Recommendation: The Secretary of Defense should ensure that the Under Secretary of Defense for Personnel and Readiness provides guidance to the services, for example, in its forthcoming diversity and inclusion strategic plan, to develop plans, with clearly defined goals, performance measures, and timeframes, to guide and monitor recruitment and retention efforts of female active-duty servicemembers in the military. (Recommendation 1)

Agency: Department of Defense
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of the Army should develop a plan, with clearly defined goals, performance measures, and timeframes, to guide and monitor the Army's female active-duty servicemember recruitment and retention efforts. (Recommendation 2)

Agency: Department of Defense: Department of the Army
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of the Navy should develop a plan, with clearly defined goals, performance measures, and timeframes, to guide and monitor the Navy's female active-duty servicemember recruitment and retention efforts. (Recommendation 3)

Agency: Department of Defense: Department of the Navy
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of the Navy should ensure that the Commandant of the Marine Corps develops a plan, with clearly defined goals, performance measures, and timeframes, to guide and monitor the Marine Corps' female active-duty servicemember recruitment and retention efforts. (Recommendation 4)

Agency: Department of Defense: United States Marine Corps
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of the Air Force should develop a plan, with clearly defined goals, performance measures, and timeframes, to guide and monitor the Air Force's female active-duty servicemember recruitment and retention efforts. (Recommendation 5)

Agency: Department of Defense: Department of the Air Force
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: NNSA's Energetic Materials Enterprise Manager and relevant NNSA officials and contractor representatives at NNSA sites should take steps to improve the accuracy of FIMS data related to NNSA's infrastructure supporting explosives activities. These steps should include reviewing and updating information about associations of assets with primary and secondary explosives missions; ensuring that those who provide asset information to FIMS administrators understand the data they need to provide; and clarifying how to accurately enter information in FIMS for explosives assets that are not buildings. (Recommendation 1)

Agency: Department of Energy: National Nuclear Security Administration
Status: Open

Comments: As of July 2020, we are currently reviewing agency information and plan to reach out as needed for additional information for this recommendation.

Recommendation: NNSA's Energetic Materials Enterprise Manager, in consultation with members of NNSA's Energetics Coordinating Committee, should, as the agency revises its Defense Programs Strategic Plan for Energetic Materials, include discussion of identified challenges related to explosives activities, such as data quality, workforce levels, and safety as well as any actions to address them, as appropriate, or document the rationale for why identified challenges were not included. (Recommendation 2)

Agency: Department of Energy: National Nuclear Security Administration
Status: Open

Comments: Based on trade press reports, NNSA appears to be taking several actions that, collectively, may serve to close this recommendation as implemented. As of July 2020, we are awaiting information from agency officials and will update the status of this recommendation when the information is received.

Recommendation: NNSA's Energetic Materials Enterprise Manager, in consultation with members of NNSA's Energetics Coordinating Committee, should, as the agency revises its Defense Programs Strategic Plan for Energetic Materials, include fully developed elements of an effective strategic plan, such as a clearly identified mission statement and performance goals that are quantifiable, set time frames for completion, and list responsible parties to carry out specific activities for all strategic goals. (Recommendation 3)

Agency: Department of Energy: National Nuclear Security Administration
Status: Open

Comments: Based on trade press reports, NNSA appears to be making progress implementing this recommendation. As of July 2020, we have requested additional information from agency officials and will update the recommendation status when the information is received.

Recommendation: The Director of the Secret Service should develop and implement a plan to ensure that special agents assigned to Presidential Protective Division and Vice Presidential Protective Division reach annual training targets given current and planned staffing levels. (Recommendation 1)

Agency: Department of Homeland Security: United States Secret Service
Status: Open

