Reports & Testimonies

  1. Share with Facebook 
  2. Share with Twitter 
  3. Share with LinkedIn 
  4. Share with mail 

Recommendations Database

GAO’s recommendations database contains report recommendations that still need to be addressed. GAO’s priority recommendations are those that we believe warrant priority attention. We sent letters to the heads of key departments and agencies, urging them to continue focusing on these issues. Below you can search only priority recommendations, or search all recommendations.

Our recommendations help congressional and agency leaders prepare for appropriations and oversight activities, as well as help improve government operations. Moreover, when implemented, some of our priority recommendations can save large amounts of money, help Congress make decisions on major issues, and substantially improve or transform major government programs or agencies, among other benefits.

As of October 25, 2020, there are 4812 open recommendations, of which 473 are priority recommendations. Recommendations remain open until they are designated as Closed-implemented or Closed-not implemented.

Browse or Search Open Recommendations

Search


Have a Question about a Recommendation?

  • For questions about a specific recommendation, contact the person or office listed with the recommendation.
  • For general information about recommendations, contact GAO's Audit Policy and Quality Assurance office at (202) 512-6100 or apqa@gao.gov.

« Back to Results List Sort by   

Results:

Subject Term: "Sensitive data"

4 publications with a total of 16 open recommendations
Download these results in CSV format or XLSX format.
Information Security and Privacy: HUD Needs a Major Effort to Protect Data Shared with External Entities
GAO-20-431, Sep 21, 2020
Director: Carol C. Harris
Phone: (202) 512-4456

5 open recommendations
Display
Recommendation: The Secretary of Housing and Urban Development should direct the Chief Information Officer, Senior Agency Official for Privacy, and Chief Privacy Officer to review and revise department-level security and privacy policies to ensure that they require the implementation of risk-based security and privacy controls for external entities that process, store, or share sensitive information with HUD. (Recommendation 1)

Agency: Department of Housing and Urban Development
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
Recommendation: The Secretary of Housing and Urban Development should direct the Chief Information Officer, Senior Agency Official for Privacy, and Chief Privacy Officer to review and revise department-level security and privacy policies to ensure that they require independent assessments of external entities that process, store, or share sensitive information with HUD to ensure controls are implemented. (Recommendation 2)

Agency: Department of Housing and Urban Development
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
Recommendation: The Secretary of Housing and Urban Development should direct the Chief Information Officer, Senior Agency Official for Privacy, and Chief Privacy Officer to review and revise department-level security and privacy policies to ensure that they require identifying and tracking corrective action needed by external entities that process, store, or share sensitive information with HUD. (Recommendation 3)

Agency: Department of Housing and Urban Development
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
Recommendation: The Secretary of Housing and Urban Development should direct the Chief Information Officer, Senior Agency Official for Privacy, and Chief Privacy Officer to review and revise department-level security and privacy policies to ensure that they require monitoring of progress in implementing controls/corrective actions by external entities that process, store, or share sensitive information with HUD. (Recommendation 4)

Agency: Department of Housing and Urban Development
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
Recommendation: The Secretary of Housing and Urban Development should direct the Chief Information Officer, Senior Agency Official for Privacy, and Chief Privacy Officer to develop and maintain a comprehensive systems inventory that incorporates sufficient, reliable information about the external entities with which HUD program information is shared and the extent to which each external entity has access to PII and other sensitive information. (Recommendation 5)

Agency: Department of Housing and Urban Development
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
Federally Funded Research and Development Centers: Improved Oversight and Evaluation Needed for DOD's Data Access Pilot Program
GAO-20-272, Mar 6, 2020
Director: Marie A. Mak
Phone: (202) 512-4841

6 open recommendations
Display
Recommendation: The Under Secretary of Defense for Research and Engineering should direct the Laboratories and Personnel Office to take steps to ensure that the details of the pilot program's data protections are incorporated into the existing agreements. (Recommendation 1)

Agency: Department of Defense: Office of the Under Secretary of Defense for Research and Engineering
Status: Open

Comments: The Under Secretary of Defense for Research and Engineering (OUSD(R&E)), Laboratories and Personnel Office (L&PO) concurred with this recommendation. In May 2020, OUSD(R&E)/L&PO stated it will require the Primary Sponsor for each applicable federally funded research and development center (FFRDC) to provide documentation that shows that the details of the pilot program's data protections have been incorporated into existing sponsoring agreements and contracts, and estimated these actions would be completed in early Fall 2020.
Recommendation: The Under Secretary of Defense for Research and Engineering should direct the Laboratories and Personnel Office to take steps to ensure that the FFRDCs and sponsors are implementing the pilot program's protections for sensitive data. (Recommendation 2)

Agency: Department of Defense: Office of the Under Secretary of Defense for Research and Engineering
Status: Open

Comments: The Under Secretary of Defense for Research and Engineering (OUSD(R&E)), Laboratories and Personnel Office (L&PO) concurred with this recommendation. In May 2020, OUSD(R&E)/L&PO stated it will task the Primary Sponsor for each applicable federally funded research and development center (FFRDC) to provide a report detailing the FFRDC's plan for implementing the pilot program's protections for sensitive data and confirming that the FFRDC is adhering to that plan. OUSD(R&E)/L&PO estimated these actions would be completed in early Fall 2020.
Recommendation: The Under Secretary of Defense for Research and Engineering should direct the Laboratories and Personnel Office to establish a monitoring and oversight mechanism to ensure that primary sponsors submit complete information on pilot projects, as required by DOD's guidance for the pilot program. (Recommendation 3)

