NATIONAL AERONAUTICS AND SPACE ADMINISTRATION 

REPORT 

PURSUANT TO 

 GOOD ACCOUNTING OBLIGATION IN GOVERNMENT ACT OF 2019 

(P.L. 115-414) 

As of November 30, 2019 
2 

Contents 

Background...................................................................................................................................................3

Summary.......................................................................................................................................................4

GAO Public Reports and Recommendations................................................................................................ 5

Open for More than One Year .................................................................................................................. 5

Implementation Status .............................................................................................................................. 5

GAO Recommendation Closed but Not Implemented.............................................................................. 6

Reconciliation with GAO’s Database of Open Recommendations .......................................................... 6

OIG Public Reports and Recommendations ................................................................................................. 6

Open for More than One Year .................................................................................................................. 6

Implementation Status .............................................................................................................................. 7

Reconciliation with NASA OIG Semi-Annual Report ............................................................................. 7

Appendix A...................................................................................................................................................8

GAO Recommendations Open More than One Year (Detail) .................................................................. 8

Actions Completed................................................................................................................................9

Actions In-Progress............................................................................................................................. 14

Non-Concurrences .............................................................................................................................. 23

Appendix B.................................................................................................................................................25

GAO Recommendations Closed but Not Implemented (Detail)............................................................. 25

Closed but Not Implemented .............................................................................................................. 26

Appendix C.................................................................................................................................................28

OIG Recommendations Open More Than One Year (Detail)................................................................. 28

Actions Completed.............................................................................................................................. 29

Actions In-Progress............................................................................................................................. 32
3 

NASA’S REQUIRED REPORTING UNDER THE GOOD ACCOUNTING 

OBLIGATION IN GOVERNMENT ACT (P.L. 115-414) 

Background 

In 2019, the President signed into law the “Good Accounting Obligation in Government Act” 

(the Act). The Act was envisioned to improve transparency into long-standing audit 

recommendations issued by the Government Accountability Office (GAO) and federal Office of 

Inspectors General (OIG). By requiring agency reporting on the lack of progress towards 

implementation, the Congress postulated that Federal agencies would be held more accountable 

and that the public can more readily assess agency funding requests in light of unfulfilled 

efficiency improvements that could potentially yield cost savings. 

Section 2 of the Act imposes an affirmative requirement on Federal agencies to submit an annual 

report on publicly-issued GAO and OIG recommendations classified as “open” for more than 

one year from the date of the annual budget justification submission. Additionally, the Act also 

requires that agencies report on publicly-issued GAO recommendations which were determined 

to “closed but not implemented.” For both categories of recommendations -- open, and closed 

but not implemented – Federal agencies are required to provide an explanation as to why final 

management action1 has not yet been completed. Finally, the Act also requires agencies perform 

a reconciliation of discrepancies between recommendations reported by GAO and OIGs, and 

Federal agencies. 

For purposes of NASA’s 2020 reporting under the Act, the following definitions are provided in 

order to enhance the utility and readability of this report: 

 Open: Final management action is pending/in-progress (includes recommendations for 

which final management action has been completed, but auditor verification/validation is 

pending/in-progress) 

 Closed: Final management action and corresponding auditor verification/validation 

completed 

 Closed/Not Implemented: Recommendation has been closed, however final 

management action has been partially completed, not completed, or action(s) not 

recommended have been taken. (Applicable only to GAO recommendations).

                                                            

1 Final Management Action: The completion of all actions that the management of an establishment has concluded, 

in its management decision, are necessary with respect to the findings and recommendations included in an audit 

report; or, in the event that the management of an establishment concludes no action is necessary, final action occurs 

when a management decision has been made. Source: Inspector General Act of 1978 (as amended). 
4 

Summary 

As of November 30, 2019, a combined total of 102 GAO and NASA OIG recommendations in 

48 public reports were open for more than one year from the date of issuance. Of these 102 open 

recommendations, 40 were issued by GAO and 62 were issued by the NASA OIG. Additionally, 

four GAO recommendations were “closed but not implemented” since NASA’s prior year (2019) 

submission under the Act (see Table 1). 

The 40 GAO recommendations open more than one year, as well as the four GAO 

recommendations which were “closed but not implemented,” were issued in 24 public reports 

during the period September 20, 2011 through August 2, 2018. While the 62 NASA OIG 

recommendations open more than one year were issued in 28 public reports during the period 

May 15, 2015 through November 28, 2018. Consequently, the effective reporting period 

covered by NASA’s 2020 GAO-IG Act submission is September 20, 2011 through November 

28, 2018. 

For contextual purposes, during the period September 20, 2011 through November 28, 2018, 

GAO issued a total of 50 public and non-public reports containing 200 recommendations 

addressed to NASA. While the NASA OIG issued a total of 65 public and non-public reports 

containing 547 total recommendations addressed to NASA during the period May 15, 2015 

through November 28, 2018. 

Table 1

   Open and Closed/Not Implemented Reports and Recommendations   

   As of November 30, 2019*   

   Reports Recommendations 

   Issued/Open Issued/Open 

Closed/Not 

Implemented 

   Issuing 

Entity 

Publicly 

Issued 

Open > 

1 Year Pct. 

Publicly 

Issued 

Open > 

1 Year Pct. Recs Pct. 

   GAO 49 20 41% 123 40 33% 4 3% 

   OIG 57 28 49% 377 62 16% n/a n/a 

   Total 106 48 45% 500 102 20% 4 3% 

 * GAO Reports Issued: 9/20/2011 - 8/2/2018   

               OIG Reports Issued: 5/15/2015 - 11/28/2018   
5 

GAO Public Reports and Recommendations

Open for More than One Year: As of November 30, 2019, a total of 40 GAO recommendations 

were open for more than one year from the date of issuance of the 20 corresponding public GAO 

reports. These 20 public reports and 40 corresponding recommendations were issued by GAO 

during the period September 20, 2011 through August 2, 2018 (see Table 2). 

The 40 GAO public recommendations open for more than one year represent one-third of 

publicly issued GAO recommendations addressed to NASA during the period September 20, 

2011 through August 2, 2018. Total (public and non-public) GAO reports and corresponding 

recommendations issued to NASA during the period September 20, 2012 through August 2, 

2018 timeframe were 50 and 200, respectively. The 40 public GAO recommendations open for 

more than one year as of November 30, 2019, constitute 20 percent of the 200 combined (public 

and non-public) recommendations issued to NASA during the September 20, 2011 through 

August 2, 2018 timeframe. 

Of the 40 public GAO recommendations open for more than one year as of November 30, 2019: 

 53 percent were open for more than one year but less than two years; 

 2 percent were open for more than two years but less than three years; 

 15 percent were open for more than three years but less than four years; 

 8 percent were open for more than four years but less than five years; 

 13 percent were open for more than five years but less than six years; 

 2 percent were open for more than six years but less than seven years; and

 7 percent were open for more than seven years but less than eight years

Table 2

   GAO Reports and Recommendations Open More than One Year   

   (As of 11/30/2019)   

   Reports Recommendations   

   Type Issued 

Open >1 

Year Pct. Issued 

Open >1 

Year Pct. 

Open > 1 Year 

(Pct. All Recs.)   

   Public 49 20 41% 123 40 33% 20%   

   NonPublic 1 1 100% 77 1 1% 1%   

   Total 50 21 42% 200 41 21% 21%   

     

Implementation Status: Detailed implementation status with regard to the 40 GAO 

recommendations open for more than one year as of November 30, 2019, is provided in 

Appendix A of this report. NASA corrective actions have been completed with respect to 38 

percent of these recommendations, while NASA corrective actions are in-progress with respect 

to 55 percent of these recommendations, and no further NASA actions are planned due to nonconcurrence with respect to 8 percent of these recommendations. 
6 

GAO Recommendation Closed but Not Implemented: Since the reporting date (February 28, 

2019) of NASA’s prior year submission under the GAO-IG Act, GAO has closed four 

recommendations as “not implemented.” The four “closed but not implemented” GAO 

recommendations correspond to four reports issued during the period September 20, 2011 

through July 16, 2015, with GAO closure occurring during the period May 7, 2018 through 

September 4, 2019. These four “closed but not implemented” recommendations constitute about 

three percent of the 123 total recommendations addressed to NASA in 49 public GAO reports 

issued during the period September 20, 2011 through August 2, 2018; and 2 percent of the 200 

recommendations addressed to NASA in 50 public and non-public reports issued during that 

same time frame. Details with respect to the four GAO recommendations “closed but not 

implemented’ during this reporting period are provided in Appendix B. 

Reconciliation with GAO’s Database of Open Recommendations: As of November 30, 2019, 

GAO’s online database of recommendations reflected a total of 40 recommendations in 20 GAO 

public reports which were open for more than one year. These 40 recommendations in 20 

reports coincide with the 40 recommendations in 20 GAO reports reflected in our reporting on 

GAO recommendations open for more than one year as reported above. As a result, there are no 

discrepancies requiring explanation between GAO reports and recommendations open for more 

than one year, as of November 30, 2019. 

OIG Public Reports and Recommendations 

Open for More than One Year: As of November 30, 2019, a total of 62 NASA OIG 

recommendations were open for more than one year from the date of issuance of the 

corresponding 28 publicly issued audit reports. These reports and recommendations were issued 

during the period May 15, 2015 through November 28, 2018 (see Table 3). 

The 62 public NASA OIG recommendations open for more than one year represent 19 percent of 

the 329 recommendations issued in 55 NASA OIG public reports during the period May 15, 

2015 through November 28, 2018. Furthermore, these 62 recommendations open for more than 

one year constitute 11 percent of the 547 total recommendations issued to NASA in 65 public 

and non-public OIG reports issued during the May 15, 2015 through November 28, 2018. 

 Table 3 

   OIG Reports and Recommendations Open More than One Year   

   (As of 11/30/2019)   

   Reports Recommendations 

   Type Issued 

Open >1 

Year Pct. Issued 

Open >1 

Year Pct. 

Open >1 Year 

(Pct. of All Recs.) 

   Public 55 28 51% 329 62 19% 11% 

   Non-Public 10 0 0% 218 0 0% 0% 

   Total 65 28 51% 547 62 11% 11% 

               

 
7 

Of the 62 NASA OIG recommendations open for more than one year as of November 30, 2019: 

 53 percent were open from between one and two years; 

 32 percent were open from between two and three years; 

 12 percent were open from between three and four years; and 

 3 percent were open from between four and five years 

Implementation Status: Details on the implementation status of each of the 62 NASA OIG 

public recommendations open for more than one year as of November 30, 2019, are provided in 

Appendix C of this report. Of these 62 publicly issued NASA OIG recommendations, 84 percent 

are in the implementation phase with on-going NASA corrective actions still in-progress, while 

NASA corrective actions have been completed and are awaiting OIG closure decisions for 16 

percent of these recommendations. 

Reconciliation with NASA OIG Semi-Annual Report: In their September 30, 2019 Semi-Annual 

Report (SAR), the NASA OIG reported a total of 181 open recommendations in 46 public and 

non-public audit reports issued to NASA. Of the 46 reports reflected in the semi-annual report, 

six were not publicly released. Additionally, 11 reports and their corresponding 60 

recommendations were open for less than one year as of the date of the OIG’s September SemiAnnual Report. As a result, the net number of NASA OIG public reports and recommendations 

open for more than one year as of September 30, 2019 totaled 29 and 59, respectively (see Table 

4). 

During the period October 1, 2019 through November 30, 2019, 19 recommendations in three 

public NASA OIG audit reports were added to the inventory of recommendations open more 

than one year. Additionally, during this same timeframe a separate population of 16 NASA OIG 

recommendations issued in four reports were closed, based on responsive management action. 

Consequently, a total of 62 NASA OIG recommendations in 28 reports were open more than one 

year as of November 30, 2019. 

Table 4

Reconciliation with OIG's September 30, 2019 Semi-Annual Report 

(As of 11/30/2019) 

   Reports Recommendations 

      

Total Open Reports and Recommendations as of 9/30/19 [OIG Semi-Annual Report] 46 181 

Minus: Non-Public Reports and Recommendations Included in OIG Semi- Annual Report (6) (62)

Minus: Public Reports and Recommendations Open Less than One Year (11) (60)

Net Public Reports and Recommendations Open More than One Year (as of 

9/30/19) 29 59 

Plus: Additional Public Reports and Recommendations Open More Than One Year 

(as of 10/1/19) 3 19 

Minus: Public Reports and Recommendations Open More than One Year on 

9/30/19 but Closed During 10/1/19 - 11/30/19 (4) (16)

Total Public Reports and Recommendations Open More than One Year 

(as of 11/30/19) 28 62 
8 

Appendix A 

GAO Recommendations Open More than One Year (Detail) 
9 

Actions Completed 

(Sort: Report Numbers Sorted Oldest Newest; Recommendation NumberAscending) 

1. Report: Telecommunications - Agencies Need Better Controls to Achieve Significant Savings on 

Mobile Devices and Services (GAO-15-431; 5/21/2015) 

Recommendation: (1) Ensure a complete inventory of mobile devices and associated services is 

established. 

Status: NASA Action Completed. NASA implemented a third-party tool, IBM Maas360, to 

enable the Agency to centrally manage smartphones and tablets that connect to NASA networks. 

