text:
A The Masters Tournament, azaz a US-Masters, a négy major golf torna egyike.
 1934 óta rendezik meg, az augusta-i (USA) Augusta National Golf Club szervezésében. A többi major tornával ellentétben a Masters – a PGA TOUR és a PGA European Tour hivatalos eseményeként – meghívásos verseny. A játékosokat a világ legjobbjai közül válogatják össze.
 A torna négy fordulóból áll (csütörtöktől vasárnapig), amelyeket 1960 óta a szerdai napon egy rövid pályán tartott par 3 verseny előz meg.
 Green Jacket
 1949 óta a győztest egy zöld zakóval (Green Jacket) és egy életre szóló címmel jutalmazzák. A hagyomány szerint, a győzelmi ceremónián a zakót az előző év bajnoka segíti fel a győztesre. Előfordulhat hogy a két személy azonos, mint ahogyan az 1966-ban Jack Nicklaus sikeres címvédése esetében is történt, ő ekkor egyedül vette fel a zakót. Az újabb sorozatgyőztesek, Nick Faldo és Tiger Woods a klubelnöktől kapták meg az ajándékot. A torna végső szakaszához érve, a lehetséges győztesek méretére készült zakók már készen állnak, így a győzelmi ceremóniára késlekedés nélkül sor kerülhet. A győztes, a méretre készült zakót egy évig magánál tarthatja, majd vissza kell juttatnia a klubhoz.
 Győztesek
 A tabella élén Jack Nicklaus (6 győzelem), Arnold Palmer és Tiger Woods (mindketten 4 győzelemmel) állnak.
 ! Év
 ! Győztes
 ! Ország
 ! Partól való eltérés
 ! Különbség
 ! Győztes díja $
 |-
 | 2012 || Bubba Watson || USA || -10 || Rájátszás (2) || 1 440 000
 |-
 | 2011 || Charl Schwartzel || Dél-Afrika || -14 || 2 || 1 440 000
 |-
 | 2010 || Phil Mickelson (3) || USA || -16 || 3 || 1 350 000
 |-
 | 2009 || Ángel Cabrera || Argentína || -12 || Rájátszás (3) || 1 350 000
 |-
 | 2008 || Trevor Immelman || Dél-Afrika || -8 || 3 || 1 350 000
 |-
 | 2007 || Zach Johnson || USA || +1 || 2 || 1 305 000
 |-
 | 2006 || Phil Mickelson (2) || USA || -7 || 2 || 1 260 000
 |-
 | 2005 || Tiger Woods (4) || USA || -12 || Rájátszás (2) || 1 260 000
 |-
 | 2004 || Phil Mickelson || USA || -9 || 1 || 1 117 000
 |-
 | 2003 || Mike Weir || Kanada || -7 || Rájátszás (2) || 1 080 000
 |-
 | 2002 || Tiger Woods (3) || USA || -12 || 3 ||1 008 000
 |-
 | 2001 || Tiger Woods (2) || USA || -16 || 2 || 1 008 000
 |-
 | 2000 || Vijay Singh || Fidzsi-szigetek || -10 || 3 || 828 000
 |-
 | 1999 || José Maria Olazábal (2) || Spanyolország || -8 || 2 || 720 000
 |-
 | 1998 || Mark O'Meara (2) || USA || -9 || 1 || 576 000
 |-
 | 1997 || Tiger Woods || USA || -18 || 12 || 486 000
 |-
 | 1996 || Nick Faldo (3) || Anglia || -12 || 5 || 450 000
 |-
 | 1995 || Ben Crenshaw (2) || USA || -14 || 1 || 396 000
 |-
 | 1994 || José Maria Olazábal || Spanyolország || -9 || 2 || 360 000
 |-
 | 1993 || Bernhard Langer || Németország || -11 || 4 || 306 000
 |-
 | 1992 || Fred Couples || USA || -13 || 2 || 270 000
 |-
 | 1991 || Ian Woosnam || Wales || -11 || 1 || 243 000
 |-
 | 1990 || Nick Faldo (2) || Anglia || -10 || Rájátszás (2) || 225 000
 |-
 | 1989 || Nick Faldo || Anglia || -5 || Rájátszás (2) || 200 000
 |-
 | 1988 || Sandy Lyle || Skócia || -7 || 1 || 183 800
 |-
 | 1987 || Larry Mize || USA || -3 || Rájátszás (3) || 162 000
 |-
 | 1986 || Jack Nicklaus (6) || USA || -9 || 1 || 144 000
 |-
 | 1985 || Bernhard Langer || Németország || -6 || 1 || 126 000
 |-
 | 1984 || Ben Crenshaw || USA || -11 || 1 || 108 000
 |-
 | 1983 || Seve Ballesteros (2) || Spanyolország || -8 || 4 || 90 000
 |-
 | 1982 || Craig Stadler || USA || -4 || Rájátszás (2) || 64 000
 |-
 | 1981 || Tom Watson (2) || USA || -8 || 2 || 60 000
 |-
 | 1980 || Seve Ballesteros || Spanyolország || -14 || 4 || 55 000
 |-
 | 1979 || Fuzzy Zoeller || USA || -8 || Rájátszás (3) || 50 000
 |-
 | 1978 || Gary Player (3) || Dél-Afrika || -11 || 1 || 45 000
 |-
 | 1977 || Tom Watson || USA || -12 || 2 || 40 000
 |-
 | 1976 || Raymond Floyd || USA || -17 || 8 || 40 000
 |-
 | 1975 || Jack Nicklaus (5) || USA || -12 || 1 || 40 000
 |-
 | 1974 || Gary Player (2) || Dél-Afrika || -10 || 2 || 35 000
 |-
 | 1973 || Tommy Aaron || USA || -5 || 1 || 30 000
 |-
 | 1972 || Jack Nicklaus (4) || USA || -2 || 3 || 25 000
 |-
 | 1971 || Charles Coody || USA || -9 || 2 || 25 000
 |-
 | 1970 || Billy Casper || USA || -9 || Rájátszás (2) || 25 000
 |-
 | 1969 || George Archer || USA || -7 || 1 || 20 000
 |-
 | 1968 || Bob Goalby || USA || -11 || 1 || 20 000
 |-
 | 1967 || Gay Brewer || USA || -8 || 1 || 20 000
 |-
 | 1966 || Jack Nicklaus (3) || USA || E || Rájátszás (3) || 20 000
 |-
 | 1965 || Jack Nicklaus (2) || USA || -17 || 9 || 20 000
 |-
 | 1964 || Arnold Palmer (4) || USA || -12 || 6 || 20 000
 |-
 | 1963 || Jack Nicklaus || USA || -2 || 1 || 20 000
 |-
 | 1962 || Arnold Palmer (3) || USA || -8 || Rájátszás (3) || 20 000
 |-
 | 1961 || Gary Player || Dél-Afrika || -8 || 1 || 20 000
 |-
 | 1960 || Arnold Palmer (2) || USA || -6 || 1 || 17 500
 |-
 | 1959 || Art Wall, Jr. || USA || -4 || 1 || 15 000
 |-
 | 1958 || Arnold Palmer || USA || -4 || 1 || 11 250
 |-
 | 1957 || Doug Ford || USA || -5 || 3 || 8 750
 |-
 | 1956 || Jack Burke, Jr. || USA || +1 || 1 || 6 000
 |-
 | 1955 || Cary Middlecoff || USA || -9 || 7 || 5 000
 |-
 | 1954 || Sam Snead (3) || USA || +1 || Rájátszás (2) || 5 000
 |-
 | 1953 || Ben Hogan (2) || USA || -14 || 5 || 4 000
 |-
 | 1952 || Sam Snead (2) || USA || -2 || 4 || 4 000
 |-
 | 1951 || Ben Hogan || USA || -8 || 2 || 3 000
 |-
 | 1950 || Jimmy Demaret (3) || USA || -5 || 2 || 2 400
 |-
 | 1949 || Sam Snead || USA || -6 || 3 || 2 750
 |-
 | 1948 || Claude Harmon || USA || -9 || 5 || 2 500
 |-
 | 1947 || Jimmy Demaret (2) || USA || -7 || 2 || 2 500
 |-
 | 1946 || Herman Keiser || USA || -6 || 1 || 2 500
 |-
 | 1945 || Elmaradt || || || ||
 |-
 | 1944 || Elmaradt || || || ||
 |-
 | 1943 || Elmaradt || || || ||
 |-
 | 1942 || Byron Nelson (2) || USA || -8 || Rájátszás (2) || 1 500
 |-
 | 1941 || Craig Wood || USA || -8 || 3 || 1 500
 |-
 | 1940 || Jimmy Demaret || USA || -8 || 4 || 1 500
 |-
 | 1939 || Ralph Guldahl || USA || -9 || 1 || 1 500
 |-
 | 1938 || Henry Picard || USA || -3 || 2 || 1 500
 |-
 | 1937 || Byron Nelson || USA || -5 || 2 || 1 500
 |-
 | 1936 || Horton Smith (2) || USA || -3 || 1 || 1 500
 |-
 | 1935 || Gene Sarazen || USA || -6 || Rájátszás (2) || 1 500
 |-
 | 1934 || Horton Smith || USA || -4 || 1 || 1 500
 A Rájátszás után szereplő szám a versenyben maradt játékosok számát jelzi.
 Többszörös győztesek
 Az alábbi játékosok több alkalommal is megnyerték a tornát:
 6 győzelem
 Jack Nicklaus: 1963, 1965, 1966, 1972, 1975, 1986
 4 győzelem
 Arnold Palmer: 1958, 1960, 1962, 1964
 Tiger Woods: 1997, 2001, 2002, 2005
 3 győzelem
 Jimmy Demaret: 1940, 1947, 1950
 Sam Snead: 1949, 1952, 1954
 Gary Player: 1961, 1974, 1978
 Nick Faldo: 1989, 1990, 1996
 2 győzelem
 Horton Smith: 1934, 1936
 Byron Nelson: 1937, 1942
 Ben Hogan: 1951, 1953
 Tom Watson: 1977, 1981
 Seve Ballesteros: 1980, 1983
 Bernhard Langer: 1985, 1993
 Ben Crenshaw: 1984, 1995
 Jose Maria Olazabal: 1994, 1999
 Phil Mickelson: 2004, 2006
 Külső hivatkozások
 http://www.masters.org/
 Golf


type: contracts

jurisdiction: EU

text:
 Avis juridique important
 |
 22003D0144
 Decision of the EEA Joint Committee No 144/2003 of 7 November 2003 amending Annex II (Technical regulations, standards, testing and certification) to the EEA Agreement
 Official Journal L 041 , 12/02/2004 P. 0027 - 0028
 Decision of the EEA Joint CommitteeNo 144/2003of 7 November 2003amending Annex II (Technical regulations, standards, testing and certification) to the EEA AgreementTHE EEA JOINT COMMITTEE,Having regard to the Agreement on the European Economic Area, as amended by the Protocol adjusting the Agreement on the European Economic Area, hereinafter referred to as "the Agreement", and in particular Article 98 thereof,Whereas:(1) Annex II to the Agreement was amended by Decision of the EEA Joint Committee No 108/2003 of 26 September 2003(1).(2) Commission Regulation (EC) No 61/2003 of 15 January 2003 amending Annexes I and II to Council Regulation (EEC) No 2377/90 laying down a Community procedure for the establishment of maximum residue limits of veterinary medicinal products in foodstuffs of animal origin(2) is to be incorporated into the Agreement,HAS DECIDED AS FOLLOWS:Article 1The following indent is added in point 14 (Council Regulation (EEC) No 2377/90) of Chapter XIII of Annex II to the Agreement:"- 32003 R 0061: Commission Regulation (EC) No 61/2003 of 15 January 2003 (OJ L 11, 16.1.2003, p. 12)."Article 2The text of Regulation (EC) No 61/2003 in the Icelandic and Norwegian languages, to be published in the EEA Supplement to the Official Journal of the European Union, shall be authentic.Article 3This Decision shall enter into force on 8 November 2003, provided that all the notifications under Article 103(1) of the Agreement have been made to the EEA Joint Committee(3).Article 4This Decision shall be published in the EEA section of, and in the EEA Supplement to, the Official Journal of the European Union.Done at Brussels, 7 November 2003.For the EEA Joint CommitteeThe PresidentHSH Prinz Nikolaus von Liechtenstein(1) OJ L 331, 18.12.2003, p. 20.(2) OJ L 11, 16.1.2003, p. 12.(3) No constitutional requirements indicated.


type: other

text:
AD 2004 nr 80 | lagen.nu
 AD 2004 nr 80
 Blombyn i Norrköping Aktiebolag; Handelsanställdas förbund; B.B.
 Blombyn i Norrköping Aktiebolag i Norrköping
 Handelsanställdas förbund och B.B. i Norrköping.
