s O \ ! 32 * Kry PRO^ U.S. ENVIRONMENTAL PROTECTION AGENCY OFFICE OF INSPECTOR GENERAL EPA Needs to Improve Safeguards for Personally Identifiable Information Report No, 14-P-0122 February 24, 2014 & Scan this mobile code to learn more about the EPA OIG. ------- Report Contributors: Rudolph M. Brevard Cheryl Reid Neven Soliman Nii-Lantei Lamptey Rodney T. Allison Abbreviations APO Agency Privacy Officer DIB Data Integrity Board DNP Do Not Pay EPA U.S. Environmental Protection Agency FY Fiscal Year LPO Liaison Privacy Official NIST National Institute of Standards and Technology OEI Office of Environmental Information OIC Office of Information Collection OIG Office of Inspector General OMB Office of Management and Budget PII Personally Identifiable Information Cover photo: EPA OIG photo depicting an individual stealing someone else's social security card and driver's license. Suggestions for Audits or Evaluations To make suggestions for audits or evaluations, contact us through one of the following methods: email: OIG WEBCOMMENTS@epa.gov phone: 1-202-566-2391 fax: 1-202-566-2599 online: http://www.epa.g0v/0ig/c0ntact.html#Full Info write: EPA Inspector General Hotline 1200 Pennsylvania Avenue, NW Mailcode 2431T Washington, DC 20460 Hotline To report fraud, waste or abuse, contact us through one of the following methods: email: OIG Hotline@epa.gov phone: 1-888-546-8740 fax: 1-202-566-2599 online: http://www.epa.gov/oig/hotline.htm write: EPA Inspector General Hotline 1200 Pennsylvania Avenue, NW Mailcode 2431T Washington, DC 20460 ------- ^tDsx * 2 \ \X! U.S. Environmental Protection Agency Office of Inspector General At a Glance 14-P-0122 February 24, 2014 Why We Did This Review The U.S. Environmental Protection Agency (EPA) must safeguard individuals' Personally Identifiable Information (Pll) consistent with the Privacy Act, the E-Government Act of 2002, Office of Management and Budget (OMB) directives, and other federal requirements. Without the proper security controls, the Pll is vulnerable to unauthorized access and use. We sought to determine whether the EPA has developed and implemented policies, procedures and processes for protecting sensitive Pll in accordance with federal and agency criteria. This report addresses the following EPA theme: • Embracing EPA as a high performing organization. EPA Needs to Improve Safeguards for Personally Identifiable Information The lack of stronger privacy program processes and procedures places the EPA's sensitive Pll at a greater risk of compromise and misuse. What We Found The EPA has not created formal policies and procedures for several processes that contribute to the safeguarding of Pll and that ensure compliance with federal requirements. The EPA is using an inaccurate list of systems that contain sensitive Pll to report to OMB and the Chief Information Officer. This listing was not up-to-date and it contained incorrect data about systems. Having outdated information may lead OMB and agency management to make decisions that may not be applicable to the agency's needs. The lack of formal policies and procedures and management oversight over agency processes for safeguarding of Pll does not ensure employees are aware of their responsibilities for protecting Pll. The Pll training process covered 50 percent of the prescribed topics and did not track training of agency personnel. Federal guidance provides specific training topics and directs agencies to train employees on their privacy responsibilities. The agency had not set up a process to track training completion and had not evaluated available privacy training before contracting to develop a new privacy training program. As a result, EPA employees are only trained on a portion of the requirements and management is unable to assess whether all employees have been trained. Recommendations and Planned Corrective Actions We recommend that the EPA implement a "rules and consequences" procedure for safeguarding Pll; develop policies and procedures for matching programs; develop and implement a process for maintaining an accurate, current listing of systems that contain sensitive Pll; implement a process to train individuals who access Pll; and conduct reviews of available training before the agency enters into contracts. For further information, contact our public affairs office at (202) 566-2391. The full report is at: www.epa.qov/oiq/reports/2014/ 20140224-14-P-0122.pdf The agency concurred with the report's recommendations and provided corrective action plans, which we found acceptable. The agency initially did not agree with recommendation 6 of the draft report and proposed an alternative corrective action. We met with agency officials and revised recommendation 6, and the agency concurred with the revised recommendation. Noteworthy Achievements The EPA had created a privacy program as we recommended in a prior Office of Inspector General audit and provided a memorandum to us certifying completion of report recommendations. ------- UNITED STATES ENVIRONMENTAL PROTECTION AGENCY WASHINGTON, D.C. 20460 THE INSPECTOR GENERAL February 24, 2014 