdown occur. When we confirm what actions CBP has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commissioner of CBP should develop internal controls to limit access to physical workspaces to appropriate employees during a government shutdown. (Recommendation 8)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: The Department of Homeland Security (DHS) agreed with the recommendation but stated that because Customs and Border Protection (CBP) does not have systems capable of efficiently restoring physical access for furloughed employees, it would have to reinstate employee access individually and the cost would be substantial. DHS stated that CBP plans to update procedures to ensure more comprehensive workspace access guidance for furloughed employees. We continue to believe that physical access controls are important during shutdowns in order to prevent misuse of government resources. We encourage CBP to improve their systems to be able to efficiently implement such controls and will monitor CBP's efforts going forward.

Recommendation: The Commissioner of Internal Revenue should develop internal controls to limit access to physical workspaces to appropriate employees during a government shutdown. (Recommendation 9)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: The Internal Revenue Service disagreed with this recommendation. IRS stated that it believes that it has effective controls in place to manage physical workspace access during a shutdown. In addition, IRS said that it believes that implementing additional access controls do not justify the corresponding resource investments. We continue to believe that IRS should improve its access controls, which currently rely on managers and furlough letters to communicate limits on workspace access. While we recognize the costs of increased access controls, government shutdowns are unique events that require additional access controls in order to prevent potential misuse of government resources and will monitor IRS's efforts to address it.

Recommendation: The U.S. Trade Representative should develop internal controls to limit access to physical workspaces to appropriate employees during a government shutdown. (Recommendation 10)

Agency: Executive Office of the President: Office of the United States Trade Representative
Status: Open

Comments: The Office of the U.S. Trade Representative (USTR) neither agreed nor disagreed with the recommendation. USTR stated that it has made the Executive Office of the President (EOP) aware of the recommendations on developing controls for physical workspace access during a shutdown. We will continue to monitor USTR's efforts to address this recommendation.

Recommendation: The Commissioner of CBP should develop internal controls to limit access to virtual workspaces to appropriate employees during a government shutdown. (Recommendation 11)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: The Department of Homeland Security (DHS) agreed with the recommendation. DHS stated that Customs and Border Protection (CBP) believes that furloughed employees must be able to passively monitor the status of the government shutdown and access important agency communications using DHS-issued electronic devices. Additionally, disabling and reactivating thousands of employee user accounts during a shutdown posed a significant burden. DHS said that CBP plans to update shutdown procedures to clarify allowed use of DHS-issued electronic devices by furloughed employees. We agree that CBP should update procedures on workspace access as suggested, and continue to believe that virtual access controls are important during shutdowns in order to prevent misuse of government resources. We encourage CBP to improve their systems to be able to efficiently implement such controls and will monitor CBP's progress going forward.

Recommendation: The Commissioner of Internal Revenue should develop internal controls to limit access to virtual workspaces to appropriate employees during a government shutdown. (Recommendation 12)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: The Internal Revenue Service disagreed with this recommendation. IRS stated that it believes that it has effective controls in place to manage virtual workspace access during a shutdown. In addition, IRS said that it believes that implementing additional access controls do not justify the corresponding resource investments. We continue to believe that IRS should improve its access controls, which currently rely on managers and furlough letters to communicate limits on workspace access. While we recognize the costs of increased access controls, government shutdowns are unique events that require additional access controls in order to prevent potential misuse of government resources and will monitor IRS's efforts to address it.

Recommendation: The Under Secretary for International Trade should develop internal controls to limit access to virtual workspaces to appropriate employees during a government shutdown. (Recommendation 13)

Agency: Department of Commerce: International Trade Administration
Status: Open

Comments: The Department of Commerce agreed with the recommendation and stated that the International Trade Administration (ITA) has established and documented internal controls to limit virtual workspace access to excepted or exempt employees during a government shutdown. When we confirm what actions ITA has taken in response to this recommendation, we will provide updated information.

Recommendation: The U.S. Trade Representative should, in consultation with EOP, develop internal controls to limit access to virtual workspaces to appropriate employees during a government shutdown. (Recommendation 14)

Agency: Executive Office of the President: Office of the United States Trade Representative
Status: Open

Comments: The Office of the U.S. Trade Representative (USTR) neither agreed nor disagreed with the recommendation. USTR stated that it has made the Executive Office of the President (EOP) aware of the recommendations on developing controls for virtual workspace access during a shutdown. We will continue to monitor USTR's efforts to address this recommendation.

