Recommendation: The Secretary of Agriculture should ensure that the agency fully implements the category management activity to reduce unaligned IT spending, by performing an analysis of alternatives to justify the agency's unaligned IT contracts. (Recommendation 1)

Agency: Department of Agriculture
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Agriculture should ensure that the agency fully implements the category management activity to develop and implement vendor management strategies, by implementing the strategies it had developed. (Recommendation 2)

Agency: Department of Agriculture
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Agriculture should ensure that the agency fully implements the category management activity to share prices paid, terms, and conditions for purchased IT goods and services. (Recommendation 3)

Agency: Department of Agriculture
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Agriculture should ensure that the agency finishes implementing its process to analyze IT contract data. (Recommendation 4)

Agency: Department of Agriculture
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Agriculture should ensure that the agency develops and implements strategies to address duplication identified through the use of spend analyses. (Recommendation 5)

Agency: Department of Agriculture
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Defense should ensure that the agency fully implements the category management activity to reduce unaligned IT spending. (Recommendation 6)

Agency: Department of Defense
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Defense should ensure that the agency documents its annual spend analyses used to identify opportunities to reduce IT contract duplication. (Recommendation 7)

Agency: Department of Defense
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Health and Human Services should ensure that the agency uses a spend analysis on a regular basis to identify IT contract duplication. (Recommendation 8)

Agency: Department of Health and Human Services
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Attorney General should ensure that the Department of Justice fully implements the category management activity to reduce unaligned IT spending, by performing an analysis of alternatives to justify the agency's unaligned IT contracts. (Recommendation 9)

Agency: Department of Justice
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Attorney General should ensure that the Department of Justice fully implements the category management activity to share prices paid, terms and conditions for purchased IT goods and services. (Recommendation 10)

Agency: Department of Justice
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Attorney General should ensure that the Department of Justice fully implements the category management activity to engage the workforce in training regarding category management principles and practices, by tracking its workforce's attendance in the training. (Recommendation 11)

Agency: Department of Justice
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Attorney General should ensure that the Department of Justice uses a spend analysis to identify opportunities to reduce IT contract duplication. (Recommendation 12)

Agency: Department of Justice
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Attorney General should ensure that the Department of Justice develops and implements strategies to address duplication identified through the use of spend analyses. (Recommendation 13)

Agency: Department of Justice
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of State should ensure that the agency fully implements the category management activity to develop and implement vendor relationship management strategies, by executing its vendor management plan. (Recommendation 14)

Agency: Department of State
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Veterans Affairs should ensure that the agency fully implements the category management activity to develop processes and policies for implementing the agency's category management efforts. (Recommendation 15)

Agency: Department of Veterans Affairs
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Veterans Affairs should ensure that the agency fully implements the category management activity to reduce unaligned IT spending, by performing an analysis of alternatives to justify the agency's unaligned IT contracts. (Recommendation 16)

Agency: Department of Veterans Affairs
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Veterans Affairs should ensure that the agency fully implements the category management activity to develop and implement vendor relationship management strategies. (Recommendation 17)

Agency: Department of Veterans Affairs
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Veterans Affairs should ensure that the agency fully implements the category management activity to share prices paid, terms and conditions for purchased IT goods and services. (Recommendation 18)

Agency: Department of Veterans Affairs
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Veterans Affairs should ensure that the agency uses a spend analysis to identify opportunities to reduce IT contract duplication. (Recommendation 19)

Agency: Department of Veterans Affairs
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Veterans Affairs should ensure that the agency develops and implements strategies to address duplication identified through the use of spend analyses. (Recommendation 20)

Agency: Department of Veterans Affairs
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Housing and Urban Development should direct the Chief Information Officer, Senior Agency Official for Privacy, and Chief Privacy Officer to review and revise department-level security and privacy policies to ensure that they require the implementation of risk-based security and privacy controls for external entities that process, store, or share sensitive information with HUD. (Recommendation 1)

Agency: Department of Housing and Urban Development
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Housing and Urban Development should direct the Chief Information Officer, Senior Agency Official for Privacy, and Chief Privacy Officer to review and revise department-level security and privacy policies to ensure that they require independent assessments of external entities that process, store, or share sensitive information with HUD to ensure controls are implemented. (Recommendation 2)

Agency: Department of Housing and Urban Development
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Housing and Urban Development should direct the Chief Information Officer, Senior Agency Official for Privacy, and Chief Privacy Officer to review and revise department-level security and privacy policies to ensure that they require identifying and tracking corrective action needed by external entities that process, store, or share sensitive information with HUD. (Recommendation 3)

Agency: Department of Housing and Urban Development
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Housing and Urban Development should direct the Chief Information Officer, Senior Agency Official for Privacy, and Chief Privacy Officer to review and revise department-level security and privacy policies to ensure that they require monitoring of progress in implementing controls/corrective actions by external entities that process, store, or share sensitive information with HUD. (Recommendation 4)

Agency: Department of Housing and Urban Development
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Housing and Urban Development should direct the Chief Information Officer, Senior Agency Official for Privacy, and Chief Privacy Officer to develop and maintain a comprehensive systems inventory that incorporates sufficient, reliable information about the external entities with which HUD program information is shared and the extent to which each external entity has access to PII and other sensitive information. (Recommendation 5)

Agency: Department of Housing and Urban Development
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of ORR should clarify in its grant announcements the information and supporting documentation applicants are required to provide in their grant applications with respect to their state licensing status, eligibility, and allegations and concerns. (Recommendation 1).

Agency: Department of Health and Human Services: Administration for Children and Families: Office of Refugee Resettlement
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of ORR should take steps to develop, and ensure that officials reviewing grant applications implement, a process to verify the accuracy and completeness of information reported by grant applicants on state licensing status, eligibility, allegations and concerns. (Recommendation 2).

Agency: Department of Health and Human Services: Administration for Children and Families: Office of Refugee Resettlement
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of ORR should ensure that the grant review process includes a documented review of applicants' past performance on ORR grants for those that have previously received grants to care for unaccompanied children. This could include, for example, a systematic review of previous quarterly and annual performance reports and a review of corrective actions issued by all ORR monitoring staff to all ORR-funded facilities previously operated by the applicant. (Recommendation 3).

Agency: Department of Health and Human Services: Administration for Children and Families: Office of Refugee Resettlement
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of ORR should clarify in its instructions to grantees the information they are required to report on state licensing citations in their quarterly performance reports. (Recommendation 4).

Agency: Department of Health and Human Services: Administration for Children and Families: Office of Refugee Resettlement
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of ORR should take steps, such as through guidance or training, to ensure that project officers clearly understand the requirement that grantees report state licensing citations at any of their facilities within 24 hours and include state licensing citations in their quarterly performance reports. (Recommendation 5).

Agency: Department of Health and Human Services: Administration for Children and Families: Office of Refugee Resettlement
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of ORR should work with state agencies that license ORR-funded facilities to develop a plan for mutual information sharing, including processes for ORR outreach to states during the grant application review process and ongoing information sharing on ORR and state monitoring processes and identified deficiencies. (Recommendation 6).

Agency: Department of Health and Human Services: Administration for Children and Families: Office of Refugee Resettlement
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of ORR should ensure that ORR provides and maintains a current point of contact for each state agency that licenses ORR grantees to facilitate information sharing regarding ORR-funded facilities. (Recommendation 7).

Agency: Department of Health and Human Services: Administration for Children and Families: Office of Refugee Resettlement
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of ORR should develop a plan—including roles, responsibilities, and timeframes—to guide and focus ORR's efforts to meet its goals to:

• conduct an audit of each facility's compliance with ORR standards on preventing and responding to sexual assault, as required under the Interim Final Rule,
• conduct on-site monitoring visits to each facility at least every 2 years in accordance with ORR policy, and
• report any noncompliance to the facility within 30 days of the site visit, in accordance with ORR policy.

(Recommendation 8).

Agency: Department of Health and Human Services: Administration for Children and Families: Office of Refugee Resettlement
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of OMB should take steps to ensure that federal agencies implement its guidance on agency adherence to E.O. 13132 requirements, particularly related to designating a federalism official. (Recommendation 1)

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Under Secretary of Defense for Acquisition and Sustainment should establish procedures requiring the military departments to collect and share findings from their peer reviews of MDAP contracting approaches—including choice of contract type—such as by updating the existing online compendium of best practices and lessons learned as they complete their reviews.

Agency: Department of Defense
Status: Open

Comments: DOD agreed with this recommendation, but as of August 2020 has not taken any action to implement it.

Recommendation: The Secretary of State, in coordination with the Secretary of Energy, should commit to regularly scheduled, substantive briefings for the House Committee on Foreign Affairs and the Senate Committee on Foreign Relations on all initiatives and negotiations related to nuclear cooperation in order to enhance transparency and establish greater confidence with Congress on nuclear cooperation matters. (Recommendation 1)

Agency: Department of State
Status: Open

Comments: We will update this recommendation after receiving information from State regarding its plans to address it.

Recommendation: The TSA Administrator should update the BASE cybersecurity template to ensure it reflects cybersecurity key practices, including the Detect and Recover functions outlined in the NIST Cybersecurity Framework. (Recommendation 2)

Agency: Department of Homeland Security: Transportation Security Administration
Status: Open

Comments: TSA concurred with this recommendation and said it would take steps to implement it by updating the BASE Cybersecurity Security Action Item section to ensure it reflects the NIST Cybersecurity Framework Detect and Recover functions. When we confirm what actions TSA has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Homeland Security should direct the Director of ICE to develop a strategy for the TTU program to ensure that ICE has a plan to guide its efforts to effectively partner with existing TTUs, and to expand the program, where appropriate, into additional countries. (Recommendation 1)

Agency: Department of Homeland Security: Office of the Secretary
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Homeland Security should direct the Director of ICE to develop a performance monitoring framework for the TTU program that would enable the agency to systematically track program results and how effectively it is achieving the program's goals. (Recommendation 2)

Agency: Department of Homeland Security: Office of the Secretary
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of NIST should establish time frames for completing NIST's initiatives, to include the information security measurement program and the cybersecurity framework starter profile, to enable the identification of sector-wide improvements from using the framework in the protection of critical infrastructure from cyber threats. (Recommendation 1)

Agency: Department of Commerce: National Institute of Standards and Technology: Office of the Director
Status: Open

Comments: In written comments provided in July 2020, the Department of Commerce (Commerce) stated that it agreed with our recommendation. It noted that to further establish its Cybersecurity Measurement program, the National Institute of Standards and Technology (NIST) will document its Cybersecurity Measurement program's scope, objectives, and approach, including an inventory of existing measurement resources. Additionally, to further amplify small business awareness of cybersecurity, and of the Cybersecurity Framework, it noted that NIST will develop and publish two Cybersecurity Framework starter profiles tailored toward risk management of business processes important to small business owners. The expected completion date is September 2020.

Recommendation: The Secretary of Agriculture, in coordination with the Secretary of Health and Human Services, should take steps to consult with respective sector partner(s), such as the SCC, DHS, and NIST, as appropriate, to collect and report sector-wide improvements from use of the framework across its critical infrastructure sector using existing initiatives. (Recommendation 2)

Agency: Department of Agriculture
Status: Open

Comments: In written comments provided in April 2020, the United States Department of Agriculture (USDA) stated that it concurred with our recommendation. The department stated that it routinely shared framework guidance provided by the Department of Homeland Security and discussed the framework as part of its monthly Sector conference calls and biannual Sector Meetings. It also added that the department will continue to strengthen its coordination efforts.