 Mellan Handelsanställdas förbund (förbundet) och Handelsarbetsgivarna gäller kollektivavtal, det s.k. detaljhandelsavtalet. Blombyn i Norrköping AB (bolaget) är genom hängavtal med förbundet bundet av kollektivavtalet. B.B. är medlem i förbundet.
 Bolaget har väckt talan och yrkat att Arbetsdomstolen skall fastställa dels att B.B. inte blivit avskedad från sin anställning hos bolaget, dels att bolaget inte är skyldigt att till B.B. utge lön för januari månad 2004.
 Arbetstagarparterna har yrkat, i första hand, att käromålet skall avvisas och, i andra hand, att käromålet skall ogillas.
 Bolaget har bestritt avvisningsyrkandet.
 Arbetstagarparterna har yrkat ersättning för rättegångskostnader.
 Bolaget har yrkat att vardera sidan skall stå för sina egna rättegångskostnader oavsett utgången i avvisningsfrågan.
 Arbetsdomstolen har prövat frågan om avvisning efter föredragning.
 Bolaget, som säljer möbler och annan heminredning, startade sin verksamhet i december 2003. I slutet av 2003 ingicks ett muntligt anställningsavtal mellan bolaget och B.B. Den 8 januari 2004 började B.B. att arbeta i bolagets butik. Parterna tecknade i början av 2004 ett skriftligt provanställningsavtal för tiden den 1 februari 2004 – 2 augusti 2004, av vilket bl.a. framgick att B.B. anställdes som säljare med en arbetstid om 40 timmar per vecka. Vid sidan av provanställningsavtalet kom parterna överens om att B.B. skulle arbeta ytterligare en dag per vecka utöver de fem dagar som parterna tidigare hade enats om och att han för detta skulle erhålla 5 000 kr extra per månad. I mitten av mars 2004 uppkom meningsskiljaktigheter mellan parterna angående storleken på extraersättningen. Företrädare för bolaget och B.B. var inte överens om hur mycket av extraersättningen som skulle bortfalla med hänsyn till att B.B. inte arbetade sex dagar i veckan såsom det var avtalat. B.B. meddelade att han omedelbart tänkte sluta anställningen om han inte fick den lön han ansåg sig ha rätt till. Företrädare för bolaget informerade B.B. om att hans lönekrav inte skulle accepteras och att det var ”upp till honom” om han ville lämna anställningen. Han uppmärksammades på att han hade en avtalad uppsägningstid på 14 dagar. B.B. lämnade då nycklarna till butiken och sade sig aldrig mer vilja komma tillbaka, vilket han inte heller gjorde. Företrädare för bolaget fick uppfattningen att B.B. lämnade anställningen med omedelbar verkan. – Några dagar senare fick bolaget ett brev från förbundets lokala kontor i Norrköping. I brevet begärdes MBL-förhandlingar med anledning av ett påstått avskedande av B.B. Vid den lokala förhandling som hölls den 5 maj 2004 deltog företrädare för bolaget och B.B. tillsammans med fackombudet S.G. Vid förhandlingen förklarade arbetsgivaren att B.B. inte hade avskedats utan i stället självmant lämnat sin anställning. Förhandlingarna avslutades i oenighet. Därefter har bolaget haft skyldighet att, jämlikt bestämmelserna i 35 och 37 §§ medbestämmandelagen, väcka talan inom tio dagar, vilket också skedde.
 Beträffande den påstådda rätten till lön för januari månad 2004 förhåller det sig så att B.B. i slutet av januari 2004 fått den överenskomna lönen utbetald i kontanter. På grund härav finns ingen lönespecifikation eller något kontoutdrag av vilket denna transaktion framgår.
 Av 19 § i detaljhandelsavtalet följer att parterna till det avtalet även är bundna av huvudavtalet mellan SAF och LO. Enligt 2 kap. 4 § huvudavtalet skall, om uppgörelse inte kan nås vid lokal förhandling, även central förhandling äga rum. Den 5 maj 2004 hölls lokal förhandling mellan bolaget och förbundet. Vid förhandlingarna framställde förbundet krav avseende lön för B.B:s räkning. Bolaget bestred lönekraven. Därmed uppstod en sådan rättstvist om lön och annan ersättning som avses i 35 § medbestämmandelagen. Bolaget har inte påkallat central förhandling inom tio dagar efter det att den lokala förhandlingen avslutades. Bolaget väckte talan vid Arbetsdomstolen innan central förhandling hade ägt rum. Enligt 4 kap. 7 § arbetstvistlagen får talan inte upptas till prövning av Arbetsdomstolen förrän förhandling som kan påkallas enligt medbestämmandelagen eller som anges i kollektivavtal har ägt rum angående tvistefrågan. Av lagkommentaren Rättegången i arbetstvister, s. 192, framgår att förhandlingsordningens ordalydelse avgör frågan om en genomförd förhandling, efter att stämningsansökan inkom till AD, kan ”läka” denna tidigare avsaknad av processförutsättning. I 2 kap. 7 § huvudavtalet mellan SAF och LO, som är den tillämpliga bestämmelsen, anges att ”part må ej i fråga om tillämpning av kollektivavtalet eller i annan tvist, som det enligt 11 § lagen om arbetsdomstol ankommer på denna domstol att avgöra, påkalla sådant avgörande, förrän han fullgjort sin skyldighet att förhandla i frågan.” När stämningsansökan inkom till Arbetsdomstolen hade ingen central förhandling genomförts, varför grund för avvisning av käromålet föreligger.
 Centrala förhandlingar ägde rum mellan bolaget och förbundet den 15 juni 2004. Förhandlingskravet är alltså uppfyllt, varför det numera inte föreligger hinder för Arbetsdomstolen att uppta målet till prövning. Förbundet kallade på egen begäran till och genomförde centrala förhandlingar med bolaget efter det att bolaget väckt talan i Arbetsdomstolen. Genom att förfara på detta sätt försvann det processhinder som ej genomförda centrala förhandlingar annars skulle utgöra. Arbetstagarparterna har genom sitt konkludenta handlande agerat på ett sätt som gett bolaget befogad anledning att utgå från att frånvaron av centrala förhandlingar inte utgjorde ett brott mot kollektivavtalet och därmed inte heller ett processhinder enligt arbetstvistlagen. – 35 § medbestämmandelagen är endast tillämplig när det är fråga om en rättstvist om lön eller annan ersättning. De lönekrav som B.B. har framställt är enbart av sekundär betydelse i målet. Kravet är helt beroende av frågan om han självmant frånträtt anställningen eller blivit avskedad. Ifrågavarande tvist handlar därför i första hand om omständigheterna kring anställningens upphörande och endast som en konsekvens av den bedömningen om de lönekrav som arbetstagarparterna har framställt med hänvisning till den påstådda uppsägningen. Tvistefrågan är därför vem som bär ansvaret för anställningens upphörande och ingenting annat.
 Enligt 4 kap. 7 § första stycket arbetstvistlagen får talan inte upptas till prövning av Arbetsdomstolen förrän förhandling, som kan påkallas enligt medbestämmandelagen eller som anges i kollektivavtal, har ägt rum rörande tvistefrågan. Innehållet i förhandlingskravet bestäms av medbestämmandelagen, andra arbetsrättsliga lagar respektive kollektivavtal. Arbetstvistlagen uppställer alltså inget eget förhandlingskrav. Hänvisningen till förhandlingsreglerna i medbestämmandelagen respektive kollektivavtal innebär att specialregler om förhandlingsskyldigheten, som avviker från de allmänna reglerna om förhandlingsskyldigheten, får genomslag vid Arbetsdomstolen. I medbestämmandelagen ges specialbestämmelser för förhandlingar i bl.a. 35 och 37 §§. I kollektivavtal förekommer ofta motsvarigheter till dessa specialregler (se Rättegången i arbetstvister, s. 187-188).
 Omfattar målet en rättstvist enligt 35 § medbestämmandelagen?
 35 § medbestämmandelagen innehåller bestämmelser om arbetsgivarens skyldighet att inom vissa tidsfrister påkalla förhandling och i sista hand väcka talan vid Arbetsdomstolen, när det har uppstått en rättstvist om lön eller annan ersättning till arbetstagarna. Bestämmelserna går ut på att arbetsgivaren blir skyldig att betala ersättning enligt arbetstagarsidans mening, om han underlåter att initiera förhandling och rättegång i tvisten. Det finns dock ett undantag för det fallet att arbetstagarsidans krav är oskäligt. I 37 § samma lag anges de tidsfrister som gäller för att begära förhandling och att väcka talan i de fall som åsyftas i bl.a. 35 §.
 Enligt protokollet från den lokala förhandling, som hölls den 5 maj 2004, framförde förbundet för B.B:s räkning bl.a. lönekrav för januari månad 2004, vilket bestreds av bolaget. Av protokollet framgår vidare att arbetstagarparterna, sedan bolaget frånträtt förhandlingen, ansett att tvist enligt 35 § medbestämmandelagen uppkommit. Bolaget har i stämningsansökan hänvisat till vad som förekommit vid denna förhandling och uppgett att bolagets talan får ses mot bakgrund av en arbetsgivares skyldighet enligt 35 och 37 §§ medbestämmandelagen. Bolaget för i målet bl.a. en talan om att det skall fastställas att någon betalningsskyldighet beträffande den nyss nämnda januarilönen inte föreligger.
 Bolaget har emellertid i en senare inlaga till domstolen gjort gällande att 35 § medbestämmandelagen inte är tillämplig eftersom de lönekrav som B.B. har framställt enbart är av sekundär betydelse och är helt beroende av bedömningen av vem som tog initiativ till uppsägningen.
 Det kan här nämnas att Arbetsdomstolen i rättsfallet AD 1991 nr 66 bl.a. hade att ta ställning till huruvida reglerna i 35 § medbestämmandelagen kunde åberopas i fråga om sådana lönekrav avseende en uppsagd arbetstagare, som grundade sig på 34 § andra stycket anställningsskyddslagen. Domstolen fann att när det inte råder tvist om annat än huruvida en anställning faktiskt består på grund av de nyss nämnda reglerna i anställningsskyddslagen finns det inte utrymme för tillämpning av reglerna i 35 § medbestämmandelagen.
 I detta fall framgår det inte klart av utredningen om en del av det lönekrav som framställdes vid den lokala förhandlingen avsåg tid beträffande vilken det är tvistigt om anställningen bestod. Det lönekrav som är aktuellt genom den talan bolaget för avser emellertid endast januari månad 2004, dvs. hänför sig till tiden före anställningens upphörande. Prövningen av det berättigade i det sistnämnda lönekravet är således inte beroende av bedömningen av den andra tvistefrågan i målet, nämligen på vems initiativ provanställningen upphörde. Mot bakgrund av vad som nu sagts får det anses klarlagt att den del av målet som rör frågan om lön utgör en sådan rättstvist som omfattas av bestämmelserna i 35 och 37 §§ medbestämmandelagen.
 Tillämpliga förhandlingsregler?
 Arbetsdomstolen övergår därefter till frågan om vilka förhandlingsregler som skall tillämpas på lönetvisten. De frister som gäller för att begära förhandling och att väcka talan enligt 35 § medbestämmandelagen framgår, som nyss nämnts, av 37 § samma lag. Av den senare bestämmelsen följer att om kollektivavtalet föreskriver att förhandling enligt bl.a. 35 § medbestämmandelagen skall äga rum både lokalt och centralt, skall central förhandling påkallas inom tio dagar efter det att den lokala förhandlingen har avslutats. I bestämmelsen anges vidare att talan vid domstol skall väckas inom tio dagar efter det att förhandling har avslutats. Bestämmelserna i 35 och 37 §§ medbestämmandelagen är dispositiva (se 4 § andra stycket samma lag). Om inte bestämmelser i kollektivavtal anger annat, är det således tillräckligt med tvisteförhandling enligt 35 § medbestämmandelagen på endast en nivå.
 Det är enligt Arbetsdomstolens mening tveksamt om den utredning som föreligger i målet kan anses visa att det av arbetstagarparterna åberopade huvudavtalet innehåller regler som anger att i fall som avses i 35 § medbestämmandelagen skall både lokal och central förhandling ske. Arbetsdomstolen saknar emellertid anledning att definitivt ta ställning i den frågan. Bolagets huvudsakliga invändning mot arbetstagarparternas avvisningsyrkande får nämligen anses vara att förhandlingskravet under målets handläggning har fullgjorts även med avseende på central förhandling. Det bör här tilläggas att beträffande tvistefrågan i övrigt i målet, dvs. frågan om B.B. självmant lämnat sin anställning eller avskedats, får det anses gälla ett krav på både lokal och central förhandling.
 När skall förhandlingskravet vara uppfyllt?
 I målet är ostridigt att central förhandling inte ägt rum då stämningsansökan inkom till Arbetsdomstolen den 14 maj 2004. Central förhandling hölls först den 15 juni 2004.