Recommendation: We recommend that the Commissioner of Internal Revenue update and implement policies and procedures for developing a courier contingency plan to prohibit managers responsible for overseeing the preparation of taxpayer receipts for deposits from also transporting them to financial institutions. (Recommendation 20-01)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: The IRS agreed with this recommendation and stated that the Wage and Investment organization will update the Courier Contingency Plan polices and procedures to provide for appropriate segregation of duties or other curative measures.

Recommendation: We recommend that the Commissioner of Internal Revenue establish and implement manual refund procedures to direct (1) initiators to document (e.g., record on the taxpayers' accounts or annotate on the related manual refund forms) the justification for bypassing the IAT tool warning related to potential duplicate tax refunds on taxpayers' accounts and (2) managers to monitor whether such warnings were bypassed and review the justifications for reasonableness prior to approving manual refund forms. (Recommendation 20-02)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: The IRS agreed with this recommendation and stated that the Wage and Investment organization agrees that actions need to occur to address duplicate tax refund conditions through improved manual refund procedures to require (1) initiator to document the justification for bypassing the Integrated Automated Technologies (IAT) tool warning related to potential duplicate tax refunds on taxpayers' accounts and (2) managers to review the justification documented for bypassing the IAT tool warning for reasonableness prior to approving manual refund forms. However, IRS also stated that it was unable to commit to implementing a corrective action plan at this time due to budgetary constraints on system enhancements.

Recommendation: We recommend that the Commissioner of Internal Revenue establish and implement actions to provide reasonable assurance that business units record the acceptance of goods and services in a timely manner in accordance with IRS policies and procedures. (Recommendation 20-03)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: The IRS agreed with this recommendation and stated that the CFO organization will determine the reasons for business unit(s) non-compliance with established policies and procedures related to timely recording of receipts and acceptance of goods and services and, based on this evaluation, develop an action plan that once completed will provide additional tools to aid the business units in reasonably ensuring compliance with established requirements.

Recommendation: We recommend that the Commissioner of Internal Revenue establish and implement actions to provide reasonable assurance that the future lease payment amounts for non-cancellable operating leases are calculated correctly. (Recommendation 20-04)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: The IRS agreed with this recommendation and stated that the CFO organization will update policies and procedures to include additional instructions needed to calculate the future lease payments due on the non-cancelable leases with terms greater than one year and will also create an automated calculation to determine the number of remaining months of lease payments.

Recommendation: The Secretary of Commerce should ensure that the Director of the Census Bureau develops and obtains management approval of mitigation and contingency plans for all risks that require them. (Recommendation 1)

Agency: Department of Commerce
Status: Open
Priority recommendation

Comments: As of May 2020, the Bureau's program risk registers included a clear indication of the status of mitigation plans; however, the Bureau's portfolio risk register did not, without which there was not a clear indication of which portfolio risk mitigation plans had been approved by management. As of August 2020, the Bureau's portfolio risk register also included a clear indication of mitigation plan status. At that time, we reviewed the Bureau's program and portfolio risk registers to determine whether the Bureau had developed and obtained management approval of mitigation and contingency plans for all risks that required them. We found six risks that met the Bureau's requirements for a contingency plan but did not have an approved contingency plan in place. We notified the Bureau and asked them to ensure that approved mitigation and contingency plans were in place for all risks that required them. We will continue to monitor the Bureau's actions to implement this recommendation.

Recommendation: The Secretary of Commerce should ensure that the Director of the Census Bureau updates the Bureau's decennial risk management plan to require that risk mitigation and contingency plans, including the risk register descriptions and separate plans, have the seven key attributes for helping to ensure they contain the information needed to manage risk. (Recommendation 4)

Agency: Department of Commerce
Status: Open

Comments: In July 2020, the Bureau updated its decennial risk management plan and, in doing so, implemented this recommendation for six of the seven key attributes we identified. The missing attribute was monitoring plans: a description in each mitigation and contingency plan of how the agency will monitor the risk response-with performance measures and milestones, where appropriate-to help track whether the plan is working as intended. According to Bureau officials, rather than requiring this attribute, they instead noted it as a lesson learned for the 2030 Census and documented it in their knowledge management tool. In August 2020, we requested documentation of these actions. Once received, we will assess whether these actions suffice to close the recommendation.