Agency: Department of Defense: Office of the Under Secretary of Defense for Research and Engineering
Status: Open

Comments: The Under Secretary of Defense for Research and Engineering (OUSD(R&E)), Laboratories and Personnel Office (L&PO) concurred with this recommendation. In May 2020, OUSD(R&E)/L&PO stated it will develop a monitoring and oversight plan, and estimated it would be completed in early Fall 2020.
Recommendation: The Under Secretary of Defense for Research and Engineering should direct the Laboratories and Personnel Office to develop a plan that outlines the methodology by which DOD will assess the pilot and how and when information collected will be analyzed to evaluate the pilot program. (Recommendation 4)

Agency: Department of Defense: Office of the Under Secretary of Defense for Research and Engineering
Status: Open

Comments: The Under Secretary of Defense for Research and Engineering (OUSD(R&E)), Laboratories and Personnel Office (L&PO) concurred with this recommendation. In May 2020, OUSD(R&E)/L&PO stated it will develop and coordinate a plan that outlines the methodology by which DOD will assess the pilot as well as the methodology for collecting and analyzing information to evaluate the pilot program. OUSD(R&E)/L&PO estimated these actions would be completed in early Fall 2020.
Recommendation: The Under Secretary of Defense for Research and Engineering should direct the Laboratories and Personnel Office to develop a plan to identify and evaluate lessons learned from the pilot program. (Recommendation 5)

Agency: Department of Defense: Office of the Under Secretary of Defense for Research and Engineering
Status: Open

Comments: The Under Secretary of Defense for Research and Engineering (OUSD(R&E)), Laboratories and Personnel Office (L&PO) concurred with this recommendation. In May 2020, OUSD(R&E)/L&PO stated it will develop a plan to identify and evaluate lessons learned from the pilot program, and estimated the plan would be completed in early Fall 2020.
Recommendation: The Under Secretary of Defense for Research and Engineering should direct the Laboratories and Personnel Office to develop a plan for obtaining input from stakeholders on the pilot program. (Recommendation 6)

Agency: Department of Defense: Office of the Under Secretary of Defense for Research and Engineering
Status: Open

Comments: The Under Secretary of Defense for Research and Engineering (OUSD(R&E)), Laboratories and Personnel Office (L&PO) concurred with this recommendation. In May 2020, OUSD(R&E)/L&PO stated it will develop a plan to obtain stakeholder inputs for use in evaluating the pilot program, and estimated the plan would be completed in early Fall 2020.
Information Security: IRS Needs to Rectify Control Deficiencies That Limit Its Effectiveness in Protecting Sensitive Financial and Taxpayer Data
GAO-18-391, Jul 31, 2018
Director: Gregory C. Wilshusen
Phone: (202) 512-6244

3 open recommendations
Display
Recommendation: The Commissioner of Internal Revenue should take steps to improve the implementation of IRS's information security program by entering correct contractor password expiration dates, per IRS's policy, in the system used for managing user access authorizations. (Recommendation 1)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: During GAO's audit of FY 2019 IRS financial statements, IRS did not submit this recommendation for closure, nor did the agency provide evidence that it had implemented this recommendation. When IRS indicates that it has implemented this recommendation, we will review relevant IRS actions.
Recommendation: The Commissioner of Internal Revenue should take steps to improve the implementation of IRS's information security program by documenting access authorizations for non-unique accounts. (Recommendation 2)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: During GAO's audit of FY 2019 IRS financial statements, IRS did not submit this recommendation for closure, nor did the agency provide evidence that it had implemented this recommendation. When IRS indicates that it has implemented this recommendation, we will review relevant IRS actions.
Recommendation: The Commissioner of Internal Revenue should take steps to improve the implementation of IRS's information security program by reviewing non-unique accounts at least annually, per IRS's policy. (Recommendation 3)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: During GAO's audit of FY 2019 IRS financial statements, IRS did not submit this recommendation for closure, nor did the agency provide evidence that it had implemented this recommendation. When IRS indicates that it has implemented this recommendation, we will review relevant IRS actions.
Healthcare.gov: Actions Needed to Enhance Information Security and Privacy Controls
GAO-16-265, Mar 23, 2016
Director: Gregory C. Wilshusen
Phone: (202) 512-6244

2 open recommendations
Display
Recommendation: To improve the oversight of privacy and security controls over the state-based marketplaces, the Secretary of Health and Human Services should direct the Administrator of the Centers for Medicare & Medicaid Services to define procedures for overseeing state-based marketplaces, to include day-to-day activities of the relevant offices and staff.

Agency: Department of Health and Human Services
Status: Open

Comments: The agency concurred with the recommendation and is actively working on addressing the recommendation. We will continue to work with the agency to verify whether implementation has occurred.
Recommendation: To improve the oversight of privacy and security controls over the state-based marketplaces, the Secretary of Health and Human Services should direct the Administrator of the Centers for Medicare & Medicaid Services to require continuous monitoring of the privacy and security controls over state-based marketplaces and the environments in which those systems operate to more quickly identify and remediate vulnerabilities.

Agency: Department of Health and Human Services
Status: Open

Comments: The agency concurred with the recommendation and is actively working on addressing the recommendation. We will continue to work with the agency to verify whether implementation has occurred.