The current tool configuration provides mobile device management (MDM) services for all 

mobile devices accessing data via NASA networks. The Mobile Device Registration (MDR) 

website for ACES Government Furnished Equipment (GFE), non-ACES GFE, and Personally 

Furnished Equipment (PFE) devices is operational and enrollment of GFE/PFE devices is 

ongoing. MDM enrollment for non-ACES GFE/PFE devices was aligned with the Office 365 

migration project schedule and is now complete. The NASA OCIO also released policies, 

guidance, and training related to the use of mobile devices that connect to NASA networks to all 

NASA Centers. The underlying service agreement with IBM for MaaS360 device management 

was renegotiated during the transition from ACES to the follow-on NASA End-User Services and 

Technology (NEST) contract and is still operable. The NEST contract still provides monthly 

deliverable documenting the carrier, device type, data/voice allocations, data/voice usage and 

other pertinent information. Once the guidance is issued and the remaining 15 percent of devices 

are brought under the existing contract, NASA will have a monthly deliverable depicting the 

services of all mobile devices. GAO review of corrective actions for closure is pending. 

Office of Primary Responsibility: Office of the Chief Information Officer 

Target Completion Date: n/a 

2. Report: Telecommunications - Agencies Need Better Controls to Achieve Significant Savings on 

Mobile Devices and Services (GAO-15-431; 5/21/2015) 

Recommendation: (2) A reliable inventory of mobile service contracts is developed and 

maintained. 

Status: NASA Action Completed. The NEST agreement went operational on September 1, 2019 

and provides mobile devices services for all NASA mobile devices users. GAO review of 

corrective actions for closure is pending. 

Office of Primary Responsibility: Office of the Chief Information Officer 

Target Completion Date: n/a 

3. Report: Telecommunications - Agencies Need Better Controls to Achieve Significant Savings on 

Mobile Devices and Services (GAO-15-431; 5/21/2015) 

Recommendation: (3) Procedures to monitor and control spending are established agency-wide. 

Specifically, ensure that: procedures include assessing devices for zero, under, and over usage; 

personnel with authority and responsibility for performing the procedures are identified; and the 

specific steps to be taken to perform the process are documented. 
10 

Status: NASA Action Completed. As a part of the Enterprise Mobility Service Contract 

deliverables, NASA requires monthly reports to monitor and optimize usage (zero, under, and 

over). NASA also has established role-based privileges to monitor and report on this activity 

Agency-wide. To elaborate, Agency IT POCs review monthly reports that include individual 

usage and cost for mobile devices and requires them to certify and/or investigate deviations. 

GAO review of corrective actions for closure is pending. 

Office of Primary Responsibility: Office of the Chief Information Officer 

Target Completion Date: n/a 

4. Report: Information Technology - Agencies Need to Improve Their Application Inventories to 

Achieve Additional Savings (GAO-16-511; 9/29/2016) 

Recommendation: (1) To improve NASA's efforts to rationalize its portfolio of applications, 

GAO recommends the NASA Administrator direct the CIO to improve NASA's inventory of 

applications by taking steps to fully address the practices that GAO identified as being partially 

met or not met. 

Status: NASA Action Completed. NASA completed final management actions in response to the 

recommendation in October 2019. Additional supporting documentation requested by, and 

provided to, GAO included an updated IT App Export report. GAO review of corrective actions 

for closure is pending. 

Office of Primary Responsibility: Office of the Chief Information Officer 

Target Completion Date: n/a 

5. Report: Federal Research Grants - Opportunities Remain for Agencies to Streamline 

Administrative Requirements (GAO-16-573; 7/22/2016)

Recommendation: (2) To reduce pre-award administrative workload and costs, particularly for 

applications that do not result in awards, the NASA Administrator should conduct agency-wide 

reviews of possible actions, such as further use of preliminary proposals, to postpone pre-award 

requirements until making a preliminary decision about an applicants' likelihood of funding, and 

through OSTP's Research Business Models working group, coordinate and report the result. 

Status: NASA Action Completed. The Grants Policy and Compliance Branch developed and 

issued policy regarding the adoption of preliminary proposals for program offices in its Grant and 

Cooperative Agreement Manual (GCAM). The NASA GCAM provides internal policy guidance 

to NASA Technical Officers, Grant Officers and Program Managers to implement governmentwide and NASA-specific regulations for awarding and administering grants and cooperative 

agreements with educational and non-profit organizations; State, local, and Indian tribal 

governments; and for-profit entities when no cost-sharing is required. The GCAM instructs the 

programs to solicit in a manner that diminishes administrative burden using a two-step approach 

for proposal submission. This is found in GCAM 5.2.2 Funding Opportunity Announcements, 

including instructions as outlined below, including considerations and instructions. On 8/16/19 

NASA requested closure of this recommendation which is currently under consideration by GAO. 
11 

Office of Primary Responsibility: Office of the Chief Financial Officer 

Target Completion Date: n/a 

6. Report: NASA Contractor Whistleblowers - Steps Taken to Implement Program but 

Improvements to Timeliness and Guidance Needed (GAO-18-262; 4/9/2018) 

Recommendation: (1) The Administrator should monitor, evaluate and make appropriate 

corrective actions, such as a documented process, to ensure it reviews reprisal complaints in a 

timely manner. 

Status: NASA Action Completed. NASA created an internal process document in coordination 

with NASA OIG that will best enable the Administration to carry out its duties pursuant to 10 

U.S.C. § 2409. The procedures ensure that all parties are provided the OIG Report of Findings 

and given an opportunity to timely submit a response to the Report that addresses any material 

fact in the Report that either the complainant or respondent disputes; any disputed conclusion of 

law; any proposed remedy pursuant to § 2409(c); and any additional information either party 

believes relevant to the decision. GAO has submitted a closure request to GAO based on the 

above actions. GAO's disposition of the recommendation is pending. 

Office of Primary Responsibility: Office of General Counsel 

Target Completion Date: n/a 

7. Report: NASA Contractor Whistleblowers - Steps Taken to Implement Program but 

Improvements to Timeliness and Guidance Needed (GAO-18-262; 4/9/2018) 

Recommendation: (2) The Administrator should review NASA's guidance or develop other 

guidance, including defining major modification, to clarify when whistle-blower protections are 

protections are conveyed. 

Status: NASA Action Completed. On 9/28/19, NASA issued a procurement information circular 

(PIC 18-02) which codified guidance on whistleblower protections for contractor and 

subcontractor employees. Based on the issuance of the PIC, NASA requested closure of the 

recommendation. On 10/9/19, GAO advised NASA that corrective actions are responsive to the 

recommendation and will close it (implemented) in due course. 

Office of Primary Responsibility: Office of Procurement 

Target Completion Date: n/a 

8. Report: NASA Contractor Whistleblowers - Steps Taken to Implement Program but 

Improvements to Timeliness and Guidance Needed (GAO-18-262; 4/9/2018) 

Recommendation: (3) The Administrator should communicate whistleblower protections to 

grantees and subgrantees and their employees. 

Status: NASA Action Completed. The guide for NASA federal financial assistance 

stakeholders, the Grant and Cooperative Agreement Manual (GCAM), has been updated to 

include agreed upon language included in federal-wide as well as NASA’s annual certifications 

and representations. Certifications and representations are requirements that entities preparing to 
12 

apply for NASA federal financial assistance must recognize and complete. Based on completion 

of the above actions, NASA submitted a closure request to GAO on 9/30/19. GAO's disposition 

of the recommendation is pending. 

Office of Primary Responsibility: Office of the Chief Financial Officer 

Target Completion Date: n/a 

9. Report: Federal Research: Additional Actions Needed to Improve Licensing of Patented 

Laboratory Inventions (GAO-18-327; 6/19/2018) 

Recommendation: (1) The Administrator of NASA should ensure the agency or its labs 

document processes for establishing license financial terms, while maintaining flexibility to tailor 

the financial terms of each license. 

Status: NASA Action Completed. NASA completed planned corrective actions in May 2019 

including the roll-out of an information website for licensing mangers NASA’s quarterly 

Interagency Working Group on Technology Transfer. GAO review of corrective actions for 

closure is pending. 

Office of Primary Responsibility: Space Technology Mission Directorate 

Target Completion Date: n/a 

10. Report: NASA Information Technology - Urgent Action Needed to Address Significant 

Management and Cybersecurity Weaknesses (GAO-18-337; 5/22/2018) 

Recommendation: (5) The Administrator should direct the Chief Information Officer to update 

policies and procedures for selecting investments to provide a structured process, including 

thresholds and criteria needed for, among other things, evaluating investment risks as part of 

governance board decision making, and outline a process for reselecting investments. 

Status: NASA Action Completed. Nominal completion of related corrective actions occurred in 

April 2019. However, in July 2019, GAO requested additional documentation in order to support 

their closure determination. NASA provided the supplemental supporting documentation in 

November 2019. GAO review for closure is pending. 

Office of Primary Responsibility: Office of the Chief Information Officer 

Target Completion Date: n/a 

11. Report: NASA Information Technology - Urgent Action Needed to Address Significant 

Management and Cybersecurity Weaknesses (GAO-18-337; 5/22/2018) 

Recommendation: (7) The Administrator should sure that the Chief Information Officer fully 

defines policies and procedures for developing the portfolio criteria, creating the portfolio, and 

evaluating the portfolio. 

Status: NASA Action Completed. Nominal completion of related corrective actions occurred in 

April 2019. However, in July 2019, GAO requested additional documentation in order to support 

their closure determination. NASA provided the supplemental supporting documentation in 

November 2019. GAO review for closure is pending. 
13 

Office of Primary Responsibility: Office of the Chief Information Officer 

Target Completion Date: n/a 

12. Report: Freedom of Information Act - Agencies Are Implementing Requirements but 

Additional Actions Are Needed (GAO-18-365; 6/25/2018) 

Recommendation: (1) Update and publish comprehensive FOIA regulations that describe 

dispute resolutions services and notifies requesters of the 90 days for appeals. 

Status: NASA Action Completed. NASA made revisions to its FOIA regulations pursuant to the 

requirements of the FOIA Improvement Act of 2016, and incorporated GAO’s recommendations 

by providing an explanation of requesters' right to dispute resolution and requesters' right to file 

an appeal within 90 days from the agency's final response. The revisions were published on Oct. 

11, 2019. 

Office of Primary Responsibility: Office of Communications 

Target Completion Date: n/a 

13. Report: Information Technology: Agencies Need to Involve Chief Information Officers in 

Reviewing Billions of Dollars in Acquisitions (GAO-18-42; 1/10/2018) 

Recommendation: (3) The Administrator of NASA should ensure that IT acquisition plans or 

strategies are reviewed and approved according to OMB guidance. 

Status: NASA Action Completed. NASA actions were completed in September 2019. A request 

for closure was submitted in September. GAO review of corrective actions for closure is 

pending. 

Office of Primary Responsibility: Office of the Chief Information Officer 

Target Completion Date: n/a 

14. Report: NASA Commercial Crew Program - Plan Needed to Ensure Uninterrupted Access to 

the International Space Station (GAO-18-476; 7/11/2018) 

Recommendation: (2) The NASA Administrator should develop and maintain a contingency 

plan for ensuring a presence on the ISS until a Commercial Crew Program contractor is certified. 

Status: NASA Action Completed. On 10/24/19, the NASA Administrator submitted a letter to 

his counterpart at Roscosmos requesting one seat on the fall 2020 Soyuz and one seat on the 

spring 2021 Soyuz. In addition, NASA is providing Extra-Vehicular Activity and robotics 

training for a subset of cosmonauts to support U.S. Operating Segment operations. NASA is also 

looking at a possible extension of the duration of the SpaceX Demonstration 2 crewed test flight. 

Office of Primary Responsibility: Human Exploration and Operations Mission Directorate 

Target Completion Date: n/a 
14 

15. Report: NASA Commercial Crew Program: Plan Needed to Ensure Uninterrupted Access to 

the International Space Station (GAO-18-476; 7/11/2018) 

Recommendation: (3) The NASA Administrator should direct the Chief Safety and Mission 

Assurance, the NASA Associate Administrator for Human Exploration and Operations, the 

Commercial Crew Program Manager and the Commercial Crew Program Contracting Officer to 

collectively determine and document before the agency certification review, how the agency will 

determine its risk tolerance level with respect to loss of crew. 

Status: NASA Action Completed. NASA believes it has met the intent of this recommendation 

and indicated such in its 9/27/18 Statement of Actions in response to GAO's final report. The 

requirement to limit risk to loss of crew was documented in HEOMD CCTS Certification 

Requirements for NASA LEO Missions (HEOMD-CSD-10001), and the Agency’s risk tolerance 

level was documented in the Decision Memorandum for the Administrator, “Agency’s Safety 

Goals and Thresholds for the Crew Transportation Missions to the International Space Station 

(ISS),” dated May 17, 2011. The CCP will document the commercial system’s ability to meet 

requirements through design and operational mitigations in its Human Rating Certification 

Package which will be finalized at the Agency certification reviews. If a commercial system 

cannot meet the requirement (or any other requirements), the program will request a waiver from 

NASA Headquarters as part of the Human Rating Certification process to ensure transparency 

and to continue emphasis of safety performance under its contracts. 

Office of Primary Responsibility: Human Exploration and Operations Mission Directorate 

Target Completion Date: n/a 

Actions In-Progress 

(Reports Sorted Oldest Newest) 

16. Report: Enterprise Architecture Value Needs to be Measured and Reported (GAO-12-791; 

9/26/2012) 

Recommendation: (1) Fully establish an approach for measuring enterprise architecture 

outcomes, including a documented methodology and metrics that are measurable, meaningful, 

repeatable, consistent, actionable, and aligned with the agency’s enterprise architecture’s strategic 

goals and intended purpose. 