Recommendation: The Secretary of Defense should take steps to consult with respective sector partner(s), such as the SCC, DHS, and NIST, as appropriate, to collect and report sector-wide improvements from use of the framework across its critical infrastructure sector using existing initiatives. (Recommendation 3)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open

Comments: In written comments provided in July 2020, the Department of Defense concurred with our recommendation. The department noted that it had developed processes and resources to help determine the type of framework adoption across the Defense Industrial Base. These include conducting assessments on the implementation of NIST Special Publication (SP) 800-171 , "Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations;" and releasing the Defense Industrial Base Implementation Guide for the NIST Cybersecurity Framework. However, the department has yet to report on sector-wide improvements using these processes and resources. Until it does so, its critical infrastructure sector may not fully understand the value of the framework to better protect its critical infrastructure from cyber threats. The expected completion dates are in September and November 2020.

Recommendation: The Secretary of Energy should take steps to consult with respective sector partner(s), such as the SCC, DHS, and NIST, as appropriate, to collect and report sector-wide improvements from use of the framework across its critical infrastructure sector using existing initiatives. (Recommendation 4)

Agency: Department of Energy: Office of the Secretary
Status: Open

Comments: In written comments provided in February 2020, the Department of Energy (DOE) stated that it partially agreed with our recommendation. It noted that DOE will coordinate with the Energy Sector to develop an understanding of sector-wide improvements from use of the framework. The expected completion date is December 2021.

Recommendation: The Administrator of the Environmental Protection Agency should take steps to consult with respective sector partner(s), such as the SCC, DHS, and NIST, as appropriate, to collect and report sector-wide improvements from use of the framework across its critical infrastructure sector using existing initiatives. (Recommendation 5)

Agency: Environmental Protection Agency
Status: Open

Comments: In written comments provided in July 2020, the Environmental Protection Agency (EPA) stated that it agreed with our recommendation. It noted that it will consult with the Water Sector Coordinating Council, the Department of Homeland Security, and the National Institute of Standards and Technology, as appropriate, to investigate options to collect and report sector-wide improvements, consistent with statutory requirements and the Sector's willingness to participate. However, the department did not provide a timeframe for completing these actions.

Recommendation: The Administrator of the General Services Administration, in coordination with the Secretary of Homeland Security, should take steps to consult with respective sector partner(s), such as the Coordinating Council and NIST, as appropriate, to collect and report sector-wide improvements from use of the framework across its critical infrastructure sector using existing initiatives. (Recommendation 6)

Agency: General Services Administration: Office of the Administrator
Status: Open

Comments: In April 2020, the General Services Administration (GSA), in coordination with its co-SSA, the Department of Homeland Security (DHS), provided documentation demonstrating that it had initiated steps to collect and report on sector-wide improvements from use of the NIST Cybersecurity Framework across its critical infrastructure sector. Specifically, the agencies from the government sector had submitted their risk management reports to DHS and OMB that described agencies' action plans to implement the framework, as required under Executive Order 13800 and evaluated the agencies against the five functions of the NIST Cybersecurity Framework: Identify, Detect, Protect, Respond, and Recover. The risk management reports are included as part of OMB's FISMA Annual Report to Congress. According to OMB's FISMA Annual Report to Congress, OMB and DHS determined that 71 of 96 agencies (74 percent) have cybersecurity programs that are either at risk or high risk. As a result, improvements were identified in the form of four core actions in the Federal Cybersecurity Risk Determination Report and Action Plan, which include: (1) Implementing the Cyber Threat Framework to increase cybersecurity threat awareness among Federal agencies, (2) Standardize IT and cybersecurity capabilities, (3) Consolidate agency SOCs to improve incident detection and response capabilities, and (4) Drive accountability across agencies through improved governance processes, recurring risk assessments, and OMB's engagements with agency leadership. We are waiting for additional information from GSA and DHS on the status of the four core actions.

Recommendation: The Secretary of Health and Human Services, in coordination with the Secretary of Agriculture, should take steps to consult with respective sector partner(s), such as the SCC, DHS, and NIST, as appropriate, to collect and report sector-wide improvements from use of the framework across its critical infrastructure sector using existing initiatives. (Recommendation 7)

Agency: Department of Health and Human Services: Office of the Secretary
Status: Open

Comments: In written comments provided in January 2020, the Department of Health and Human Services (HHS) stated that it concurred with our recommendation. The department noted that it would work with the appropriate entities to refine and communicate best practices to the sector.

Recommendation: The Secretary of Homeland Security should take steps to consult with respective sector partner(s), such as the SCC and NIST, as appropriate, to collect and report sector-wide improvements from use of the framework across its critical infrastructure sectors using existing initiatives. (Recommendation 8)

Agency: Department of Homeland Security: Office of the Secretary
Status: Open

Comments: In written comments provided in February 2020, the Department of Homeland Security (DHS) stated that it agreed with our recommendation. It noted that in coordination with the IT Sector Coordinating Council, the department recently issued a survey to small and mid-sized IT sector partners to better understand framework adoption and use within the IT sector. Once the results of the survey are received, DHS's Cybersecurity and Infrastructure Security Agency will determine the feasibility of issuing similar surveys to other sectors, and the potential timelines for completing sector-specific survey modifications, issuing surveys, compiling responses, and developing white papers on the status of framework adoption for each sector. The department expects completion of this work by December 31, 2021.

Recommendation: The Secretary of Transportation, in coordination with the Secretary of Homeland Security, should take steps to consult with respective sector partner(s) such as the SCC and NIST, as appropriate, to collect and report sector-wide improvements from use of the framework across its critical infrastructure sector using existing initiatives. (Recommendation 9)

Agency: Department of Transportation: Office of the Secretary
Status: Open

Comments: In written comments provided in April 2020, the Department of Transportation (DOT) stated that it concurred with our recommendation. It noted that the department (through the Office of the Secretary, Office of Intelligence, Security, and Emergency Response) and the Department of Homeland Security (through the Transportation Security Administration and United States Coast Guard) will coordinate as Co-Sector-Specific Agencies for the Transportation Systems Sector to finalize the development and distribution of a survey instrument to determine the level and type of framework adoption in the Sector. The department expects completion of this work by December 31, 2021.

Recommendation: The Secretary of the Treasury should take steps to consult with respective sector partner(s), such as the SCC, DHS, and NIST, as appropriate, to collect and report sector-wide improvements from use of the framework across its critical infrastructure sector using existing initiatives. (Recommendation 10)

Agency: Department of the Treasury: Office of the Secretary
Status: Open

Comments: In written comments provided in January 2020, the Department of the Treasury (Treasury) stated that it agreed with our recommendation. The department noted that it will assess using the identified initiatives and their viability for collecting and reporting sector-wide improvements from the use of the NIST Framework. The department did not provide a timeframe for completing these actions.

Recommendation: The Secretary of Homeland Security should identify the information about family members apprehended together that its components collectively need to process those family members and communicate that information to its components. (Recommendation 1)

Agency: Department of Homeland Security
Status: Open

Comments: According to DHS, in June 2020, DHS's Office of Immigration Statistics launched a Family Status Data Standards Community of Interest (COI) under the purview of the DHS Immigration Data Integration Initiative. In August 2020, DHS reported that the Family Status COI includes subject matter experts and data system managers from DHS components, the Department of Health and Human Services, and the Executive Office for Immigration Review. The COI's mandate includes drafting common DHS-wide and interagency data standards (common codes, common definitions, common formats) for all topics related to family status, including codes to identify the reasons for family separation, members apprehended together, and unaccompanied children. DHS expects to complete these actions by September 30, 2020. Identifying and communicating department-wide information needs with respect to family members who have been apprehended together should help provide DHS with greater assurance that its components are identifying all individuals who may be eligible for relief from removal from the United States based on their family relationships.

Recommendation: The Secretary of Homeland Security should ensure that, at the time of apprehension, CBP collects the information that DHS components collectively need to process family members apprehended together. (Recommendation 2)

Agency: Department of Homeland Security
Status: Open

Comments: In commenting on a draft of our report, DHS reported that its Office of Immigration Statistics (OIS) will work with relevant components and offices to ensure all required information is collected at the time of apprehension on the Form I-213 when processing family members apprehended together. As of August 2020, DHS reported that DHS OIS continues to work with relevant components and offices to ensure all required information is collected at the time of apprehension on Form I-213 when processing family members apprehended together. DHS expects to complete these actions by September 30, 2020. Collecting information about the relationships between family members apprehended together and documenting that information on the Form I-213 could help address fragmentation among DHS components and improve the information available to other agencies.

Recommendation: The Secretary of Homeland Security should ensure that CBP documents the information that DHS components collectively need to process family members apprehended together on the Form I-213. (Recommendation 3)

Agency: Department of Homeland Security
Status: Open

Comments: In commenting on a draft of our report, DHS reported that, upon implementation of the steps the department plans to take in response to our second recommendation, CBP will issue guidance to the field to ensure that CBP agents and officers document the information that DHS components collectively need to process family members. In August 2020, DHS reported that component agencies continue to collaborate to define the process of family members apprehended together, as will be reflected on CBP Form I-213. DHS estimates issuing this guidance by March 31, 2021. Collecting information about the relationships between family members apprehended together and documenting that information on the Form I-213 could help address fragmentation among DHS components and improve the information available to other agencies.immigration or other proceedings.

Recommendation: The Secretary of Homeland Security should evaluate options for developing a unique identifier shared across DHS components' data systems to link family members apprehended together. (Recommendation 4)

Agency: Department of Homeland Security
Status: Open

Comments: In commenting on a draft of our report, DHS reported that its Office of Immigration Statistics (OIS) plans to work with relevant components to develop a unique shared identifier linking family members apprehended together. According to DHS, DHS OIS launched the Family Status Community of Interest (COI) in June 2020, and the COI has since established a bi-weekly meeting schedule. The COI's initial focus is on standard codes describing the reasons for family separations. Upon completing the family separation reason standard, DHS reported that the COI will prioritize developing common codes to identify family members apprehended together. DHS estimates completing these actions by March 31, 2021. Evaluating options for developing a shared unique family member identifier across components that would allow each component access to certain information about family members apprehended together would help bridge the information gaps about family relationships between components caused by DHS's fragmented data systems.

Recommendation: The Under Secretary of Defense for Acquisition and Sustainment should ensure that the Deputy Assistant Secretary of Defense for Materiel Readiness create, share, and maintain a comprehensive and up-to-date list of all DOD sharing venues (i.e., working groups), including points of contact, related to depot maintenance. (Recommendation 1)

Agency: Department of Defense: Office of the Secretary of Defense: Office of the Under Secretary of Defense for Acquisition and Sustainment
Status: Open

Comments: DOD concurred with this recommendation. In response to our report, the Deputy Assistant Secretary of Defense for Materiel Readiness will create, share, and maintain a comprehensive and up-to-date list of all DOD sharing venues related to depot maintenance with associated points of contact. The estimated completion date is August 2020. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of the Army should ensure that Army Materiel Command reestablish and maintain organizations dedicated to sharing materiel best practices and lessons learned, as required by Army regulations. (Recommendation 2)

Agency: Department of Defense: Department of the Army: Office of the Secretary
Status: Open

Comments: DOD concurred with this recommendation. In response to our report, the Army is working to update policies to accurately reflect current activities for capturing, preserving, and distributing lessons learned and best practices throughout the organic industrial base. The estimated completion date is no later than December 2022. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of State should direct the Assistant Secretary of State for Democracy, Human Rights, and Labor to develop a mechanism to facilitate the active sharing of information about democracy assistance projects between DRL and relevant staff at embassies.