 Som ovan nämnts får enligt huvudregeln i 4 kap. 7 § arbetstvistlagen talan inte upptas till prövning förrän förhandlingskravet är uppfyllt. Innebörden av detta uttryck är, vilket framgår av arbetstvistlagens förarbeten (prop. 1974:77 s. 174 f. och SOU 1974:8 s. 198 f.), att förhandlingskravet skall vara uppfyllt innan talan får väckas. Förhandlingarna måste med andra ord vara avslutade innan part stämmer vid Arbetsdomstolen och det är inte tillräckligt att de avslutas först före målets företagande till dom.
 Det processhinder som föreligger om förhandlingskravet inte är uppfyllt är emellertid dispositivt, vilket innebär att det beaktas endast efter invändning av part. Det beaktas inte heller om invändningen görs för sent (AD 1977 nr 187). En part anses ha försuttit sin rätt att göra invändning med stöd av 4 kap. 7 § arbetstvistlagen om parten går in i svaromål i sak utan att göra invändningen (AD 1989 nr 30). Mot den bakgrunden har Arbetsdomstolen i rättsfallet AD 1990 nr 52 uttalat att avvisning inte bör ske för det fall att förhandlingskravet inte är uppfyllt vid talans väckande men blir uppfyllt innan invändning om bristande förhandling görs (se även AD 1998 nr 153).
 Arbetstagarparternas invändning om att det förelåg processhinder på grund av att förhandlingskravet i 4 kap. 7 § arbetstvistlagen inte var uppfyllt framfördes i det svaromål som inkom till Arbetsdomstolen den 22 juni 2004. Den centrala förhandlingen ägde rum den 15 juni 2004. Den centrala förhandlingen ägde alltså rum innan arbetstagarparterna gjorde invändning om processhinder.
 Mot bakgrund av vad som nu sagts finner Arbetsdomstolen att bolaget har fullgjort sin förhandlingsskyldighet. Det saknas således skäl att enligt 4 kap. 7 § arbetstvistlagen avvisa käromålet.
 Arbetsdomstolen avslår Handelsanställdas förbunds och B.B:s avvisningsyrkande.
 Beslut 2004-10-13, målnummer A-94-2004
 Ledamöter: Inga Åkerlund, Dag Ekman, Kurt Eriksson, Claes Frankhammar, Inger Mattsson Kasserud, Nils Lang (f.d. avtalsombudsmannen i Svenska Kommunalarbetareförbundet; tillfällig ersättare) och Margareta Zandén. Enhälligt.
 A-94-2004
 AD 1977 nr 187
 AD 1989 nr 30
 AD 1991 nr 66
 AD 1998 nr 153


type: wikipedia

text:
Dobiva se iz rude volframita (volframat željeza i mangana), u obliku sivog praha, koji se grijanjem pod tlakom na temperaturi ispod tališta može pretvoriti u kompaktni rastezljivi metal. Volfram je 1781. godine otkrio Carl Wilhelm Scheele. Ime je dobio po mineralu volframitu. Nastalo je od njemačkog prijevoda latinskog naziva volframove rude "lupi spuma", što znači "vučja pjena". Također se naziva tungsten, što dolazi od švedskih riječi "tung sten", koje u prijevodu znače "težak kamen".
 Volfram je tvrd, krt, sjajan srebrnobijeli metal koji ima iznimno visoku gustoću od 19,25 g/cm3, što je skoro jednako kao zlato (19,3 g/cm3). Za usporedbu, olovo ima gustoću od 11,34 g/cm3, a najgušći element, osmij ima gustoću od 22,57 g/cm3. Ima drugo najviše vrelište od svih elemenata (5930 °C) i najviše talište od svih kovina (3422 °C). Zbog najvišeg tališta, volframove niti se koriste kao žarne niti u električnim žaruljama, koje što se više zagrijavaju, to daju više svjetlosti.
 Volfram čini slitine s mnogim metalima. Čelici s volframom su izvanredne tvrdoće i elastičnosti. Inače se volfram upotrebljava kao sastojak čelika i legura od kojih se prave noževi za brzo rezanje metala na tokarilici (brzorezni čelik), te slitina za električne kontakte. Volframovi karbidi, W2C i WC, glavni su sastojak tvrdih metala za oštrice alata (vidija). Volframov trioksid WO3 služi kao žuta boja za staklo. Soli volframove kiseline H2WO4 (volframati) i kiseline s kiselim oksidima služe u analitičkoj kemiji, te u proizvodnji boja.
 Svojstva volframa
 Fizikalna svojstva
 Volfram je tvrd, sjajan, srebrnobijeli metal s najvišim talištem (3422 °C), najnižim tlakom vlastitih para, te najvećom vlačnom čvrstoćom (sve do temperature 1650 °C) od svih metala. Javlja se u dvije alotropske modifikacije: "alfa-volfram", koji je prostorno centrirane kubične kristalne strukture, i "beta-volfram", koji je plošno centrirane kubične strukture. Pri sobnoj temperaturi na zraku je postojan, a zagrijan do crvenog žara izgara dajući volframov(VI) oksid. Vrlo čist metal, iako tvrd, dobro se obrađuje klasičnim metodama. No, ako sadrži imalo primjesa, postaje vrlo krhak. Volfram se stoga bolje i češće obrađuje metodama metalurgije praha.
 Izotopi volframa
 Prirodni volfram je smjesa od pet stabilnih izotopa: volfram-18O, volfram-182, volfram-183, volfram-184 i volfram-186, a poznato je još dvanaest prirodnih radioaktivnih izotopa. Svi ti izotopi su ustvari radioaktivni izotopi, ali neki od njih s vrlo velikim vremenom poluraspada (prelaze u hafnij s alfa raspadom), pa se zato smatraju "stabilnima". Za volfram-18O se pretpostavlja da ima vrijeme poluraspada od 1,8 ± 0,2 × 1018 godina, što znači da se u jednom gramu prirodnog volframa dogode 2 raspada volframa-18O u godini dana (2 Bekerela). Za ostala četiri stabilna prirodna izotopa, vrijeme poluraspada se pretpostavlja:
 volfram-182: vrijeme poluraspada > 8,3 × 1018 godina;
 volfram-183: vrijeme poluraspada > 29 × 1018 godina;
 volfram-184: vrijeme poluraspada > 13 × 1018 godina;
 volfram-186: vrijeme poluraspada > 27 × 1018 godina;
 Od ostalih prirodnih i umjetnih izotopa najstabilniji je volfram-181, koji ima vrijeme poluraspada 121,2 dana; zatim volfram-185 ima vrijeme poluraspada 75,1 dana; volfram-188 ima vrijeme poluraspada 69,4 dana; volfram-178 ima vrijeme poluraspada 21,6 dana, te volfram-187 koji ima vrijeme poluraspada 23,72 sata. Ostali radioaktivni izotopi imaju vrijeme poluraspada manje od 3 sata, a većina manje od 8 minuta. Volfram ima i četiri metastabilna izotopa, od kojih je najstabilniji volfram-179m koji ima vrijeme poluraspada 6,4 minute.
 Kemijska svojstva
 Volfram je otporan na djelovanje većine kiselina, tako da ga fluorovodična kiselina i zlatotopka nagrizaju vrlo sporo, ali se brzo otapa u smjesi dušične i fluorovodične kiseline. Lako i brzo se otapa u talini NaOH + NaNO3, a taljenjem s lužinama daje volframate.
 Volfram pravi spojeve u kojima ima oksidacijski broj 0, +2, +3, +4, +5 i +6. Spojevi s nižim oksidacijskim brojem nemaju osobitu važnost, a tipični su u karbonilnim i fosfinskim spojevima. Veći broj spojeva, posebno oksida, nestehiometrijskog su sastava. Volfram stvara brojne komplekse. U višim oksidacijskim stanjima ima uglavnom S- i O-ligande, a u nižim P-ligande. Halogenidi nižih oksidacijskih stanja obično su polimerizirani s jakim W - W vezama.
 Glavne skupine spojeva su:
 Volframovi halogenidi nastaju izravnom sintezom elemenata. Fluoridi volframa postoje u oksidacijskim brojevima +6, +5 i +4 (WF6,WFs i WF4). Pripadni kompleksi sadrže ione [WF7]- i [WF6]-. Kloridi postoje u oksidacijskim brojevima od +6 do +2 (WCl6, WCl5, WCl4, WCl3 i WCl2, a kompleksni kloridi sadrže ione [WCl6]-, [WCl6]2- i [W2Cl9]3-. Analogno postoje bromidi (WBr6, WBr4, WBr3 i WBr2), te jodidi (WI4, WI3 i WI2) i njihovi kompleksi.
 Volframovi stehiometrijski oksidi su žuti WO3 i smeđi WO2. Pored njih postoje brojni nestehiometrijski oksidi. Najvažniji je volframov(VI) oksid (WO3). Netopljiv je u kiselinama, a otapanjem u lužinama daje ortovolframate, ione WO42-. Ovisno o alkalnosti otopina ortovolframata mogu nastati manje ili više polimerni volfrarnati npr. M10W12O41 x aH2O, M6W7O24 x bH2O i M6H2W12O40. Reakcijom elementamog volframa s alkalijskim volframatima uz zagrijavanje, dobiju se intenzivno obojene tzv. volframove bronce (M x WO3, gdje je M = Li, Na ili K), koje imaju metalni izgled i dobri su vodiči električne struje.
 Volframovi karbidi, W2C i WC, glavna su sastojina tvrdih metala za oštrice alata ("Widia").
 Dobivanje volframa
 Čisti metal volfram može se dobiti redukcijom volframovog(VI) oksida (WO3) vodikom. Za dodivanje WO3 koriste se volframove rude ferberit ili šelit, koje se najprije raščine natrijevim karbonatom uz prisutnost zraka:
 4 FeWO4(s) + 4 Na2CO3(s) + O2(g) <=> 4 Na2WO4(s) + 2 Fe2O3(s) + 4 CO2(g)
 CaWO4(s) + Na2CO3(s) <=> Na2WO4(s) + CaCO3(s)
 Nastali natrijev volframat otopi se u vodi i zakiseli, pri čemu se istaloži netopljiva ortovolframatna kiselina (H2WO4), koja se zagrijava da bi se dobio čisti WO3. Redukcija oksida vodikom odvija se pri temperaturi 1200 °C, a nastaje elementarni volfram u obliku metalnog praha:
 WO3(S) + 3 H2(g) <-> W(g) + 3 H2O(g)
 Budući da se dosta volframa upotrebljava u metalurgiji kao ferovolfram, koji se legira s čelicima (velik broj različitih alatnih čelika), volframove rude se direktno prerađuju u ferovolframat. Pri tom se ruda ferberit reducira s aluminijem, a šelit i volframit se reduciraju koksom u električnim pećima, uz dodatak odgovarajućih količina željezovog(III) oksida.
 Minerali i proizvodnja
 Volfram se nalazi u mineralima volframitu (volframat željeza i mangana, (Fe,Mn)WO4), šelitu (kalcijev volframat (CaWO4), ferberitu (FeWO4) i huebneritu (MnWO4). U zemljinoj kori ima ga otprilike sto puta manja od kroma. Kina je proizvela 51 000 tona volframovog koncentrata u 2009., što je bilo 83% svjetske proizvodnje te godine (61 000 tona). Ostali veći proizvođači volframa su: Rusija (2 500 tona), Kanada (1 964 tone), Bolivija (1 023 tone), Austrija (900 tona), Portugal (900 tona), Tajland (600 tona), Brazil (500 tona), Peru (500 tona) i Ruanda (500 tona). U Demokratskoj Republici Kongo je primjećeno neetičko rudarenje volframa.
 Biološka uloga volframa
 Kod ljudi volfram nema nikakvu biološku ulogu. Smatra se da je volfram blago otrovan (toksičan). Smrtonosna doza metala volframa je oko 2 grama po kilogramu tjelesne težine. Volfram iritira kožu i oči i eksperimentalni je teratogen. U čovjeku prosječne težine 70 kg ima ga 0,02 mg.
 Primjena
 Oko pola proizvedenog volframa se koristi za dobivanje tvrdih metala, posebno volframovog karbida.
 Tvrde legure
 Tvrde legure se upotrebljavaju za izradu visokokvalitetnih reznih alata, kod kojih se mogu primijeniti velike brzine rezanja i dobije se visoka kvaliteta površine koja se obrađuje. Zbog visokih temperatura koje se pri procesima rezanja razvijaju (> 700 °C), zahtjev u svojstvima se prije svega odnosi na veliku tvrdoću, otpornost na trošenje i stabilnost osobina na povišenim temperaturama (puzanje). Rezni alati izrađeni od tvrdih legura imaju bolja svojstva od alata izrađenih od brzoreznih čelika, posebno bolja svojstva rezanja na povišenim temperaturama. Izrađuju se procesom sinterovanja (metalurgija praha), tvrde legure na bazi volframovog karbida (kompozitni materijal) i procesom lijevanja – steliti. Zbog načina dobivanja, ali i velike tvrdoće, tvrde legure ne mogu da se oblikuju plastičnim deformiranjem (npr. kovanje), niti da se toplinski obrađuju.