Status: In-Progress. NASA has delayed updating procedural requirements for Enterprise 

Architecture (NPR 2830.1) that would address this recommendation as a result of the Mission 

Support Future Architecture Program (MAP) that is implementing a phased approach to 

transform all mission support services from their current state to an enterprise operating model 

while maintaining mission focus, improving efficiency, ensuring local authority and valuing the 

workforce. The OCIO expects the results of MAP activities to alter the approach and outcomes 

associated with Enterprise Architecture (EA). As envisioned, the NPR would establish EA as a 

key element of Agency IT governance. The revised version of the NPR would also better align 

enterprise architecture metrics and methods to measure outcomes (vs. output as cited in the GAO 

report) and benefits. While some EA work continues, the implementation of the EA program and 

policy will occur at the conclusion of the Agency-wide vetting and decisions expected after 

9/30/2020. 
15 

Office of Primary Responsibility: Office of the Chief Information Officer 

Target Completion Date: 9/30/2020 

17. Report: Enterprise Architecture Value Needs to be Measured and Reported (GAO-12-791; 

9/26/2012) 

Recommendation: (2) Periodically measure and report enterprise architecture outcomes and 

benefits to top agency officials (i.e., executives with authority to commit resources or make 

changes to the program) and to OMB. 

Status: In-Progress. Implementation of recommendation 2 is predicated on implementation of 

recommendation 1 and is not expected prior to 9/30/2020. 

Office of Primary Responsibility: Office of the Chief Information Officer 

Target Completion Date: 9/30/2020 

18. Report: Earned Value Management Implementation Across Major Spaceflight Projects Is 

Uneven (GAO-13-22; 11/19/2012) 

Recommendation: (4) To improve the reliability of project EVM data, NPR 7120.5 should be 

modified to require projects to implement a formal surveillance program that: a) Ensures 

anomalies in contractor-delivered monthly earned value management reports are identified and 

explained, and report periodically to the mission directorate’s leadership on relevant trends in the 

number of unexplained anomalies; b) Ensures consistent use of WBSs for both the EVM report 

and the schedule; c) Ensures that lower level EVM data reconcile to project level EVM data 

using the same WBS structure; and d) Improves underlying schedules so that they are properly 

sequenced using predecessor and successor dependencies and are free of constraints to the extent 

practicable so that the EVM baseline is reliable. 

Status: In-Progress. In December 2018, the Agency Program Management Council (APMC) 

approved a Corrective Action Plan (CAP) to Enhance EVM Implementation, which includes 

steps to put into operation formal EVMS surveillance. In February 2019, the EVM Steering 

Committee approved additional funding to execute the CAP initiative and begin implementation 

of formal EVMS surveillance. Near term steps include: 1) Develop an annual EVMS 

Surveillance Plan to include both in-house work scope and contracts; 2) Improve EVM 

Assessments at the project level to include in-house work scope; 3) Improve EVM surveillance 

“flow down” to DCMA for contracts; 4) Require projects to perform monthly EVM data anomaly 

assessments for all Category 1 projects; 5) Require projects to report EVM data anomalies to 

Mission Directorates and OCFO/SID and require corrective action plans for resolution of any 

material issues; and 6) Conduct EVM surveillance using NASA resources on major contractors 

where DCMA does not have an existing presence. For additional details on the NASA CAP 

Enhanced EVM initiative, go to NASA.gov at 

https://www.nasa.gov/sites/default/files/atoms/files/nasa_high_risk_corrective_action_plan_2018.

pdf for more information. 

Office of Primary Responsibility: Office of the Chief Financial Officer 

Target Completion Date: 9/30/2021 
16 

19. Report: NASA Actions Need to Improve Transparency and Assess Long-Term Affordability of 

Human Exploration Programs (GAO-14-385; 5/8/2014) 

Recommendation: (1) Establish a separate cost and schedule baseline for work required to 

support the SLS Block I EM-2 and report this information to the Congress through NASA’s 

annual budget submission. If NASA decides to fly the SLS Block I beyond EM-2, establish 

separate life cycle cost and schedule baseline estimates for those efforts, to include funding for 

operations and sustainment, and report this information annually to Congress via the agency’s 

budget submission. 

Status: In-Progress. ESD will expedite efforts to meet GAO best practices on contract 

management and reporting. Now that the manifest is better defined and contracts are in place, 

ESD will be in a better position to respond to GAO's recommendation and provide additional 

transparency on estimated contract cost and performance. ESD will implement NASA policy 

guidance as required to establish commitments for capabilities implemented above the $250M 

lifecycle cost threshold by establishing contract performance commitments for EUS and ML-2. 

ESD is also standardizing criteria for evaluation of contract performance, enhancing the use of 

EVM, and incorporating other management practices highlighted in the GAO reports. ESD will 

continue to provide detailed information to the GAO during the annual audit process reflecting on 

these changes. 

Office of Primary Responsibility: Human Exploration and Operations Mission Directorate 

Target Completion Date: 12/31/2020 

20. Report: NASA Actions Need to Improve Transparency and Assess Long-Term Affordability of 

Human Exploration Programs (GAO-14-385; 5/8/2014) 

Recommendation: (3) Because NASA intends to use increased capabilities of the SLS, Orion 

and GSDO efforts well into the future and has chosen to estimate costs associated with achieving 

capabilities, establish separate cost and schedule baselines for each additional capability that 

encompass all life cycle costs, to include operations and sustainment. When NASA cannot fully 

specify costs due to lack of well-defined missions or flight manifests, forecast a cost estimate 

range – including life cycle costs – having minimum and maximum boundaries. These baselines 

or ranges should be reported to Congress annually via the agency’s budget submission. 

Status: In-Progress. ESD will expedite efforts to meet GAO best practices on contract 

management and reporting. Now that the manifest is better defined and contracts are in place, 

ESD will be in a better position to respond to GAO's recommendation and provide additional 

transparency on estimated contract cost and performance. ESD will implement NASA policy 

guidance as required to establish commitments for capabilities implemented above the $250M 

lifecycle cost threshold by establishing contract performance commitments for EUS and ML-2. 

ESD is also standardizing criteria for evaluation of contract performance, enhancing the use of 

EVM, and incorporating other management practices highlighted in the GAO reports. ESD will 

continue to provide detailed information to the GAO during the annual audit process reflecting on 

these changes. 

Office of Primary Responsibility: Human Exploration and Operations Mission Directorate 

Target Completion Date: 12/31/2020 
17 

21. Report: Space Launch System - Resources Need to be Matched to Requirements to Decrease 

Risk and Support Long Term Affordability (GAO-14-631; 7/23/2014) 

Recommendation: (2) To provide decisionmakers with an informed basis for making investment 

decisions regarding the SLS program, NASA should identify a range of possible missions for 

each future SLS variant that includes cost and schedule estimates and plans for how those 

possible missions would fit within NASA’s funding profile. 

Status: In-Progress. ESD will expedite efforts to meet GAO best practices on contract 

management and reporting. Now that the manifest is better defined and contracts are in place, 

ESD will be in a better position to respond to GAO's recommendation and provide additional 

transparency on estimated contract cost and performance. ESD will implement NASA policy 

guidance as required to establish commitments for capabilities implemented above the $250M 

lifecycle cost threshold by establishing contract performance commitments for EUS and ML-2. 

ESD is also standardizing criteria for evaluation of contract performance, enhancing the use of 

EVM, and incorporating other management practices highlighted in the GAO reports. ESD will 

continue to provide detailed information to the GAO during the annual audit process reflecting on 

these changes. 

Office of Primary Responsibility: Human Exploration and Operations Mission Directorate 

Target Completion Date: 12/31/2020 

22. Report: Space Launch System - Resources Need to be Matched to Requirements to Decrease 

Risk and Support Long Term Affordability (GAO-14-631; 7/23/2014) 

Recommendation: (3) To allow for a continued assessment of progress and affordability, NASA 

should structure each future increment of SLS capability with a total cost exceeding the $250 

million threshold for designation as a major project as a separate development project within the 

SLS program. 

Status: In-Progress. ESD will expedite efforts to meet GAO best practices on contract 

management and reporting. Now that the manifest is better defined and contracts are in place, 

ESD will be in a better position to respond to GAO's recommendation and provide additional 

transparency on estimated contract cost and performance. ESD will implement NASA policy 

guidance as required to establish commitments for capabilities implemented above the $250M 

lifecycle cost threshold by establishing contract performance commitments for EUS and ML-2. 

ESD is also standardizing criteria for evaluation of contract performance, enhancing the use of 

EVM, and incorporating other management practices highlighted in the GAO reports. ESD will 

continue to provide detailed information to the GAO during the annual audit process reflecting on 

these changes. 

Office of Primary Responsibility: Human Exploration and Operations Mission Directorate 

Target Completion Date: 12/31/2020 
18 

23. Report: Space Launch System - Resources Need to be Matched to Requirements to Decrease 

Risk and Support Long Term Affordability (GAO-14-631; 7/23/2014) 

Recommendation: (4) To promote affordability, before finalizing acquisition plans for future 

capability variants, NASA should assess the full range of competition opportunities and provide 

to the Congress the agency’s assessment of the extent to which development and production of 

future elements of the SLS could be competitively procured. 

Status: In-Progress. ESD will expedite efforts to meet GAO best practices on contract 

management and reporting. Now that the manifest is better defined and contracts are in place, 

ESD will be in a better position to respond to GAO's recommendation and provide additional 

transparency on estimated contract cost and performance. ESD will implement NASA policy 

guidance as required to establish commitments for capabilities implemented above the $250M 

lifecycle cost threshold by establishing contract performance commitments for EUS and ML-2. 

ESD is also standardizing criteria for evaluation of contract performance, enhancing the use of 

EVM, and incorporating other management practices highlighted in the GAO reports. ESD will 

continue to provide detailed information to the GAO during the annual audit process reflecting on 

these changes. 

Office of Primary Responsibility: Human Exploration and Operations Mission Directorate 

Target Completion Date: 12/31/2020 

24. Report: Information Technology - Additional OMB and Agency Actions Are Needed to Achieve 

Portfolio Savings (GAO-14-65; 11/6/2013) 

Recommendation: (1) Reflect 100 percent of information technology investments in the agency's 

enterprise architecture. 

Status: In-Progress. NASA has delayed implementation of this recommendation as a result of 

the Mission Support Architecture Program (MAP) that is implementing a phased approach to 

transform all mission support services from their current state to an enterprise operating model 

while maintaining mission focus, improving efficiency, ensuring local authority and valuing the 

workforce. During MAP, EA will be assessed, and decisions made on future approaches using an 

Agency-wide decision-making process. While some EA work continues, the implementation of 

an EA program will occur at the conclusion of the Agency-wide vetting expected after 9/30/2020. 

Office of Primary Responsibility: Office of the Chief Information Officer 

Target Completion Date: 4/30/2020 

25. Report: Data Center Consolidation: Agencies Making Progress but Planned Saving Goals Need 

to be Established (GAO-16-323; 3/3/2016) 

Recommendation: (2) The NASA Administrator should take action to improve progress in the 

data center optimization areas that were reported as not meeting OMB's established targets, 

including addressing any identified challenges. 

Status: In-Progress. NASA submitted a closure request to GAO in 2017 that was denied as the 

Agency had not met 4 of the 5 metrics. Since then, the metrics have changed, and the Agency is 
19 

currently meeting the metrics outlined and contained in the Integrated Data Collection report. 

Revised estimated completion date for remaining NASA actions is June 2020. 

Office of Primary Responsibility: Office of the Chief Information Officer 

Target Completion Date: 6/30/2020 

26. Report: Federal Research Grants - Opportunities Remain for Agencies to Streamline 

Administrative Requirements (GAO-16-573; 7/22/2016) 

Recommendation: (1) To further standardize administrative research requirements, the NASA 

Administrator should coordinate through the OSTP Research Business Models working group to 

identify additional areas where they can standardize requirements and report these efforts. 

Status: In-Progress. All identified agencies are collaborating, discovering and implementing 

ways across the federal government to reduce burden. These efforts are reported out in an annual 

report issued through the RBM. The final report will be issued in or around March 2020. The 

first report was issued in March of 2018. The second report was expected to be released in March 

2019 but has not yet been released due to the change in RBM leadership. Next steps to be 

determined. 

Office of Primary Responsibility: Office of the Chief Financial Officer 

Target Completion Date: 3/31/2020 

27. Report: Orion Multi-Purpose Crew Vehicle - Action Needed to Improve Viability into Cost 

Schedule, and Capacity to Resolve Technical Challenges (GAO-16-620; 7/27/2016) 

Recommendation: (1) To provide the Congress and NASA a reliable estimate of program cost 

and schedule that are useful to support management and stakeholder decisions, GAO 

recommends the NASA Administrator direct the Orion program to perform an updated JCL 

analysis including updating cost and schedule estimates in adherence with cost and schedule 

estimating best practices. 

Status: In-Progress. The Orion program will conduct a JCL in accordance with Agency policy to 

conduct JCLs at KDP-D for programs at least 5 percent over Agency Baseline Commitment. 

 Office of Primary Responsibility: Human Exploration and Operations Mission Directorate 

Target Completion Date: 12/31/2020 

28. Report: Federal Chief Information Officers - Opportunities Exist to Improve Roles and 

Address Challenges to Authority (GAO-16-686; 9/15/2016) 

Recommendation: (1) Define the Senior Agency Information Security Officer (SAISO) role in 

agency policy of contractor oversight system security for information systems that are operated 

by contractors on the Agency's behalf. 