Agency: Department of State
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of FTA should develop a communication plan that will effectively share information with state transportation agencies and rural and tribal transit providers on coordination opportunities and leading coordination practices in an accessible and informative way. (Recommendation 1)

Agency: Department of Transportation: Federal Transit Administration
Status: Open

Comments: As of June 2020, FTA partially concurred with this recommendation. FTA noted that they will direct the National Rural Transit Assistance Program (NRTAP) to create a centralized, searchable library database cataloging all available resources that cover transportation coordination. This library database will include resources developed by FTA, other Coordinating Council on Access and Mobility (CCAM) members, and their technical assistance centers and initiatives, such as the Rural Opportunities to Use Transportation for Economic Success (ROUTES). FTA will complete these actions by August 31, 2021. We will review the database and other resources when they become available.

Recommendation: The Secretary of Defense should ensure that the Under Secretary of Defense for Acquisition and Sustainment develop and implement a plan to guide and coordinate efforts to implement the Wideband AOA recommendations to support timely, informed decisions on its next wideband satellite communications architecture. (Recommendation 1)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open

Comments: DOD concurred with our recommendation, but as of July 2020 is still working to implement its corrective action plan.

Recommendation: The Secretary of the Treasury should ensure that the Office of Foreign Assets Control provides its partner agencies more specific guidance regarding Kingpin Act–related expenditure data to improve the consistency of data submitted by these agencies. This could include, for example, how agencies account for expenditures that support Kingpin Act investigations when they are not the lead and for what types of activities resource expenditure data are required. (Recommendation 1)

Agency: Department of the Treasury: Office of the Secretary
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of the Treasury should ensure that the Office of Foreign Assets Control discloses information about limitations in the consistency and reliability of the agency expenditure data in its annual reports to Congress. (Recommendation 2)

Agency: Department of the Treasury: Office of the Secretary
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Transportation should direct the Administrator of FTA to identify and develop controls, such as methods to more easily identify transit expenses within applications submitted by larger entities, such as a city, county, or state government, to address the risk of duplicate funding. (Recommendation 1)

Agency: Department of Transportation
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Homeland Security should direct the Administrator of FEMA to identify and develop controls, such as methods to more easily identify transit expenses within applications submitted by larger entities such as a city, county, or state government, to address the risk of duplicate funding. (Recommendation 2)

Agency: Department of Homeland Security
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Attorney General should ensure that relevant DOJ offices update information about religious-based hate crimes on college campuses, practices to address them, and available DOJ resources to help colleges, campus law enforcement, and other stakeholders monitor and address these crimes. (Recommendation 1)

Agency: Department of Justice
Status: Open

Comments: DOJ has taken a number of steps to address this recommendation, including creating a campus-specific brochure that highlights the Community Relations Service's (CRS) hate crimes prevention and response resources for campus stakeholders. CRS is also in the process of developing a comprehensive guide with best practices for and tools to aid in the planning and implementation of Campus SPIRIT programs and a "spotlight" article for the Department's hate crimes website. DOJ noted that the Office of Community Oriented Policing Services (COPS) is developing hate crimes-specific training curriculum to provide technical assistance to law enforcement agencies, including those on campus. These are important steps to implement this recommendation, but because these resources are currently under development, this recommendation remains open.

Recommendation: The Attorney General should ensure that relevant DOJ offices share more information about available DOJ resources with colleges, campus law enforcement, and other stakeholders to help them monitor and address religious-based hate crimes on college campuses. (Recommendation 3)

Agency: Department of Justice
Status: Open

Comments: DOJ outlined steps it will take to work with campus-based law enforcement organizations such as the International Association of Campus Law Enforcement Administrators, the International Association of Chiefs of Police's University and College Police Section, and the National Association of Student Affairs Professionals. This includes participating in a conference in June 2020 and contacting the groups to increase awareness of its hate crimes website. GAO has requested documentation to demonstrate this outreach has occurred.

Recommendation: The Under Secretary for Benefits should systematically solicit and collect information on potential financial exploitation from VA's Pension Management Centers and other relevant VA components, including VA's Office of General Counsel, and assess this information to inform plans to address the potential exploitation of veterans receiving pension benefits. Such plans could also address the broader population of veterans with disabilities. (Recommendation 1)

Agency: Department of Veterans Affairs
Status: Open

Comments: As of July 2020, VA reported taking steps to share data on potential financial exploitation threats, but further opportunities to collect information exist. In February 2020, VA updated its policy manual, instructing Pension Management Centers to send copies of any OIG fraud referrals to VA's Fraud, Waste, and Abuse Incident Team. This team plans to use the information to identify trends in potential fraud, and recommend changes to VA laws, policies, or procedures, as needed. VA also plans to use this data to coordinate with other Government agencies and offices to help prevent financial exploitation. However, VA has not reported taking steps to collect information from its Office of General Counsel, Pension Management Centers, and other components on threats to veterans that do not result in fraud referrals to OIG. VA asserts that collecting additional information on suspicious activities that do not meet the level of fraud that can be referred to OIG would be inappropriate because VA lacks investigative authority. As GAO noted in its report, not all suspicious activity or complaints rise to the level of fraud. Collecting additional information could improve VA's ability to understand threats to veterans and develop responses, such as outreach, and could build on VA efforts already underway with its Fraud, Waste, and Abuse Incident Team.

Recommendation: The Under Secretary for Benefits should place additional warnings on paper and electronic documents, including on benefit applications, regarding fees which veterans cannot be charged. (Recommendation 2)

Agency: Department of Veterans Affairs
Status: Open

Comments: As of July 2020, VA reports that it plans to include warnings on its pension applications to clarify which fees attorneys and others may charge veterans for representing them when applying for pension benefits. According to VA, information collection requests were published in the Federal Register in June 2020, and VA expects its application forms to be revised by the end of calendar year 2020. GAO will close this recommendation once VA's applications are revised.

Recommendation: The Under Secretary for Benefits should explore the costs and benefits of additional steps claims processors could take to verify that the direct deposit information provided by claimants on their applications is for the appropriate party. (Recommendation 4)

Agency: Department of Veterans Affairs
Status: Open

Comments: In August 2020 VA reported that it is in the process of updating its application forms to require claimants to submit documentation, such as a voided check or deposit slip, when applying for pension benefits. GAO will close this recommendation once changes to these applications are complete.

Recommendation: The Deputy Secretary of Homeland Security should ensure that S&T take steps to more fully incorporate practices for developing milestones within DHS's budget preparation guidance, into the Surface Transportation Explosive Threat Detection program. (Recommendation 1)

Agency: Department of Homeland Security
Status: Open

Comments: In September 2019, GAO reported on a Department of Homeland Security's (DHS) Science and Technology Directorate (S&T) research and development (R&D) program to develop technologies to secure mass transit systems. DHS budget guidance requires S&T to develop results-oriented milestones to track program progress. GAO found that the S&T program's milestones did not clearly link to key activities described in program plans, and thus, were not results oriented. Therefore, we recommended that DHS develop milestones to track its progress developing the technologies that fully adhered to guidance. DHS concurred with our recommendation, and in February 2020, reported that S&T's Finance and Budget Division validated that milestones for the program were compliant with DHS guidance. GAO is currently working with DHS S&T to review documentation related to the validation process in order to close the recommendation..

Recommendation: The Administrator of TSA should develop a mechanism to more routinely and comprehensively share appropriate information on the performance of mass transit security technologies (such as the annual sensor catalog and security technology assessments) with mass transit operators and stakeholders until DHS completes work on a more permanent information sharing resource. (Recommendation 2)

Agency: Department of Homeland Security: Transportation Security Administration
Status: Open

Comments: In September 2019, GAO reported on key mechanisms that TSA uses to collaborate and share information on identifying capability gaps and security technologies with stakeholders, including mass transit operators. We found that TSA regularly assesses commercially available technologies, but does not routinely or comprehensively share its results with mass transit operators. Therefore, we recommended that TSA develop a mechanism to routinely and comprehensively share security technology information with mass transit operators. TSA concurred with our recommendation, and in February 2020, reported implementing two of three planned efforts to better share security technology information, including steps to increase distribution of its annual publication on security technologies and to provide regular updates on assessed technologies at routine stakeholder meetings. We will continue to monitor TSA efforts with a third effort in order to close this recommendation.

Recommendation: The Assistant Secretary of State for Consular Affairs should provide additional training or related resources to consular officers and locally employed staff on adjudicating E-2 visas, to cover topics that include the E-2 eligibility requirements and understanding business- and tax-related documents. (Recommendation 1)

Agency: Department of State
Status: Open

Comments: Department of State officials stated in January 2020 that the department plans to address this recommendation by increasing the frequency and specificity of E-2 content through webinars, workshops, and cables. The Department of State also plans to develop subject matter experts on business and tax related documents that can provide consultative services on an as-needed basis. As of July 2020, Department of State officials said that they had not yet implemented these actions. We will continue to monitor the status of this recommendation.

Recommendation: The Assistant Secretary of State for Consular Affairs should develop minimum standards for E-2 company registration programs, such as standards for how often companies are to be re-vetted. (Recommendation 2)

Agency: Department of State
Status: Open

Comments: Department of State officials stated in January 2020 that the department plans to address this recommendation by incorporating into policy a 5-year mandatory review of companies registered at any post using a company registration program. As of July 2020, Department of State officials said that they had not yet implemented these actions. We will continue to monitor the status of this recommendation.

Recommendation: The Assistant Secretary of State for Consular Affairs should develop and implement a process to ensure that posts maintain required E-2 visa application documentation. (Recommendation 3)

Agency: Department of State
Status: Open

Comments: Department of State officials stated in January 2020 that the department plans to communicate a reminder to posts abroad that there is a requirement to scan required E-2 documentation into each visa applicant's record. Department of State also plans to provide regular policy guidance to consular managers at posts that adjudicate E-2 visa applications. Further, Department of State officials stated in July 2020 that the department plans to incorporate the supplemental E-2 visa application (DS-156E) into the standard online application for all nonimmigrant visa applicants (DS-160). However, the officials stated that they experienced technical challenges in doing so, and was still working to resolve the challenges as of July 2020. We will continue to monitor the status of this recommendation as the Department of State works to address the technical challenges.

Recommendation: The Secretary of Labor should document internal policies and procedures for managing the IRA prohibited transaction exemption process. (Recommendation 1)

Agency: Department of Labor
Status: Open

Comments: DOL agreed with this recommendation and plans to create an internal procedure manual which will document the Office of Exemption Determinations' process for managing IRA prohibited transaction exemption applications. When we confirm what actions DOL has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Labor, in consultation with the Commissioner of Internal Revenue, should establish a formal means, such as a memorandum of understanding or other mechanism, to support and guide DOL's and IRS's collaborative efforts to oversee IRA prohibited transaction exemptions. (Recommendation 2)

Agency: Department of Labor
Status: Open

Comments: DOL agreed with this recommendation and plans to periodically discuss all IRA exemption cases with IRS and did not elaborate on the formal means for this information sharing. IRS said that it has met with DOL to formalize collaboration on exemptions from prohibited transaction treatment in IRAs. DOL agreed to contact IRS within 25 days of DOL receiving an IRA prohibited transaction exemption application to determine if there are any Internal Revenue Code issues. To avoid any disclosure concerns, DOL will not identify the applicant at that time. This new process will be reflected in DOL's forthcoming internal procedure manual for the prohibited transaction exemption process.