 Žarne niti električnih žarulja
 Važna je upotreba volframa za žarne niti električnih žarulja i katoda elektronskih cijevi. Žarne niti se proizvode ili iz štapića volframa ciklusima: kovanje - zagrijavanje - hlađenje, dok ne postane rastezljiv metal da se može izvlačiti u tanke niti promjera oko 0,01 mm. Druga metoda je propuštanje niti napravljenih od smjese praha volframa, 1 - 4% ThO2 i veziva kroz peći zagrijane na temperaturu 2200 - 2400 °C. U tom prolazu praškasta smjesa se sinterira, a ThO2 pospješuje proces sinteriranja i kontrolira rast kristalnog zrna, a time i mikrokristalnu morfologiju. Volfram za žarne niti mora imati izdužene mikrokristale. Ovako dobivene volframove niti upotrebljavaju se za proizvodnju žarnih niti u elektronskim i katodnim cijevima, te električnim žaruljama.
 Volfram za legiranje
 Iz volframa se izrađuje ferovolfram, legura koja se upotrebljava u metalurgiji za dobivanje čvrstih volframovih čelika, koji se odlikuju izuzetnom antikorozivnošću na visokim temperaturama. Koriste se za izradu oplata visokotemperaturnih peći, električnih grijača i brojnih raketnih elemenata, posebno mlaznica u svemirskoj tehnologiji. Poznati čelici za brzorezne alate, Haselloy i Stellit, legirani su volframom. Volframov karbid (WC), jedna je od najtvrđih tvari i glavnih proizvoda na bazi volframa, a koristi se za izradu brzoreznih alata ili kao nanos na alatima iz tvrdih sinterovanih metala, te za alate koji se upotrebljavaju u naftnoj industriji i rudarstvu - za najkritičnije dijelove (vrhove bušilica i rudarskih drobilica). Karbid ima tvrdoću 9,5 na Mohsovoj ljestvici od 10 (za dijamant) i talište pri 2860 °C.
 Volfram se legira i s drugim metalima kao što su srebro, bakar i nikal. Ove se legure koriste za električne kontakte, štitove za ionizirajuća zračenja, izradu teških strojnih dijelova (žiroskopskih rotora, zrakoplovnih protuutega i sl.). Legure s kobaltom i kromom također se koriste za izradu reznih alata i raznih ekstruzijskih elemenata.
 Tantal se najviše koristi legiran s volframom i niobijem, te nešto manje s hafnijem i molibdenom. Volfram u kristalu tantala stvara čvrstu, malo prednapregnutu otopinu, čime mu povećava čvrstoću (efekt očvršćavanja čvrste otopine), a vrlo malo utječe na antikorozivnost tantala. Ove su legure izuzetno antikorozivne (mogu im parirati jedino stakla), pa se koriste za izradu dijelova u kemijskim postrojenjima koji su izloženi jakim korozivnim sredstvima (najčešće za prevlačanje reakcijskih kotlova). Koriste se u proizvodnji klorovodične kiseline i vodikovog peroksida, za izradu kada za kromiranje, kao dodaci kromovih grijača i čelika ili za proizvodnju samih visokotemperaturnih grijača. Legure na bazi tantala, uz visoku antikorozivnost, vrlo su čvrste pa se koriste i u svemirskoj tehnologiji. Dodaci cirkonija omogućuju zadržavanje visoke čvrstoće i do temperature od 1200 °C, ali cirkonij smanjuje antikorozivna svojstva legure.
 Kinetički penetrator
 Legure volframa, nikla i željeza (ili kobalta) se koriste za izradu kinetičkog penetratora. Kinetički penetrator (znan kao KE penetrator) je tip municije, koja poput metka ne eksplodira, a za proboj (penetraciju) mete koristi kinetičku energiju. Ovaj naziv može se koristiti za svu municiju koja koja koristi kinetičku energiju kako bi probila neko sredstvo ili metu, ali obično se misli na protuoklopna oružja, kao APFSDS (engl. Armor-Piercing Fin-Stabilized Discarding Sabot) ili LRP (engl. Long-Rod Penetrator), a ne na metke.
 Obrnuto od KE penetratora je uporaba kemijske energije kao penetratora. U uporabi su dvije vrste takvih projektila: HEAT (engl. High Explosive Anti-Tank) i HESH (engl. High Explozive Squash Head). U prošlosti su ovakvi projektili masovno korišteni za uništavanje tenkova, ali s pojavom dvoslojnog i višeslojnog (Chobhom) oklopa kakve danas koriste suvremeni tenkovi, njihova učinkovitost u probijanju oklopa je postala znatno manja.
 TIG postupak zavarivanja
 TIG ili elektrolučno zavarivanje netaljivom elektrodom u zaštiti inertnog plinom (engl. Gas Tungsten Arc Welding – GTAW), je ručni postupak zavarivanja, koji koristi netaljivu volfram elektrodu, inertni ili poluinertni zaštitni plin, i posebno dodatni materijal. Karakteristika ovog postupka je stabilan električni luk i visoko kvalitetan zavar, ali zahtjeva izuzetne vještine zavarivača i relativno je spor. Iako se može koristiti za skoro sve vrste materijala, najčešće se koristi za zavarivanje nehrđajućih čelika i lakih metala. Često se koristi kod proizvodnje bicikla, zrakoplova i brodova.
 Izvori
 Kemijski elementi


type: caselaw

text:
 26.1.2013
 PL
 Dziennik Urzędowy Unii Europejskiej
 C 26/47
 Postanowienie Sądu z dnia 20 listopada 2012 r. — Marcuccio przeciwko Komisji
 (Sprawa T-491/11 P) (1)
 (Odwołanie - Służba publiczna - Urzędnicy - Czas trwania postępowania w sprawie uznania częściowej trwałej niezdolności do pracy - Szkoda poniesiona jakoby przez wnoszącego odwołanie - Zwrot kosztów, których można było uniknąć - Oddalenie skargi w pierwszej instancji jako oczywiście pozbawionej podstawy prawnej - Artykuł 94 lit. a) regulaminu postępowania przed Sądem do spraw Służby Publicznej)
 2013/C 26/92
 Język postępowania: włoski
 Strony
 Wnoszący odwołanie: Marcuccio (Tricase, Włochy) (przedstawiciel: adwokat G. Cipressa)
 Druga strona postępowania: Komisja Europejska (przedstawiciele: J. Currall i C. Berardis-Kayser, pełnomocnicy, wspierani przez adwokata A. Del Ferra)
 Przedmiot
 Odwołanie mające na celu uchylenie postanowienia Sądu do spraw Służby Publicznej Unii Europejskiej (trzecia izba) z dnia 30 czerwca 2011 r. w sprawie F-14/10 Marcuccio przeciwko Komisji, dotychczas niopublikowanego w Zbiorze.
 Sentencja
 1)
 Odwołanie zostaje oddalone.
 2)
 Luigi Marcuccio pokrywa własne koszty oraz koszty poniesione przez Komisję Europejską w niniejszej instancji.
 (1) Dz.U C 331 z 12.11.2011.


text:
 12.4.2017
 SV
 Europeiska unionens officiella tidning
 L 99/26
 BESLUT nr 48/2017 AV DEN GEMENSAMMA KOMMITTÉ SOM INRÄTTATS ENLIGT AVTALET OM ÖMSESIDIGT ERKÄNNANDE MELLAN EUROPEISKA GEMENSKAPEN OCH AMERIKAS FÖRENTA STATER
 av den 27 mars 2017
 beträffande listning av organ för bedömning av överensstämmelse i den sektoriella bilagan om elektromagnetisk kompatibilitet [2017/690]
 GEMENSAMMA KOMMITTÉN HAR BESLUTAT FÖLJANDE
 med beaktande av avtalet om ömsesidigt erkännande mellan Europeiska gemenskapen och Amerikas förenta stater, särskilt artiklarna 7 och 14, och av följande skäl:
 Det ankommer på gemensamma kommittén att fatta beslut om listning av ett eller flera organ för bedömning av överensstämmelse i en sektoriell bilaga.
 HÄRIGENOM FÖRESKRIVS FÖLJANDE.
 1.
 Det organ för bedömning av överensstämmelse som anges i tillägg A ska upptas i förteckningen över organ för bedömning av överensstämmelse i kolumnen ”EG:s tillträde till Förenta staternas marknad” i avsnitt V i den sektoriella bilagan om elektromagnetisk kompatibilitet.
 2.
 Parterna har kommit överens om och kommer att upprätthålla den specifika räckvidd avseende produkter och förfaranden för bedömning av överensstämmelse som ska gälla för det organ för bedömning av överensstämmelse som anges i tillägg A.
 Detta beslut, som upprättats i två exemplar, ska undertecknas av företrädare för gemensamma kommittén, som är bemyndigade att handla på parternas vägnar vid ändringar av avtalet. Detta beslut ska få verkan från och med dagen för det sista av dessa undertecknanden.
 På Amerikas förenta staters vägnar
 James C. SANFORD
 Undertecknat i Washington D.C. den 6 mars 2017
 På Europeiska unionens vägnar
 Ignacio IRUARRIZAGA
 Undertecknat i Bryssel den 27 mars 2017
 Tillägg A
 Organ för bedömning av överensstämmelse i EG som upptas i förteckningen över organ för bedömning av överensstämmelse i kolumnen ”EG:s tillträde till Förenta staternas marknad” i avsnitt V i den sektoriella bilagan om elektromagnetisk kompatibilitet
 TÜV RHEINLAND ITALIA S.R.L.
 via E. Mattei, 3
 20010 Pogliano Milanese
 ITALIEN


text:
 6.7.2015
 CS
 Úřední věstník Evropské unie
 C 221/17
 Usnesení Tribunálu ze dne 12. května 2015 – Red Bull v. OHIM – Automobili Lamborghini (ztvárnění dvou býků)
 (Věc T-73/14) (1)
 („Ochranná známka Společenství - Návrh na zrušení - Zrušení zápisu - Nevydání rozhodnutí ve věci samé“)
 (2015/C 221/23)
 Jednací jazyk: němčina
 Účastníci řízení
 Žalobkyně: Red Bull GmbH (Fuschl am See, Rakousko) (zástupci: původně A. Renck, V. von Bomhard a J. Fuhrmann, advokáti, a I. Fowler, solicitor, poté A. Renck a I. Fowler)
 Žalovaný: Úřad pro harmonizaci na vnitřním trhu (ochranné známky a vzory) (zástupkyně: D. Walicka, zmocněnkyně)
 Další účastnice řízení před odvolacím senátem, vystupující jako vedlejší účastnice před Tribunálem: Automobili Lamborghini SpA (Sant’Agata Bolognese, Itálie) (zástupce: M. Hartmann, advokát)
 Předmět věci
 Žaloba podaná proti rozhodnutí prvního odvolacího senátu OHIM ze dne 14. listopadu 2013 (věc R 1263/2012-1) týkajícím se řízení o prohlášení neplatnosti mezi společnostmi Automobili Lamborghini SpA a Red Bull GmbH.
 Výrok
 1.
 O žalobě již není třeba rozhodnout.
 2.
 Žalobkyně a vedlejší účastnice řízení ponesou každá vlastní náklady řízení a nahradí každá polovinu nákladů řízení vynaložených žalovaným.
 (1) Úř. věst. C 102, 7.4.2014.