MEMORANDUM SUBJECT: EPA Needs to Improve Safeguards for Personally Identifiable Information Report No. 14-P-0122 FROM: Arthur A. Elkins Jr. TO: Renee Wynn, Acting Assistant Administrator and Chief Information Officer Office of Environmental Information This is our report on the subject audit conducted by the Office of Inspector General (OIG) of the U.S. Environmental Protection Agency (EPA). This report contains findings that describe the problems the OIG identified and corrective actions the OIG recommends. The Office of Information Collection is the primary office responsible for the agency program that we reviewed during this audit. This report represents the opinion of the OIG and does not necessarily represent the final EPA position. The agency concurred with all the report's recommendations and provided high-level planned corrective action plans with milestone dates, which we found acceptable. Action Required We will close this report upon issuance in our audit tracking system based on your response to the draft report. We believe the proposed actions, when implemented, will adequately address the report's findings and recommendations. Please provide updated information in the EPA's Management Audit Tracking System as you complete each planned corrective action or revise any corrective actions and/or milestone dates. If you are unable to meet your planned milestones, or believe other corrective actions are warranted, please send us a memorandum stating why you are revising the milestones or why you are proposing alternative corrective actions, as required by EPA Manual 2750. If you or your staff have any questions regarding this report, please contact Richard Eyermann, acting Assistant Inspector General, Office of Audit, at (202) 566-0565 or eyermann.richard@epa. gov; or Rudolph M. Brevard, Director, Information Resources Management Assessments, at (202) 566-0893 or brevard.rudv@epa.gov. ------- EPA Needs to Improve Safeguards for Personally Identifiable Information 14-P-0122 Table of C Chapters 1 Introduction 1 Purpose 1 Background 1 Responsible Office 1 Noteworthy Achievements 2 Scope and Methodology 2 2 EPA's Documented Processes for Protecting Pll Need Improvement 4 Formal "Rules and Consequences" Procedure Does Not Exist 4 Agency Lacks Oversight Over a Matching Program 5 Mandated Contract Reviews Not Performed 6 Process for Maintaining Pll System List Needs Improvement 7 Conclusion 7 Recommendations 7 Agency Comments and OIG Evaluation 8 3 Privacy Training Not Well Defined or Tracked 9 Privacy Training Topics Not Covered 9 Privacy Training Not Tracked in Program Offices 10 Conclusion 11 Recommendations 11 Agency Comments and OIG Evaluation 12 Status of Recommendations and Potential Monetary Benefits 13 Appendices A Agency Response to Draft Report 14 B Revised Agency Response to Report Recommendations 21 C Distribution 23 ------- Chapter 1 Introduction Purpose We sought to determine whether the U.S. Environmental Protection Agency (EPA) has developed and implemented policies, procedures and processes for protecting sensitive personally identifiable information (PII) in accordance with federal and agency criteria. Background The Privacy Act of 1974 sets forth requirements for federal agencies when they collect, maintain or disseminate information about individuals. The act requires that federal agencies (a) collect minimal information necessary on individuals, (b) safeguard the information, and (c) allow individuals to inspect and correct erroneous information. It is the responsibility of the agency to provide information security protection for the use and/or disclosure of information collected or maintained by or on behalf of the agency. It is the policy of the EPA to safeguard individuals' privacy in a manner consistent with the Privacy Act, the E-Government Act of 2002, Office of Management and Budget (OMB) directives and other federal requirements concerning privacy. Without the proper security controls, the PII information collected by agencies is vulnerable to unauthorized access and use. Responsible Office The Office of Information Collection within the Office of Environmental Information (OEI) provides oversight of the EPA's National Privacy Program. The EPA National Privacy Program provides leadership, direction and support for the agency's privacy activities by developing policies, procedures, tools and guidance for administering the EPA's requirements under the Privacy Act, the E-Government Act, the Federal Information Security Management Act, and policy and guidance issued by the President and OMB. The Privacy Act officer is the National Privacy Program manager responsible for coordinating and overseeing the agency's Privacy Program, coordinating the publication of a system of records notices with program offices, and providing training or training opportunities for all key privacy personnel and agency employees. 