Recommendation: The Commissioner of Internal Revenue, in consultation with the Secretary of Labor, should establish a formal means, such as a memorandum of understanding or other mechanism, to support and guide DOL's and IRS's collaborative efforts to oversee IRA prohibited transaction exemptions. (Recommendation 3)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS agreed with this recommendation and said it has met with DOL to formalize collaboration on exemptions from prohibited transaction treatment in IRAs. DOL agreed to contact IRS within 25 days of DOL receiving an IRA prohibited transaction exemption application to determine if there are any Internal Revenue Code issues. To avoid any disclosure concerns, DOL will not identify the applicant at that time. This new process will be reflected in DOL's forthcoming internal procedure manual for the prohibited transaction exemption process.

Recommendation: As VA and IHS revise the MOU and related performance measures, the Secretary of Veterans Affairs should ensure these measures are consistent with the key attributes of successful performance measures, including having measurable targets. (Recommendation 1)

Agency: Department of Veterans Affairs
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Veterans Affairs should, in consultation with IHS and tribes, establish and distribute a written policy or guidance on how referrals from IHS and Tribal Health Program (THP) facilities to VA facilities for specialty care can be managed. (Recommendation 2)

Agency: Department of Veterans Affairs
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: As VA and IHS revise the MOU and related performance measures, the Director of IHS should ensure these measures are consistent with the key attributes of successful performance measures, including having measurable targets. (Recommendation 3)

Agency: Department of Health and Human Services: Public Health Service: Indian Health Service
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: Congress should consider taking legislative action to resolve the long-standing issues between the Corps and the Advisory Council on Historic Preservation over the Corps Regulatory Program's procedures for implementing section 106 of the National Historic Preservation Act. (Matter for Consideration 1)

Agency: Congress
Status: Open

Comments: When we determine what steps the Congress has taken, we will provide updated information

Recommendation: The Secretary of Energy should develop a documented policy or clarify existing policy to implement the statutory requirement to consult with Alaska Native Corporations (ANC) on the same basis as Indian tribes under Executive Order 13175. (Recommendation 1)

Agency: Department of Energy
Status: Open

Comments: As of April 2020, the Department of Energy plans to clarify and consolidate its consultation policies and practices for consultation with Alaska Native Corporations by June 2021.

Recommendation: The Administrator of the Environmental Protection Agency should develop a documented policy or clarify existing policy to implement the statutory requirement to consult with ANCs on the same basis as Indian tribes under Executive Order 13175. (Recommendation 2)

Agency: Environmental Protection Agency
Status: Open

Comments: In December 2019, EPA created a draft document, Guiding Principles for Consulting with Alaska Native Claims Settlement Act Corporations, and issued it for consultation with Alaska Native Corporations (ANCs). The draft guiding principles seek to clarify EPA's consultation and coordination practices with ANCs. Additionally, according to agency officials, an EPA working group is in the process of developing an internal, best practices implementation guide. As of April 2020, EPA expects to finalize these guidance documents in 2020

Recommendation: The Secretary of Housing and Urban Development should develop a documented policy or clarify existing policy to implement the statutory requirement to consult with ANCs on the same basis as Indian tribes under Executive Order 13175. (Recommendation 3)

Agency: Department of Housing and Urban Development
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Homeland Security should establish a time frame for developing or updating policy to implement the statutory requirement to consult with ANCs on the same basis as Indian tribes under Executive Order 13175. (Recommendation 5)

Agency: Department of Homeland Security
Status: Open

Comments: In February 2019, the Department of Homeland Security provided GAO documentation supporting a planned time frame of March 2020 for developing and updating its consultation policy to implement the statutory requirement to consult with ANCs in response to this recommendation. We plan to close the recommendation after reviewing documentation that the policy has been updated.

Recommendation: The Assistant to the Secretary of Agriculture for Rural Development should document in the agency's tribal consultation policy how agency officials are to communicate with tribes about how tribal input from consultation was considered in agency decisions on proposed infrastructure projects. (Recommendation 6)

Agency: Department of Agriculture: Rural Development
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of Civil Works of the Corps should document in the agency's tribal consultation policy how agency officials are to communicate with tribes about how tribal input from consultation was considered in agency decisions on infrastructure projects. (Recommendation 7)

Agency: Department of Defense: Department of the Army: Corps of Engineers: Civil Works
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director for the Bureau of Ocean Energy Management should document in the agency's tribal consultation policy how agency officials are to communicate with tribes about how tribal input from consultation was considered in agency decisions on infrastructure projects. (Recommendation 8)

Agency: Department of the Interior: Bureau of Ocean Energy Management
Status: Open

Comments: As of September 2019, Bureau of Ocean Energy Management (BOEM) plans to amend its tribal consultation policy with policies and procedures for communicating with tribes after consultation by December 2020.

Recommendation: The Secretary of Energy should document in the agency's tribal consultation policy how agency officials are to communicate with tribes about how tribal input from consultation was considered in agency decisions on infrastructure projects. (Recommendation 10)

Agency: Department of Energy
Status: Open

Comments: As of April 2020, the Department of Energy indicated that it plans to document policies for communicating about how input from tribal consultation was considered in agency decisions on infrastructure projects by June 2021.

Recommendation: The Administrator of the Federal Highway Administration should document in the agency's tribal consultation policy how agency officials are to communicate with tribes about how tribal input from consultation was considered in agency decisions on infrastructure projects. (Recommendation 14)

Agency: Department of Transportation: Federal Highway Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Homeland Security should document in the agency's tribal consultation policy how agency officials are to communicate with tribes about how tribal input from consultation was considered in agency decisions on infrastructure projects. (Recommendation 16)

Agency: Department of Homeland Security
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Housing and Urban Development should document in the agency's tribal consultation policy how agency officials are to communicate with tribes about how tribal input from consultation was considered in agency decisions on infrastructure projects. (Recommendation 17)

Agency: Department of Housing and Urban Development
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Chairman of the Nuclear Regulatory Commission should document in the agency's tribal consultation policy how agency officials are to communicate with tribes about how tribal input from consultation was considered in agency decisions on infrastructure projects. (Recommendation 19)

Agency: Nuclear Regulatory Commission
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Transportation should document in the agency's tribal consultation policy how agency officials are to communicate with tribes about how tribal input from consultation was considered in agency decisions on infrastructure projects. (Recommendation 20)

Agency: Department of Transportation
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Assistant Secretary of Indian Affairs should develop a process so that all regional and agency offices consistently provide tribes with documentation on calculations and methodologies to identify resources available to administer a program using a self-determination contract. (Recommendation 1)

Agency: Department of the Interior: Bureau of Indian Affairs
Status: Open
Priority recommendation

Comments: Interior agreed with this recommendation and stated that it will develop updated procedures on the response to tribal inquiries for resources available for self-determination contracts. To fully implement this recommendation, BIA needs to develop updated procedures to respond to tribal inquiries regarding available resources. When we obtain additional information from BIA, we will update the status of this recommendation.

Recommendation: The Assistant Secretary of Indian Affairs should develop a process that results in consistent determinations for inherently federal functions and to provide documentation to tribes on specific activities and functions determined to be inherently federal. (Recommendation 2)

Agency: Department of the Interior: Bureau of Indian Affairs
Status: Open

Comments: Interior agreed with this recommendation. When we obtain additional information from BIA, we will update the status of this recommendation.

Recommendation: The Assistant Secretary of Indian Affairs should establish a process to track and monitor the disbursement of funds associated with self-determination contracts and self-governance compacts. (Recommendation 3)

Agency: Department of the Interior: Bureau of Indian Affairs
Status: Open

Comments: Interior agreed with this recommendation and is developing documentation on the process for the disbursement of funds. Once the agency provides additional information regarding its efforts to implement the recommendation, we will evaluate the status of it.

Recommendation: The Director of OMB should enhance the guidelines for agencies to establish the controls required by FRDAA, by clarifying the difference between FRDAA and ERM requirements, and through collaboration with agencies to determine what additional information agencies need to implement the controls. (Recommendation 1)

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: In March 2020, the Payment Integrity Information Act of 2019 (PIIA) was enacted to improve efforts to identify and reduce government-wide improper payments, including payments that are the result of fraud. PIIA repealed and replaced FRDAA. However, OMB and the other agencies subject to PIIA essentially must satisfy the same requirements established under FRDAA, including adhering to OMB's related guidelines. OMB has not updated its published guidelines for FRDAA as we recommended. If OMB takes additional actions to supplement guidelines under PIIA, we will review the guidelines to determine whether it addresses our recommendation.

Recommendation: The Director of OMB should enhance FRDAA reporting guidelines by directing agencies to report complete and detailed information on each of the reporting elements specified by FRDAA, which should include information related to financial and nonfinancial fraud. (Recommendation 2)

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: In March 2020, the Payment Integrity Information Act of 2019 (PIIA) was enacted to improve efforts to identify and reduce government-wide improper payments, including payments that are the result of fraud. PIIA repealed and replaced FRDAA, but maintained similar reporting requirements for federal agencies regarding fraud risks and also extended the time line for reporting by a year. OMB did not update its previous reporting guidance for FRDAA as we recommended. If OMB takes additional actions to supplement reporting guidelines under PIIA, we will review the guidelines to determine whether it addresses our recommendation.

Recommendation: The Director of OMB should take steps to improve existing information on federal asset management to reflect leading practices such as those described in ISO 55000 and the key characteristics we identified and make it readily available to federal agencies. These steps could include updating asset management guidance and developing a clearinghouse of information on asset management practices and successful agency experiences. (Recommendation 1)

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: As of September 2020, OMB has developed guidance to help federal agencies implement the capital planning requirements described in OMB's November 6, 2019 Memorandum 20-3, "Implementation of Agency-wide Real Property Capital Planning." According to OMB officials, this guidance was distributed to agencies in July 2020. Agency plans were due to OMB by August 15,2020. This recommendation remains open pending further information from OMB on the status and contents of these plans.

Recommendation: The Secretary of Veterans Affairs should ensure that the role and responsibilities of the Interagency Program Office are clearly defined within the governance plans for acquisition of the department's new electronic health record system. (Recommendation 1)

Agency: Department of Veterans Affairs
Status: Open
Priority recommendation

Comments: The Department of Veterans Affairs (VA) concurred with our recommendation to ensure that the role and responsibilities of the Interagency Program Office (IPO) were clearly defined within the governance plans for acquisition of the department's new electronic health record system. As of December 2019, VA and the Department of Defense (DOD) have replaced the IPO with a new joint governance body. Specifically, the Federal Electronic Health Record Modernization (FEHRM) program office has been established to serve as the single point of accountability in the delivery of a common health record between the departments and the advancement of interoperability with the private sector. In its charter, the FEHRM was described as a single decision-making authority to manage issues in support of the departments' integrated electronic health record objectives and its leadership is responsible for, among other things, working to formulate, oversee, de-conflict, and ensure adherence to electronic health record-related VA and DOD policies. However, the corresponding Implementation Plan that is intended to document how the FEHRM executes its full responsibilities has yet to be issued. To fully implement this recommendation, VA needs to document the role and responsibilities of the FEHRM with respect to VA's acquisition of its new electronic health record system, explaining the role, if any, the FEHRM will have in the governance process. We will continue to monitor the departments' incorporation of the FEHRM into the plans for the ongoing acquisition.