jurisdiction: US

text: b' Department of Health and Human Services\n OFFICE OF\n INSPECTOR GENERAL\n\n\n\n\nREVIEW OF MEDICARE CONTRACTOR\n INFORMATION SECURITY\n PROGRAM EVALUATIONS FOR\n FISCAL YEAR 2010\n\n Inquiries about this report may be addressed to the Office of Public Affairs at\n Public.Affairs@oig.hhs.gov.\n\n\n\n\n Daniel R. Levinson\n Inspector General\n\n January 2013\n A-18-12-30100\n\x0c Office of Inspector General\n https://oig.hhs.gov\n\n\n\nThe mission of the Office of Inspector General (OIG), as mandated by Public Law 95-452, as amended, is\nto protect the integrity of the Department of Health and Human Services (HHS) programs, as well as the\nhealth and welfare of beneficiaries served by those programs. This statutory mission is carried out\nthrough a nationwide network of audits, investigations, and inspections conducted by the following\noperating components:\n\nOffice of Audit Services\n\nThe Office of Audit Services (OAS) provides auditing services for HHS, either by conducting audits with\nits own audit resources or by overseeing audit work done by others. Audits examine the performance of\nHHS programs and/or its grantees and contractors in carrying out their respective responsibilities and are\nintended to provide independent assessments of HHS programs and operations. These assessments help\nreduce waste, abuse, and mismanagement and promote economy and efficiency throughout HHS.\n\nOffice of Evaluation and Inspections\nThe Office of Evaluation and Inspections (OEI) conducts national evaluations to provide HHS, Congress,\nand the public with timely, useful, and reliable information on significant issues. These evaluations focus\non preventing fraud, waste, or abuse and promoting economy, efficiency, and effectiveness of\ndepartmental programs. To promote impact, OEI reports also present practical recommendations for\nimproving program operations.\n\nOffice of Investigations\nThe Office of Investigations (OI) conducts criminal, civil, and administrative investigations of fraud and\nmisconduct related to HHS programs, operations, and beneficiaries. With investigators working in all 50\nStates and the District of Columbia, OI utilizes its resources by actively coordinating with the Department\nof Justice and other Federal, State, and local law enforcement authorities. The investigative efforts of OI\noften lead to criminal convictions, administrative sanctions, and/or civil monetary penalties.\n\nOffice of Counsel to the Inspector General\nThe Office of Counsel to the Inspector General (OCIG) provides general legal services to OIG, rendering\nadvice and opinions on HHS programs and operations and providing all legal support for OIG\xe2\x80\x99s internal\noperations. OCIG represents OIG in all civil and administrative fraud and abuse cases involving HHS\nprograms, including False Claims Act, program exclusion, and civil monetary penalty cases. In\nconnection with these cases, OCIG also negotiates and monitors corporate integrity agreements. OCIG\nrenders advisory opinions, issues compliance program guidance, publishes fraud alerts, and provides\nother guidance to the health care industry concerning the anti-kickback statute and other OIG enforcement\nauthorities.\n\x0c Notices\n\n\n THIS REPORT IS AVAILABLE TO THE PUBLIC\n at https://oig.hhs.gov\n\n Section 8L of the Inspector General Act, 5 U.S.C. App., requires\n that OIG post its publicly available reports on the OIG Web site.\n\nOFFICE OF AUDIT SERVICES FINDINGS AND OPINIONS\n\n The designation of financial or management practices as\n questionable, a recommendation for the disallowance of costs\n incurred or claimed, and any other conclusions and\n recommendations in this report represent the findings and\n opinions of OAS. Authorized officials of the HHS operating\n divisions will make final determination on these matters.\n\x0c EXECUTIVE SUMMARY\n\nBACKGROUND\n\nThe Medicare Prescription Drug, Improvement, and Modernization Act of 2003 added\ninformation security requirements for Medicare administrative contractors (MAC), fiscal\nintermediaries, and carriers to the Social Security Act (the Act). These contractors process and\npay Medicare fee-for-service claims. Each Medicare contractor must have its information\nsecurity program evaluated annually by an independent entity, and these evaluations must\naddress the eight major requirements enumerated in the Federal Information Security\nManagement Act of 2002 (FISMA). To comply with this provision, the Centers for Medicare\n& Medicaid Services (CMS) contracted with PricewaterhouseCoopers (PwC) to evaluate\ninformation security programs at the MACs, fiscal intermediaries, and carriers using a set of\nagreed-upon procedures.\n\nThe Act also requires evaluations of the information security controls for a subset of systems but\ndoes not specify the criteria for these evaluations. To satisfy this requirement, CMS expanded\nthe scope of its evaluations in fiscal year (FY) 2010 to test segments of the Medicare claims\nprocessing systems hosted at the Medicare data centers, which support each of the fiscal\nintermediaries, carriers, and MACs. CMS also contracted with iFed, LLC (iFed), to perform\ntechnical assessments at the two CMS enterprise data centers that process Medicare claims using\nan information security assessment methodology.\n\nThe Inspector General, Department of Health and Human Services, must submit to Congress\nannual reports on the results of these evaluations, to include assessments of their scope and\nsufficiency. This report fulfills that responsibility for FY 2010.\n\nOBJECTIVES\n\nOur objectives were to (1) assess the scope and sufficiency of Medicare contractor information\nsecurity program evaluations and CMS enterprise data center technical assessments and\n(2) report the results of those evaluations and assessments.\n\nSUMMARY OF RESULTS\n\nPwC\xe2\x80\x99s evaluations of the contractor information security programs were adequate in scope and\nwere sufficient. PwC reported a total of 303 gaps at 21 Medicare contractors. iFed\xe2\x80\x99s assessment\nfor one of the two enterprise data centers was adequate in scope and was sufficient, but for the\nother center, we could not determine whether the scope and sufficiency of the review were\nadequate. iFed reported a total of 51 gaps at the 2 enterprise data centers.\n\nAssessment of Scope and Sufficiency\n\nPwC\xe2\x80\x99s evaluations of the contractor information security programs adequately encompassed in\nscope and sufficiency the eight FISMA requirements referenced in the Act.\n\n\n\n i\n\x0ciFed\xe2\x80\x99s evaluation of the information security controls at one of the two enterprise data centers\ntested was adequate in scope and was sufficient. However, for the other enterprise data center,\nwe could not determine whether the scope and sufficiency of the review were adequate because\nof issues with the working papers, such as lack of evidence that all testing procedures had been\ncompleted and that all identified weaknesses were adequately supported.\n\nResults of Evaluations\n\nThe results of the contractor information security program evaluations and enterprise data center\ntechnical assessments are presented in terms of gaps, which are defined as the differences\nbetween FISMA or CMS core security requirements and the contractors\xe2\x80\x99 implementation of\nthem.\n\nResults of Contractor Information Security Program Evaluations\n\nIn the 21 PwC evaluation reports for FY 2010, which covered all MACs, fiscal intermediaries,\nand carriers, PwC identified a total of 303 gaps, which it consolidated into 90 findings. The\ncontractors are responsible for developing a corrective action plan for each gap or finding. The\nnumber of gaps per contractor ranged from 6 to 22 and averaged 14. The most gaps occurred in\nthe following FISMA control areas: policies and procedures to reduce risk (74 gaps at 21\ncontractors), testing of information security controls (62 gaps at 21 contractors), security\nprogram and system security plans (49 gaps at 21 contractors), incident response (39 gaps at 19\ncontractors), and continuity of operations planning (35 gaps at 18 contractors). There was an\nincrease in the number of gaps in FY 2010, some of which was due to the expansion of testing\nthat PwC performed at each contractor. CMS is responsible for tracking each finding until it is\nremediated.\n\nResults of Enterprise Data Center Technical Assessments\n\nThe 2 Medicare enterprise data center technical assessment reports prepared by iFed identified a\ntotal of 51 gaps (10 gaps at 1 data center, 41 at the other data center). Most of the gaps occurred\nin the following security control categories: access control (26 gaps at 2 data centers), system\nand communications protection (10 gaps at 2 data centers), and identification and authentication\n(9 gaps at 1 data center).\n\nOf the 51 gaps iFed identified at the 2 enterprise data centers, 27 gaps were resolved and closed\nduring or after iFed\xe2\x80\x99s onsite visits. Hence, a total of 24 gaps at data centers required corrective\naction in FY 2010. The contractors are responsible for developing a corrective action plan for\neach gap, which CMS tracks until the gap is remediated.\n\nRECOMMENDATION\n\nWe recommend that CMS ensure that its enterprise data center technical assessments are\nadequately supported.\n\n\n\n\n ii\n\x0cCENTERS FOR MEDICARE & MEDICAID SERVICES COMMENTS\n\nIn written comments to our draft report, CMS concurred with our recommendation. CMS also\nstated that it would take the appropriate actions to address the identified issues. We have\nincluded CMS\xe2\x80\x99s comments in their entirety as Appendix D.\n\n\n\n\n iii\n\x0c TABLE OF CONTENTS\n\n Page\n\nINTRODUCTION............................................................................................................. 1\n\n BACKGROUND .....................................................................................................1\n The Medicare Program ................................................................................. 1\n Medicare Prescription Drug, Improvement, and Modernization\n Act of 2003 ................................................................................................ 1\n Centers for Medicare & Medicaid Services Evaluation Process\n for Fiscal Year 2010................................................................................... 2\n\n OBJECTIVES, SCOPE, AND METHODOLOGY .................................................3\n Objectives ..................................................................................................... 3\n Scope ............................................................................................................. 3\n Methodology ................................................................................................. 3\n\nRESULTS OF REVIEW .................................................................................................. 4\n\n ASSESSMENT OF SCOPE AND SUFFICIENCY ................................................4\n\n RESULTS OF MEDICARE CONTRACTOR INFORMATION SECURITY\n PROGRAM EVALUATIONS.................................................................................4\n Policies and Procedures To Reduce Risk...................................................... 6\n Testing of Information Security Controls ..................................................... 6\n Security Program and System Security Plans ............................................... 7\n Incident Detection, Reporting, and Response ............................................... 8\n Continuity of Operations Planning ............................................................... 8\n\n RESULTS OF ENTERPRISE DATA CENTER TECHNICAL\n ASSESSMENTS ......................................................................................................9\n Access Control ............................................................................................ 10\n System and Comunications Protection ....................................................... 11\n Identification and Authentication ............................................................... 11\n\n CONCLUSION ......................................................................................................12\n\n RECOMMENDATION .........................................................................................12\n\n CENTERS FOR MEDICARE & MEDICAID SERVICES COMMENTS ..........12\n\nAPPENDIXES\n\n A: LIST OF GAPS BY FEDERAL INFORMATION SECURITY MANAGEMENT ACT\n OF 2002 CONTROL AREA AND MEDICARE CONTRACTOR\n\n\n iv\n\x0cB: RESULTS OF MEDICARE CONTRACTOR EVALUATIONS FOR FEDERAL\n INFORMATION SECURITY MANAGEMENT ACT OF 2002 CONTROL AREAS\n WITH THE GREATEST NUMBER OF GAPS\n\nC: LIST OF GAPS BY NATIONAL INSTITUTE OF STANDARDS AND\n TECHNOLOGY SECURITY CONTROL AREA AND ENTERPRISE DATA\n CENTER\n\nD: CENTERS FOR MEDICARE & MEDICAID SERVICES COMMENTS\n\n\n\n\n v\n\x0c INTRODUCTION\n\nBACKGROUND\n\nThe Medicare Program\n\nThe Centers for Medicare & Medicaid Services (CMS) administers the Medicare program.\nMedicare is a health insurance program for people age 65 or older, people under age 65 with\ncertain disabilities, and people of all ages with end-stage renal disease. In fiscal year (FY) 2010,\nMedicare paid more than $447 billion on behalf of more than 47 million Medicare beneficiaries.\nCMS contracts with Medicare Administrative Contractors (MAC), fiscal intermediaries, and\ncarriers to administer Medicare benefits paid on a fee-for-service basis. CMS uses enterprise\ndata centers to process all Medicare fee-for-service claims.\n\nIn FY 2010, 11 distinct entities served as fiscal intermediaries, carriers, and Part A/B MACs.\nTwo external entities operated enterprise data centers to process all Medicare fee-for-service\nclaims. Thus, 13 distinct entities processed and paid Medicare fee-for-service claims.\n\nMedicare Prescription Drug, Improvement, and Modernization Act of 2003\n\nThe Medicare Prescription Drug, Improvement, and Modernization Act of 2003 (MMA) added\ninformation security requirements for MACs, fiscal intermediaries, and carriers to section 1874A\nof the Social Security Act (the Act). 