Open Recommendations | EEOC Office of Inspector General

Report 2019-004-AOIG - Federal Information Security Modernization Act of 2014 (FISMA) Fiscal Year 2019 Performance Audit

We recommend EEOC OIT conduct a privacy impact assessment of the SharePoint system to identify privacy issues and risks associated with the security settings; and to provide recommendations to mitigate potential privacy risk.

We recommend EEOC OIT conduct a privacy impact assessment of the SharePoint
system to identify privacy issues and risks associated with the security settings; and to
provide recommendations to mitigate potential privacy risk.
We recommend EEOC OIT provide specialized training for SharePoint administrators and users to reduce the risk of exposing sensitive information and PII.

We recommend EEOC OIT provide specialized training for SharePoint administrators
and users to reduce the risk of exposing sensitive information and PII.
We recommend EEOC OIT review and remediate critical-risk, high-risk, and mediumrisk vulnerabilities in accordance with EEOC OIT's assessment of risk. If the risk is not remediated then we recommend EEOC OIT document the acceptance of the risk.

We recommend EEOC OIT review and remediate critical-risk, high-risk, and medium risk
vulnerabilities in accordance with EEOC OIT's assessment of risk. If the risk is not
remediated then we recommend EEOC OIT document the acceptance of the risk.

Report 2019-002-AOIG - Audit of the Equal Employment Opportunity Commission’s Fiscal Year 2019 Financial Statements

EEOC should ensure the existing policy in place is followed and documentation of the process is reviewed by the CFO or their designee on a quarterly basis.

EEOC should ensure the existing policy in place is followed and documentation of the
process is reviewed by the CFO or their designee on a quarterly basis.

Report 2019-001-EOIG - Evaluation of EEOC’s Contracts Administration Activities

OCFO should review and update the Contract File Content Checklist to reflect current documents maintained in the file.

OCFO should review and update the Contract File Content Checklist to reflect current
documents maintained in the file.
ASD should review and update the COR Appointment Letter as needed and specifically address the maintenance of electronic contract files.

ASD should review and update the COR Appointment Letter as needed and specifically
address the maintenance of electronic contract files.
OCFO should revise EEOC Order 360.001 as needed to assist CORs in performing their duties. Include implementation guidance for contract administration activities, such as submitting contract modifications.

OCFO should revise EEOC Order 360.001 as needed to assist CORs in performing their
duties. Include implementation guidance for contract administration activities, such as
submitting contract modifications.

Report 2018-004-AOIG - U.S. Equal Employment Opportunity Commission Federal Information Security Modernization Act of 2014 (FISMA) Fiscal Year 2018 Independent Evaluation

U.S. Equal Employment Opportunity Commission Federal Information Security Modernization Act of 2014 (FISMA) Fiscal Year 2018 Independent Evaluation

We recommend the OIT review and remediate critical-risk, high-risk and moderate-risk vulnerabilities. These vulnerabilities should be resolved to avoid compromise to EEOC’s systems; or the Agency should document acceptance of the risk or reclassification of the risk

EEOC Federal Hearings and Appeals Processes

Standardize on-boarding activities and training programs required for new AJs and other staff working at the District and Field offices, so that the Federal hearings experience is consistent for both complainants and agencies across offices.

Standardize on-boarding activities and training programs required for new AJs and
other staff working at the District and Field offices, so that the Federal hearings
experience is consistent for both complainants and agencies across offices.
OIT developers should meet directly with software users, such as OFO attorneys and supervisory attorneys and OFP AJs and Supervisory AJs (SAJ) to determine additional requirements.

OIT developers should meet directly with software users, such as OFO attorneys and
supervisory attorneys and OFP AJs and Supervisory AJs (SAJ) to determine additional
requirements.
Assign a target amount of days for intake so that management can determine if changes implemented impact the efficiency of the process.

Assign a target amount of days for intake so that management can determine if changes
implemented impact the efficiency of the process.
Ensure future process changes are implemented according to change management best practices noted by GAO.