14-P-0122 1 ------- Noteworthy Achievements The EPA had created a privacy program as we had recommended in a prior EPA Office of Inspector General (OIG) audit and provided a memorandum to OIG certifying completion of report recommendations. The EPA created a privacy policy and an agency-wide privacy program Intranet page. Scope and Methodology We conducted this audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. We performed this audit at the EPA headquarters in Washington, D.C., and collected and reviewed information from other EPA locations from December 2012 through August 2013. We reviewed federal requirements and guidelines associated with the safeguarding of PII and compared them to related internal policies and procedures used by the EPA. We also interviewed the EPA privacy officer, system owners and other agency officials to inquire about their internal processes for safeguarding PII. We randomly sampled six systems that contained sensitive PII, requested system documentation, and reviewed compliance with federal and internal policies and procedures for three of the six sampled systems. We conducted follow-up on the previous recommendations in an OIG audit report on the EPA's Privacy Program management controls, EPA Needs to Strengthen its Privacy Program Management Controls, Report No. 2007-P-00035, dated September 17, 2007. We limited our review to determine whether the EPA took steps to implement the identified recommendations. We did not conduct testing to determine the effectiveness of the recommendations. In this prior report, we recommended that the OEI's Director, Office of Information Collection: • Establish and formally document key goals and activities for OEI's Records, Freedom of Information Act, and Privacy Branch associated with the EPA's Privacy Program. • Establish and track performance measures associated with OEI's Records, the Freedom of Information Act, and Privacy Branch key privacy goals and activities and measure Privacy Program progress. • Update, implement and communicate the EPA's privacy policies and procedures and ensure they adequately address key tenets of the Privacy Program. 14-P-0122 2 ------- • Develop and implement processes for managing the EPA privacy policies and procedures to ensure they are updated with appropriate changes. • Establish a means of making agency privacy policies and procedures accessible to the EPA personnel. • Establish a monitoring and oversight process to help ensure that managers and employees are implementing and complying with the established agency privacy policies and procedures. 14-P-0122 3 ------- Chapter 2 EPA's Documented Processes for Protecting Pll Need Improvement The EPA's privacy policies and procedures lacked several processes that contribute to the safeguarding of PII and ensure compliance with federal requirements. The OMB and the EPA's Privacy Policy prescribe the practices for implementing the agency's privacy program. These processes were deficient because: • A formal "rules and consequences" procedure required by OMB Memorandum 07-16 did not exist prior to us questioning the agency. • Policies and procedures that would govern the need for written agreements in order for the EPA to participate in matching programs with other agencies and would require employees to communicate matching activities to the appropriate officials were not created. • The EPA did not create oversight processes for ensuring mandated contract reviews were performed to ensure contracts contain language to make the provisions of the Privacy Act of 1974 binding on the contractor and the employees. • The EPA is using an inaccurate list of systems that contain sensitive PII to report to OMB and the Chief Information Officer on a continuous basis. This listing was not up-to-date and it contained incorrect data about systems. The agency has not developed a process for reviewing and updating this list of systems that contain sensitive PII on a timely basis to ensure accuracy. Having outdated information, as presented by the listing of systems that contain PII, may lead OMB and agency management to make decisions that may not be applicable to the agency's needs. The lack of formal policies and procedures, and also management oversight over agency processes for protecting PII, does not ensure employees are aware of their responsibilities for protecting PII in accordance with federal requirements. As a result, employees may inadvertently mistreat, misuse and/or expose PII without proper knowledge of their responsibilities. Formal "Rules and Consequences" Procedure Does Not Exist The EPA's Privacy Policy contains a high level policy statement addressing "rules and consequences" for protecting PII but needs to publicize specific details via a "rules and consequences" procedure. OMB Memorandum 07-16 states that each agency is responsible for developing and implementing an appropriate policy outlining the rules of behavior and identifying consequences and corrective actions 14-P-0122 4 ------- available for failure to follow these rules. In addition, the memorandum states that policy should describe the terms and conditions that affected individuals shall be subject to and identify available corrective actions. To comply with the OMB memorandum, the agency developed an Intranet page that