Recommendation: The Assistant Secretary for Countering Weapons of Mass Destruction should develop a strategy and implementation plan to help the Department of Homeland Security, among other things, guide, support, integrate and coordinate its chemical defense programs and activities; leverage resources and capabilities; and provide a roadmap for addressing any identified gaps. (Recommendation 1)

Agency: Department of Homeland Security: Countering Weapons of Mass Destruction Office
Status: Open
Priority recommendation

Comments: DHS agreed with GAO's September 2018 recommendation and is taking actions to address it. Countering Weapons of Mass Destruction Office (CWMD) officials stated in December 2018 that CWMD plans to develop a strategy and implementation plan to help DHS guide, support, integrate and coordinate its chemical defense programs and activities; leverage resources and capabilities; and provide a roadmap for addressing any identified gaps. According to CWMD officials, the implementation plan would broadly address DHS chemical defense activities and programs to prevent, protect against, and respond to chemical incidents, including support to federal, state, tribal, and territorial operators and agencies, as well as the private sector. CWMD officials provided GAO with the completed strategy in December 2019 and plan to complete the implementation plan by December 2020. The strategy includes four overarching goals that will drive CWMD's mission in protecting American safety and security from chemical threats and incidents. We will continue to monitor the status of the implementation plan, as completion of both documents is essential to help the CWMD Office guide DHS's efforts to address fragmentation and coordination issues and would be consistent with the office's aim to establish a coherent mission.

Recommendation: The Director of DHS's National Protection and Programs Directorate's Infrastructure Security Compliance Division (ISCD) should incorporate vulnerability into the CFATS site security scoring methodology to help measure the reduction in the vulnerability of high-risk facilities to a terrorist attack, and use that data in assessing the CFATS program's performance in lowering risk and enhancing national security. (Recommendation 1)

Agency: Department of Homeland Security
Status: Open

Comments: DHS concurred with this recommendation and has taken steps to implement and monitor two new performance metrics intended to better demonstrate the CFATS program's effectiveness in enhancing national security and reducing national risk. Specifically, according to DHS, these new performance metrics allow for the (1) evaluation of the progress individual facilities have made in enhancing their security while part of the CFATS program, and (2) comparison of the security measures employed by CFATS-covered chemical facilities upon first entering the program against the improved and enhanced security measures contained in their approved CFATS security plans. DHS began reporting the two measures, "Average score of approved Site Security Plans" and "Average score of initial Site Security Plans", for the first quarter of fiscal year 2019. DHS stated that these measures will be used to demonstrate the percent increase in security score of facilities' security plans, resulting in a representation of the increase in the security posture across the facility population, which will be used internally to assess progress. GAO continues to monitor the results of these two new performance metrics.

Recommendation: The Secretary of Homeland Security should direct Homeland Security's members of the interagency working group for protection of Native American cultural property to implement selected leading collaboration practices, such as taking steps to agree on outcomes and objectives, clarify roles and responsibilities, and document these decisions. (Recommendation 1)

Agency: Department of Homeland Security
Status: Open

Comments: As of August 2019, we have reached out to the Department of Homeland Security and are awaiting a response on actions they may have taken in response to this recommendation.

Recommendation: The Secretary of the Interior should direct Interior's members of the interagency working group for protection of Native American cultural property to implement selected leading collaboration practices, such as taking steps to agree on outcomes and objectives, clarify roles and responsibilities, and document these decisions. (Recommendation 2)

Agency: Department of the Interior
Status: Open

Comments: Since August 2018, Interior's Office of International Affairs has updated its contact list for international repatriation assistance with information on the Department's roles and responsibilities in support of international repatriation. In addition, Interior's interagency working group members have developed a description of the interagency working group. However, the statement does not include outcomes and objectives for the group's work. GAO made the same recommendation to each of the four agencies covered in the review because implementing leading collaboration practices will require the collective participation of group members. GAO will keep the recommendation open until further collaborative actions are taken.

Recommendation: The Attorney General should direct Justice's members of the interagency working group for protection of Native American cultural property to implement selected leading collaboration practices, such as taking steps to agree on outcomes and objectives, clarify roles and responsibilities, and document these decisions. (Recommendation 3)

Agency: Department of Justice
Status: Open

Comments: As of August 2019, we have reached out to the Department of Justice and are awaiting a response on actions they may have taken in response to this recommendation.

Recommendation: The Secretary of State should direct State's members of the interagency working group for protection of Native American cultural property to implement selected leading collaboration practices, such as taking steps to agree on outcomes and objectives, clarify roles and responsibilities, and document these decisions. (Recommendation 4)

Agency: Department of State
Status: Open

Comments: Since August 2018, the Department of State shared a statement of its roles and responsibilities with other working group members. However, the statement does not include outcomes and objectives for the group's work. GAO made the same recommendation to each of the four agencies covered in the review because implementing leading collaboration practices will require the collective participation of group members. GAO will keep the recommendation open until further collaborative actions are taken.

Recommendation: The Secretary of Homeland Security should direct Homeland Security's members of the interagency working group for protection of Native American cultural property to identify and externally communicate to tribes points of contact within the agency that are responsible for responding to tribes' requests for assistance with repatriating cultural items from overseas auctions. (Recommendation 5)

Agency: Department of Homeland Security
Status: Open

Comments: As of August 2019, we have reached out to the Department of Homeland Security and are awaiting a response on actions they may have taken in response to this recommendation.

Recommendation: The Attorney General should direct Justice's members of the interagency working group for protection of Native American cultural property to identify and externally communicate to tribes points of contact within the agency that are responsible for responding to tribes' requests for assistance with repatriating cultural items from overseas auctions. (Recommendation 7)

Agency: Department of Justice
Status: Open

Comments: As of August 2019, we have reached out to the Department of Justice and are awaiting a response on actions they may have taken in response to this recommendation.

Recommendation: The Secretary of Homeland Security should direct Homeland Security's members of the interagency working group for protection of Native American cultural property to collaborate with the interagency working group members from other agencies to assess, in consultation with Indian tribes, whether and how amending the U.S. legal framework governing the export, theft, and trafficking of Native American cultural items would facilitate the repatriation of these items from auctions overseas and report its findings to Congress. (Recommendation 9)

Agency: Department of Homeland Security
Status: Open

Comments: As of August 2019, we have reached out to the Department of Homeland Security and are awaiting a response on actions they may have taken in response to this recommendation.

Recommendation: The Secretary of the Interior should direct Interior's members of the interagency working group for protection of Native American cultural property to collaborate with the interagency working group members from other agencies to assess, in consultation with Indian tribes, whether and how amending the U.S. legal framework governing the export, theft, and trafficking of Native American cultural items would facilitate the repatriation of these items from auctions overseas and report its findings to Congress. (Recommendation 10)

Agency: Department of the Interior
Status: Open

Comments: As of September 2019, Interior is working to develop an assessment of legislative options for discussion with the interagency working group, and plans to meet with tribes later this fall to discuss the assessment. Interior anticipates a September 30, 2020, completion date for the assessment of these legislative options. Interior has also reviewed legislative proposals related to the export, theft, and trafficking of Native American cultural items and has prepared for Congressional hearings on this topic.

Recommendation: The Attorney General should direct Justice's members of the interagency working group for protection of Native American cultural property to collaborate with the interagency working group members from other agencies to assess, in consultation with Indian tribes, whether and how amending the U.S. legal framework governing the export, theft, and trafficking of Native American cultural items would facilitate the repatriation of these items from auctions overseas and report its findings to Congress. (Recommendation 11)

Agency: Department of Justice
Status: Open

Comments: As of August 2019, we have reached out to the Department of Justice and are awaiting a response on actions they may have taken in response to this recommendation.

Recommendation: The Secretary of State should direct State's members of the interagency working group for protection of Native American cultural property to collaborate with the interagency working group members from other agencies to assess, in consultation with Indian tribes, whether and how amending the U.S. legal framework governing the export, theft, and trafficking of Native American cultural items would facilitate the repatriation of these items from auctions overseas and report its findings to Congress. (Recommendation 12)

Agency: Department of State
Status: Open

Comments: In November 2019, the Department of State, in conjunction with other interagency working group members, circulated a draft legal assessment and draft legislative options. The interagency working group members conducted a listening session with tribal members in November 2019, and conducted a tribal consultation in January 2020. GAO will continue monitoring the agencies' efforts toward implementing this recommendation.

Recommendation: FTA should determine which on-demand services qualify as "public transportation" based on the statutory definition and disseminate information to clarify whether and how to report data from such services into the National Transit Database (NTD). (Recommendation 2)

Agency: Department of Transportation: Federal Transit Administration
Status: Open

Comments: DOT concurred with this recommendation. As of September 2018, FTA planned to implement it by updating its NTD manual to include a new data collection field for on-demand services provided by Transportation Network Companies (TNC) in order to track these separately from other types of on-demand services. FTA will post a proposed update to clarify whether and how to report TNC-provided services into the NTD. FTA plans to post the proposed revisions along with specifications for which on-demand services qualify as "Public transportation" to the NTD policy in the Federal Register for comment. As of May 2020, FTA anticipated completing these actions by November 30, 2020.

Recommendation: The Secretary of Defense should ensure that the Under Secretary of Defense for Acquisition and Sustainment clarifies the categories of threats within JIDO's counter-improvised threat mission. (Recommendation 1)

Agency: Department of Defense
Status: Open

Comments: DOD agreed with this recommendation. As of October 2019, DOD indicated that is has begun taking action to implement it. We will update the status of this recommendation once we confirm the actions DOD has taken.

Recommendation: The Secretary of Defense should ensure that the Under Secretary of Defense for Acquisition and Sustainment clarifies JIDO's authorities for countering improvised threats, including the degree to which JIDO is to focus (lead, advocate, and coordinate) departmental efforts in key areas such as research and rapid fielding. (Recommendation 2)

Agency: Department of Defense
Status: Open

Comments: DOD agreed with this recommendation. As of October 2019, DOD indicated that is has begun taking action to implement it. We will update the status of this recommendation once we confirm the actions DOD has taken.

Recommendation: The Secretary of Defense should ensure the DTRA Director establishes a process to routinely obtain permission to release applicable information from organizations connected to JIDO research projects so that JIDO can send the information to Defense Technical Information Center (DTIC). (Recommendation 3)

Agency: Department of Defense
Status: Open

Comments: DOD agreed with this recommendation. As of October 2019, DOD indicated that is has begun taking action to implement it. We will update the status of this recommendation once we confirm the actions DOD has taken.

Recommendation: The Secretary of Defense should ensure the DTRA Director establishes a process to submit information on JIDO's research projects to DTIC. (Recommendation 4)

Agency: Department of Defense
Status: Open

Comments: DOD agreed with this recommendation. As of October 2019, DOD indicated that is has begun taking action to implement it. We will update the status of this recommendation once we confirm the actions DOD has taken.