1 (See 42 U.S.C. \xc2\xa7 1395kk-1.) Pursuant to section\n1874A(e)(2)(A) of the Act, each MAC, fiscal intermediary, and carrier must have its information\nsecurity program evaluated annually by an independent entity. This section requires that these\nevaluations address the eight major requirements enumerated in the Federal Information Security\nManagement Act of 2002 (FISMA). (See 44 U.S.C. \xc2\xa7 3544(b).) These requirements, referred to\nas \xe2\x80\x9cFISMA control areas\xe2\x80\x9d in this report, are:\n\n 1. periodic risk assessments;\n\n 2. policies and procedures to reduce risk;\n\n 3. security program and system security plans;\n\n 4. security awareness training;\n\n 5. testing of information security controls;\n\n 6. remedial actions;\n\n\n\n\n1\n The MMA contracting reform provisions added to section 1874A of the Act replace existing fiscal intermediaries\nand carriers with MACs, which are competitively selected. Until all MACs are in place, the requirements of\nsection 1874A also apply to fiscal intermediaries and carriers.\n\n 1\n\x0c 7. incident detection, reporting, and response; and\n\n 8. continuity of operations planning.\n\nSection 1874A(e)(2)(A)(ii) of the Act requires that the effectiveness of information security\ncontrols be tested for an appropriate subset of Medicare contractors\xe2\x80\x99 information systems.\nHowever, this section does not specify the criteria for evaluating these security controls.\n\nAdditionally, section 1874A(e)(2)(C)(ii) of the Act requires the Inspector General of the\nDepartment of Health and Human Services to submit to Congress annual reports on the results of\nsuch evaluations, including assessments of their scope and sufficiency. This report fulfills that\nresponsibility for FY 2010.\n\nCenters for Medicare & Medicaid Services Evaluation Process for Fiscal Year 2010\n\nCMS developed agreed-upon procedures (AUP) for the program evaluation based on the\nrequirements of section 1874A(e)(1) of the Act, FISMA, information security policy and\nguidance from the Office of Management and Budget and the National Institute of Standards and\nTechnology (NIST), and the Government Accountability Office\xe2\x80\x99s (GAO) Federal Information\nSystems Controls Audit Manual (FISCAM). In FY 2010, 11 distinct entities served as fiscal\nintermediaries, carriers, and MACs. The independent auditors, PricewaterhouseCoopers (PwC),\nunder contract with CMS, used the AUPs to evaluate the information security programs at the 11\nentities. Many of the entities had multiple contracts with CMS to fulfill their responsibilities as\nMedicare fiscal intermediaries, carriers, A/B MACs, and Durable Medical Equipment MACs.\nTesting was performed for each of the contracts. As a result, PwC performed evaluations and\nissued separate reports for 21 fiscal intermediaries, carriers, and MACs.\n\nTo comply with the section 1874A(e)(2)(A)(ii) requirement to test the effectiveness of\ninformation security controls for an appropriate subset of contractors\xe2\x80\x99 information systems, CMS\nexpanded the scope of its AUP evaluations in FY 2010 to test segments of the Medicare claims\nprocessing systems hosted at the Medicare data centers, which support each of the fiscal\nintermediaries, carriers, and MACs. Medicare data centers are used for \xe2\x80\x9cfront-end\xe2\x80\x9d\npreprocessing of claims received from providers and \xe2\x80\x9cback-end\xe2\x80\x9d issuing of payments to\nproviders after claims have been adjudicated. PwC performed additional testing to eliminate the\nneed to contract with another entity to perform the assessments that had previously been\nperformed at the fiscal intermediaries, carriers, and MAC data centers. In addition, CMS\ncontracted with iFed, LLC (iFed), to plan, develop, and implement a comprehensive program to\nperform testing of information security controls at the two CMS enterprise data centers, which\nare used to process and adjudicate all Medicare claims. iFed performed the assessments and\nissued separate reports for each of the two enterprise data centers.\n\nThe results of the contractor information security program evaluations and enterprise data center\ntechnical assessments are presented in terms of gaps, which are defined as the differences\nbetween FISMA or CMS core security requirements and the contractors\xe2\x80\x99 implementation of\nthem. In some instances, PwC combined multiple gaps into one finding. PwC assigned impact\nlevels to each of the findings, and iFed assigned risk levels to each of the gaps. The contractors\n\n 2\n\x0care responsible for developing a corrective action plan for each gap or finding, which is tracked\nby CMS.\n\nOBJECTIVES, SCOPE, AND METHODOLOGY\n\nObjectives\n\nOur objectives were to (1) assess the scope and sufficiency of Medicare contractor information\nsecurity program evaluations and data center technical assessments and (2) report the results of\nthose evaluations and assessments.\n\nScope\n\nWe evaluated the FY 2010 results of the independent evaluations and technical assessments of\nMedicare contractors\xe2\x80\x99 information security programs. Our review did not include an evaluation\nof internal controls. We performed our reviews of PwC and iFed working papers at CMS\nheadquarters in Baltimore, Maryland, and at Office of Inspector General regional offices.\n\nMethodology\n\nTo accomplish our objectives, we performed the following steps:\n\n \xe2\x80\xa2 To assess the scope of the evaluations of contractor information security programs,\n we determined whether the AUPs included the eight FISMA control requirements\n enumerated in section 1874A(e)(1) of the Act.\n\n \xe2\x80\xa2 To assess the sufficiency of the evaluations of contractor information security\n programs, we reviewed PwC working papers supporting the evaluation reports to\n determine whether PwC sufficiently addressed all areas required by the AUPs. We\n also determined whether all security-related weaknesses were included in the PwC\n reports by comparing supporting documentation with the reports and whether all\n findings in the PwC reports were adequately supported by comparing the reports with\n the PwC working papers.\n\n \xe2\x80\xa2 To assess the scope of the enterprise data center technical assessments, we reviewed\n the contract and statement of work between CMS and iFed and verified that iFed\n performed the work that CMS had specified.\n\n \xe2\x80\xa2 To assess the sufficiency of the enterprise data center technical assessments, we\n reviewed working papers to verify that iFed completed all test procedures, reported\n all medium- and high-risk gaps, and adequately supported all reported results with\n sufficient and appropriate evidence.\n\n \xe2\x80\xa2 To report on the results of the evaluations and technical assessments, we aggregated\n the results contained in the individual contractor evaluation reports and data center\n technical assessment reports. For the PwC evaluations, we used the number of gaps\n\n 3\n\x0c listed in the individual contractor evaluation reports to aggregate the results. For the\n iFed technical assessments, we used the gaps listed in the individual technical\n assessment reports to aggregate the results.\n\nWe conducted this performance audit in accordance with generally accepted government\nauditing standards, except that we did not obtain comments from PwC or iFed. Those standards\nrequire that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a\nreasonable basis for our findings and conclusions based on our audit objectives. We believe that\nthe evidence obtained provides a reasonable basis for our findings and conclusions based on our\naudit objectives.\n\n RESULTS OF REVIEW\n\nPwC\xe2\x80\x99s evaluations of the contractor information security programs were adequate in scope and\nwere sufficient. PwC reported a total of 303 gaps, which resulted in 168 findings at 21 Medicare\ncontractors. For the 11 entities that encompass the 21 contracts, there were a total of 166 gaps\nresulting in 90 findings. iFed reported a total of 51 gaps at the 2 enterprise data centers. One of\nthe two enterprise data center technical assessments performed by iFed was adequate in scope\nand was sufficient. However, for the other enterprise data center, we could not determine\nwhether the scope and sufficiency of the review were adequate because of problems with the\nworking papers, such as a lack of evidence that all testing procedures had been completed or that\nidentified weaknesses were adequately supported.\n\nASSESSMENT OF SCOPE AND SUFFICIENCY\n\nPwC\xe2\x80\x99s evaluations of the contractor information security programs adequately encompassed in\nscope and sufficiency the eight FISMA requirements referenced in section 1874A(e)(1) of the\nAct.\n\nThe scope of the work and sufficiency of documentation for all reported gaps were adequate for\nthe one of the two enterprise data center technical assessments. CMS\xe2\x80\x99s contract with iFed\nprovided for the planning, development, and implementation of a comprehensive program to\nperform testing of information security controls at enterprise data centers. However, the test plan\ndocumentation supplied by iFed for one enterprise data center did not contain sufficient evidence\nthat all of the testing procedures had been performed. Additionally, we were unable to trace all\ngaps presented in iFed\xe2\x80\x99s report to supporting documentation in the working papers. CMS did not\nensure that all iFed working papers were complete for all tests and that all gaps were adequately\nsupported in the working papers.\n\nRESULTS OF MEDICARE CONTRACTOR INFORMATION SECURITY PROGRAM\nEVALUATIONS\n\nAs shown in Table 1, the 21 evaluation reports identified a total of 303 gaps. The number of\ngaps per contractor ranged from 6 to 22 and averaged 14. See Appendix A for a list of gaps per\ncontrol area by contractor.\n\n\n\n 4\n\x0c Table 1: Range of Medicare Contractor Gaps\n Number of Contractors With\n Number of Total 0 1-5 6\xe2\x80\x9310 11-15 16+\n FY Contractors Gaps Gaps Gap(s) Gaps Gaps Gaps\n 2010 21 303 0 0 2 10 9\n\nThe total number of gaps reported increased from 94 in FY 2009 to 303 in FY 2010. Some of\nthis increase was due to PwC\xe2\x80\x99s expanded testing in FY 2010. PwC expanded its testing to\ninclude the Medicare claims processing systems hosted at the Medicare data centers. New\ntesting included review of network management controls and a network attack and penetration\ntest at the Medicare data centers.\n\nTable 2 summarizes the gaps found in each FISMA control area in FY 2010.\n\nTable 2: Gaps by Federal Information Security Management Act Control Area in FY 2010\n Impact Levels\n of FISMA No. of Contractors\n FISMA Control Area No. of Gaps With One or More\n Control Area Subcategories Identified Gap(s)\n Policies and procedures to\n High 74 21\n reduce risk\n Testing of information\n High 62 21\n security controls\n Security program and\n High/Medium 49 21\n system security plans\n Incident detection,\n High 39 19\n reporting, and response\n Continuity of operations\n High/Medium 35 18\n planning\n Security awareness\n Medium 28 15\n training\n Periodic risk assessments High/Medium 9 9\n Remedial actions High 7 3\n Total 303\n\nThe Medicare contractor information security program evaluations covered several subcategories\nwithin each FISMA control area. The \xe2\x80\x9cimpact level\xe2\x80\x9d shown in Table 2 refers to the possible\nlevel of adverse impact that could result from successful exploitation of gaps in any of the\nsubcategories depending on the organization\xe2\x80\x99s mission and criticality and the sensitivity of the\nsystems and data involved. The actual ratings assigned to the subcategories were all high or\nmedium impact and were PwC\xe2\x80\x99s assessments. Individual findings were assigned an overall risk\nlevel on a subjective basis by PwC after considering the impact and likelihood of occurrence.\nHowever, as stated in NIST Special Publication (SP) 800-115, Technical Guide to Information\nSecurity Testing and Assessment, section 4.3, it is difficult to identify the risk level of individual\nvulnerabilities because they rarely exist in isolation.\n\n 5\n\x0cThe following sections discuss the five FISMA control areas containing the most gaps. See\nAppendix B for descriptions of each subcategory tested for the five control areas.\n\nPolicies and Procedures To Reduce Risk\n\nAccording to NIST SP 800-53, Recommended Security Controls for Federal Information\nSystems and Organizations:\n\n \xe2\x80\xa6the management of risk is a key element in the organization\xe2\x80\x99s information\n security program and provides an effective framework for selecting the\n appropriate security controls for an information system\xe2\x80\x94the security controls\n necessary to protect individuals and the operations and assets of the organization.\n The risk-based approach to security control selection and specification considers\n effectiveness, efficiency, and constraints taking into account applicable federal\n laws, Executive orders, directives, policies, regulations, standards, or guidelines.\n\nAll 21 Medicare contractors had from 1 to 4 gaps each. In total, PwC identified 74 gaps in this\narea. Following are examples of gaps in policies and procedures to reduce risk:\n\n \xe2\x80\xa2 Security policies and procedures did not address or enforce platform security\n configuration 2 or patch management 3 standards.\n\n \xe2\x80\xa2 Patch management procedures did not contain a timetable or time line for putting patches\n or service packs in place based on the severity of the risk associated with the\n vulnerability to be patched.\n\n \xe2\x80\xa2 Procedures for applying mainframe updates did not include steps to identify security\n patches for the mainframe or to apply them within the time line required by CMS.\n\nIneffective policies and procedures to reduce risk could jeopardize an organization\xe2\x80\x99s mission,\ninformation, and information technology assets. Without adequate configuration standards and\nthe latest security patches, systems may be susceptible to exploitation that could lead to\nunauthorized disclosure of data, data modification, or the unavailability of data.