Recommendation: The NASA Associate Administrator for Human Exploration and Operations should direct the Commercial Crew Program to include the results of its schedule risk analysis in its mandatory quarterly reports to Congress. (Recommendation 1)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: NASA did not concur with our recommendation that the Commercial Crew Program should include the results of its schedule analysis in its quarterly reports to Congress. In July 2019, NASA reaffirmed that it will be working to ensure that the contractors' schedules and the program's internal assessments sync up as the program gets closer to launch, which is the process it used in March 2019 leading up to SpaceX's uncrewed test flight. GAO continues to believe that the recommendation is valid because the program's schedule risk analysis would provide Congress with valuable insight into potential delays, which are likely.

Recommendation: The NASA Administrator should develop and maintain a contingency plan for ensuring a presence on the ISS until a Commercial Crew Program contractor is certified. (Recommendation 2)

Agency: National Aeronautics and Space Administration
Status: Open
Priority recommendation

Comments: NASA agreed with this recommendation. NASA stated that it is in discussions with Russia to obtain additional seats on its Soyuz spacecraft for NASA crew as a contingency plan. NASA is also providing Extra-Vehicular Activity and robotics training for a subset of cosmonauts to support U.S. Operating Segment operations, and looking at a possible extension of the duration of the Space X Demonstration 2 crewed test flight. In November 2019, NASA reported that it completed its actions for this recommendation. However, while NASA is working on potential solutions, there is no contingency plan in place. To fully implement this recommendation, NASA needs to provide documentation of its contingency plan.

Recommendation: The NASA Administrator should direct the Chief of Safety and Mission Assurance, the NASA Associate Administrator for Human Exploration and Operations, the Commercial Crew Program Manager, and the Commercial Crew Program Contracting Officer to collectively determine and document before the agency certification review how the agency will determine its risk tolerance level with respect to loss of crew. (Recommendation 3)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: NASA partially concurred with our recommendation, stating it documented the agency's risk tolerance level with respect to loss of crew for the program in its May 2011 safety memo. NASA stated that ultimately the Commercial Crew Program is accountable for ensuring that the contractors' systems meet the loss of crew value of 1 in 270. In July 2019, the Commercial Crew Program noted that it will continue to determine its risk tolerance with respect to loss of crew and formally document its decisions at program management meetings. We continue to believe that, before agency certification, the key parties must collectively determine how the agency will determine its risk tolerance with response to loss of crew, as the risk tolerance for the loss of crew requirement depends on which entity is presenting the results of its analysis. We believe this approach will reduce confusion and increase transparency. In late September 2020, GAO received additional information from NASA on actions taken to implement this recommendation. We are currently assessing this information.

Recommendation: After completing the agency certification review, NASA's Chief Engineer and Chief of Safety and Mission Assurance, with support from the NASA Associate Administrator for Human Exploration and Operations and the Commercial Crew Program Manager, should document lessons learned related to loss of crew as a safety threshold for future crewed spaceflight missions, given the complexity of the metric. (Recommendation 4)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: NASA concurred with our recommendation to document lessons learned related to the loss of crew requirement. In June 2020, NASA told us that they expect to take action to close this recommendation by the end of May 2021.

Recommendation: To assist CISOs in carrying out their responsibilities, the Director of OMB should issue guidance for agencies' implementation of the FISMA 2014 requirements to ensure that (1) senior agency officials carry out information security responsibilities and (2) agency personnel are held accountable for complying with the agency-wide information security program. This guidance should clarify the role of the agency CISO with respect to these requirements, as well as implementing the other elements of an agency-wide information security program, taking into account the challenges identified in this report.

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: The Office of Management and Budget (OMB) partially concurred with this recommendation, but does not intend to directly issue guidance as recommended. As of June 2020, OMB has not provided sufficient evidence that it has implemented this recommendation. We will continue to monitor OMB's implementation of this recommendation.

Recommendation: To ensure that the role of the SISO is defined in department policy in accordance with FISMA 2014, the Secretary of Defense should define the SISO's role in department policy for ensuring that the department has procedures for incident detection, response, and reporting.

