Recommendation Dashboard

The Chief Information Officer review the permissions within the Google Apps for business applications and revise any that are necessary to protect any personally identifiable information and sensitive but unclassified information from being shared improperly.

The Chief Information Officer document and implement procedures to review permissions periodically within the Google Apps for business applications to identify and correct any improperly shared personally identifiable information and other sensitive information.

The Chief Information Officer document and implement a training program for users of the Google Apps for business applications that includes awareness of the risks of disclosing sensitive information and preventive measures to avoid improper disclosure.

The Chief Information Officer review and update the May 26, 2011, privacy impact assessment for Google Apps for business to reflect the types of information that the Google applications collect, maintain, and disseminate, and how the information is used.

The Chief Information Officer document and implement a process for confirming that complete and detailed cost-benefit analyses are prepared for all proposed cloud computing service contracts and that investment documents, including cost estimates and validations, are maintained in accordance with Office of Management and Budget Circular A-130, the Federal Acquisition Regulation Subpart 39, and Automated Directives System 577.

the Chief Information Officer document and implement a process for confirming that all documents supporting post-implementation reviews of cloud computing service contracts are maintained as required in Automated Directives System 577.

The Chief Information Officer update USAID's inventory of cloud computing contracts so the inventory list is complete.

The Chief Information Officer document and implement procedures for maintaining a complete, accurate inventory of the Agency's cloud computing contracts.

The Director, Office of Acquisition and Assistance, document and implement acquisition policies and procedures to comply with the IT Project Governance Manual, and require USAID missions, bureaus, and offices to get the Chief Information Officer's approval before acquiring and using cloud computing services.

The Director, Office of Acquisition and Assistance, develop and establish cloud service contracting requirements in accordance with the best practices for the following items: terms of service, service level agreements, nondisclosure agreements, and investigative access.

The Chief Information Officer modify USAID contract no. AID-CIO-O-13-00054 with MiCore Solutions Inc. for Google Apps for business to include: terms of service and assign a USAID official to monitor USAID's compliance with the terms.A service level agreement that addresses scheduled service outages, data
preservation responsibilities, and service agreement change. A signed nondisclosure agreement by the cloud service provider. A requirement for investigative access in accordance with best practices.

The Chief Information Officer modify USAID contract no. AID-CIO-M-11-00008 with Terremark Federal Group Inc. for Terremark Services to include:an assigned USAID official to monitor USAID's compliance with the terms of service. An executed service level agreement with the cloud service provider that addresses remedies to be paid when services are not available. A signed nondisclosure agreement by the cloud service provider. A requirement for investigative access in accordance with best practices.

The Chief Information Officer modify USAID contract no. AID-CTA-TO-13-00001/2 with Triad Technology Partners Inc. and Immix Technology Inc. for the Intranet Modernization Initiative to include:terms of service and assign a USAID official to monitor USAID's compliance with the terms. An executed service level agreement with the cloud service provider that addresses schedule service outages, data preservation responsibilities, service agreement changes, and remedies to be paid when services are not available. A signed nondisclosure agreement by the cloud service provider. A requirement for investigative access in accordance with best practices.

The Chief Information Officer establish or revise target dates in Google Apps for business's plan of action and milestones for action items that do not have a due date or are past-due.

The Chief Information Officer modify the contract for Google Apps for business to require that the cloud service provider be certified by the Federal Risk and Authorization Management Program, or move the service to a certified provider.

The Chief Information Officer complete the Federal Risk and Authorization Management Program Agency Authorization for Huddle and Tibbr for the Intranet Modernization Initiative by September 30, 2015, per the contract.

The Chief Information Officer assess and authorize security controls for Salesforce's CRM cloud-based system.

The Chief Information Officer update the Frequency of Reviews column in Automated Directives System, Chapter 577, Table 1 -Investment Funding Category Documentation and Review Requirements, by requiring post-implementation reviews for Investment Funding Category I and II as required by the Office of Management and Budget Circular A-130.

USAID/Armenia implement controls to incorporate lessons learned and concept paper review comments into project design.

USAID/Armenia document how the Clean Energy and Water Project is aligned with the country development cooperation strategy.

USAID/Armenia implement written procedures to document technical direction provided by the contracting officer's representative and give the directions to the contracting officer.

