Recommendation: The Administrator of the General Services Administration, in coordination with the Secretary of Homeland Security, should take steps to consult with respective sector partner(s), such as the Coordinating Council and NIST, as appropriate, to collect and report sector-wide improvements from use of the framework across its critical infrastructure sector using existing initiatives. (Recommendation 6)

Agency: General Services Administration: Office of the Administrator
Status: Open

Comments: In April 2020, the General Services Administration (GSA), in coordination with its co-SSA, the Department of Homeland Security (DHS), provided documentation demonstrating that it had initiated steps to collect and report on sector-wide improvements from use of the NIST Cybersecurity Framework across its critical infrastructure sector. Specifically, the agencies from the government sector had submitted their risk management reports to DHS and OMB that described agencies' action plans to implement the framework, as required under Executive Order 13800 and evaluated the agencies against the five functions of the NIST Cybersecurity Framework: Identify, Detect, Protect, Respond, and Recover. The risk management reports are included as part of OMB's FISMA Annual Report to Congress. According to OMB's FISMA Annual Report to Congress, OMB and DHS determined that 71 of 96 agencies (74 percent) have cybersecurity programs that are either at risk or high risk. As a result, improvements were identified in the form of four core actions in the Federal Cybersecurity Risk Determination Report and Action Plan, which include: (1) Implementing the Cyber Threat Framework to increase cybersecurity threat awareness among Federal agencies, (2) Standardize IT and cybersecurity capabilities, (3) Consolidate agency SOCs to improve incident detection and response capabilities, and (4) Drive accountability across agencies through improved governance processes, recurring risk assessments, and OMB's engagements with agency leadership. We are waiting for additional information from GSA and DHS on the status of the four core actions.

Recommendation: The Administrator of GSA should work with the Secretary of VA to develop a memorandum of understanding outlining the roles and responsibilities of GSA and NAC for collaborating under GSA's delegation of authority to VA for the healthcare-related Federal Supply Schedules, including the processes through which the two organizations will coordinate and share useful tools and practices. (Recommendation 6)

Agency: General Services Administration: Office of the Administrator
Status: Open

Comments: GSA concurred with this recommendation. In August 2020, GSA stated that it has met with VA and agreed to develop an interagency memorandum of understanding by December 2020.

Recommendation: The Administrator of GSA should take steps to document its delegation of authority for the healthcare-related Federal Supply Schedules to VA. (Recommendation 8)

Agency: General Services Administration: Office of the Administrator
Status: Open

Comments: GSA concurred with this recommendation. In August 2020, GSA stated that it is working to develop updated delegation of authority and will provide further details by December 2020.

Recommendation: The Administrator of GSA should direct the Office of Government-wide Policy (1) to incorporate into its guidance approaches or practices that agencies could use to assess utilization of and the ongoing need for property—approaches such as recommendations for periodic justifications, data analytics, and utilization reviews—and (2) to develop a plan and timelines for communicating the guidance to agencies government-wide. (Recommendation 1)

Agency: General Services Administration: Office of the Administrator
Status: Open

Comments: As of April 2020, GSA indicated in its 180-day letter that it had published on its website draft guidance in response to the Federal Personal Property Management Act of 2018. In addition, GSA identified several actions it planned to take in the coming months, such as publishing a comprehensive plan and timelines to address GAO's recommendation, publishing a request for information in the Federal Register to seek comments and suggestions, and engaging additional subject matter experts and related associations and standards group to improve upon the draft guidance. GAO will continue to monitor GSA's efforts to implement this recommendation.

Recommendation: The GSA Administrator should direct the Office of Government-wide Policy to revise the Personal Property Reporting Tool by updating the authorities agencies can select. (Recommendation 6)

Agency: General Services Administration: Office of the Administrator
Status: Open

Comments: As of February 2020, GSA indicated in its 180-day letter that it concurred with the recommendation, and has taken steps to revise the Personal Property Reporting Tool (tool). GSA has added relevant authorities to the tool as recently as July 2019, and will continue to contact agencies to ensure relevant authorities are included in the tool. GSA is also evaluating technical updates to the tool to ensure that reporting agencies select an appropriate authority when reporting personal property. GSA plans to complete these actions by July 31, 2020, and inform agencies of these changes in their guidance by the end of fiscal year 2020. GAO will continue to monitor GSA's efforts to implement the recommendation.

Recommendation: The GSA Administrator should direct the Office of Government-wide Policy to document in what circumstances excess property loaned to non-federal recipients should be reported and what property GSA is reporting on behalf of agencies, for example, by updating GSA guidance. (Recommendation 7)

Agency: General Services Administration: Office of the Administrator
Status: Open

Comments: As of February 2020, GSA indicated in its 180-day letter that it concurred with the recommendation. GSA will better communicate with agencies to better understand the confusion of reporting on loaned excess property, as reporting requirements are in statute, regulations, and guidance. GSA also plans to review and update by July 31, 2020, relevant regulations and guidance in this area including Federal Management Regulation Bulletin B-27, "Annual Executive Agency Reports on Excess and Exchange/Sale Personal Property." GAO will continue to monitor GSA's efforts to implement this recommendation.

Recommendation: The Administrator of the General Services Administration should expand its outreach as appropriate to obtain feedback from lessors that are representative of its entire lease portfolio. (Recommendation 1)

Agency: General Services Administration: Office of the Administrator
Status: Open

Comments: GSA agreed with this recommendation. In its 180-day letter to the congressional clients dated March 25, 2020, GSA stated that it would provide additional documentation of invitations to its industry outreach efforts. We will review this information when it is available.