Ensure future process changes are implemented according to change management best
practices noted by GAO.
OFO and OFP, in partnership with OIT, should consider development of an IMS training guide or document that is consistently updated and reviewed following upgrades, enhancements or modifications of the software. This guide should include all necessary cod

OFO and OFP, in partnership with OIT, should consider development of an IMS
training guide or document that is consistently updated and reviewed following
upgrades, enhancements or modifications of the software. This guide should include all
necessary codes for every action item in the process and should be available for all
product users. This guide should ensure that product users track all mandated steps in
IMS. Given that each office’s staff has their own needs within IMS: One guide should
be made for OFP legal techs, AJs, and SAJs. A separate guide should be available for
OFO CCD staff, attorneys and supervisory attorneys.
Evaluate and assess timeline improvement after the use of the new contractors. If significant improvements are verified by data, consider improvements to the ongoing staffing model and the possible addition of these contractor positions as permanent roles

Evaluate and assess timeline improvement after the use of the new contractors. If
significant improvements are verified by data, consider improvements to the ongoing
staffing model and the possible addition of these contractor positions as permanent
roles. OFO should determine and monitor metrics, such as improvement of targeted
timelines from one step to another (data can be gathered from IMS).
The Office of Information Technology (OIT), in partnership with OFP and OFO, should re-evaluate IMS requirements, and requirements for the framework of its successor system, to determine what additional reporting functionalities are needed in order to ana

The Office of Information Technology (OIT), in partnership with OFP and OFO, should
re-evaluate IMS requirements, and requirements for the framework of its successor
system, to determine what additional reporting functionalities are needed in order to
analyze data about staff and office productivity. A Voice of the Customer exercise or a
user requirement meeting could serve as starting point to gather current requirements
OFFICE OF INSPECTOR GENERAL SEMIANNUAL REPORT 10
from IMS main users (OFP and OFO) and to determine what other current systems need
to be integrated to make them function in alignment with IMS (Power BI, Complainant
Portal).
Examine the staffing model of the appeals intake process to determine if the dedicated resources are sufficient for ensuring processes are completed in a timely manner.

Examine the staffing model of the appeals intake process to determine if the dedicated
resources are sufficient for ensuring processes are completed in a timely manner.

Report 2017-007-AOIG - Independent Evaluation of the U.S. Equal Employment Opportunity Commission’s Compliance with Provisions of the Federal Information Security Modernization Act of 2014 (FISMA)

Report 2017-007-AOIG - Independent Evaluation of the U.S. Equal Employment Opportunity Commission’s Compliance with Provisions of the Federal Information Security Modernization Act of 2014

EEOC should conduct an e-authentication risk assessment for its digital systems and has not fully implemented multifactor authentication for logical and remote access for privileged and non-privileged users. (Repeat finding since FY 2008)
Report 2017-007-AOIG - Independent Evaluation of the U.S. Equal Employment Opportunity Commission’s Compliance with Provisions of the Federal Information Security Modernization Act of 2014

EEOC should develop a Trusted Internet Connection (TIC) program that meets OMB requirements to improve the agency’s security posture.

Report 2016-008-EOIG - Independent Evaluation of the U.S. Equal Employment Opportunity Commission’s Compliance with Provisions of the Federal Information Security Modernization Act of 2014 (FISMA)

Report 2016-008-EOIG - Independent Evaluation of the U.S. Equal Employment Opportunity Commission’s Compliance with Provisions of the Federal Information Security Modernization Act of 2014 (FISMA)

EEOC OIT should review and analyze critical, high, and medium vulnerabilities. These vulnerabilities should be resolved to avoid compromise of EEOC’s systems; or the agency should document acceptance of the risk or reclassification of the risk.

Report 2013-008-PSA - Performance Audit of the Agency’s Personnel Security Program

Report 2013-008-PSA - Performance Audit of the Agency’s Personnel Security Program

Immediately correct any known weaknesses. If EEOC determines not to correct a noted weakness, EEOC should document this analysis and their acceptance of the associated risk.
Report 2013-008-PSA - Performance Audit of the Agency’s Personnel Security Program

Develop and implement policies and procedures to address the safeguarding, transfer, storage, or disposal of classified information. The policy should include the requirements for Memorandums of Understanding between agencies.
Report 2013-008-PSA - Performance Audit of the Agency’s Personnel Security Program

Implement a formalized training program for individuals who use classified information as a part of their duties. If an external agency is to assume the responsibility of training these individuals, this agreement should be documented in an MOU.