Recommendation: The Administrator of the General Services Administration should update existing procedures to require GSA officials to estimate the full operations and maintenance costs of design choices in the planning and design process for new Design Excellence buildings. (Recommendation 1)

Agency: General Services Administration
Status: Open
Priority recommendation

Comments: GSA agreed with the recommendation. GSA officials are in the process of developing a tool to estimate the full operations and maintenance costs of design choices during the planning and design, including how those choices will impact areas discussed in our report, e.g., cleaning, energy, and landscaping costs. This tool is scheduled for completion in 2020. Based on a demonstration from GSA, we believe that upon implementation this tool will address our recommendation by allowing officials to better understand the impact of design choices as they are being made. We will follow up with GSA in later in the year to validate that the tool is operational.

Recommendation: The Administrator of the General Services Administration should update existing procedures to require GSA officials to further consider and document, during the planning and design of new Design Excellence buildings, how design choices may affect building functionality, such as whether a building is publicly visible and accessible. (Recommendation 3)

Agency: General Services Administration
Status: Open

Comments: GSA concurred with this recommendation. GSA officials are the process of developing a tool that will include the ability to consider building functionality, e.g., purpose or function of the building and spaces, when estimating operations and maintenance costs during planning and design. This tool is scheduled for completion in July 2020. Based on a demonstration from GSA, we believe that upon implementation this tool will address our recommendation by allowing officials to better understand the impact of functional design choices as they are being made. We will follow up with GSA later in the year to validate that the tool is operational.

Recommendation: The Administrator of FEMA should work with regional emergency communications coordination working group members to reach consensus on and implement an ongoing mechanism to encourage nationwide collaboration across these groups, considering the costs of one or more suitable methods, such as a national-level working group that uses virtual or other means of coordination, as appropriate. (Recommendation 1)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: DHS concurred with our recommendation. DHS created a national RECCWG website as part of the Homeland Security Information Network in fall 2019, and began a phased roll-out of 10 regional sub-pages available to all RECCWG members can post content and share information on exercises and training. In August 2020 FEMA officials confirmed the national site and all 10 regional sites were operational. They said that briefings on how to use the website for the regions are ongoing. We will continue to follow up on DHS's actions to implement the recommendation.

Recommendation: The Acting Commissioner of Internal Revenue should ensure that the Information Sharing and Analysis Center (ISAC) pilot better aligns with leading practices for effective pilot design. This should include (1) establishing criteria for assessing whether the pilot's objectives have been met before making decisions about its scalability and whether, how, and when to when to proceed to full implementation; and (2) developing a data analysis plan that identifies data sources and criteria necessary for effectively evaluating the pilot. (Recommendation 1)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS transitioned the Information Sharing and Analysis Center (ISAC) from a pilot to full implementation in October 2018. As of June 2020, we have requested documentation from IRS related to this transition to determine if it is consistent with the recommendation to align with leading practices. We will continue to monitor ISAC activities.

Recommendation: The Acting Commissioner of Internal Revenue should ensure that the ISAC Partnership develops an outreach plan to expand membership and improve states' and industry partners' understanding of the ISAC's benefits. (Recommendation 2)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: The ISAC annual report released in April 2018 cites plans to continue to grow member participation from private sector and other government agencies and to provide opportunities to deepen members' participation with clear guidelines. As of June 2020, we have requested additional information about participation levels and ongoing outreach efforts. Developing an outreach plan to broaden membership to non-Security Summit members of industry and financial institutions would further promote stakeholders collaborating and sharing fraud information.

Recommendation: The FEMA Assistant Administrator for Recovery, in coordination with the Associate Administrator of the Federal Insurance and Mitigation Administration, should develop performance measures and associated objectives for the new delivery model to better align with FEMA's strategic goal for hazard mitigation in the recovery process. (Recommendation 5)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency: Office of Response and Recovery: Assistant Administrator for Recovery
Status: Open

Comments: FEMA concurred with this recommendation and said it would take steps to implement it. As of September 2018, officials reported completing activities to develop disaster-specific mitigation performance measures that align with strategic goals and analyzed available data to identify the drivers of mitigation in events of various sizes. Due to hiring delays associated with the establishment of the 406 Mitigation Branch, officials have extended the expected completion date for all actions, including proposing refined performance measures to FEMA senior leadership, to the end of January 2019. As of December 2019, GAO is awaiting a response from FEMA on their progress completing these actions.

Recommendation: To ensure progress is made toward the implementation of any IT enhancements needed to establish electronic public health situational awareness network capabilities mandated by PAHPRA, the Secretary of HHS should direct the Assistant Secretary for Preparedness and Response to task an integrated project team, made up of an IT project manager and business owner, with including specific actions in the Public Health and Medical Situational Awareness Strategy Implementation Plan for conducting all activities required to establish and operate the network.

Agency: Department of Health and Human Services
Status: Open

Comments: Officials have previously acknowledged that a public health situational awareness network capability is important for identifying, processing, and comprehending data in real-time and stated that such a capability requires coordination and participation from numerous federal entities, including numerous HHS's operating divisions. However, as of January 2020, GAO has not received any information demonstrating progress made to implement our recommendation. Further, HHS has not provided us with a plan of action describing how they would implement the recommendation. Until steps are taken to implement our recommendation, HHS may not make the progress needed to establish an electronic public health situational awareness network capability mandated by PAHPRA in 2013 and the Pandemic and All-Hazards Preparedness and Advancing Innovation Act of 2019.

Recommendation: To ensure progress is made toward the implementation of any IT enhancements needed to establish electronic public health situational awareness network capabilities mandated by PAHPRA, the Secretary of HHS should direct the Assistant Secretary for Preparedness and Response to task the integrated project team with developing a project management plan that includes measurable steps--including a timeline of tasks, resource requirements, estimates of costs, and performance metrics--that can be used to guide and monitor HHS's actions to establish the network defined in the plans.

Agency: Department of Health and Human Services
Status: Open

Comments: Officials have previously acknowledged that a public health situational awareness network capability is important for identifying, processing, and comprehending data in real-time and stated that such a capability requires coordination and participation from numerous federal entities, including numerous HHS's operating divisions. However, as of February 2020 agency officials have not indicated whether or not they concur with the recommendation, nor have they taken any action or provided a plan of action describing how they would implement the recommendation. Until steps are taken to implement our recommendation, HHS may not make progress toward establishing an electronic public health situational awareness network capability mandated by PAHPRA in 2013 and in the Pandemic and All-Hazards Preparedness and Advancing Innovation Act of 2019 .

Recommendation: To ensure progress is made toward the implementation of any IT enhancements needed to establish electronic public health situational awareness network capabilities mandated by PAHPRA, the Secretary of HHS should direct the Assistant Secretary for Preparedness and Response to conduct all IT management and oversight processes related to the establishment of the network in accordance with Enterprise Performance Life Cycle Framework guidance, under the leadership of the HHS CIO.

Agency: Department of Health and Human Services
Status: Open
Priority recommendation

Comments: In HHS' Public Health and Social Services Emergency Fund's fiscal year 2021 budget justification-which includes the Office of the Assistant Secretary for Preparedness and Response-the agency stated it "concurred" with this recommendation. However, as of February 2020, GAO has not received any information demonstrating progress made to implement our recommendation. Until then, HHS may continue to lack the necessary progress needed in order to establish an electronic public health situational awareness network capability mandated by PAHPRA. To address this recommendation, HHS needs to direct the Assistant Secretary for Preparedness and Response to conduct all IT management and oversight processes related to the establishment of the network in accordance with Enterprise Performance Life Cycle Framework guidance.

Recommendation: The Secretary of Defense should direct the Under Secretary of Defense for Personnel and Readiness to, in coordination with the Director, USMEPCOM, establish a schedule to repair the internal EPTS database so that USMEPCOM can provide more regular and specific feedback to MEPS chief medical officers.

Agency: Department of Defense
Status: Open

Comments: In its comments to this recommendation, DOD concurred with this recommendation and said that the database was inoperable but that it was being reviewed as part of a multi-year information technology modernization effort to transition all military medical records to a new system known as MHS (Military Health System) GENESIS. They noted that the capability for USMEPCOM to conduct EPTS medical records review would be available within MHS GENESIS' business intelligence tools once implemented. When asked about the status of any actions taken to address this recommendation by preparing a schedule as to when this internal database would be repaired, DOD responded in January 2018 that USMEPCOM is unable to expend any funds to repair or replace the EPTS database system as this functionality is to be incorporated into the upcoming MHS GENESIS program. DOD officials confirmed that USMEPCOM's initial site testing will occur in FY 2019. While DOD officials are not able to repair its current internal database needed to complete its statistical analysis of these particular medical records, MHS GENESIS will be able to provide USMEPCOM with this capability. In August 2019, a senior DOD official confirmed that using MHS GENESIS is still the primary course of action to address this recommendation. He said that its implementation is planned for 2020/2021; however, there has been another delay and the department is waiting for a new implementation date to be established. In May 2020, this same official provided updated information that said MHS Genesis was delayed until 2021. Therefore, until further progress is made in implementing MHS GENESIS, this recommendation should remain open.

Recommendation: The Secretary of Defense should direct the Under Secretary of Defense for Personnel and Readiness to, in coordination with the Under Secretary of Defense for Acquisition, Technology, and Logistics and the DOD Healthcare Management Systems Program Executive Office, develop a schedule of actions for deploying its new electronic health record system, MHS GENESIS, within USMEPCOM that includes key activities such as the major actions required to accomplish this effort, completion dates for all actions leading up to these events, and dates for the system's deployment to MEPS locations.

Agency: Department of Defense
Status: Open

Comments: In its comments to this recommendation, DOD partially concurred and stated that it began fielding MHS GENESIS and anticipated issuing a Full Deployment Decision (FDD) certification in 2018 to proceed to the remaining sites. Further, when asked about the status of any actions taken to address this recommendation, DOD responded in January 2018 that USMEPCOM's inclusion in MHS GENESIS is scheduled for approval in late fiscal year 2018 with initial MEPS site testing in fiscal year 2019. According to DOD, USMEPCOM officials are working closely with the program management officials and the MHS GENESIS team to develop information requirements for approval and inclusion in the MHS GENESIS deployment plan once FDD is granted. The estimated completion date for the roll out to all remaining MEPS locations is fiscal year 2021. In August 2019, a senior DOD official confirmed that the department's primary course of action for addressing this recommendation remains the use of MHS GENESIS. However, he said that DOD has experience a delay and in May 2020, he stated that MHS Genesis had been delayed until FY 21. Given that DOD is still in the process of deploying MHS GENESIS, we believe this recommendation should remain open until progress has been made in implementing the MHS Genesis within the MEPS locations.

Recommendation: To provide clinicians and pharmacists with improved tools to support pharmacy services to veterans and reduce risks to patient safety, the Secretary of Veterans Affairs should direct the Assistant Secretary for Information and Technology and the Under Secretary for Health to establish and implement a plan for updating the pharmacy system to address the inefficiencies with viewing patient medication data in the Outpatient Pharmacy application and between the pharmacy application and viewers.

Agency: Department of Veterans Affairs
Status: Open

Comments: VA concurred with our recommendation and in August 2017 stated that it had identified $4 million in fiscal year 2018 to establish a pharmacy graphical user interface. As of September 2020, VA was still in the process of implementing the pharmacy graphical user interface, which it estimated it would deploy in December 2020. We will continue to monitor the situation.