Recommendation: The Administrator of the General Services Administration should, for future outreach efforts, document and assess lessors' feedback about the leasing process. (Recommendation 2)

Agency: General Services Administration: Office of the Administrator
Status: Open

Comments: GSA agreed with this recommendation. In its 180-day letter to the congressional clients dated March 25, 2020, GSA stated that it would document and assess the feedback received from lessors during its outreach efforts. We will review this information when it is available.

Recommendation: The Administrator of the General Services Administration should evaluate whether the simplified lease model is achieving its intended results. (Recommendation 3)

Agency: General Services Administration: Office of the Administrator
Status: Open

Comments: GSA agreed with this recommendation. In its 180-day letter to the congressional clients dated March 25, 2020, GSA stated that it would evaluate its simplified lease model and provide documentation of the evaluation's methodology, findings, and recommendations. We will review information related to this evaluation when it is available.

Recommendation: The Administrator of the GSA should report for Congress and the public—for example, on GSA's prospectus website—the extent to which completed projects' construction costs and schedules were rebaselined and final construction costs, to include any additional funding tenant agencies may have provided to GSA for changes. (Recommendation 1)

Agency: General Services Administration: Office of the Administrator
Status: Open

Comments: The General Services Administration (GSA) partially concurred with this recommendation. On February 6, 2020, GSA stated that it will publish summary schedule and budget results for completed projects on GSA's public-accessible prospectus website. GAO will continue to monitor GSA's actions related to this recommendation and update information accordingly.

Recommendation: The Administrator of the GSA should update its 2005 Commissioning Guide—or replace it with appropriate industry-recognized standards and guidance—to be consistent with GSA's current design standards and industry practices. (Recommendation 2)

Agency: General Services Administration: Office of the Administrator
Status: Open

Comments: GSA concurred with this recommendation, and on February 6, 2020, stated that GSA will publish updated Commissioning Guidance. GAO will continue to monitor GSA's actions related to this recommendation and update information accordingly.

Recommendation: The Administrator of the GSA should identify and communicate—such as through policy, guidance, or other appropriate mechanism—(a) when and how Post Occupancy Evaluations should be conducted for completed projects considering resource constraints and (b) how recommendations or lessons learned from those evaluations are effectively communicated to future project teams. (Recommendation 3)

Agency: General Services Administration: Office of the Administrator
Status: Open

Comments: GSA concurred with this recommendation, and on February 6, 2020, stated that GSA will publish program guidance on how and when Post Occupancy Evaluations are conducted and communicate recommendations or lessons learned to future project teams. GAO will continue to monitor GSA's actions related to this recommendation and update information accordingly.

Recommendation: The Administrator of GSA should direct the Director of FedRAMP to clarify guidance to agencies and cloud service providers on program requirements and responsibilities. (Recommendation 2)

Agency: General Services Administration: Office of the Administrator
Status: Open

Comments: As of September 2020, GSA has not provided evidence to close this recommendation. We will continue to monitor the agency's progress and update the recommendation's status when GSA provides its corrective actions.

Recommendation: The Administrator of GSA should direct the Director of FedRAMP to improve the program's continuous monitoring process by allowing more automated capabilities, including for agencies to review documentation. (Recommendation 3)

Agency: General Services Administration: Office of the Administrator
Status: Open

Comments: As of September 2020, GSA has not provided evidence to close this recommendation. We will continue to monitor the agency's progress and update the recommendation's status when GSA provides its corrective actions.

Recommendation: The Administrator of GSA should update security plans for selected systems to include the description of security controls and reviews and approvals plan. (Recommendation 4)

Agency: General Services Administration: Office of the Administrator
Status: Open

Comments: As of September 2020, GSA has not provided evidence to close this recommendation. We will continue to monitor the agency's progress and update the recommendation's status when GSA provides its corrective actions.

Recommendation: The Administrator of GSA should update the security assessment report for the selected system to identify the summarized results of control effectiveness tests. (Recommendation 5)

Agency: General Services Administration: Office of the Administrator
Status: Open

Comments: As of September 2020, GSA has not provided evidence to close this recommendation. We will continue to monitor the agency's progress and update the recommendation's status when GSA provides its corrective actions.

Recommendation: The Administrator of GSA should update the list of corrective actions for selected systems to identify the responsible office and estimated funding required and anticipated source of funding. (Recommendation 6)

Agency: General Services Administration: Office of the Administrator
Status: Open

Comments: As of September 2020, GSA has not provided evidence to close this recommendation. We will continue to monitor the agency's progress and update the recommendation's status when GSA provides its corrective actions.

Recommendation: The Administrator of GSA should develop guidance requiring that cloud service authorization letters be provided to the FedRAMP program management office. (Recommendation 7)

Agency: General Services Administration: Office of the Administrator
Status: Open

Comments: As of September 2020, GSA has not provided evidence to close this recommendation. We will continue to monitor the agency's progress and update the recommendation's status when GSA provides its corrective actions.

Recommendation: The Administrator of the General Services Administration (GSA), in coordination with the Director of the Office of Management and Budget, should ensure that the average cost per square foot performance measure for GSA-managed space is calculated using actual cost information. (Recommendation 1)

Agency: General Services Administration: Office of the Administrator
Status: Open

Comments: GSA concurred with this recommendation and has developed an action plan to implement it. In January 2020, GSA officials told us that GSA will change the method for calculating the average cost per square foot performance measure by now using the actual rent agencies paid to GSA in the calculation. GSA officials also stated that GSA will post this information annually to performance.gov. We will continue to monitor GSA's implementation of these efforts.