Status: In-Progress. NASA remains committed to ensuring the role of the NASA Senior Agency 

Information Security Officer (SAISO) is defined in Agency policy in accordance with the FISMA 

Act of 2014. Given the substantive role the SAISO executes to ensure the cybersecurity of the 
20 

Agency, multiple documents are being revised and published to explicitly address this position 

regarding contractor system security. Because of new federal requirements, the internal Agency 

reorganization, and continue updating NASA’s cybersecurity policies, and internal review 

process for final release of certain document modifications, this update has taken longer than 

anticipated. 

Office of Primary Responsibility: Office of the Chief Information Officer 

 

Target Completion Date: 3/20/2020 

29. Report: Information Technology Reform - Agencies Need to Improve Certification of 

Incremental Development (GAO-18-148; 11/7/2017) 

Recommendation: (1) Ensure that the CIO of NASA establishes an agency-wide policy and 

process for the CIO's certification of major IT investments' adequate use of incremental 

development in accordance with OMB's guidance on the implementation of FITARA, and 

confirm it includes; a description of how CIO certification will be documented; and a definition 

of incremental development and time frames for delivering functionality, consistent with OMB 

guidance. 

Status: In-Progress. NASA updated the following policies to address the incremental 

development requirement: NASA Policy Directive (NPD) 2800.1, “Managing Information 

Technology,” and NASA Procedural Requirement (NPR) 7120.7, “NASA Information 

Technology and Institutional Infrastructure Program and Project Management Requirements.” 

NPD 2800.1 will include, within the OCIO’s roles and responsibilities, a responsibility for 

certifying that IT resources are adequately implementing incremental development. NPR 7120.7 

is being updated to include a definition of incremental development and processes for ensuring 

that the CIO certifies incremental development. 

Office of Primary Responsibility: Office of the Chief Information Officer 

Target Completion Date: 3/31/2020 

30. Report: NASA Information Technology - Urgent Action Needed to Address Significant 

Management and Cybersecurity Weaknesses (GAO-18-337; 5/22/2018) 

Recommendation: (2) The Administrator should direct the Chief Information Officer to update 

the IT strategic plan for 2018 to 2021 and develop associated implementation plans to ensure it 

fully describes strategies the agency will use to achieve the desired results and descriptions of 

interdependencies within and across programs. 

Status: In-Progress. NASA requested an extension in October 2019 and provided additional 

information to GAO on the status of the Cybersecurity & Privacy Program Plan which is 

currently in the OCIO Review & Disposition process. 

Office of Primary Responsibility: Office of the Chief Information Officer 

Target Completion Date: 2/28/2020 
21 

31. Report: NASA Information Technology - Urgent Action Needed to Address Significant 

Management and Cybersecurity Weaknesses (GAO-18-337; 5/22/2018) 

Recommendation: (4) The Administrator should direct the Chief Information Officer to institute 

an effective IT governance structure by completing planned improvement efforts and finalizing 

charters to fully establish IT governance boards, clearly defining roles and responsibilities for 

selecting and overseeing IT investments and ensuring that the governance boards operate as 

intended. 

Status: In-Progress. Due to the government furlough and the associated delays in both restart and 

return to full operations, the sixth and final program plan, Cybersecurity, is under review. The 

program plans and governing board charters for all programs except Cybersecurity are complete 

and signed. The governing board charter for Cybersecurity was established in 2013 and is still in 

operation. The program plans define roles and responsibilities for selecting and overseeing IT 

investments. The ITC and CLT annual reviews were completed in November 2018. To ensure 

adequate time to allow for review and signature of the final piece of evidence, the Cybersecurity 

Program Plan, an extension was requested. 

Office of Primary Responsibility: Office of the Chief Information Officer 

Target Completion Date: 2/28/2020 

32. Report: NASA Information Technology - Urgent Action Needed to Address Significant 

Management and Cybersecurity Weaknesses (GAO-18-337; 5/22/2018) 

Recommendation: (6) The Administrator should direct the Chief Information Officer to address 

weaknesses in oversight practices and ensure routine oversight of all investments by taking action 

to document criteria for escalating investments among governance boards and establish 

procedures for tracking corrective actions for underperforming investments. 

Status: In-Progress. NASA on-track to complete planned corrective actions in early 2020. 

Office of Primary Responsibility: Office of the Chief Information Officer 

Target Completion Date: 1/31/2020 

33. Report: NASA Information Technology - Urgent Action Needed to Address Significant 

Management and Cybersecurity Weaknesses (GAO-18-337; 5/22/2018) 

Recommendation: (8) The Administrator should direct the Chief Information Officer to establish 

an agency-wide approach to managing cybersecurity risk that includes a cybersecurity strategy 

that, among other things, makes explicit the agency’s risk tolerance, accepted risk assessment 

methodologies, a process for consistently evaluating risk across the organization, response 

strategies and approaches for monitoring risk over time, and priorities for risk management 

investments. 

Status: In-Progress. From May 2018 to December 2018, the OCIO undertook a significant 

review of existing processes, policies, and practices to determine where risk management gaps 

exist. The NASA Chief Cybersecurity Risk Officer created a proposal to support developing a 

complete cyber risk and resiliency program, of which a core responsibility includes overseeing a 

cybersecurity risk management strategy. However, the government shutdown from December 
22 

2018 to January 2019 delayed this proposal due to OCIO’s need to shift funding and operational 

priorities to resume post-shutdown operations. In June 2019, the OCIO decided to pursue the 

Department of Homeland Security’s (DHS) Continuous Diagnostics and Mitigation’s (CDM) 

DEFEND contract vehicle to support this proposal. As cyber risk management requires a 

comprehensive organizational approach, OCIO is confident that working with DHS will help 

integrate risk management practices with current government security tools. This approach is also 

consistent with GAO-19-384, published July 25, 2019, which includes a recommendation for the 

Director of the Office of Management and Budget (OMB), in coordination with DHS, to help 

establish guidance for how to implement consistent cybersecurity risk management policies and 

procedures across an agency. The OCIO is awaiting a decision from DHS on the current Request 

for Service. 

Office of Primary Responsibility: Office of the Chief Information Officer 

Target Completion Date: 9/30/2020 

34. Report: NASA Information Technology - Urgent Action Needed to Address Significant 

Management and Cybersecurity Weaknesses (GAO-18-337; 5/22/2018) 

Recommendation: (10) The Administrator should direct the Chief Information Officer to 

establish an agency-wide approach to managing cybersecurity risk that includes policies and 

procedures with well-defined roles and responsibilities that are integrated and reflect NASA’s 

current security practices and operating environment. 

Status: In-Progress. The OCIO is working with outside consultants to map-out current policy 

processes to identify bottlenecks, gaps, and inefficiencies, and is working to overcome those 

issues. Additionally, a Cybersecurity Integration Team, an effort consisting of key stakeholder 

offices from across NASA, is examining a number of policies used to implement cybersecurity 

across NASA projects. The team is identifying gaps and plans to propose solutions such as 

specific language to enhance definitions for roles and responsibilities. This will ensure that 

cybersecurity is considered in both policy and practice throughout all phases of a project’s 

lifecycle. 

Office of Primary Responsibility: Office of the Chief Information Officer 

Target Completion Date: 11/30/2020 

35. Report: Freedom of Information Act - Agencies Are Implementing Requirements but 

Additional Actions Are Needed (GAO-18-365; 6/25/2018) 

Recommendation: (2) The Administrator of NASA should provide agency records of final 

opinions online. 

Status: In-Progress. NASA will publish any final opinions as they are issued and reviewed for 

public posting. 

Office of Primary Responsibility: Office of Communications 

Target Completion Date: 1/31/2020 
23 

36. Report: NASA Commercial Crew Program - Plan Needed to Ensure Uninterrupted Access to 

the International Space Station (GAO-18-476; 7/11/2018) 

Recommendation: (4) After completing the Agency certification review, NASA Chief Engineer 

and Chief Safety and Mission Assurance, with support from the NASA Associate Administrator 

for Human Exploration and Operation and the Commercial Crew Program Manager, should 

document lessons learned related to loss of crew as a safety threshold for future crewed 

spaceflight missions, given the complexity of the metric. 

Status: In-Progress. Planned corrective actions are in-progress, including collection of data in 

conjunction with human rating policy stakeholder survey. 

Office of Primary Responsibility: Office of Safety and Mission Assurance 

Target Completion Date: n/a 

37. Report: Federal Chief Information Officers Critical Actions Needed to Address Shortcomings 

and Challenges in Implementing Responsibilities (GAO-18-93; 8/2/2018) 

Recommendation: (1) The Administrator of the National Aeronautics Space Administration 

should ensure that the department's IT management policies address the role of the CIO for key 

responsibilities in the 6 areas GAO identified. 

Status: In-Progress. Final management actions are nearing completion and are expected to be 

finalized not later than early 2020. 

Office of Primary Responsibility: Office of the Chief Information Officer 

Target Completion Date: 1/31/2020 

Non-Concurrences 

(Reports Sorted Oldest Newest) 

38. Report: NASA Information Technology - Urgent Action Needed to Address Significant 

Management and Cybersecurity Weaknesses (GAO-18-337; 5/22/2018) 

Recommendation: (3) The Administrator should direct the Chief Information Officer address, in 

conjunction with the Chief Human Capital Officer, gaps in IT workforce planning by fully 

implementing the eight key IT workforce planning activities noted in this report. 

Status: Non-Concur. NASA is conducting a comprehensive, Agency-wide assessment that is 

designed to ensure that NASA resources are optimally structured to achieve the NASA mission. 

The first piece of this assessment is the Mission Support Future Architecture Program which aims 

at re-aligning mission support functions from a decentralized model to an enterprise model. The 

OCIO is in the beginning phases of this realignment with estimated completion in FY22. 

Additionally, the 2018 Strategic Workforce Planning (SWP) project directed the creation of an 

Agency Workforce Master Plan that: a) Estimates workforce needs five plus years into the future 

and defines the size and composition of the NASA workforce needed to meet future mission 

requirements; b) Includes civil service, contractors, and other workforce segments; c) Includes 
24 

both mission direct and mission support workforce; and e) Considers external changes, program 

lifecycle evolution (e.g., future of ISS, Gateway etc.), current Agency demographics, and other 

environmental or internally-driven factors (e.g. MAP) that impact the workforce. The data 

collection phase of the SWP project has been completed and the Agency is currently analyzing 

the data to glean insights and make recommendations. 

Office of Primary Responsibility: Office of the Chief Information Officer 

Target Completion Date: n/a 

39. Report: Cybersecurity Workforce - Agencies Need to Improve Baseline Assessments and 

Procedures for Coding Positions (GAO-18-466; 6/14/2018) 

Recommendation: (1) The Administrator of the National Aeronautics and Space Administration 

should evaluate the level of preparedness for cybersecurity personnel not currently holding 

professional certifications to take certification exams and report this information to Congress. 

Status: Non-Concur. NASA non-concurred with GAO’s recommendation, citing the fact that 

there is currently no federal or Agency requirement for employees in cybersecurity positions to 

hold and/or maintain a professional certification. Without this requirement, there is no plan to 

assess readiness of cybersecurity personnel to take certification exams. NASA provided the 

initial assessment to Congress in December 2016 and does not plan to repeat the assessment at 

this time. 

Office of Primary Responsibility: Office of the Chief Human Capital Officer 

Target Completion Date: n/a 

40. Report: NASA Commercial Crew Program - Plan Needed to Ensure Uninterrupted Access to 

the International Space Station (GAO-18-476; 7/11/2018) 

Recommendation: (1) The NASA Administrator for Human Exploration and Operations should 

direct the Commercial Crew Program to include the results of its schedule risk analysis in its 

mandatory quarterly reports to Congress. 

Status: Non-Concur. NASA non-concurred with GAO's recommendation. NASA provides 

quarterly Congressional reports in accordance with the Explanatory Statement accompanying the 

Fiscal Year 2015 Consolidated and Further Continuing Appropriations Act (P.L. 113-235) which 

includes a NASA qualitative statement regarding milestone schedules. However, NASA is 

assessing its schedule process and frequency for releasing flight test and post-certification 

mission dates to provide the latest schedules as timely as practicable. 

Office of Primary Responsibility: Human Exploration and Operations Mission Directorate 

Target Completion Date: n/a 
25 

Appendix B 

GAO Recommendations Closed but Not Implemented (Detail) 
26 

Closed but Not Implemented

(Sort: Report Numbers Sorted Oldest Newest; Recommendation NumberAscending) 

 

1. Report: Personal ID Verification - Agencies Should Set a Higher Priority on Using the 

Capabilities of Standardized Identification Cards (GAO-11-751; 9/20/2011) 

Recommendation: (2) Develop and implement procedures for PIV-based logical access when 

using Apple Mac and mobile devices that do not rely on direct interfaces with PIV cards, which 

may be impractical. 

Comments: Through the DHS Continuous Diagnostic and Monitoring (CDM) program, NASA 

began to implement Centrify which allowed PIV logical based access for Apple Macs. During 

this time NASA worked closely with Apple and developed a Native Apple/Enterprise Connect 

solution which avoids any out-year maintenance cost. All Mac users who were utilizing Centrify 

have been migrated to the Native Apple solution as of March 1st (Action is now completed). 