Comments: In May 2019 we reported that the Secret Service had not met the established training target (25 percent of work time) and lacked a plan for achieving it. We therefore recommended that the Director of the Secret Service develop and implement a plan to ensure that special agents assigned to the Presidential Protective Division and the Vice Presidential Protective Division reach annual training targets given current and planned staffing levels. The agency concurred with our recommendation. Towards addressing this recommendation, in October 2019, the Secret Service reported that the Office of Protective Operations is currently soliciting training requirements from each internal operational division, including the Presidential and Vice Presidential Protective Divisions, to determine the appropriate amount of training and associated training hours for each division. They further reported that once reviewed, the training requirements are to inform the agency's revised Human Capital Strategic Plan. The revised Human Capital Strategic Plan is to include an overview of Office of Protective Operations' training requirements and corresponding staffing needs. The Secret Service anticipates a revised Human Capital Strategic Plan to be available by the end of January 2020. The Secret Service's efforts to reevaluate the training requirements and targets are a positive first step. However, Secret Service's actions are not fully consistent with the recommendation. Specifically, in its updated response, the Secret Service stated that training hours for Presidential Protective Division and Vice Presidential Protective Division special agents training will only increase once the agency nears its ultimate staffing target. This is inconsistent with our recommendation to establish a plan to ensure these special agents reach annual training targets given current staffing levels. In the interim, affected special agents may continue to lack training required to prevent security breaches, such as that of September 19, 2019, when an intruder jumped the north fence and entered the White House. We will continue to monitor the Secret Service's progress in implementing this recommendation.

Recommendation: The Director of the Secret Service should develop and implement a policy that documents the process for collecting complete Uniformed Division officer training data and establishes the types of information that should be collected. (Recommendation 2)

Agency: Department of Homeland Security: United States Secret Service
Status: Open

Comments: In May 2019 we reported that training data collected on the Secret Service's Uniform Division were incomplete and in certain cases unrelated to protection or lacked descriptions to clearly link the training to required skills. Further, the process used to capture the data was not consistently employed and did not include information on how or whether to capture internal on-the-job training instances, or instruction on the type of training to be captured to demonstrate that the training is protection-related training. We therefore recommended that the Director of the Secret Service develop and implement a policy that documents the process for collecting complete Uniformed Division officer training data and establishes the types of information that should be collected. The Secret Service, through DHS, concurred with our recommendation, stating that it would develop rigorous and uniform standards for collecting and reporting training data related to the Uniformed Division branch, and would work to capture additional training information. In response to our recommendation, in October 2019 the Secret Service reported that the Uniformed Division has worked with the Office of Training and Performance and Learning Management System (PALMS) team to capture Uniformed Division training requirements. The requirements are to include the 20 formalized on-the-job training programs for officers assigned to the Uniformed Division's White House, Foreign Missions, and Naval Observatory Branches, or one of the Special Operations Branch specialized units. In addition, the Secret Service stated that approximately 19 micro-training courses (also known as Roll Call Training) are currently captured within PALMS-the Department of Homeland Security's learning management system -and additional formalized on-the-job training programs are being reviewed for inclusion in PALMS. According to the Secret Service, use of PALMS should help ensure that the process for collecting and recording Uniformed Officer training is standardized and monitored. The Secret Service's efforts to capture additional training information in PALMS is a positive development. However, we have not yet observed progress towards the Secret Service's implementation of a policy that documents the process for collecting complete Uniformed Division officer training data and establishes the types of information that should be collected, as we recommended. We will continue to monitor the Secret Service's progress in implementing this recommendation.

Recommendation: The Director of OPM, together with the CHCO Council, should track government-wide data to establish a baseline and analyze the extent to which the seven Title 5 special payment authorities are effective in improving employee recruitment and retention, and determine what potential changes may be needed to improve the seven authorities' effectiveness. (Recommendation 1)

Agency: Office of Personnel Management
Status: Open
Priority recommendation

Comments: OPM partially concurred with the recommendation and said that by August 2018, OPM would (1) track Governmentwide data to establish a baseline of agency use of the seven Title 5 special payment authorities by occupation with a focus on mission-critical occupations; and (2) work with the CHCO Council to determine what changes may be needed to improve the seven authorities' effectiveness. OPM said agencies are in the best position to analyze the extent to which special pay authorities, when used in conjunction with other human resources flexibilities, improve their ability to recruit and retain their employees. However, we noted that by working with the agencies through the CHCO Council, OPM would be better positioned to track government-wide data to analyze the extent to which Title 5 special payment authorities improve employee recruitment and retention. In December 2018, OPM told us that it established a baseline to measure changes over time, on an annual basis, regarding the use of the seven special payment authorities. OPM also stated that it is working with the CHCO Council to administer a survey to obtain agency input on how to improve the authorities' effectiveness. In May 2019, OPM provided documented analyses of the extent agencies use special payment authorities for various occupations, but provided no information on actions taken with the CHCO council as we recommended. More specifically, to fully implement the recommendation OPM needs to work with the CHCO Council to analyze changes in government-wide data and the extent to which the seven special payment authorities are effective. We will update the status of actions to implement this recommendation as OPM provides any documentation responsive to it, as we requested in September 2019 and further coordinated with OPM in June 2020.