Agency: Department of Defense
Status: Open

Comments: In response to our report, DOD partially concurred with our recommendation; however, DOD subsequently concurred with the recommendation and is taking steps to implement it. The department stated that the issuance of an updated Cyber Incident Handling guidance is on track to be completed and coordinated in the third quarter of fiscal year 2018. As of June 2020, it has not yet provided sufficient evidence that it has implemented the recommendation. When we confirm what actions DOD has taken, we will provide updated information.

Recommendation: To ensure that the role of the CISO is defined in department policy in accordance with FISMA 2014, the Secretary of State should define the CISO's role in department policy for ensuring that the department has procedures for incident detection, response, and reporting.

Agency: Department of State
Status: Open

Comments: The Department of State (State) concurred with this recommendation. However, as of June 2020, the department has not yet provided sufficient evidence that it has implemented the recommendation. When we receive additional evidence from State, we will review it to determine whether the department has addressed the recommendation.

Recommendation: To ensure that the role of the CISO is defined in department policy in accordance with FISMA 2014, the Secretary of Transportation should define the CISO's role in department policy for ensuring that subordinate security plans are documented for the department's information systems.

Agency: Department of Transportation
Status: Open

Comments: The Department of Transportation (DOT) concurred with the recommendation and is currently updating its Cybersecurity Policy. The Department plans to be complete by June 29, 2019. As of June 2020, the department has not yet provided sufficient evidence that it has implemented the recommendation. Upon receiving additional evidence from DOT, we will review it to determine whether the department has addressed the recommendation.

Recommendation: To ensure that the role of the CISO is defined in department policy in accordance with FISMA 2014, the Secretary of Transportation should define the CISO's role in department policy for ensuring that security controls are tested periodically.

Agency: Department of Transportation
Status: Open

Comments: The Department of Transportation (DOT) concurred with the recommendation and is currently updating its Cybersecurity Policy. The Department plans to be complete by June 29, 2019. As of June 2020, the department has not yet provided sufficient evidence that it has implemented the recommendation. Upon receiving additional evidence from DOT, we will review it to determine whether the department has addressed the recommendation.

Recommendation: To ensure that the role of the SAISO is defined in agency policy in accordance with FISMA 2014, the Administrator of the National Aeronautics and Space Administration should define the SAISO's role in agency policy for oversight of security for information systems that are operated by contractors on the agency's behalf.

Agency: National Aeronautics and Space Administration
Status: Open

Comments: The National Aeronautics and Space Administration (NASA) concurred with our recommendation. As of June 2020, NASA stated that the agency is working to update the relevant policy to address this recommendation, but the update is taking longer than expected; NASA expects the policy to be updated and the review process to be completed by November 30, 2020. We will examine the evidence when NASA provides it.

Recommendation: To avoid serious disruptions to the Treasury market and to help inform the fiscal policy debate in a timely way, Congress should consider alternative approaches that better link decisions about the debt limit with decisions about spending and revenue at the time those decisions are made such as those described in this report.

Agency: Congress
Status: Open

Comments: The Bipartisan Budget Act of 2019 temporarily suspended the debt limit through July 31, 2021. This will allow the Treasury to continue to borrow to meet the funding needs of the federal government. However, the Act did not explicitly link decisions about the debt limit to legislation that is expected to increase borrowing needs or debate over specific tax or spending proposals and their effect on debt. As of June 2020, we confirmed that no further legislative action has been taken since our last update. We will continue to monitor legislation enacting future debt limit increases to see if it addresses our matter for congressional consideration.

Recommendation: However, if Congress chooses to continue to temporarily suspend the debt limit, it should consider providing Treasury with more flexibility in the level of Treasury's operating cash so that it is based not on the level that it was just prior to a suspension period, but on the federal government's immediate borrowing needs. This would minimize some of the disruptions to Treasury's normal cash management and debt issuance.

Agency: Congress
Status: Open

Comments: The Bipartisan Budget Act of 2019 temporarily suspended the debt limit through July 31, 2021, but did not provide Treasury with more flexibility in the level of Treasury's operating cash at the end of the suspension period. As result, absent future action, Treasury is expected to reduce its cash balance to approximately the level it was at on the date the suspension was enacted as it has following previous debt limit suspensions, regardless of cyclical or other cash management needs. We will continue to monitor legislation enacting future debt limit increases to see if it addresses our matter for congressional consideration. As of June 2020, no relevant legislation has been enacted.