Phases 1 and 2 of the NASA Mobile Device Management to support mobile devices without 

using a separate user ID and password are complete. Phase 1 allows users who have a NASA 

iPhone or Android device to be managed and tracked which allows NASA to wipe mobile 

devices remotely if the device is lost. Phase 2 allows for certificate lifecycle management 

meaning users no longer must sync their mobile active directory password and they can receive 

and read encrypted email on their mobile device. Currently the capability to access NASA 

applications from mobile devices is not enabled. Phase 3, a future endeavor, will focus on 

Application Lifecycle Management which will allow users to access NASA applications from 

their mobile device without using a separate username/password (Action is now completed). 

Office of Primary Responsibility: Office of Protective Services 

2. Report: James Webb Space Telescope - Project Facing Increased Schedule Risk with 

Significant Work Remaining (GAO-15-100; 12/15/2014) 

Recommendation: (1) In order to provide additional information and analyses to effectively 

manage the program and account for new risks identified after the 2011 re-plan, direct the JWST 

project to follow best practices while conducting a cost risk analysis on the prime contract for the 

work remaining and ensure it is updated as significant risks emerge. 

Comments: NASA conducted a cost-risk analysis of the prime contractor Northrup Grumman 

Aerospace Systems (NGAS); used NASA best practices; and provided the results of those 

analyses to GAO together with an outline of the best practices utilized. The project re-baselined 

again in June 2018 with a very robust budget and schedule for the March 2021 LRD; significantly 

enhanced oversight over the past year, particularly at NGAS. NASA performed an SRB Schedule 

Risk Analysis in April 2019, and a JCL in August 2019. 

Office of Primary Responsibility: Science Mission Directorate 

3. Report: ISS - Measurable Performance Targets and Documentation Needed to Better Assess 

Management of National Laboratory (GAO-15-397; 5/27/2015) 

Recommendation: (3) In order for NASA to fully implement the NASA Authorization Act of 

2008 and for Center for the Advancement of Science in Space (CASIS) to fulfill its responsibility 

as outlined in the cooperative agreement, direct the Associate Administrator for the Human 
27 

Exploration and Operations Mission Directorate to fully staff the ISS National Laboratory 

Advisory Committee (INLAC). 

Comments: NASA does not plan to staff the International Space Station National Laboratory 

Advisory Committee (INLAC). NASA and CASIS have held annual public board meetings for 

the general public and interested parties to foster additional transparency. NASA and CASIS also 

meet face-to-face no less than quarterly to ensure performance requirements are on track. The 

next scheduled board meeting for CASIS is February 7, 2020. 

Office of Primary Responsibility: HEOMD 

4. Report: Space Launch System - Management Tools Should Better Track to Cost and Schedule 

Commitments to Adequately Monitor Increasing Risk (GAO-15-596; 7/16/2015) 

Recommendation: (3) To ensure that decisionmakers are able to track progress toward the 

agency’s committed launch readiness date, the NASA administrator should direct the SLS 

program to include as part of the program’s quarterly reports to NASA headquarters a reporting 

mechanism that tracks and reports program progress relative to the agency’s external committed 

cost and schedule baselines. 

Comments: The planned re-baseline of Artemis I will provide the opportunity to establish an 

updated baseline of the Artemis I cost and schedule data. This information will be reported to 

NASA Headquarters quarterly once the new baseline has been established. 

Office of Primary Responsibility: Human Exploration and Operations Mission Directorate 

Target Completion Date: March 31, 2020 
28 

Appendix C 

OIG Recommendations Open More Than One Year (Detail) 
29 

Actions Completed 

(Sort: Report Numbers Sorted Oldest Newest; Recommendation NumberAscending) 

1. Report: NASA's Compliance with the Improper Payments Information Act for Fiscal Year 

2015 (IG-16-021; 5/12/2016) 

 

Recommendation: (5) Obtain management decision letters issued by contracting officers to 

identify potential overpayments and report any overpayments determined to be improper in the 

Agency Financial Report (AFR) as overpayments identified from outside of payment recapture 

audits. 

Status: NASA Action Completed. Corrective actions were completed on 5/21/19. OIG 

review/consideration of the adequacy of corrective actions for closure will occur in conjunction 

with the OIG's FY20 IPIA Audit scheduled for completion in the May 2020 time frame. 

Office of Primary Responsibility: Office of the Chief Financial Officer 

Target Completion Date: n/a 

2. Report: NASA’s Response to SpaceX’s June 2015 Launch Failure: Impacts on Commercial 

Resupply of the International Space Station (IG-16-025; 6/28/2016) 

Recommendation: (5) Improve coordination with other Federal agencies involved in commercial 

space. For example, consider a. creating a formal Memorandum of Understanding with the FAA, 

NTSB, and USAF to coordinate accident investigations; b. coordinating with other Federal 

agencies to determine the hierarchy and roles of different investigation authorities during all 

phases of commercial launches with NASA payloads; and c. communicating investigation 

findings and corrective actions to all interested Federal agencies to allow full and informed 

decisions. 

Status: NASA Action Completed. Planned corrective actions have been completed. Charter has 

been executed and signed by USAF, NTSB, FAA and NASA for the Quad Agency working 

group defining how the agencies will coordinate with each other in commercial space mishap 

investigations, and lesson learned. Request for closure was submitted to the OIG on November 

13th. OIG review of actions taken in support of closure is underway. 

Office of Primary Responsibility: Office of Safety and Mission Assurance 

Target Completion Date: n/a 

3. Report: Audit of Industrial Control System Security within NASA’s Critical and Supporting 

Infrastructure (IG-17-011; 2/8/2017) 

Recommendation: (1) The NASA Administrator, in conjunction with the Associate 

Administrator for Mission Support and NASA Mission Directorates, develop a framework to 

coordinate security efforts across the Agency that promotes uniformity of processes and 

procedures and enables collaboration between OCIO, OPS, and OSI. 

Status: NASA Action Completed. Operational Technology Working Group (OTWG) charter 

published on August 2019. It defines the roles and responsibilities of the OTWG under the 

Enterprise Protection Board. Each Center and the Jet Propulsion Laboratory have appointed a 
30 

point-of-contact to the OTWG with Center-wide responsibility for addressing OT security and the 

ability to integrate cross-Center offices in the implementation of OT security activities. 

Office of Primary Responsibility: Office of Strategic Infrastructure 

Target Completion Date: n/a 

4. Report: Audit of Industrial Control System Security within NASA’s Critical and Supporting 

Infrastructure (IG-17-011; 2/8/2017) 

Recommendation: (2) The Assistant Administrator for OPS, in conjunction with the Agency 

Chief Information Officer, develop a standardized process to assess Agency cyber and physical 

assets for NASA critical infrastructure designation that adequately evaluates criticality to NASA's 

overall mission. 

Status: NASA Action Completed. OPS executed a data call for 100% verification and validation 

of currently designated NCI assets (July 2019). Validation not only confirmed components of 

each NCI. It also required Centers and Mission Directorates to validate the continued need for 

NCI designation in accordance with NPR 1600.1.a. In addition, NPR 1620.3B, “Physical 

Security Requirements for NASA Facilities and Property” was updated to include OT definition 

and requirements to include OT when executing Facility Security Assessments; updated, 

approved, and signed on May 13, 2019. The OTWG Released a Second OT Security Policy 

Memorandum (May 28, 2019), which initiated a NASA Critical Infrastructure (NCI) OT Data 

Call. 100 percent of NCI assets were assessed, and 202 OT Systems part of NCI were identified. 

Office of Primary Responsibility: Office of Strategic Infrastructure 

Target Completion Date: n/a 

5. Report: NASA’s Parts Quality Control Process (IG-17-016; 3/29/2017) 

Recommendation: (3) Identify supplier performance information of common interest and modify 

SAS data structure to accommodate such information. 

Status: NASA Action Completed. On November 29, 2019, NASA provided the OIG with 

supporting documentation relating to corrective actions taken in response to the recommendation. 

NASA is awaiting OIG's review of the actions taken along with their disposition determination. 

Office of Primary Responsibility: Office of Safety and Mission Assurance 

Target Completion Date: n/a 

6. Report: NASA’s Parts Quality Control Process (IG-17-016; 3/29/2017) 

Recommendation: (8) Review a representative sample of PQASPs to identify deficiencies and 

best practices and revise policy as needed to include quantification and documentation of 

nonconformance and control risks for ensuring surveillance activities and resources are 

commensurate with part criticality and overall accepted project risk. 
31 

Status: NASA Action Completed. On November 29, 2019, NASA provided the OIG with 

supporting documentation relating to corrective actions taken in response to the recommendation. 

NASA is awaiting OIG's review of the actions taken along with their disposition determination. 

Office of Primary Responsibility: Office of Safety and Mission Assurance 

Target Completion Date: n/a 

7. Report: NASA's Compliance with the Improper Payments Information Act for Fiscal Year 

2016 (IG-17-020; 5/15/2017) 

Recommendation: (3) Revisit the description of the scoring criteria for all risk factors, 

particularly the risk factors under the External Monitoring and Materiality of Disbursements risk 

conditions, to ensure the criteria for each level is a fair representation of the risk. 

Status: NASA Action Completed. Corrective actions were completed on 10/3/19. However, 

OIG’s review/consideration of the adequacy of corrective actions for closure will occur in 

conjunction with the OIG's FY20 IPIA Audit scheduled for completion in the May 2020 time 

frame. 

Office of Primary Responsibility: Office of the Chief Financial Officer 

Target Completion Date: n/a 

8. Report: Audit of NASA’s Compliance with the Improper Payments Information Act for Fiscal 

Year 2017 (IG-18-017; 5/14/2018) 

Recommendation: (1) Implement a procedure to use information regarding known improper 

payments, including the latest available data used for payment recapture reporting, when 

performing the annual risk assessment. 

Status: NASA Action Completed. Corrective actions were completed on 10/3/19. However, 

OIG’s review/consideration of the adequacy of corrective actions for closure will occur in 

conjunction with the OIG's FY20 IPIA Audit scheduled for completion in the May 2020 time 

frame. 

Office of Primary Responsibility: Office of the Chief Financial Officer 

Target Completion Date: n/a 

9. Report: Audit of NASA’s Compliance with the Improper Payments Information Act for Fiscal 

Year 2017 (IG-18-017; 5/14/2018) 

Recommendation: (2) Revise the existing risk assessment process by considering improper 

payments from prior years identified in external reports reviewed in the assessment year to 

determine program susceptibility to significant improper payments. 

Status: NASA Action Completed. Corrective actions were completed on 10/3/19. However, 

OIG review/consideration of the adequacy of corrective actions for closure will occur in 

conjunction with the OIG's FY20 IPIA Audit scheduled for completion in the May 2020 time 

frame. 
32 

Office of Primary Responsibility: Office of the Chief Financial Officer 

Target Completion Date: n/a 

10. Report: Audit of NASA’s Management and Utilization of the International Space Station (IG18-021; 7/30/2018) 

Recommendation: (3) Ensure there is a contingency plan for each exploration-enabling 

technology demonstration not scheduled to be fully tested by 2024, such as: a) Identification of 

alternate testing platforms; b) Impact to technical risk of exploration systems; and c) Impact to 

the technology demonstration schedule. 

Status: NASA Action Completed. Corresponding corrective actions have been completed. 

Documentation evidencing those corrective actions has been provided to the OIG for review. 

OIG's closure decision is pending. 

Office of Primary Responsibility: Human Exploration and Operations Mission Directorate 

Target Completion Date: n/a 

Actions In-Progress 

(Reports Sorted Oldest  Newest) 

11. Report: NASA’s Compliance with the Improper Payments Information Act for Fiscal Year 

2014 (IG-15-015; 5/15/2015) 

Recommendation: (5) Include cost-type contract payments in the Agency’s recapture audit 

efforts. If NASA determines this proposal is not cost-effective, the CFO should document its 

justification for excluding these payments, including demonstrating that costs associated with 

recovering the funds are projected to be greater than the amount recovered. 

Status: In-Progress. NASA is still researching possible solutions to continue executing an 

effective and efficient internal control platform that provides reasonable assurance that payments 

are proper, and that NASA is in compliance with the Improper Payments Information Act (IPIA). 

NASA has determined that including fixed price contract payments in our payment recapture 

audit program is not cost-effective. We based our determination on a cost benefit analysis that 

focused on the time, effort and resources expended in the process versus actual funds recovered. 

On November 7, 2019, OMB provided acceptance of our analysis. As NASA continues to pursue 

methodologies for demonstrating that including cost type contracts in our recapture program is 

not a cost-effective activity for the Agency, we will continue to engage and work with the OIG. 

In short, NASA is continuing to pursue the corrective action necessary to close this 

recommendation and is exploring ways to confirm whether payment recapture audits on cost type 

contracts is a cost-effective activity that will bring benefit to the Agency. 

Office of Primary Responsibility: Office of the Chief Financial Officer 

Target Completion Date: 5/31/2020 
33 

12. Report: NASA’s Response to Orbital’s October 2014 Launch Failure: Impacts on Commercial 

Resupply of the International Space Station (IG-15-023; 9/17/2015) 

Recommendation: (7) Consider whether contract provisions relating to the boards should be 

revised to more closely align with NASA Mishap Investigation Board procedures (NASA 

Procedural Requirement 8621.1B, Chapter 4). 

Status: In-Progress. Final management action is dependent upon in-process revisions to 

Revision D of NPR 8621 NASA "Procedural Requirements for Mishap and Close Call Reporting, 

Investigating, and Recordkeeping," which incorporates Chapter 7 for Commercial Space Mishap 

Investigations. 