Recommendation: To provide clinicians and pharmacists with improved tools to support pharmacy services to veterans and reduce risks to patient safety, the Secretary of Veterans Affairs should direct the Assistant Secretary for Information and Technology and the Under Secretary for Health to complete a plan for the implementation of an approach to data standardization that will support the capability for clinicians and pharmacists to view complete DOD data and receive order checks that consistently include DOD data.

Agency: Department of Veterans Affairs
Status: Open

Comments: VA concurred in principle with our recommendation and in May 2018 awarded a contract to implement the same electronic health record system that is being deployed by DOD, which is intended to present VA clinicians with complete DOD data and the ability to perform order checks on DOD data. In parallel, the department is continuing and expanding the implementation of data standardization. According to the department's September 2020 update, the agency had updated its pharmacy system to improve data standardization. However, the agency had not submitted sufficient documentation to close the recommendation. We will continue to monitor the situation.

Recommendation: To provide clinicians and pharmacists with improved tools to support pharmacy services to veterans and reduce risks to patient safety, the Secretary of Veterans Affairs should direct the Assistant Secretary for Information and Technology and the Under Secretary for Health to conduct an assessment to determine to what extent interoperability of VA's pharmacy system with DOD's pharmacy system is impacting transitioning service members.

Agency: Department of Veterans Affairs
Status: Open

Comments: VA concurred with our recommendation and in May 2017 stated that the health executive committee would complete an assessment to determine the extent interoperability with DOD's pharmacy system is impacting transitioning service members. In October 2017, VA conducted an assessment, however it was limited to one part of its system, the Joint Legacy Viewer (JLV), and read-only data. In September 2020, the agency provided a written response to supplement its October 2017 assessment with additional data regarding the potential impact of failures of its system to exchange pharmacy and allergy data with DOD. However, VA had not submitted sufficient documentation to close the recommendation. We will continue to monitor the situation.

Recommendation: To provide clinicians and pharmacists with improved tools to support pharmacy services to veterans and reduce risks to patient safety, the Secretary of Veterans Affairs should direct the Assistant Secretary for Information and Technology and the Under Secretary for Health to develop and execute a plan for implementing the capability to send outbound e-prescriptions to non-VA pharmacies, in accordance with National Council for Prescription Drug Programs standards.

Agency: Department of Veterans Affairs
Status: Open

Comments: VA concurred with our recommendation and in August 2017 stated that it will review its plan for e-prescribing functionality after it has signed a contract to adopt the electronic health record system that is being deployed by DOD. Although VA awarded the contract for the new electronic health record system in May 2018, VA had not submitted sufficient documentation to close the recommendation as of September 2020. We will continue to monitor the situation.

Recommendation: To provide clinicians and pharmacists with improved tools to support pharmacy services to veterans and reduce risks to patient safety, the Secretary of Veterans Affairs should direct the Assistant Secretary for Information and Technology and the Under Secretary for Health to ensure that the department's evaluation of alternatives for electronic health records includes consideration for additional generation level 3 capability such as navigating from an alert to medication order in the electronic health record system.

Agency: Department of Veterans Affairs
Status: Open

Comments: VA concurred with our recommendation and in August 2017 stated that it had entered into contract negotiations to acquire and deploy a level 3 electronic health record system that is expected to address pharmacy functions. As of September 2020, the agency had not submitted sufficient documentation to close the recommendation. We will update the status of this recommendation when VA provides documentation of its evaluation of alternatives to us.

Recommendation: To provide clinicians and pharmacists with improved tools to support pharmacy services to veterans and reduce risks to patient safety, the Secretary of Veterans Affairs should direct the Assistant Secretary for Information and Technology and the Under Secretary for Health to reassess the priority for establishing an inventory management capability to monitor and update medication levels and track when to reorder medications.

Agency: Department of Veterans Affairs
Status: Open

Comments: VA concurred with our recommendation and in August 2017 stated that it will reassess the prioritization of medication inventory management after a contract for adoption of the electronic health record system is signed. As of September 2020, VA had not submitted sufficient documentation to close the recommendation. We will continue to monitor the situation.

Recommendation: To continue the agency's efforts to improve state and local emergency preparedness for rail accidents involving hazardous materials, the Secretary of Transportation should, after the rulemaking is finalized, develop a process for regularly collecting information from state emergency response commissions on the distribution of the railroad-provided hazardous-materials-shipping information to local planning entities.

Agency: Department of Transportation
Status: Open

Comments: DOT published the Oil Spill Response Plans and Information Sharing for High-Hazard Flammable Trains final rule in February 2019. As of September 2020, PHMSA indicated that it wanted to close out the recommendation by adding 2 questions to the Hazardous Materials Emergency Preparedness grant application asking SERCs whether they receive information on High-Hazard Flammable Train operations and whether they are disseminating this information to local planning entities. OMB is currently reviewing the additional information request. We will continue to monitor DOT's efforts to address the recommendation.

Recommendation: To assist CISOs in carrying out their responsibilities, the Director of OMB should issue guidance for agencies' implementation of the FISMA 2014 requirements to ensure that (1) senior agency officials carry out information security responsibilities and (2) agency personnel are held accountable for complying with the agency-wide information security program. This guidance should clarify the role of the agency CISO with respect to these requirements, as well as implementing the other elements of an agency-wide information security program, taking into account the challenges identified in this report.

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: The Office of Management and Budget (OMB) partially concurred with this recommendation, but does not intend to directly issue guidance as recommended. As of June 2020, OMB has not provided sufficient evidence that it has implemented this recommendation. We will continue to monitor OMB's implementation of this recommendation.

Recommendation: To ensure that the role of the SISO is defined in department policy in accordance with FISMA 2014, the Secretary of Defense should define the SISO's role in department policy for ensuring that the department has procedures for incident detection, response, and reporting.

Agency: Department of Defense
Status: Open

Comments: In response to our report, DOD partially concurred with our recommendation; however, DOD subsequently concurred with the recommendation and is taking steps to implement it. The department stated that the issuance of an updated Cyber Incident Handling guidance is on track to be completed and coordinated in the third quarter of fiscal year 2018. As of June 2020, it has not yet provided sufficient evidence that it has implemented the recommendation. When we confirm what actions DOD has taken, we will provide updated information.

Recommendation: To ensure that the role of the CISO is defined in department policy in accordance with FISMA 2014, the Secretary of State should define the CISO's role in department policy for ensuring that the department has procedures for incident detection, response, and reporting.

Agency: Department of State
Status: Open

Comments: The Department of State (State) concurred with this recommendation. However, as of June 2020, the department has not yet provided sufficient evidence that it has implemented the recommendation. When we receive additional evidence from State, we will review it to determine whether the department has addressed the recommendation.

Recommendation: To ensure that the role of the CISO is defined in department policy in accordance with FISMA 2014, the Secretary of Transportation should define the CISO's role in department policy for ensuring that subordinate security plans are documented for the department's information systems.

Agency: Department of Transportation
Status: Open

Comments: The Department of Transportation (DOT) concurred with the recommendation and is currently updating its Cybersecurity Policy. The Department plans to be complete by June 29, 2019. As of June 2020, the department has not yet provided sufficient evidence that it has implemented the recommendation. Upon receiving additional evidence from DOT, we will review it to determine whether the department has addressed the recommendation.

Recommendation: To ensure that the role of the CISO is defined in department policy in accordance with FISMA 2014, the Secretary of Transportation should define the CISO's role in department policy for ensuring that security controls are tested periodically.

Agency: Department of Transportation
Status: Open

Comments: The Department of Transportation (DOT) concurred with the recommendation and is currently updating its Cybersecurity Policy. The Department plans to be complete by June 29, 2019. As of June 2020, the department has not yet provided sufficient evidence that it has implemented the recommendation. Upon receiving additional evidence from DOT, we will review it to determine whether the department has addressed the recommendation.

Recommendation: To ensure that the role of the SAISO is defined in agency policy in accordance with FISMA 2014, the Administrator of the National Aeronautics and Space Administration should define the SAISO's role in agency policy for oversight of security for information systems that are operated by contractors on the agency's behalf.

Agency: National Aeronautics and Space Administration
Status: Open

Comments: The National Aeronautics and Space Administration (NASA) concurred with our recommendation. As of June 2020, NASA stated that the agency is working to update the relevant policy to address this recommendation, but the update is taking longer than expected; NASA expects the policy to be updated and the review process to be completed by November 30, 2020. We will examine the evidence when NASA provides it.

Recommendation: To strengthen USDA's ability to better manage and monitor the progress of the Blueprint, including efforts to streamline and improve administrative services, the Secretary of Agriculture should direct the Assistant Secretary for Administration to develop a complete list identifying all of the Blueprint efforts under way and document key information needed to monitor their progress, such as status of implementation, time frames for completion, and related performance measures.

Agency: Department of Agriculture
Status: Open

Comments: As of June 2020, GAO is working with the agency to determine what actions the agency has taken related to this recommendation.

Recommendation: To strengthen USDA's ability to better manage and monitor the progress of the Blueprint, including efforts to streamline and improve administrative services, the Secretary of Agriculture should direct the Assistant Secretary for Administration to reexamine the adequacy of the staff and budget resources committed to the day-to-day management of the Blueprint, and further leverage existing departmental resources as needed.

Agency: Department of Agriculture
Status: Open

Comments: As of June 2020, GAO is working with the agency to determine what actions the agency has taken related to this recommendation.

Recommendation: To improve USDA's efforts to identify and track the benefits of the Blueprint, the Secretary of Agriculture should direct the Assistant Secretary for Administration to document the methodologies used to calculate any savings claimed for the Blueprint effort to ensure any such estimate is based on quality information.

Agency: Department of Agriculture
Status: Open

Comments: As of June 2020, GAO is working with the agency to determine what actions the agency has taken related to this recommendation.

Recommendation: To improve USDA's efforts to identify and track the benefits of the Blueprint, the Secretary of Agriculture should direct the Chief Financial Officer to develop a cost-effective method, using existing data systems, to collect and track USDA's spending on administrative services to identify baseline spending and target areas for future cost savings.

Agency: Department of Agriculture
Status: Open

Comments: As of June 2020, GAO is working with the agency to determine what actions the agency has taken related to this recommendation.

Recommendation: To improve USDA's efforts to identify and track the benefits of the Blueprint, the Secretary of Agriculture should direct the Assistant Secretary for Administration to systematically identify and track nonfinancial benefits from USDA's Blueprint efforts to better gauge the Blueprint's progress and more fully report its results.

Agency: Department of Agriculture
Status: Open

Comments: As of June 2020, GAO is working with the agency to determine what actions the agency has taken related to this recommendation.

Recommendation: To enhance USDA's efforts to share lessons learned from the Blueprint, the Secretary of Agriculture should direct the Assistant Secretary for Administration to maintain and promote existing web-based collaboration tools, including keeping information in these tools current, for agencies and staff offices to report their experiences and lessons learned from their Blueprint efforts to help strengthen internal information sharing and inform future efforts.

Agency: Department of Agriculture
Status: Open

Comments: As of June 2020, GAO is working with the agency to determine what actions the agency has taken related to this recommendation.

Recommendation: To help ensure that FDA has relevant and timely information to support management decisions, including the critical information necessary to ensure the safety and effectiveness of drugs compounded for animals, the Secretary of Health and Human Services should direct the Commissioner of the FDA to develop policy or guidance for agency staff that specifies circumstances under which FDA will or will not enforce compounding regulations for animals and clearly define key terms.