Recommendation: The Director of OPM, together with the CHCO Council, should provide guidance on assessing effectiveness and tools--such as best practices or frequently asked questions--for the range of Title 5 special payment authorities. (Recommendation 2)

Agency: Office of Personnel Management
Status: Open

Comments: OPM concurred with recommendation and said that by February 2019, it would (1) develop guidance on assessing the effectiveness for the range of Title 5 special payment authorities, and (2) work on any guidance or tools that the CHCO Council identifies that would improve their use of the special payment authorities. After our report was issued in December 2017, OPM also posted new templates on its website to help agencies provide required information and facilitate the request and approval process for waivers of the normal payment limitations on recruitment, relocation, and retention incentives. We will update the status of actions to implement this recommendation as OPM provides any documentation responsive to it, as we requested in September 2019 and further coordinated with OPM in June 2020.

Recommendation: The Director of OPM should establish documented procedures to assess special payment authority requests requiring OPM approval and periodically review approval procedures to consider ways to streamline them. (Recommendation 3)

Agency: Office of Personnel Management
Status: Open

Comments: OPM concurred with the recommendation and, in December 2018, provided documented procedures for reviewing agency requests to waive the normal payment limitations on recruitment, relocation, and retention incentives; and for reviewing agency requests for special rates and critical position pay. However, the procedures generally restated the types of information that agencies must submit and did not provide criteria to assess the information supporting requests. For example, the procedures for assessing special rates and critical position pay requests only referred to lists of required information items. Furthermore, the guidance on assessing agency requests to waive the normal payment limitations on recruitment, relocation, and retention incentives did not provide criteria, such as to assess the soundness of the methodology or reliability of underlying data for calculating payment amounts or the sufficiency of prior agency efforts to recruit and retain employees without having to resort to additional pay. Although the procedures documents OPM provided referred to periodic annual reviews of the procedures beginning in May 2019, the documents did not provide information on whether and how such reviews were to consider and identify ways to streamline the procedures. We will update the status of actions to implement this recommendation as OPM provides any additional documentation responsive to it, as we requested in September 2019 and further coordinated with OPM in June 2020.

Recommendation: The Undersecretary for Health should develop and implement a process to accurately count all physicians providing care at each medical center, including physicians who are not employed by VHA. (Recommendation 1)

Agency: Department of Veterans Affairs: Veterans Health Administration
Status: Open
Priority recommendation

Comments: As of January 2020, VHA continues to disagree with the recommendation and has not taken any action. Although VA responded to our report by stating that the ability to count physicians does not affect its ability to assess workload, we maintain that an accurate count of all physicians providing care at each medical center is necessary for accurate workforce planning. To implement the first recommendation, VHA needs to develop a system-wide process to collect information on all physicians providing care at VAMCs, including physicians that are not employed by VHA. This information should be available at the local level for workforce planning purposes.

Recommendation: The Undersecretary for Health should develop and issue guidance to the VAMCs on determining appropriate staffing levels for all mission-critical physician occupations. (Recommendation 2)

Agency: Department of Veterans Affairs: Veterans Health Administration
Status: Open

Comments: VHA concurred with this recommendation. In November 2017, VHA's Executive in Charge chartered the Specialty Care Provider Staffing and Network Model Workgroup to develop a methodology for determining the scope and complexity of specialty care services. The Workgroup also developed an analytical tool to support local decision-making around specialty staffing levels. According to VHA, the Specialty Care Services Staffing model has been validated across some VHA regions. The Workgroup was directed to develop an Executive Decision Memorandum for an official determination as to implementation of the model. As of January 2020, VHA was awaiting the results of the Governing Board's decision on the Executive Decision Memorandum, the guidance documents, and analytical template. VHA reported the target date for completion is March 2020.

Recommendation: The Undersecretary for Health should establish a system-wide method to share information about physician trainees to help fill vacancies across VAMCs. (Recommendation 4)

Agency: Department of Veterans Affairs: Veterans Health Administration
Status: Open

Comments: VHA concurred with this recommendation. VHA is working to develop the necessary capacity to enable a system-wide method for sharing information about physician trainees to help fill vacancies. In April 2019, VHA anticipated having this system in place by the end of fiscal year 2019. However, VHA has not submitted any additional information since April 2019. VHA has also created a VHA-Trainee Recruitment and Hiring Workgroup (the Workgroup). The Workgroup serves as the advisory group on trainee recruitment and hiring, for the purpose of developing a permanent Trainee Recruitment and Hiring Function. The Workgroup is holding Virtual Trainee Recruitment Events for critical occupations. Until GAO sees evidence of a system-wide method for sharing information about physician trainees, this recommendation will remain open.