Office of Primary Responsibility: Human Exploration and Operations Mission Directorate 

Target Completion Date: 1/31/2020 

13. Report: Audit of NASA Space Grant Awarded to the University of Texas at Austin (IG-16-013; 

2/18/2016) 

Recommendation: (3) Establish policies and procedures, as part of the NASA Grant and 

Cooperative Agreement Manual, to periodically review a recipient’s actual cost match and 

document award requirements. 

Status: In-Progress. Updates to the Grant and Cooperative Agreement Manual (GCAM) in 

response to the OIG's recommendation are currently in-progress. Revised GCAM is expected to 

by the spring of 2020. 

Office of Primary Responsibility: Office of the Chief Financial Officer 

 

Target Completion Date: 4/30/2020 

14. Report: NASA’s Management of the Near-Earth Network (IG-16-014; 3/17/2016) 

Recommendation: (7) Ensure that malware protections are functioning as intended on applicable 

Network components. 

Status: In-Progress. Corrective actions intended to fully deploy an Anti-Virus solution nearing 

completion targeted for early 2020. 

Office of Primary Responsibility: Goddard Space Flight Center 

Target Completion Date: 1/31/2020 

15. Report: Audit of the Spaceport Command and Control System (IG-16-015; 3/28/2016) 

Recommendation: (1) The OIG recommends that the Associate Administrator for Human 

Exploration and Operations commission an independent assessment to evaluate the status of the 

SCCS software development effort and determine the necessary steps to reduce the risk of further 

cost, schedule, and performance issues, including consideration of acquiring commercial 

command and control software to replace some or all of the system currently under development. 
34 

Status: In-Progress. NASA continues to work toward implementation of this recommendation. 

Related corrective actions are in-progress. 

Office of Primary Responsibility: Human Exploration and Operations Mission Directorate 

Target Completion Date: 2/28/2021 

16. Report: NASA’s Response to SpaceX’s June 2015 Launch Failure: Impacts on Commercial 

Resupply of the International Space Station (IG-16-025; 6/28/2016) 

Recommendation: (6) Update NPR 8621.1B to include commercial space launches with NASA 

payloads in official mishap policies. In particular, NASA should a) define commercial space 

launches with NASA payloads; b) determine the extent to which official NASA mishap policies 

apply in commercial space launches with NASA payloads; c) describe what types of 

investigations may occur and the processes to be followed in lieu of an Official Mishap 

Investigation Board, such as an independent investigation board created by NASA; and d) clarify 

the scope and purpose of each investigation, such as a NASA defined root cause compared to a 

technical root cause analysis, and consider the inclusion of programmatic and organizational root 

cause analysis. 

Status: In-Progress. Planned corrective actions are in progress. Rev D of NPR 8621 which 

includes Chapter 7 for Commercial Space Mishap Investigations, going through final review 

process. 

 Office of Primary Responsibility: Office of Safety and Mission Assurance 

Target Completion Date: 1/31/2020 

17. Report: NASA's Earth Science Mission Portfolio (IG-17-003; 11/2/2016) 

Recommendation: (1) Update the Architecture Plan every 5 years to align with the release of 

Earth Science Decadal Surveys and mid-term Surveys and account for portfolio changes. 

Status: In-Progress. The current Implementation Plan is based on the 2007 Decadal Survey 

(DS). When this recommendation was issued (2016) NASA management did not know the scope 

and content of the 2017 DS. The draft 2017 DS was released January 5, 2018. The final version 

of the 2017 DS was not released until several weeks later with some minor changes. The 700-

page DS contains significant NASA-focused recommendations. The Earth Science Division 

(ESD) has developed a strategic approach to address the recommendations for Designated 

Observables, the Incubation Program, the Earth Venture Continuity, Earth Systems Explorer 

Program, and other program recommendations. The full strategy is still being developed as are 

the architecture study results to enable formulation of a full implementation strategy. ESD has 

drafted a budgetary approach to the implementation of the new DS; however, budget 

developments may lead to changes in strategy. NASA will work on the revised Architecture 

Plan, but it is important to note that the previous DS was more straightforward since it 

recommended specific missions, which are now part of the existing ESD Program of record. The 

2017 Decadal, instead of specifying missions, recommends “observables.” In addition, the new 

DS made recommendations to other parts of the ESD portfolio, including technology, research, 

and applied sciences, which requires additional implementation planning that has been underway. 

NASA is in the process of conducting pre-formulation studies on the designated observables and 

developing strategies to implement the resulting projects and observing systems. The architecture 
35 

study results for the first designated observable will not be available until the end of calendar year 

2020. Results from the remaining four designated observables will follow. The conclusions and 

results of these studies are absolutely necessary for NASA to develop the Implementation Plan. 

NASA does not anticipate having the study information needed to develop/update the 

implementation plan until late FY2021. 

 

Office of Primary Responsibility: Science Mission Directorate 

Target Completion Date: 11/31/2021 

18. Report: Security of NASA’s Cloud Computing Services (IG-17-010; 2/7/2017) 

 

Recommendation: (1) Monitor adherence to the requirement that only approved cloud 

computing services on NASA’s cloud services registry be used to transmit, process, and store 

NASA data and block access on NASA networks to unapproved services that do not have an 

authorization to operate and established IT system security plans. 

Status: In-Progress. Centers provided Corrective Action Plans (CAP) detailing how they would 

promote the benefits of using OSCAR and encourage program and project managers to review the 

database prior to procuring flight inventory from outside vendors. All Centers provided CAPs, 

indicating actions that would be taken to address this recommendation. The CAPs were approved 

by OSI. Updated: OSI developed a standardized Agency-wide process to document justification 

for inventory retention and worked with Centers to develop necessary policy to ensure that 

appropriate documentation accompanies property entering the disposition process. However, 

under MAP, processes and delivery models are undergoing changes that will require OSI to 

readdress this action. The new NPD/NPR to be developed will reflect MAP's new agreement with 

Center management for program and flight inventory CAPs. A NID has been submitted and we 

expect to update NPD and NPR 4100.1 for Centers to reflect OSI's new cost-effective measures 

and processes. 

Office of Primary Responsibility: Office of the Chief Information Officer 

Target Completion Date: 1/31/2020 

19. Report: Security of NASA’s Cloud Computing Services (IG-17-010; 2/7/2017) 

Recommendation: (2) Ensure NASA personnel at Agency Centers, Mission Directorates, and 

Program and Project Offices coordinate acquisition of any cloud computing service through 

CSPO to ensure cloud services are properly accounted for on the Agency’s cloud services registry 

and that all recommended FedRAMP contract provisions are incorporated into the acquisition. 

Status: In-Progress. A NID is being prepared and we expect to update applicable policy 

documents to reflect new processes and procedures to determine the appropriate amount of spare 

parts required to support unmanned aircraft systems (UAS). 

Office of Primary Responsibility: Office of the Chief Information Officer 

Target Completion Date: 6/30/2020 
36 

20. Report: Security of NASA’s Cloud Computing Services (IG-17-010; 2/7/2017) 

Recommendation: (4) Ensure all approved cloud services are registered with FedRAMP and are 

FedRAMP compliant. 

Status: In-Progress. NASA partially concurred with this recommendation. Although there are 

nearly 20,000 cloud products available in the marketplace, since the FedRAMP mandate went 

into effect for Federal agencies in June 2014, less than 100 FedRAMP authorizations have been 

granted. As a result, “officially” FedRAMP-approved products represent only 0.5 percent of 

available cloud products. Because so few cloud products have received FedRAMP approval, 

Federal agencies are inhibited from fully adopting the “cloud first” approach to replacing 

information technology resources with cloud solutions as directed in the President’s digital 

strategy. NASA will use FedRAMP approved cloud services whenever available. Otherwise, 

NASA will perform an appropriate risk assessment, and may make a risk-based decision to 

approve the service for use at NASA considering mission requirements/ impacts, availability of 

alternative cloud services, information categorization, other industry compliance standards met, 

and NASA security safeguards that could be employed to ensure safe use. 

 

Office of Primary Responsibility: Office of the Chief Information Officer 

 

Target Completion Date: 1/31/2020 

21. Report: Security of NASA’s Cloud Computing Services (IG-17-010; 2/7/2017) 

Recommendation: (6) Direct all NASA Centers, Mission Directorates, and Program and Project 

Offices to review their current cloud computing services and take steps necessary to ensure that 

existing services meet FedRAMP requirements. 

Status: In-Progress. The NASA CIO will issue a memorandum to: 1) Direct NASA Centers, 

Mission Directorates and Program and Project offices to review their current cloud computing 

services and take steps necessary to ensure that existing services have been vetted such that they 

have an Authorization to Operate and that they are part of an approved IT Security plan; and 2) 

Advise the Agency of the new required procurement guidelines and processes regarding the 

acquisition of cloud computing. 

Office of Primary Responsibility: Office of the Chief Information Officer 

Target Completion Date: 6/30/2020 

22. Report: Audit of Industrial Control System Security within NASA’s Critical and Supporting 

Infrastructure (IG-17-011; 2/8/2017) 

Recommendation: (3) The Assistant Administrator for OPS ensure OCIO and OSI 

representatives are included in functional reviews of NASA's critical infrastructure assets and 

facility security assessments so that cyber and facilities interdependencies are addressed 

appropriately. 

Status: In-Progress. NPR 1620.3B Operational Technology (OT) language (released on May 13, 

2019) – The facility security assessment shall be conducted by the Center Protective Services 

Office with support from the Center CIO and Center Facilities Office, or equivalent offices, and 

designated representatives of the assessed facility to ensure OT is identified and afforded the 
37 

same level of protection as the asset/mission or facility. New language in NPR 1620.3B – 

“Facilities designated or housing NASA Critical Infrastructure (NCI) shall be designated Facility 

Security Level III at a minimum.” 

 Office of Primary Responsibility: Office of Strategic Infrastructure 

Target Completion Date: 9/30/2020 

23. Report: Audit of Industrial Control System Security within NASA’s Critical and Supporting 

Infrastructure (IG-17-011; 2/8/2017) 

 

Recommendation: (4) The Assistant Administrators of OPS and OSI, in conjunction with the 

Agency Chief Information Officer, coordinate the development of a methodology for the 

identification and protection of interdependencies (either within the facility security assessment 

or facility security level designation process) 

Status: In-Progress. Appendix F of NPR 1600.1, “NASA Security Program Procedural 

Requirements” (revision of this NPR is on hold during OPS MAP implementation). After OT 

systems that are part of the components of current NCI assets are identified, NCI policy will be 

altered to ensure that supporting infrastructure that is critical to the operations or capabilities of 

an NCI asset will be included in the inventory of components of an NCI asset. (OT systems and 

interdependencies are identified). Identify roles and responsibilities for maintaining physical 

security (OPS), cybersecurity (OCIO), and resiliency of interdependencies (OSI). Draft language 

ready for review by OTWG and Center POCs: September 15, 2019. NID issued December 23, 

2019. NPR modification coordinated informally to all: January 2020. 

Office of Primary Responsibility: Office of Strategic Infrastructure 

Target Completion Date: 9/30/2020 

24. Report: Audit of Industrial Control System Security within NASA’s Critical and Supporting 

Infrastructure (IG-17-011; 2/8/2017) 

Recommendation: (5) The Agency Chief Information Officer, in conjunction with the Assistant 

Administrators of OPS and OSI, develop security policy based on NIST SP 800-53, rev. 4 and 

NIST SP 800-82 guidance for managing the protection of OT within the mission and institutional 

directorates. At a minimum, this should include: a) defining control systems; b) identifying all OT 

systems at NASA and a strategy for segmenting OT from IT across the Agency; c) utilizing ICSCERT alerts when assessing control systems security posture; d) developing system security 

plans and assessment methodologies for control systems/OT in a way that ensures the use of 

appropriate system boundaries and effective compensating controls, in the absence of common 

controls or automation as defined in NIST SP 800-82; and e) developing training for responsible 

security personnel in line with NIST and DHS guidance on control system security. This may 

include control system administrators, OCIO approval authorities, control system owners, and 

assessment teams. 

Status: In-Progress. Corrective actions completed and planned include: 1) NPD 2800.1 is being 

prepared for formal Agency coordination. The directive includes the definition of OT and 

clarifies that OT is a type of IT and that IT requirements and processes that are currently in policy 

apply to OT; 2) A survey of Operational Technology systems across Centers, component 

facilities, and the Jet Propulsion Laboratory was completed in September 2018. A focused data 
38 

call to identify all OT systems that are part of NASA Critical Infrastructure was completed in 

August 2019; 3) The OCIO is testing a process that will automatically distribute US-CERT and 

ICS-CERT alerts to all ISOs and ISSOs. There is an open ticket with the NOMAD group since 

early September related to Office 365 mail transport rules that has delayed implementation. 

Outreach material has been drafted and will be routed through Labor Relations and OGC prior to 

publication; 4) The OCIO is drafting a handbook to assist in the authorization and assessment of 

OT systems including the segmentation of OT systems; and 5) During 2018-2019 the OCIO has 

released training for Information System Owners, Information System Security Officers and 

Organizational Computer Security Officials as well as Authorizing Officials and Authorizing 

Officials Designated Representatives and continues to develop and release internal training. 

Office of Primary Responsibility: Office of the Chief Information Officer 

Target Completion Date: 9/30/2020 

25. Report: NASA’s Management of Electromagnetic Spectrum (IG-17-012; 3/9/2017) 

Recommendation: (2) The Associate Administrator for Human Exploration and Operations 

should ensure the incorporation of the “Spectrum Guidance for NASA Small Satellite Missions” 

into formal NASA electromagnetic spectrum policies NPD 2570.5E, “NASA Electromagnetic 

Spectrum Management - Revalidated 9/13/16,” and NPR 2570.1C, “NASA Radio Frequency 

Electromagnetic Spectrum Management Manual.” 