USAID/Armenia discuss and document the need for a Clean Energy and Water Project contract modification with the contracting officer and the contractor, and modify if needed.

USAID/Armenia develop and implement procedures to factor sustainability into project planning.

USAID/Armenia assess and document the Armenian Government's capacity and implement a sustainability plan for the Clean Energy and Water Project activities.

USAID/Armenia, in coordination with donors and others as necessary, determine the need for activities identified as potentially duplicative and document the results of the determination and coordination.

USAID/Armenia provide clarification on the contracting officer representative's approval of the implementing partner's documents, and train contracting officer representatives on the level of technical, administrative, and financial oversight they should provide to implementers.

USAID/Armenia require the contractor to provide detailed subcontractors' vouchers that have budget lines for costs such as salaries, allowances, and other direct costs.

USAID/Armenia provide missing rate approvals for implementing partner staff.

USAID/Armenia determine the amount of salaries billed, the allowability of $131,235 in unsupported salaries paid, and collect any deemed unallowable.

USAID/Armenia implement controls for identifying and reconciling budgeted versus actual project costs.

USAID/Armenia implement and document internal controls to make sure project management files maintain the minimum amount of documentation, in accordance with the designation letter. These files should be accessible and have adequate documentation for audit purposes and future contracting officers' representatives.

USAID/Armenia collaborate with the implementing partner to update the performance management plan to ensure validity, integrity, precision, and reliability of data, and document the results.

USAID/Armenia implement a plan to improve oversight and verification of the implementing partner's reported performance results.

USAID/Armenia determine the amount spent on energy, and discuss energy-related project priorities with the Bureau for Economic Growth, Education, and Environment's Energy and Infrastructure Office, take any related corrective actions, and document the discussion and results.

USAID/Rwanda modify the Family Health Project contract to establish binding performance standards.

USAID/Rwanda require Chemonics International Inc. to provide quarterly progress reports that include quantitative and sex-disaggregated performance management plan data.

USAID/Rwanda implement a system to track and document mission follow-up on issues and recommendations reported in data quality assessments.

USAID/Rwanda update its standard site visit checklist to reflect the site visit data verification steps required by the mission order.

USAID/Nepal work with World Wildlife Fund to increase the final target for Hectares of biodiverse area under improved management to reflect an ambitious, achievable result expected under the Hariyo Ban Program.

USAID/Nepal work with World Wildlife Fund to create standard reporting procedures for program income earned under the Hariyo Ban Program.

USAID/Nepal work with World Wildlife Fund to develop new guidance for cooperatives receiving revolving funds, including requirements to use funds in a timely manner and limit administrative expenses.

USAID/Nepal require the World Wildlife Fund to set performance targets or milestones for activities funded by Windows of Opportunity grants to gauge how successful they are in contributing to the Hariyo Ban Program's objectives.

USAID/Nepal require World Wildlife Fund to contract audits of its subrecipients Federation of Community Forest Users Nepal and National Trust for Nature Conservation for the fiscal years ending June 2013 and June 2014, and verify that an audit is completed for every subrecipient spending more than $300,000 in one fiscal year. The audits should be conducted in accordance with the Guidelines for Financial Audits Contracted by Foreign Recipients, dated February 2009.

USAID's Bureau for Policy, Planning, and Learning, as part of its next planned country development cooperation strategy policy revision, survey relevant Washington and mission staff to find ways to streamline the process to address these issues, and make sure these changes are written into the updated policy.

USAID's Bureau for Policy, Planning, and Learning work with relevant Washington staff to develop a written process and plan for reviewing and commenting on country development cooperation strategies, and set deadlines for getting feedback.

USAID's Bureau for Policy, Planning, and Learning define, track, and update regularly the complete list of USAID countries and regional missions and maintain a list of those granted exemptions from having country development cooperation strategies.

USAID's Bureau for Policy, Planning, and Learning revise policy to include documentation required to exempt a mission from having a country development cooperation strategy, as well as verification, approval, and tracking procedures.

USAID's Bureau for Policy, Planning, and Learning coordinate with the Administrator and Office of Budget Resources and Management to determine how to increase the focus on local priorities considering budgetary constraints, and document the results.