Agency: Department of Health and Human Services
Status: Open

Comments: In November 2019, FDA released for public comment its new Draft Guidance for Industry #256 - Compounding Animal Drugs from Bulk Drug Substances. The draft guidance describes FDA's policy regarding the compounding of animal drugs from bulk drug substances including the conditions under which FDA does not intend to take enforcement action for violations of the Federal Food, Drug, and Cosmetic Act's requirements for approval, adequate directions for use, and current Good Manufacturing Practices. We will review the updated guidance when it is finalized and determine if it addresses this recommendation. In August 2020, FDA indicated that, in response to numerous requests from external stakeholders, the comment period on the draft guidance has been extended to October 2020. Once the comments have been reviewed, FDA anticipates finalizing the guidance by the end of calendar year 2021.

Recommendation: To help ensure that FDA has relevant and timely information to support management decisions, including the critical information necessary to ensure the safety and effectiveness of drugs compounded for animals, the Secretary of Health and Human Services should direct the Commissioner of the FDA to consistently document the bases for FDA's decisions about how or whether it followed up on warning letters, adverse event reports, and complaints about drug compounding for animals.

Agency: Department of Health and Human Services
Status: Open

Comments: In July 2019, FDA reported to GAO that when the Draft Guidance for Industry #256 was issued that calendar year, FDA intended to develop a risk-based compliance program to address compounding of animal drugs from bulk drug substances. As part of that compliance program, FDA reported that it intended to consistently document the basis for its decisions about what actions are taken, for example, warning letters, adverse event reports, and complaints. In August 2020, FDA reported that a working group has been formed to develop a risk-based compliance strategy, which will include a process for documenting the basis for FDA's decisions about how or whether it followed up on warning letters, adverse event reports, and complaints about drug compounding for animals. FDA anticipates implementing this strategy simultaneously with the finalization of Guidance for Industry #256, which is anticipated to occur at the end of calendar year 2021. We will follow-up with FDA regarding these actions and determine if the actions address our recommendation.

Recommendation: To ensure that NCUA has adequate authority to determine the safety and soundness of credit unions, Congress should consider modifying the Federal Credit Union Act to grant NCUA authority to examine technology service providers of credit unions.

Agency: Congress
Status: Open

Comments: In July 2015, we suggested that Congress modify the Federal Credit Union Act to grant NCUA authority to examine technology service providers of credit unions. As of July 2020, Congress had not granted NCUA this authority.

Recommendation: To help improve awareness of OCS roles and responsibilities and to collect OCS issues at the military services and the service component commands, the Secretary of Defense should direct the Secretaries of the military departments, in coordination with the Chairman of the Joint Chiefs of Staff, to establish an OCS training requirement for commanders and senior leaders.

Agency: Department of Defense
Status: Open

Comments: DOD concurred with our recommendation. As of September 2020, DOD has taken steps to focus OCS training to all planners, including those outside the logistics directorate. In December 2015, the Joint Staff J7 certified the Joint OCS Planning and Execution (JOPEC) course of instruction for Joint training. The Joint Staff, per this training certification, is working with the Joint Deployment Training Center and the Joint Force Staff College to provide student administrative and course catalog support for future JOPEC training. In August 2020, OSD officials stated that they have secured funding for development of a new, online strategic-level OCS course, which they plan to develop, test, and field in 2021. Finally, OSD officials said that the updated OCS instruction will also address training for planners beyond the logistics directorate; officials anticipate the instruction being issued in late 2020. We will continue to monitor these efforts and this recommendation will remain open at this time.

Recommendation: Congress should consider strengthening the current consumer privacy framework to reflect the effects of changes in technology and the marketplace--particularly in relation to consumer data used for marketing purposes--while also ensuring that any limitations on data collection and sharing do not unduly inhibit the economic and other benefits to industry and consumers that data sharing can accord. Among the issues that should be considered are: (1) the adequacy of consumers' ability to access, correct, and control their personal information in circumstances beyond those currently accorded under FCRA; (2) whether there should be additional controls on the types of personal or sensitive information that may or may not be collected and shared; (3) changes needed, if any, in the permitted sources and methods for data collection; and (4) privacy controls related to new technologies, such as web tracking and mobile devices.

Agency: Congress
Status: Open

Comments: As of July 2020, Congress has not taken action on this matter.

Recommendation: Congress should consider granting Labor the additional authority it is seeking to access wage data to help verify claimants' reported income and help ensure the proper payment of benefits.

Agency: Congress
Status: Open

Comments: No legislation introduced as of March 20120. The Workers' Compensation Reform Act of 2015 (S. 2051, title V) was introduced in the 114th Congress. It would have allowed DOL to access wage data, as GAO suggested in April 2013, from the National Directory of New Hires to improve the integrity of the Federal Employees' Compensation Act program, among other actions. If similar legislation were introduced in the 116th Congress and enacted, this legislation could help to prevent and detect improper payments in the Federal Employees' Compensation Act program.

Recommendation: To better enable CPSC to target unsafe consumer products, Congress may wish to amend section 29(f) of CPSA to allow CPSC greater ability to enter into information-sharing agreements with its foreign counterparts that permit reciprocal terms on disclosure of nonpublic information.

Agency: Congress
Status: Open

Comments: As of May 15, 2020, Section 29 of CPSA had not been amended since 2008. In 2013, a bill was introduced (S.1887) but not passed. That bill would have allowed "the Commission, when sharing information under the federal-state cooperation program with a foreign government agency for official law enforcement or consumer protection purposes, to authorize a foreign government agency to make that information available to another agency of the same foreign government (including a political subdivision of that foreign government that is located within the same territory or administrative area as the agency disclosing the information) if an appropriate official of the foreign government agency disclosing the information certifies (by prior agreement, memorandum of understanding with the CPSC, or other written certification) that it will establish and apply specified confidentiality restrictions under the Consumer Product Safety Act."

Recommendation: To systematically gauge the extent to which deficiencies identified by individual AIBs may be occurring throughout VHA; and to maximize opportunities for sharing information across VHA to improve its overall operations, the Secretary of Veterans Affairs should direct the Under Secretary for Health to establish a process to collect and analyze aggregate data from AIB investigations, including the number of investigations conducted, the types of matters investigated, whether the matters were substantiated, and systemic deficiencies identified.

Agency: Department of Veterans Affairs
Status: Open

Comments: VA concurred with this recommendation and noted that it would explore any new processes for collecting and analyzing aggregate data from AIB investigations. In September 2015, VA reported that VHA had established a workgroup to review this recommendation and also had created a database to collect and analyze aggregate data from AIB investigations into senior executive service (SES) employees. Based on the results of an informal survey as well as its analysis of AIB data for SES employees, VA stated that central office oversight of the AIB process is not needed and that several systems already in place capture data on system-wide risks (e.g., sexual assault reporting, Issue Briefs, and National Center for Patient Safety Patient Safety Information System Program). In December 2016, VA reported that it convened another workgroup in September 2016 to re-examine this recommendation. That workgroup ultimately determined that oversight of AIBs at the national level continues to not be warranted. In April 2018, VA reported that it does not intend to take any further action in response to this recommendation, and it reaffirmed this position in March 2020.

Recommendation: To systematically gauge the extent to which deficiencies identified by individual AIBs may be occurring throughout VHA; and to maximize opportunities for sharing information across VHA to improve its overall operations, the Secretary of Veterans Affairs should direct the Under Secretary for Health to establish a process for sharing information about systemic changes, including policies and procedures implemented in response to the results of AIB investigations, which may have broader applicability throughout VHA.

Agency: Department of Veterans Affairs
Status: Open

Comments: VA concurred with this recommendation and noted that it would explore any new processes for collecting and analyzing aggregate data from AIB investigations. In September 2015, VA reported that it had established a working group to review this recommendation. In addition, VA also had created a database to collect and analyze aggregate data from AIB investigations into senior executive service (SES) employees to identify trends and address deficiencies. Based on an informal survey of its working group and its analysis of AIB data for SES employees, VA stated that VISNs currently provide adequate oversight of the AIB process and notify VA central office when appropriate and that a comprehensive review of its AIB data for SES employees identified no system-wide issues. Ultimately, VA stated that it could not justify the resources needed to implement this recommendation. In April 2018, VA reported that it does not intend to take any further action in response to this recommendation, and it reaffirmed this position in March 2020.

Recommendation: To enhance the safety of unregulated onshore hazardous liquid and gas gathering pipelines, the Secretary of Transportation should direct the PHMSA Administrator to collect data from operators of federally unregulated onshore hazardous liquid and gas gathering pipelines, subsequent to an analysis of the benefits and industry burdens associated with such data collection. Data collected should be comparable to what PHMSA collects annually from operators of regulated gathering pipelines (e.g., fatalities, injuries, property damage, location, mileage, size, operating pressure, maintenance history, and the causes of incidents and consequences).

Agency: Department of Transportation
Status: Open

Comments: PHMSA plans to collect data on previously unregulated hazardous liquid and natural gas gathering lines via rulemakings. PHMSA issued a final rule that covers data collection for hazardous liquid gathering pipelines in October 2019. As of May 2020, PHMSA anticipates issuing the final rule for natural gas pipelines by Fall, 2020.

Recommendation: To better ensure that economically similar outcomes are taxed similarly and minimize opportunities for abuse, the Secretary of the Treasury should undertake a study that compares the current approach to alternative approaches for the taxation of financial derivatives. To determine if changes would be beneficial, such a study should weigh the tradeoffs to IRS and taxpayers that each alternative presents, including simplicity, administrability, and economic efficiency.

Agency: Department of the Treasury
Status: Open

Comments: Treasury disagreed with this recommendation based on the fact that many outside studies already exist and IRS did not comment. The Tax Cuts and Jobs Act enacted in December 2017 did not include any requirements that Treasury study alternative approaches for the taxation of financial derivatives. However members of Congress have released proposals for a mark-to-market tax system, which would include financial derivatives. GAO continues to maintain that further study is needed in coordination with IRS and will continue to monitor the climate for such a study.

Recommendation: In light of the need for accurate and complete information on children's access to health services under Medicaid and CHIP, the requirement that states report information to CMS on certain aspects of their Medicaid and CHIP programs, and problems with accuracy and completeness in this state reporting, the Administrator of CMS should work with states to identify additional improvements that could be made to the CMS 416 and CHIP annual reports, including options for reporting on the receipt of services separately for children in managed care and fee-for-service delivery models, while minimizing reporting burden, and for capturing information on the CMS 416 relating to children's receipt of treatment services for which they are referred.

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: In August 2019, CMS stated that the agency's long-term plan is to use the Transformed Medicaid Statistical Information System (T-MSIS) to analyze information on children's receipt of Early and Periodic Screening, Diagnostic and Treatment (EPSDT) services. As of June 2020, CMS had developed a new CMS-416 reporting form that gives states the option of having CMS calculate the measures for the report using T-MSIS. CMS stated that it intends to implement this option for states for fiscal year 2020 CMS-416 reports, which are due in April 2021. As of August 2020, the new CMS-416 form was undergoing Paperwork Reduction Act review. CMS is also exploring using T-MSIS to generate the Core Set of Children's Health Care Quality Measures for Medicaid and CHIP, some of which are included in the CHIP annual report. As of June 2020, CMS had begun a pilot test to generate five of the Core Set measures using 2018 T-MSIS data. GAO considers this recommendation open and will continue to monitor CMS's progress towards its long-term goal of using T-MSIS to monitor children's receipt of EPSDT services.