Status: In-Progress. Revisions to NPR 2570.1C intended to implement the recommendation are 

in-progress. Issuance of revised NPR 2570 is expected in the summer of 2020. 

 Office of Primary Responsibility: Human Exploration and Operations Mission Directorate 

Target Completion Date: 7/31/2020 

26. Report: NASA’s Plans for Human Exploration beyond Low Earth Orbit (IG-17-017; 4/13/2017) 

Recommendation: (4) Include cost as a factor in NASA’s Journey to Mars feasibility studies when 

assessing various potential missions and systems. 

Status: In-Progress. NASA continues to work toward implementation of this recommendation. 

Related corrective actions are in-progress. 

Office of Primary Responsibility: Human Exploration and Operations Mission Directorate 

Target Completion Date: 4/30/2020 

27. Report: Construction of Test Stands 4693 and 4697 at Marshall Space Flight Center (IG-17-

021; 5/17/2017) 

Recommendation: (1) Perform a comprehensive review of Program-funded construction projects 

to ensure adequate analysis, including all life cycle costs, is completed prior to project initiation. 
39 

Status: In-Progress. A new protocol was established during the Facilities and Real Estate 

Division's Business Service Assessment and it will go into NPR 8820 update after MAP is 

completed. 

 Office of Primary Responsibility: Office of Strategic Infrastructure 

Target Completion Date: 12/31/2020 

28. Report: Construction of Test Stands 4693 and 4697 at Marshall Space Flight Center (IG-17-

021; 5/17/2017) 

Recommendation: (2) Develop additional construction project guidance for establishing 

unallocated construction reserves for program-direct construction facility projects to better 

account for significant expected risks. 

Status: In-Progress. A new protocol was established during the Facilities and Real Estate 

Division's Business Service Assessment and it will go into NPR 8820 update after MAP is 

completed. 

 Office of Primary Responsibility: Office of Strategic Infrastructure 

Target Completion Date: 12/31/2020 

29. Report: Construction of Test Stands 4693 and 4697 at Marshall Space Flight Center (IG-17-

021;5/17/2017) 

Recommendation: (3) Ensure facility needs, such as construction of new facilities and/or 

modification of existing facilities, are appropriately included in program planning and scheduling 

and that testing requirements are adequately understood prior to committing the Agency to 

construction or modification of test facilities. 

Status: In-Progress. Efforts to develop language intended to strengthen the Project Definition 

ratings Index (PDRI) requirements is being developed and will be incorporated into on-going 

revisions to NPR 8820 "Facility Project Requirements." 

Office of Primary Responsibility: Human Exploration and Operations Mission Directorate 

Target Completion Date: 7/31/2020 

30. Report: NASA’s Research Efforts and Management of Unmanned Aircraft Systems (IG-17-025; 

9/18/2017) 

Recommendation: (2) Create or incorporate into existing policy criteria for defining the UAS 

subject to acquisition and tracking requirements, distinguishing an aerial drone from a collection 

of spare parts, and the criteria Centers should use for determining the number of UAS spare parts 

to maintain. 

Status: In-Progress. Logistics and Aircraft Management Divisions chaired an aircraft parts 

working group that developed a policy requiring organizations to determine the number of spare 

parts needed to support the UAS prior to obtaining acquisition approval. NASA Procedural 

Requirement (NPR) 4100.1 will be updated with this new process during OSI Mission 
40 

Architecture Program. In the interim, the Logistics Management Division is in the process of 

drafting a NASA Interim Directive (NID) that contains the new procedures Centers must follow 

when determining the number of spare parts required to support UAS. 

Office of Primary Responsibility: Office of Strategic Infrastructure 

Target Completion Date: 6/30/2020 

31. Report: NASA’s Management of Spare Parts for its Flight Projects (IG-18-001; 10/5/2017) 

Recommendation: (3) Develop a standardized cataloging process for OSCAR to ensure NASA 

program and project officials can effectively identify and reserve compatible flight inventory. 

Status: In-Progress. Centers provided Corrective Action Plans (CAP) detailing how they would 

promote the benefits of using OSCAR and encourage program and project managers to review the 

database prior to procuring flight inventory from outside vendors. All Centers provided CAPs, 

indicating actions that would be taken to address this recommendation. The CAPs were approved 

by the Office of Strategic Infrastructure (OSI). OSI developed a standardized Agency-wide 

process to document justification for inventory retention and worked with Centers to develop 

necessary policy to ensure that appropriate documentation accompanies property entering the 

disposition process. However, under MAP, processes and delivery models are undergoing 

changes that will require OSI to readdress this action. The new NPD/NPR to be developed will 

reflect MAP's new agreement with Center management for program and flight inventory CAPs. 

A NID has been submitted and we expect to update NPD and NPR 4100.1 for Centers to reflect 

OSI's new cost-effective measures and processes. 

Office of Primary Responsibility: Office of Strategic Infrastructure 

Target Completion Date: 12/31/2021 

32. Report: NASA’s Management of Spare Parts for its Flight Projects (IG-18-001; 10/5/2017) 

Recommendation: (5) Work with Center logistics officials to develop alternative approaches to 

ensure Centers can meet the requirement to conduct complete reviews of spare parts inventories 

every 5 years. 

Status: In-Progress. A NID is being prepared and we expect to update applicable policy 

documents to reflect new processes and procedures to determine the appropriate amount of spare 

parts required to support unmanned aircraft systems (UAS). 

Office of Primary Responsibility: Office of Strategic Infrastructure 

Target Completion Date: 9/30/2021 

33. Report: NASA’s Surface Water and Ocean Topography Mission (IG-18-011; 1/17/2018) 

Recommendation: (6) The Associate Administrator for Science should require all SRBs to 

explicitly monitor and document variances from NASA’s JCL policy – specifically regarding 

international partners and launch vehicle risks – and their potential cost and schedule impacts. 
41 

Status: In-Progress. In response to the recommendation, NASA concurred in that SRB should 

monitor and document all significant risks, including those from international partners and launch 

vehicles, associated with project cost and schedule as part of their JCL evaluation at KDP-C or a 

rebaseline review. For KDP-C, launch vehicle risks will generally not be specific to a NASA 

launch system given the acquisition and selection process concludes following mission 

confirmation. Additionally, the Cost Estimating Handbook encourages establishing a set of 

programmatic, technical and schedule ground rules and assumptions to define the scope of the 

estimate (i.e., what costs are being included and what costs are excluded). NASA historically 

includes the Launch Vehicle (LV) as a pass through, with no negative results. With that said, 

SMD will work with the OCFO to determine if the Handbook language needs to be more 

definitive about LVs. In March of 2018 SMD and OCFO reviewed the relevant guidance in the 

Cost Estimating Handbook and concluded that the Handbook's language is sufficiently definitive. 

However, the OIG maintains its concern that JCL analyses should include all discrete 

development risks to include important risks managed outside the project. In response to this 

ongoing concern SMD will reassess the relevant NASA policies to understand if there is any 

basis for revision. 

Office of Primary Responsibility: Science Mission Directorate 

Target Completion Date: 2/29/2020 

34. Report: Review of NASA’s Purchase and Travel Charge Card Programs (IG-18-014; 2/28/2018) 

Recommendation: (1) Establish a procedure to monitor whether travelers are using their travel 

cards for all official travel expenses. Possible options include but are not limited to: 

 a) modifying NSSC’s existing pre and post-payment procedures performed on travel vouchers; 

and b) instructing CAPCs to include this review as part of their oversight responsibilities. 

Status: In-Progress. NASA continues to work toward implementation of this recommendation. 

Related corrective actions are in-progress. 

Office of Primary Responsibility: Ames Research Center 

Target Completion Date: 3/30/2020 

35. Report: NASA’s Management of the Goddard Institute for Space Studies (IG-18-015; 4/5/2018) 

Recommendation: (4) Hire a senior administrator to serve as a Deputy Chief of GISS for 

Administration to manage the Institute’s grants, cooperative agreements, personnel, and 

procurement actions. 

Status: In-Progress. An unexpected delay in the issuance of a corresponding vacancy 

announcement was encountered. However, the vacancy announcement was issued and closed in 

late November. The selection process is underway. 

Office of Primary Responsibility: Goddard Space Flight Center 

Target Completion Date: 4/30/2020 
42 

36. Report: NASA’s Management of the Goddard Institute for Space Studies (IG-18-015; 4/5/2018) 

Recommendation: (8) To the extent practicable, implement the GAO’s best practices for 

establishing partnerships, including the formalization of agreements that outline the roles and 

responsibilities of each agency in the performance and application of climate research performed 

at GISS. 

Status: In-Progress. NASA continues to work toward implementation of this recommendation. 

Related corrective actions are in-progress. 

Office of Primary Responsibility: Science Mission Directorate 

Target Completion Date: 6/30/2020 

37. Report: Audit of Commercial Resupply Services to the International Space Station (IG-18-016; 

4/26/2018) 

Recommendation: (5) The Associate Administrator for Human Exploration and Operations 

Mission Directorate ensure the ISS Program: decides by January 2020 whether to compete task 

orders beyond the minimum guarantee of six for each contractor through the existing contract or 

through the On-Ramp clause. 

Status: In-Progress. The ISS program is not at a point in time that it can intelligently decide if "to 

compete task orders beyond the minimum guarantee of six for each contractor." The factors that 

have created this situation: 1) CRS2 providers have not begun to fly their new and/or augmented 

capabilities for this contract. This leads to unproven estimates of the providers’ performance 

capabilities. First launches have a NET of August 2020 and would take about a year to have all 

three providers’ first flight; 2) CCP schedule movement to the right has delayed the crew 

compliment increase and its corresponding increase in up-mass requirements that would 

eventually drive additional orders; and 3) Although the ISS extension to 2030 is officially 

supported in the recent ESA ministerial meeting, it is still under discussion by the other 

governments of the ISS partnership. The ISS extension would eventually drive additional orders 

as well. Given the environment today, the ISS program believes that a decision “to compete task 

orders beyond the minimum guarantee of six for each contractor” should be pushed to the first 

quarter of FY2021. 

Office of Primary Responsibility: Human Exploration and Operations Mission Directorate 

Target Completion Date: 10/31/2020 

38. Report: Audit of NASA’s Compliance with the Improper Payments Information Act for Fiscal 

Year 2017 

(IG-18-017; 5/14/2018) 

Recommendation: (3) Develop a process for tracking overpayments identified and subsequently 

recovered through reductions in future billings on existing contracts such as contract credits. 

Status: In-Progress. OCFO is still in the process of researching an automated solution. 

Collaborative efforts between key stakeholders including OCFO, NSSC, GRC [process 

champion], and the Office of Procurement are on-going. 
43 

Office of Primary Responsibility: Office of the Chief Financial Officer 

Target Completion Date: 5/31/2020 

39. Report: Audit of NASA’s Information Technology Supply Chain Risk Management Efforts (IG18-019; 5/24/2018) 

Recommendation: (2) Ensure NASA’s assessed and cleared listing (ACL) is updated weekly and 

that it contains a selection of cleared IT and communications products and services sufficient to 

meet Agency needs. 

Status: In-Progress. The OCIO currently performs a review and update of the ACL weekly. 

Additionally, OCIO is implementing additional capabilities through the Risk Information 

Security and Compliance System (RISCS) that will further automate the ACL. 

Office of Primary Responsibility: Office of the Chief Information Officer 

Target Completion Date: 9/17/2020 

40. Report: Audit of NASA’s Information Technology Supply Chain Risk Management Efforts (IG18-019; 5/24/2018) 

Recommendation: (7) Direct all NASA Centers, Mission Directorates, and Program/Project 

Offices to review and strengthen their current supply chain risk management efforts to ensure 

only assessed and cleared IT and communications products and services enter the Agency’s 

supply chain. 

Status: In-Progress. The NASA OCIO is updating NPD 2800.1 C, Managing information 

Technology. It will be released to all NASA Centers, Mission Directorates, and Program Offices 

to strengthen current SCRM efforts. NASA is also developing supply chain controls and 

processes in the NASA Risk Info. Security and Compliance Systems (RISCS) to enable the 

NASA community to document, assess, and track SCRM activities. 

Office of Primary Responsibility: Office of the Chief Information Officer 

Target Completion Date: 9/17/2020 

41. Report: Audit of NASA’s Security Operations Center (IG-18-020; 5/23/2018) 

Recommendation: (1) The Agency CIO develop a charter and set of authorities signed by the 

NASA constituent executives (including the NASA Administrator) that addresses the SOC’s 

organizational placement, purpose, authority, and responsibilities. 

Status: In-Progress. The OCIO has developed a charter for the NASA SOC that addresses the 

SOC’s organizational placement, purpose, authority, and responsibility within the OCIO 

Cybersecurity & Privacy Division. The OCIO will present the charter to SOC stakeholders for 

review and concurrence by the Agency ITC and the NASA SAISO, for NASA CIO approval and 

signature. The charter will then be sent, through the Office of the Administrator, for the NASA 

Administrator’s concurrence, prior to publication. 