Recommendation: To enhance information available to operational unit managers, the Secretary of Commerce should direct the director of NOAA's WFMO to ensure that complete information on hiring requests is routinely communicated to NWS managers throughout the three phases of the hiring process, such as by supporting the development of improved tracking and reporting capabilities in the planned new Commerce-wide data system.

Agency: Department of Commerce
Status: Open

Comments: The agency agreed with our recommendation. As of June 2020, the agency had taken some action, but had not fully implemented it. We will update this recommendation's status as we receive more information.

Recommendation: To assist CISOs in carrying out their responsibilities, the Director of OMB should issue guidance for agencies' implementation of the FISMA 2014 requirements to ensure that (1) senior agency officials carry out information security responsibilities and (2) agency personnel are held accountable for complying with the agency-wide information security program. This guidance should clarify the role of the agency CISO with respect to these requirements, as well as implementing the other elements of an agency-wide information security program, taking into account the challenges identified in this report.

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: The Office of Management and Budget (OMB) partially concurred with this recommendation, but does not intend to directly issue guidance as recommended. As of June 2020, OMB has not provided sufficient evidence that it has implemented this recommendation. We will continue to monitor OMB's implementation of this recommendation.

Recommendation: To ensure that the role of the SISO is defined in department policy in accordance with FISMA 2014, the Secretary of Defense should define the SISO's role in department policy for ensuring that the department has procedures for incident detection, response, and reporting.

Agency: Department of Defense
Status: Open

Comments: In response to our report, DOD partially concurred with our recommendation; however, DOD subsequently concurred with the recommendation and is taking steps to implement it. The department stated that the issuance of an updated Cyber Incident Handling guidance is on track to be completed and coordinated in the third quarter of fiscal year 2018. As of June 2020, it has not yet provided sufficient evidence that it has implemented the recommendation. When we confirm what actions DOD has taken, we will provide updated information.

Recommendation: To ensure that the role of the CISO is defined in department policy in accordance with FISMA 2014, the Secretary of State should define the CISO's role in department policy for ensuring that the department has procedures for incident detection, response, and reporting.

Agency: Department of State
Status: Open

Comments: The Department of State (State) concurred with this recommendation. However, as of June 2020, the department has not yet provided sufficient evidence that it has implemented the recommendation. When we receive additional evidence from State, we will review it to determine whether the department has addressed the recommendation.

Recommendation: To ensure that the role of the CISO is defined in department policy in accordance with FISMA 2014, the Secretary of Transportation should define the CISO's role in department policy for ensuring that subordinate security plans are documented for the department's information systems.

Agency: Department of Transportation
Status: Open

Comments: The Department of Transportation (DOT) concurred with the recommendation and is currently updating its Cybersecurity Policy. The Department plans to be complete by June 29, 2019. As of June 2020, the department has not yet provided sufficient evidence that it has implemented the recommendation. Upon receiving additional evidence from DOT, we will review it to determine whether the department has addressed the recommendation.

Recommendation: To ensure that the role of the CISO is defined in department policy in accordance with FISMA 2014, the Secretary of Transportation should define the CISO's role in department policy for ensuring that security controls are tested periodically.

Agency: Department of Transportation
Status: Open

Comments: The Department of Transportation (DOT) concurred with the recommendation and is currently updating its Cybersecurity Policy. The Department plans to be complete by June 29, 2019. As of June 2020, the department has not yet provided sufficient evidence that it has implemented the recommendation. Upon receiving additional evidence from DOT, we will review it to determine whether the department has addressed the recommendation.

Recommendation: To ensure that the role of the SAISO is defined in agency policy in accordance with FISMA 2014, the Administrator of the National Aeronautics and Space Administration should define the SAISO's role in agency policy for oversight of security for information systems that are operated by contractors on the agency's behalf.

Agency: National Aeronautics and Space Administration
Status: Open

Comments: The National Aeronautics and Space Administration (NASA) concurred with our recommendation. As of June 2020, NASA stated that the agency is working to update the relevant policy to address this recommendation, but the update is taking longer than expected; NASA expects the policy to be updated and the review process to be completed by November 30, 2020. We will examine the evidence when NASA provides it.