\n\nTesting of Information Security Controls\n\nAccording to NIST SP 800-53, Recommended Security Controls for Federal Information\nSystems and Organizations, Control CA-2, the effectiveness of information security policies,\nprocedures, practices, and controls should be tested and evaluated at least annually.\nNIST SP 800-115, section 2.3, notes that security testing enables organizations to measure levels\nof compliance in areas such as patch management, password policy, and configuration\n\n2\n A security configuration is a set of security controls and settings established for an information system that meets\noperational requirements and helps systems operate correctly and securely.\n3\n Patch management is the process of identifying, reporting, and effectively remediating information system flaws in\nan operational system.\n\n 6\n\x0cmanagement. According to GAO\xe2\x80\x99s FISCAM, section 3.3, changes to an application should be\ntested and approved before being put into production.\n\nAll 21 Medicare contractors had from 1 to 5 gaps each related to testing of information security\ncontrols. In total, 62 gaps were identified in this area.\n\nFollowing are examples of gaps in testing of information security controls:\n\n \xe2\x80\xa2 The contractor\xe2\x80\x99s system software change-control procedures did not reflect the process used\n to test the different platforms.\n\n \xe2\x80\xa2 The contractor\xe2\x80\x99s change-control procedures did not include the variation in the process used\n for firewall changes based on the determined risk level of the change to the firewall.\n\n \xe2\x80\xa2 Security weaknesses were identified as part of the internal network penetration testing.\n\nWithout a comprehensive program for periodically testing and monitoring of information\nsecurity controls, management has no assurance that appropriate safeguards are in place to\nmitigate identified risks.\n\nSecurity Program and System Security Plans\n\nNIST SP 800-100, Information Security Handbook: A Guide for Managers, section 2.2.5, states\nthat an agency should ensure its information security policy is sufficiently current to\naccommodate the information security environment and the agency mission and operational\nrequirements. NIST SP 800-53, Control PS-3, requires organizations to screen employees before\ngranting access to information and information systems. The Executive Summary of NIST SP\n800-18, Guide for Developing Security Plans for Federal Information Systems, states that\n\xe2\x80\x9csystem security plan[s] should provide an overview of a system\xe2\x80\x99s security requirements and\ndescribe the controls in place or planned for meeting those requirements.\xe2\x80\x9d\n\nAll 21 Medicare contractors had from 1 to 4 gaps each. In total, PwC identified 49 gaps in this\narea.\n\nFollowing are examples of gaps in security program and system security plans:\n\n \xe2\x80\xa2 The contractor\xe2\x80\x99s internal and external assessments, including audits, controls testing,\n security reviews, and penetration and vulnerability assessments, were not completed.\n\n \xe2\x80\xa2 The contractor\xe2\x80\x99s procedures for background investigations did not require completion of\n background checks before hiring employees and granting them access to systems.\n\n \xe2\x80\xa2 The contractor\xe2\x80\x99s system security plan did not identify a complete list of platforms that\n supports Medicare operations.\n\n\n\n 7\n\x0cIf information security program requirements are not implemented and enforced, management\nhas no assurance that established system security controls will be effective in protecting valuable\nassets, such as information, hardware, software, systems, and related technology assets that\nsupport the organization\xe2\x80\x99s critical missions.\n\nIncident Detection, Reporting, and Response\n\nThe Executive Summary of NIST SP 800-61, Computer Security Incident Handling Guide, states\nthat:\n\n \xe2\x80\xa6computer security incident response has become an important component of\n information technology programs. Security-related threats have become not only\n more numerous and diverse but also more damaging and disruptive. New types of\n security-related incidents emerge frequently. Preventative activities based on the\n results of risk assessments can lower the number of incidents, but not all incidents\n can be prevented. An incident response capability is therefore necessary for\n rapidly detecting incidents, minimizing loss and destruction, mitigating any\n weaknesses that were exploited, and restoring computing services.\n\nTwo of the twenty-one Medicare contractors had no identified gaps in incident response, while\nthe remaining 19 had 1 to 3 gaps each. In total, PwC identified 39 gaps in this area. Following\nare examples of gaps in incident response:\n\n \xe2\x80\xa2 The process for maintaining and reviewing system logs was not consistent with CMS\n requirements.\n\n \xe2\x80\xa2 System logs were not retained for the amount of time required by CMS and followup of\n suspicious activities was not performed.\n\n \xe2\x80\xa2 Reportable incidents were not reported within the required timeframe in accordance with\n CMS requirements.\n\nKeeping the number of incidents reasonably low is very important to protect the business\nprocesses of the organization. If security controls are insufficient, high volumes of incidents\nmay occur, which could overwhelm the incident response team. This could lead to slow and\nincomplete responses and negative business effects (e.g., extensive damage to computer systems,\nperiods without computer service, and periods when data are unavailable).\n\nContinuity of Operations Planning\n\nAccording to NIST SP 800-34, Contingency Planning Guide for Federal Information Systems,\nsection 2.2, contingency planning represents a broad scope of activities designed to sustain and\nrecover critical information technology services following an emergency. Contingency planning\nfor information systems is part of an overall organizational program for achieving continuity of\noperations for business operations. Physical security controls and media disposal were also\nincluded in the scope of PwC\xe2\x80\x99s testing in this area.\n\n 8\n\x0cThree of the twenty-one Medicare contractors had no identified gaps in continuity of operations\nplanning, while the remaining 18 had 1 to 4 gaps each. In total, PwC identified 35 gaps in this\narea. Following are examples of gaps in continuity of operations planning:\n\n \xe2\x80\xa2 The contractor did not arrange for an alternate data processing facility.\n\n \xe2\x80\xa2 The contingency plan was not reviewed, tested, and kept up to date.\n\n \xe2\x80\xa2 Policies and procedures to address all aspects of data sanitization 4 did not exist.\n\nIf contingency planning activities are inadequate, even relatively minor interruptions of service\ncan result in lost or incorrectly processed data, which can cause financial losses, expensive\nrecovery efforts, and inaccurate or incomplete financial or management information.\n\nRESULTS OF ENTERPRISE DATA CENTER TECHNICAL ASSESSMENTS\n\nThe technical assessment reports for the 2 enterprise data centers identified a total of 51 gaps (10\ngaps at 1 data center, 41 gaps at the second data center). iFed\xe2\x80\x99s testing included a review of\npolicies and procedures of the following five NIST control areas:\n\n 1. Access control\n\n 2. Identification and authentication\n\n 3. Physical and environmental protection\n\n 4. Personnel security\n\n 5. System and communication protection\n\nAt one enterprise data center, iFed\xe2\x80\x99s testing included a limited penetration test and vulnerability\nscans of the data center\xe2\x80\x99s distributed systems and a technical review of its mainframe. At the\nother enterprise data center, iFed performed vulnerability scanning and a limited-scope\nassessment of the mainframe. The additional testing identified gaps in the security control\ncategory of configuration management.\n\niFed assigned each of the gaps to one of the security control areas. In a manner similar to that of\nPwC, iFed categorized the risks associated with the individual gaps as high, medium, or low\nbased on the potential impact and likelihood of exploitation. Of the 51 gaps iFed identified\nacross the 2 enterprise data centers, 8 gaps were high risk, 25 gaps were medium risk, and 18\ngaps were low risk. Twenty-seven gaps were resolved and closed during iFed\xe2\x80\x99s onsite visits or\nbefore iFed issued its reports to the data centers, including 7 high-risk gaps, 10 medium-risk\ngaps, and 10 low-risk gaps. Hence, a total of 24 gaps at data centers required corrective action in\nFY 2010.\n\n4\n Data sanitization is the process of removing data from media so that there is reasonable assurance that the data may\nnot be easily retrieved and reconstructed.\n\n 9\n\x0cTable 3 presents the aggregate results reported for the two data centers. Appendix C shows the\nnumber of reported gaps at each data center by security control area.\n\n Table 3: Enterprise Data Center Reported Gaps by\n National Institute of Standards and Technology Security Control Area\n Security Control Total No. No. of No. of No. of No. of\n Area of Gaps Data High- Medium- Low-Risk\n Identified Centers Risk Risk Gaps\n w/ Gaps Gaps Gaps\nAccess control 26 2 2 16 8\nSystem and 10 2 3 3 4\ncommunications\nprotection\nIdentification and 9 1 3 2 4\nauthentication\nConfiguration 5 2 0 3 2\nmanagement\nPersonnel security 1 1 0 1 0\n Total 51 8 25 18\n\nNote: iFed did not report any gaps in the NIST security control area of physical and\nenvironmental protection.\n\nThe following sections discuss the three security control areas with the highest number of gaps.\n\nAccess Control\n\nAccording to GAO\xe2\x80\x99s FISCAM, section 3.2, access controls limit or detect inappropriate access to\ncomputer resources (data, equipment, and facilities), thereby protecting them from unauthorized\nmodification, loss, and disclosure. Such controls include both logical and physical controls.\n\niFed identified access control gaps at the two enterprise data centers. Following are examples of\ngaps in this area:\n\n \xe2\x80\xa2 An excessive number of users had the ability to make changes to sensitive system files.\n\n \xe2\x80\xa2 Users could read sensitive system files that might not have been required by their job\n function.\n\n \xe2\x80\xa2 A remote server had shared directories with sensitive data that unauthorized users could\n read.\n\nInadequate access controls diminish the reliability of computerized data and increase the risk of\ndestruction or inappropriate disclosure of data. Gaps in access control create vulnerabilities in\nthe confidentiality, integrity, and availability of Medicare data and systems. Associated gaps in\n\n\n 10\n\x0cthe configuration of systems software that controls access to systems can make computers\nvulnerable to unauthorized access.\n\nSystem and Communications Protection\n\nAccording to NIST SP 800-53, Recommended Security Controls for Federal Information\nSystems and Organizations, Control SC-8, the information system should protect the integrity of\ntransmitted information. Control SC-4 states that \xe2\x80\x9cthe information system prevents unauthorized\nand unintended information transfer via shared system resources.\xe2\x80\x9d\n\niFed identified system and communication protection control gaps at the two data centers.\nFollowing are examples of gaps in this area:\n\n \xe2\x80\xa2 The secure socket layer (i.e., protocol for encrypting information over the Internet)\n certificate used a weak hashing algorithm. 5\n\n \xe2\x80\xa2 Residual CMS data residing in the direct access storage device could have been reused or\n recovered by unauthorized persons (e.g., programmers) after erasure from the operating\n system.\n\nWithout adequate system controls, unauthorized users may gain access to sensitive data through\nunsecured transmissions or devices that have not been fully protected.\n\nIdentification and Authentication\n\nNIST SP 800-53 requires organizations to develop, disseminate, and periodically review or\nupdate identification and authentication policies and procedures. Authentication of an\nindividual\xe2\x80\x99s identity is a fundamental component of physical and logical access control\nprocesses. The information system should uniquely identify and authenticate computer devices\nbefore establishing a connection to an organization\xe2\x80\x99s network.\n\niFed reported identification and authentication control gaps at one of the data centers. Following\nare examples of gaps in this area:\n\n \xe2\x80\xa2 No process existed for recording, reviewing, or assessing device connection reports.\n\n \xe2\x80\xa2 A Web server was vulnerable to a cross-site scripting attack 6 because of a software flaw.\n\n\n\n\n5\n A hashing algorithm is used with a digital signature to provide assurance of origin authentication and data\nintegrity.\n6\n A cross-site scripting attack occurs when there is a flaw in a Web application that allows an attacker to add content\nto a Web site that can be malicious when viewed by other users of the Web site.\n\n\n 11\n\x0cThese gaps could permit sensitive information on a server to be read by unauthorized\nindividuals, changed in an unauthorized manner, or accessed from an unauthorized device. This\nis a common threat to organizations.\n\nCONCLUSION\n\nThe scope of the work and sufficiency of documentation for all reported gaps were sufficient for\nthe 21 Medicare contractors reviewed by PwC and for one of the two data center technical\nassessments performed by iFed. However, at one data center, the test plan documentation did\nnot contain sufficient evidence that iFed performed all of the testing procedures, nor were we\nable to trace all gaps presented in iFed\xe2\x80\x99s reports to supporting documentation. In addition, we\nwere not able to determine whether iFed included all medium- and high-risk gaps in the report\nbecause of inadequate working paper references in the test scripts. CMS did not ensure that all\niFed working papers were complete for all tests and that all gaps were adequately supported in\nthe working papers. Gaps that are not identified during a data center technical assessment could\nresult in unidentified vulnerabilities that could in turn result in unauthorized access to sensitive\nMedicare data.