 
44 

Office of Primary Responsibility: Office of the Chief Information Officer 

Target Completion Date: 1/31/2020 

42. Report: Audit of NASA’s Security Operations Center (IG-18-020; 5/23/2018) 

Recommendation: (2) The Agency CIO, in conjunction with the SAISO, establish Operational 

Level Agreements with NASA Centers, Mission Directorates, the Communications Services 

Office, the End User Services Office, the Agency Applications Office, and Web Services Office 

to clearly define incident response roles and responsibilities, ensure data storage and sharing 

needs are addressed, and opportunities to leverage economies of scale are identified and acted 

upon in support of Agency cybersecurity goals. The agreements should include (but not be 

limited to) the following issues: a) responsibilities of signing parties; b) data visibility, sharing, 

storage, and logging requirements; c) change management plan; d) communications plan; e) an 

explanation detailing the technology deployments necessary to support the agreement; and f) 

service levels expected detailing the service benefit to both parties in line with Agency goals. 

Status: In-Progress. NASA partially concurred with this recommendation and noted that the 

NASA SOC will work with the OCIO Information Technology (IT) Business Management 

Division to determine the governance for establishing or updating appropriate Operational Level 

Agreements (OLAs). The NASA SOC will also update the existing Service Level Agreements 

between the SOC and: 1) the Communications Services Office; 2) the Computer Service Program 

Office; and 3) Center CIO Offices, converting the Service Level Agreements to Operational 

Level Agreements. 

Office of Primary Responsibility: Office of the Chief Information Officer 

Target Completion Date: 1/22/2020 

43. Report: Audit of NASA’s Security Operations Center (IG-18-020; 5/23/2018) 

Recommendation: (6) The Agency CIO identify and reduce unnecessary duplication of the 

incident monitoring, detection, and response capabilities, including toolsets and competencies 

available Agency-wide to enhance the capabilities and resources of the SOC and realize 

efficiencies in the management of these capabilities. 

Status: In-Progress. The OCIO will identify the incident monitoring, detection, and response 

services across the Agency. The SAISO will document and assess duplication of services and 

provide a recommendation to the Agency CIO for targeted implementation in FY20. 

Office of Primary Responsibility: Office of the Chief Information Officer 

Target Completion Date: 1/31/2020

44. Report: Audit of NASA’s Management and Utilization of the International Space Station (IG18-021; 7/30/2018) 

Recommendation: (4) Complete all end of mission critical systems and open work related to 

nominal and contingency deorbit operations. 
45 

Status: In-Progress. Planned corrective actions, including ISS ongoing discussions with the 

Partner related to export control document markings and other issues pertaining to SSP 51066 are 

in-progress. 

Office of Primary Responsibility: Human Exploration and Operations Mission Directorate 

Target Completion Date: 12/31/2020 

45. Report: Audit of NASA’s Management and Utilization of the International Space Station (IG18-021;7/30/2018) 

Recommendation: (5) Develop options for obtaining supplemental emergency deorbit propellant 

support from U.S. commercial vehicles. 

Status: In-Progress. Planned corrective actions are on-going and are targeted for completion in 

late 2020. 

Office of Primary Responsibility: Human Exploration and Operations Mission Directorate 

Target Completion Date: 12/31/2020 

46. Report: NASA’s Management of the Space Launch System Stages Contract (IG-19-001; 

10/10/2018) 

Recommendation: (2) Direct Boeing to complete delivery of two Core Stages and the EUS using 

an Earned Value Management System with realistic schedule assumptions and appropriate cost 

estimates through the end of the contract in 2021. 

Status: In-Progress: NASA is continuing work on this and is on track to award the contract by 

1/31/2020. Once the contract is awarded, NASA will request closure of this recommendation. 

Office of Primary Responsibility: Human Exploration and Operations Mission Directorate 

Target Completion Date: 1/31/2020 

47. Report: NASA’s Management of the Space Launch System Stages Contract (IG-19-001; 

10/10/2018) 

Recommendation: (3) Complete a review of the Boeing Stages contract that includes an 

independent federal government cost estimate to confirm the funding amounts needed to 

complete all deliverables. 

Status: In-Progress. NASA is continuing work on this and is on track to award the contract by 

1/31/2020. Once the contract is awarded, NASA will request closure of this recommendation. 

Office of Primary Responsibility: Human Exploration and Operations Mission Directorate 

Target Completion Date: 1/31/2020 
46 

48. Report: NASA’s Management of the Space Launch System Stages Contract (IG-19-001; 

10/10/2018) 

Recommendation: (4) Renegotiate the Boeing Stages contract based on both Boeing and federal 

government cost estimates. 

Status: In-Progress: NASA is continuing work on this and is on track to award the contract by 

1/31/2020. Once the contract is awarded, NASA will request closure of this recommendation. 

Office of Primary Responsibility: Human Exploration and Operations Mission Directorate 

Target Completion Date: 1/31/2020 

49. Report: NASA’s Management of the Space Launch System Stages Contract (IG-19-001; 

10/10/2018) 

Recommendation: (7) Implement an acquisition strategy for building Core Stages beyond Core 

Stage 2 for future missions that includes consideration for awarding the contract as a fixed-price, 

end-item deliverable contract with each Core Stage separated into unique task orders with 

specific performance milestones. 

Status: In-Progress: NASA is nearing completion of planned corrective actions and expects to 

provide the OIG with evidence of those actions in the near-term. 

Office of Primary Responsibility: Human Exploration and Operations Mission Directorate 

 

Target Completion Date: 1/31/2020 

50. Report: NASA’s Management of the Space Launch System Stages Contract (IG-19-001; 

10/10/2018) 

Recommendation: (4a) Renegotiate the Boeing Stages contract by: separating each deliverable 

(Core Stage 1, Core Stage 2, and EUS) into its own CLIN for tracking costs, performance, and 

award fees. 

Status: In-Progress. NASA is continuing to pursue corrective actions and is on track to award 

the contract by 1/31/2020. Once the contract is awarded, NASA will request closure of this 

recommendation. 

Office of Primary Responsibility: Human Exploration and Operations Mission Directorate 

Target Completion Date: 1/31/2020 

51. Report: NASA’s Management of the Space Launch System Stages Contract (IG-19-001; 

10/10/2018) 

Recommendation: (4b) Renegotiate the Boeing Stages contract by removing the system 

integration fee structure and capping potential award fees at 12.5 percent of estimated costs. 
47 

Status: In-Progress. NASA is continuing to pursue corrective actions and is on track to award 

the contract by 1/31/2020. Once the contract is awarded, NASA will request closure of this 

recommendation. 

Office of Primary Responsibility: Human Exploration and Operations Mission Directorate 

Target Completion Date: 1/31/2020 

52. Report: NASA’s Management of the Space Launch System Stages Contract (IG-19-001; 

10/10/2018) 

Recommendation: (4c) Renegotiate the Boeing Stages contract by determining the amount of 

cost overruns to date and ensuring no future fees are paid on this amount. 

Status: In-Progress. NASA is continuing to pursue corrective actions and is on track to award 

the contract by 1/31/2020. Once the contract is awarded, NASA will request closure of this 

recommendation. 

Office of Primary Responsibility: Human Exploration and Operations Mission Directorate 

Target Completion Date: 1/31/2020 

53. Report: NASA’s Management of the Space Launch System Stages Contract (IG-19-001; 

10/10/2018) 

Recommendation: (4d) Renegotiate the Boeing Stages contract by: reducing the performance 

evaluation period to 6 months with interim reports at 3 months. 

Status: In-Progress. NASA is continuing to pursue corrective actions and is on track to award the 

contract by 1/31/2020. Once the contract is awarded, NASA will request closure of this 

recommendation. 

Office of Primary Responsibility: Human Exploration and Operations Mission Directorate 

Target Completion Date: 1/31/2020 

54. Report: NASA’s Management of the Space Launch System Stages Contract (IG-19-001; 

10/10/2018) 

Recommendation: (4e) Renegotiate the Boeing Stages contract by removing provisional 

performance award fee payments to reflect the current contractor’s performance. 

Status: In-Progress. NASA is continuing to pursue corrective actions and is on track to award 

the contract by 1/31/2020. Once the contract is awarded, NASA will request closure of this 

recommendation. 

Office of Primary Responsibility: Human Exploration and Operations Mission Directorate 

Target Completion Date: 1/31/2020 
48 

55. Report: Audit of NASA's Historic Property (IG-19-002; 10/22/2018) 

Recommendation: (1) To improve the management of NASA’s efforts to retrieve lost historic 

personal property, the OIG recommends the NASA General Counsel develop a process to more 

effectively identify, validate ownership of, and coordinate within NASA and/or with other 

agencies on recovery of historic property. 

Status: In-Progress. Planned corrective actions are in-progress. Stakeholders (OGC, OSI and 

Office of Communications are working towards finalization and publication of a NASA 

Procedural Requirements (NPR) that will address the process and procedure for identifying and 

recovering historic property. 

Office of Primary Responsibility: Office of Strategic Infrastructure 

Target Completion Date: 5/31/2020 

56. Report: Audit of NASA's Historic Property (IG-19-002; 10/22/2018) 

Recommendation: (2) To improve NASA’s identification and management of heritage assets, 

the OIG recommends that the Assistant Administrator for Strategic Infrastructure, in coordination 

with the Associate Administrator for Communications: Develop comprehensive procedures for 

identifying and managing heritage assets, including defining roles and responsibilities for the 

different NASA entities responsible for evaluating what historic items would most effectively be 

maintained by the Agency and considered as heritage assets. 

Status: In-Progress. A draft policy directive has been developed and is currently under review. 

A meeting is planned for January 9, 2020 for the purpose of dispositioning comments received in 

response to the draft directive. 

Office of Primary Responsibility: Office of Communications 

Target Completion Date: 5/14/2020 

57. Report: Audit of NASA's Historic Property (IG-19-002; 10/22/2018) 

Recommendation: (3) To improve NASA’s identification and management of heritage assets, 

the OIG recommends that the Assistant Administrator for Strategic Infrastructure, in coordination 

with the Associate Administrator for Communications: Evaluate and justify the existing list of 

NASA and contractor held heritage assets to determine whether NASA is the most effective 

owner and what property the Agency will retain because of its historical value. 

Status: In-Progress. The Office of Communications and the Office of Strategic Infrastructure are 

coordinating on planned actions intended to implement the recommendation. 

 

Office of Primary Responsibility: Office of Communications 

Target Completion Date: 6/14/2020 
49 

58. Report: Audit of NASA's Historic Property (IG-19-002; 10/22/2018) 

Recommendation: (4) To improve the management of Columbia and Challenger artifacts, the 

OIG recommends the Kennedy Space Center Director: Ensure agreements are signed, 

appropriately updated, and include all necessary loan terms, including a security plan developed 

by the borrower and reviewed by the Center's Office of Protective Services prior to property 

transfer. 

Status: In-Progress. Substantive corrective actions taken include: A) Updated Kennedy NASA 

Procedural Requirements (KNPR) 8621.1, "Columbia Research and Preservation" and; B) 

Modified the Concession Agreement: “Article 28 – Space Shuttle Atlantis Memorial Gallery 

Exhibit." Related documents are in the final review and approval cycle with an estimated 

completion date of January 2020. 

Office of Primary Responsibility: Kennedy Space Center 

Target Completion Date: 1/31/2020 

59. Report: Audit of NASA's Historic Property (IG-19-002; 10/22/2018) 

Recommendation: (5) To improve the use of funds generated from National Historic 

Preservation Act (NHPA) leases, the OIG recommends the Assistant Administrator for Strategic 

Infrastructure: Ensure NASA policy and procedures for using the proceeds from facilities leased 

under NHPA authority appropriately aligns with Agency goals to minimize excess facilities. 

Status: In-Progress. OSI is crafting the policy to update and outline NASA’s established criteria 

for entering into NHPA leases. Based on this revision, the OIG determined that the intent of their 

recommendation has been achieved. OSI is working towards closure by October 31, 2020 for the 

approval and publication of a revised NPR 8800.15. 

Office of Primary Responsibility: Office of Strategic Infrastructure 

Target Completion Date: 10/31/2020 

60. Report: NASA’s Management of Extended Temporary Duty Travel (IG-19-007; 11/28/2018) 

Recommendation: (1) Review the ETDY travel authorization and lodging costs after the first 30 

days of ETDY travel to validate, adjust, and update, if necessary, the authorized lodging 

reimbursements to more closely match actual lodging expenses—but not to exceed the 65 percent 

maximum per diem rate. 

Status: In-Progress. NASA continues to work toward implementation of this recommendation. 

Related corrective actions are in-progress. 

Office of Primary Responsibility: Office of the Chief Financial Officer 

 

Target Completion Date: 12/31/2020 
50 

61. Report: NASA’s Management of Extended Temporary Duty Travel (IG-19-007; 11/28/2018)

Recommendation: (2) Revise NASA policy to explicitly state that actual lodging costs will be 

reviewed after the first 30 days of ETDY travel and authorizations adjusted, if needed. 

Status: In-Progress. NASA continues to work toward implementation of this recommendation. 

Related corrective actions are in-progress. 

Office of Primary Responsibility: Office of the Chief Financial Officer 

Target Completion Date: 1/1/2021 

62. Report: NASA’s Management of Extended Temporary Duty Travel (IG-19-007; 11/28/2018) 

Recommendation: (3) Include in all ETDY travel authorizations a statement that lodging costs 

will be reviewed after the first 30 days of ETDY travel with the corresponding authorized 

reimbursements adjusted to more closely match actual lodging expenses—but not to exceed the 

65 percent maximum per diem rate. 

Status: In-Progress. NASA continues to work toward implementation of this recommendation. 

Related corrective actions are in-progress. 

Office of Primary Responsibility: Office of the Chief Financial Officer 

 

Target Completion Date: 1/2/2021