USAID's Bureau for Policy, Planning, and Learning revise policy to clarify how local priorities and budget are weighted and to what extent the country development cooperation strategy should reflect these needs, and include guidance on increasing focus on local priorities, as needed, based on its coordination efforts with the Administrator and Office of Budget Resources and Management.

USAID/Zambia implement a coordination strategy for its HIV program to help implementers avoid duplicating activities.

USAID/Zambia review the implementation strategy of its Partnership for Integrated Social Marketing Project and make changes to its community-based distribution program.

USAID/Zambia analyze the competing demands on contracting officer's representatives' time and implement solutions to make sure it has sufficient resources to perform fundamental oversight tasks.

USAID/Zambia require its contracting officer's representatives to complete USAID's records management training course and update project files to include the required documents.

USAID/Zambia, in collaboration with Population Services International, implement procedures to improve the tracking of HIV commodities, which includes using stock cards for all commodities stored in its warehouses.

USAID/Zambia, in collaboration with Population Services International, implement cost-effective procedures to address the environmental hazards at its central warehouse in Lusaka.

USAID/Zambia, in collaboration with Population Services International, implement procedures to improve the legibility of lot numbers and expiration dates stamped on commodities.

USAID/Peru adjust its ProDecentralization Project's remaining work plans to include a civil service law awareness campaign and provide technical assistance on how to implement the law.

USAID/Peru incorporate private sector involvement into the ProDecentralization activities and track them accordingly.

USAID's Chief Financial Officer either configure webTA so it prevents employees and supervisors from validating and certifying timesheets that include premium pay hours that have not been submitted and approved in accordance with webTA procedures and document the results or document the acceptance of the risk of not doing so.

USAID's Chief Financial Officer conduct a documented review of the 151 pay provider validation rules in webTA; make a written
determination on which rules apply to Agency operations, and based on that, document an approved webTA baseline set of controls.

USAID's Chief Information Officer, through the cognizant contracting officer, modify the written webTA contract to require the webTA vendor to provide detailed explanations of each pay provider validation rule, including the impact of each on the submission and approval of requests and the validation and approval of timesheets.

USAID's Chief Financial Officer coordinate with the Chief Human Capital Officer and the Chief Information Officer to designate in writing a responsible office for developing and enforcing premium pay policies and procedures, and update USAID's Automated Directives System 472 and 626, including mandatory internal references, accordingly.

USAID/Cote d'Ivoire, in coordination with USAID/West Africa's Regional Assistance and Acquisition Office, sign Modification 3 after verifying that it includes updated plans and a revised budget for construction activities.

USAID/Cote d'Ivoire document its intention to award the American Institutes for Research a no-cost extension to allow sufficient time to complete planned construction activities. If approved, the extension should require the American Institutes for Research to develop and implement a mission-approved schedule for construction.

USAID/Cote d'Ivoire, in coordination with the American Institutes for Research and the Ministry of Education, implement a memorandum of understanding to establish roles and responsibilities that aligns with the cooperative agreement.

USAID/Cote d'Ivoire, in coordination with USAID/West Africa's Regional Financial Management Office, review and document program disbursements as of June 30, 2014, and confirm that the implementer used funds appropriately.

USAID/Cote d'Ivoire train its staff to use PhoenixViewer to monitor payments to the implementer.

USAID/Cote d'Ivoire implement procedures to provide financial oversight of the program. These procedures should include verifying that the American Institutes for Research submits quarterly federal financial reports as required and that the agreement officer's representative compares these reports to the Agency's online financial reporting system.

USAID/Colombia document and implement a plan of action, with milestones, for the remainder of the program, to address the land titling plans that were submitted to the Colombian Government for approval.

USAID/Colombia determine the allowability of
$2,086,829 in ineligible questioned costs for subawards that were not competed, and recover from ACDI/VOCA any amounts deemed unallowable.

USAID/Colombia review all subawards issued by the Afro-Colombian and Indigenous Program that were awarded without competition and determine whether an adequate justification for exception to competition exists, take remedial action, including recovering any costs deemed unallowable, and document the results.

USAID/Colombia issue a written notice to ACDI/VOCA of its responsibilities related to competition, and document any exceptions to competition.

USAID/Colombia instruct ACDI/VOCA in writing to provide proper documentation supporting training lasting more than 1 day to USAID.

USAID/Colombia determine whether the midterm evaluation should be conducted as planned, make changes if appropriate, and document the results.