\n\nRECOMMENDATION\n\nWe recommend that CMS ensure that its enterprise data center technical assessments are\nadequately supported.\n\nCENTERS FOR MEDICARE & MEDICAID SERVICES COMMENTS\n\nIn written comments to our draft report, CMS concurred with our recommendation. CMS also\nstated that it would take the appropriate actions to address the identified issues. We have\nincluded CMS\xe2\x80\x99s comments in their entirety as Appendix D.\n\n\n\n\n 12\n\x0cAPPENDIXES\n\x0c APPENDIX A: LIST OF GAPS BY\n FEDERAL INFORMATION SECURITY MANAGEMENT ACT OF 2002\n CONTROL AREA AND MEDICARE CONTRACTOR\n\n Control Areas (With Impact Levels)\n Security\n Policies Program Incident\n and and Testing of Detection, Continuity\n Periodic Procedures System Security Information Reporting, of\n Risk To Reduce Security Awareness Security Remedial and Operations\nMedicare Assessments Risk Plans Training Controls Actions Response Planning Total\nContractor (High) (High) (High) (Medium) (High) (High) (High) (High) Gaps\n 1 1 4 2 0 4 0 3 2 16\n 2 1 4 2 0 4 0 3 2 16\n 3 0 3 2 0 3 0 3 2 13\n 4 0 3 2 0 3 0 3 2 13\n 5 0 4 3 1 3 0 3 0 14\n 6 0 4 1 0 3 0 3 4 15\n 7 0 4 1 2 3 0 1 1 12\n 8 0 4 1 2 3 0 1 1 12\n 9 0 4 1 2 3 0 1 1 12\n 10 1 4 4 2 4 0 2 2 19\n 11 1 4 4 0 4 0 2 1 16\n 12 0 4 2 2 2 0 2 1 13\n 13 0 4 2 2 2 0 2 1 13\n 14 0 4 2 2 2 0 2 1 13\n 15 1 3 4 1 3 2 1 2 17\n 16 1 3 4 1 3 2 1 2 17\n 17 1 4 3 2 5 3 2 2 22\n 18 0 1 2 2 1 0 0 0 6\n 19 0 1 1 3 1 0 0 0 6\n 20 1 4 3 2 3 0 2 4 19\n 21 1 4 3 2 3 0 2 4 19\n Total 9 74 49 28 62 7 39 35 303\n\n Note: Impact levels for Federal Information Security Management Act of 2002 (FISMA)\n control areas were derived by PricewaterhouseCoopers by taking the highest value from among\n the subcategories.\n\x0c Page 1 of 6\n\n APPENDIX B: RESULTS OF MEDICARE CONTRACTOR EVALUATIONS\n FOR FEDERAL INFORMATION SECURITY MANAGEMENT ACT OF 2002\n CONTROL AREAS WITH THE GREATEST NUMBER OF GAPS\n\nThe \xe2\x80\x9cimpact level\xe2\x80\x9d shown in Tables 1 through 5 on the following pages refers to the level of\nadverse impact that could result from successful exploitation of a vulnerability in any of the\nFISMA control areas. Impact can be described as high, medium, or low in light of the\norganization\xe2\x80\x99s mission and criticality and the sensitivity of the systems and data involved.\nPricewaterhouseCoopers assigned a rating of high or medium impact to each of the subcategories\nin the agreed-upon procedures developed by the Centers for Medicare & Medicaid Services\n(CMS). Individual gaps were assigned an overall risk level on a subjective basis by\nPricewaterhouseCoopers after considering the impact of the gaps and likelihood of their\noccurrence.\n\nSubcategories that were added to testing in FY 2010 are designated by an asterisk.\n\x0c Page 2 of 6\n\nPOLICIES AND PROCEDURES TO REDUCE RISK\n\nThe Medicare contractor information security program evaluations assessed seven subcategories\nrelated to policies and procedures to reduce risk. The evaluation reports identified a total of 74\ngaps in this FISMA control area.\n\n Table 1: Policies and Procedures To Reduce Risk Gaps\n Total No. of Gaps Subcategory\n Subcategory in This Area Impact Level\n Documentation exists that outlines reducing\n 1 the risk exposure identified in periodic risk 0 High\n assessments.\n Systems security controls have been tested\n and evaluated. The system/network\n 2 2 High\n boundaries have been subjected to periodic\n reviews/audits.\n All gaps in compliance per CMS\xe2\x80\x99s minimum\n security requirements are identified in the\n 3 0 High\n results of management\xe2\x80\x99s compliance\n checklist.\n Security policies and procedures include\n 4 controls to address platform security 19 High\n configurations and patch management.\n The latest patches have been installed on\n 5* 21 High\n contractor\xe2\x80\x99s systems.\n Security settings included within internal\n 6* checklists and comply with Defense 17 High\n Information Systems Agency standards.\n Malicious software protection has been\n installed on workstations/laptops, is up to\n 7* date, and is operating effectively, and 15 High\n administrators are alerted of any malicious\n software identified on workstations/laptops.\n Total 74\n\n* Subcategory added to testing in FY 2010.\n\x0c Page 3 of 6\n\nTESTING OF INFORMATION SECURITY CONTROLS\n\nThe Medicare contractor information security program evaluations covered seven subcategories\nrelated to the testing of information security controls. The evaluation reports identified a total of\n62 gaps in this FISMA control area.\n\n Table 2: Testing of Information Security Controls Gaps\n Total No. of Gaps Subcategory\n Subcategory in This Area Impact Level\n Management reports exist for the review and\n testing of information security policies and\n procedures, including network risk assessments,\n1 0 High\n accreditations and certifications, internal and\n external audits, security reviews, and penetration\n and vulnerability assessments.\n Annual reviews and audits are conducted to\n ensure compliance with FISMA guidance from\n the Office of Management and Budget for\n2 reviews of security controls, including logical 5 High\n and physical security controls, platform\n configuration standards, and patch management\n controls.\n Remedial action is being taken for issues noted in\n3 1 High\n audits.\n4 Change control management procedures exist. 5 High\n Change control procedures are tested by\n5 13 High\n management to verify they are in use.\n Systems are configured according to documented\n6* 19 High\n security configuration checklists.\n Weaknesses are identified by PwC during a\n7* 19 High\n network attack and penetration test.\n Total 62\n\n* Subcategory added to testing in FY 2010.\n\x0c Page 4 of 6\n\nSECURITY PROGRAM AND SYSTEM SECURITY PLANS\n\nThe Medicare contractor information security program evaluations assessed 11 subcategories\nrelated to security program and system security plans. The evaluation reports identified a total of\n49 gaps in this FISMA control area.\n\n Table 3: Security Program and System Security Plan Gaps\n Total No. of\n Gaps in This Subcategory\n Subcategory Area Impact Level\n 1 A security plan is documented and approved. 0 High\n 2 The security plan is kept current. 7 Medium\n A security management structure has been\n 3 0 High\n established.\n Information security responsibilities are clearly\n 4 2 High\n assigned.\n 5 Owners and users are aware of security policies. 0 High\n Hiring, transfer, termination, and performance\n 6 0 High\n policies address security.\n 7 Employee background checks are performed. 7 Medium\n Security employees have adequate security\n 8 0 Medium\n training and background.\n Management has documented that it\n periodically assesses the appropriateness of\n 9 security policies and compliance with them, 18 High\n including testing of security policies and\n procedures.\n Management ensures that corrective actions are\n 10 1 Medium\n effectively implemented.\n Hired, transferred, and terminated employees\n11* have their access properly added, changed, or 14 Medium\n removed.\n Total 49\n\n* Subcategory added to testing in FY 2010.\n\x0c Page 5 of 6\n\nINCIDENT DETECTION, REPORTING, AND RESPONSE\n\nThe Medicare contractor information security program evaluations assessed five subcategories\nrelated to incident detection, reporting, and response. The evaluation reports identified a total of\n39 gaps in this FISMA control area.\n\n Table 4: Incident Response Gaps\n Total No. of Gaps Subcategory\n Subcategory in This Area Impact Level\n Management has a process to monitor systems\n 1 and networks for unusual activity or intrusion 0 High\n attempts.\n Management has procedures to take and has\n 2 taken action in response to unusual activity, 6 High\n intrusion attempts, and actual intrusions.\n Management processes and procedures include\n 3 reporting of intrusion attempts and intrusions 0 High\n in accordance with FISMA guidance.\n Policies, procedures, and security configuration\n checklists related to intrusion detection systems\n within the network are in place, controls\n4* comply with documented security 14 High\n configuration checklists, and there is a process\n for monitoring intrusion detection system\n alerts.\n Log management procedures have been\n developed and implemented for specific\n5* 19 High\n platforms, and intrusion detection systems have\n been properly placed and configured.\n Total 39\n\n* Subcategory added to testing in FY 2010.\n\x0c Page 6 of 6\n\nCONTINUITY OF OPERATIONS PLANNING\n\nThe Medicare contractor information security program evaluations assessed 14 subcategories\nrelated to continuity of operations planning. The evaluation reports identified a total of 35 gaps\nin this FISMA control area.\n\n Table 5: Continuity of Operations Planning Gaps\n Total No. of\n Gaps in This Subcategory\n Subcategory Area Impact Level\n Critical data and operations are formally identified\n 1 0 Medium\n and prioritized.\n Resources supporting critical operations are\n 2 0 Medium\n identified in contingency plans.\n Emergency processing priorities have been\n 3 0 High\n established.\n Data and program backup procedures have been\n 4 3 Medium\n implemented.\n Adequate environmental controls have been\n 5 0 High\n implemented.\n 6 Staff has been trained to respond to emergencies. 3 Medium\n Hardware maintenance, problem management, and\n 7 change management procedures exist to help 2 High\n prevent unexpected interruptions.\n Policies and procedures for disposal of data and\n 8 equipment exist and include applicable Federal 10 High\n security and privacy requirements.\n 9 An up-to-date contingency plan is documented. 2 High\n Arrangements have been made for alternate data\n 10 2 Medium\n processing and telecommunications facilities.\n 11 The contingency plan is periodically tested. 2 High\n Contingency plan test results are analyzed and\n 12 0 High\n contingency plans adjusted accordingly.\n Physical security controls exist to protect\n 13 0 High\n information technology resources.\n Media disposal procedures meet requirements\n defined by CMS and the National Institute of\n14* 11 Medium\n Standards and Technology (NIST), and evidence\n of disposal of media exists.\n Total 35\n\n* Subcategory added to testing in FY 2010.\n\x0cAPPENDIX C: LIST OF GAPS BY NATIONAL INSTITUTE OF STANDARDS AND\nTECHNOLOGY SECURITY CONTROL AREA AND ENTERPRISE DATA CENTER\n\n Data Center\n NIST Security Control\n Area 1 2 Total Gaps\n Access control 6 20 26\n System and\n communications\n protection 2 8 10\n Identification and\n authentication 0 9 9\n Configuration\n management 2 3 5\n Personnel security 0 1 1\n Physical and\n environmental protection 0 0 0\n Total 10 41 51\n\x0c Page 1 of2\n\n\nAPPENDIX D: CENTERS FOR MEDICARE & MEDICAID SERVICES COMMENTS\n\n\n /-""\' ... \n\n ~ \t\n (\n ,,-sr DEPARTMENT OF HEALTH & HUMAN SERVICES Camera lor MeOicar8 & MedicaiO Services\n\n\n Admi"istrator\n Washington, DC 20201\n\n\n\n\n DATE: NOV 1 4 101!\n\n TO: \t Daniel R. Levinson\n\n\n\n FROM ~;;~\'m\n SUBJE(..i: \t Offic~of Inspector General (OIG) Draft Report: " Review of Medicare Contractor\n Information Security Program Evaluations for Fiscal Year 2010" (A- lS-12-30100)\n\n\n The Centers for Medicare & Medicaid Services (eM S) would like to thank. OIG for the\n opportunity to review and comment on the OIG Draft Report referenced above. The objective of\n this report is to (l) assess the scope and sufficiency of Medicare contractor informatio n security\n program evaluations and e MS Enterprise Data Center (EOC) technical assessments, and (2)\n report the results of these evaluations and assess ments.\n\n Section H!74 A (e)(2) of Ihe Social Security Act requires that each Medicare contractor have ils\n information security program be evaluated annually by an independent e ntity. The resultS are\n then submitted to O IG, which is requ ired to submit an annual report to Congress on the results of\n these evaluations, including assessments o f the scope and sufficiency of these evaluations. The\n OIG found that the scope of work and documentation were sufficient for the Medicare\n contractors and one of the two EDCs. However, there were issues concerning test plan\n documentation and working IllLper compl etene.~s in perfonning tec hnical assessments alone of\n the EDCs. CMS is aware of this finding. The corrective action plans have been completed to\n address them. The OIG recommendation and e MS\'s response to the recommendat ion are\n discussed below.\n\n OIG Recommendatio n\n\n The OIG recommends that CMS teChnical assessment management ensure that its e nterprise data\n center technical assessme nts are adequately supported.\n\n eMS Respo nse\n\n The e MS concurs with OIG \'s recommendation for this finding.\n\n The eMS has implemented various process improvements designed to ensure that EDC technical\n assessments are adequately supported. The follow ing improveme nts are currently in place:\n\x0c Page 2 of2\n\n\n\n\nPage 2 - Daniel R. Levinson\n\n\xe2\x80\xa2 \t Test plans have been updated and standardized ac ross a!l lechnical assessment platforms.\n including EDC assessments; and\n\xe2\x80\xa2 \t EDC contractors responsible fot performing technical assessme nts have been providing\n trai ning covering the tec hnical assessme nt process li nd repo rtin g requi reme nts; lind\n\xe2\x80\xa2 \t Specific repo rti ng and deliverable requirements were updated in the technical assessme nt\n EOC contrac tor Statement o f Work.\n\nAddit ionally, the contrac tor perfo rmi ng the technical assessments alt he lime of Ihis report has\nbeen replaced. The new contractor has been prov ided specific in~lruc[jons in line with the items\ndocumen ted above to assure thal lechnical assess ments /He appropriately performed.\n\nThe eMS would like to thank OIG fo r Ihe opportuni ty to rev iew Knd comment on this draft\nrepo rt.\n\x0c'