contains "rules and consequences." Although this Intranet page contained rules of conduct and consequences with regard to safeguarding PII, the agency had not developed the information on the website into an official agency procedure. Using an Intranet Web page to address a procedure requirement does not ensure that agency personnel are aware of the federal requirements. Employees may inadvertently mistreat, misuse and/or expose PII without proper knowledge of their responsibilities and the consequences for noncompliance. Agency Lacks Oversight Over a Matching Program The agency planned to participate in a matching program without providing needed oversight for ensuring that the required documentation exists and appropriate stakeholders are involved. The Privacy Act of 1974 identifies a matching program as any computerized comparison of two or more automated systems of records or a system of records with non-federal records for the purpose of establishing or verifying the eligibility of (or continuing compliance with statutory and regulatory requirements by) applicants for cash or in-kind assistance or payments under federal benefit programs. The Privacy Act of 1974 requires that a source agency and a recipient agency complete a written agreement before disclosing a record from a system of record for use in a computer matching program. The act also requires that the agency's Data Integrity Board (DIB) review, approve and maintain all written agreements for matching programs. In addition, the EPA's Privacy Policy states that if the agency is involved in a computer matching program, the EPA must establish a DIB, consisting of senior officials, to oversee and coordinate the implementation of the matching program. Lastly, the EPA Privacy Policy states that the agency privacy officer is responsible for oversight over system manager activities to ensure that all privacy-related, statutory and regulatory requirements are met. The Office of the Chief Financial Officer was preparing to transmit a file from the agency's Compass system into the U.S. Treasury's Do Not Pay (DNP) Portal on March 31, 2013. The Compass financial system replaced the agency's Integrated Financial Management System, which was a System of Record. The agency representatives indicated that the System of Record Notice for the Integrated Financial Management System may still be used for Compass. The EPA never identified the DNP initiative as a likely matching program. In addition, a written matching agreement between the EPA's financial system and the U.S. Treasury's DNP Portal had not been initiated. Also, the agency has not provided coordination or oversight to communicate the need for the DIB to convene in order to oversee 14-P-0122 5 ------- the implementation of this matching program. Lastly, system owners for the data being transferred were not aware of the DIB's role in matching programs. The EPA has not created written procedures that require a written matching agreement before the agency engages in a matching program that describes how employees are to communicate matching activities to appropriate officials and the privacy office representative. There are also no policies or procedures which require the privacy office representative to solicit responses on a continuous basis from agency regions and program offices to determine the existence of matching programs. As such, the agency representative was not aware that an EPA office was participating in a matching program and the agency representative lacked needed information to advise the DIB to meet to approve agency matching programs. Subsequent to issuing our discussion document, the agency indicated that Office of Technology Solutions representatives indicated that during phase I agency payment files are to be compared against public databases that do not contain PII and, therefore, computer matching requirements are not applicable. However, in phase 2 of the DNP implementation (June 2014 and beyond), the U.S. Department of Treasury will begin using restricted versions of these databases and the EPA would then need matching agreements in place. Without written procedures, the EPA may not be implementing matching programs in accordance with federal requirements and agency employees may not be able to properly identify and classify ongoing matching program activities. Further, inaccurate information about agency matching programs may be reported to management and OMB. Mandated Contract Reviews Not Performed The agency did not conduct required biennial contract reviews. An agency representative stated the contract reviews were last performed in 2008. However, the representative could not provide us with evidence of reviews done since 2008. OMB Circular A-130, Appendix I, requires agencies to review every 2 years a random sample of agency contracts to ensure they contain language to make the provisions of the Privacy Act of 1974 binding on the contractor and the employees. The EPA's Conducting Privacy On-site Reviews procedures state that the agency representative will provide instructions to information management officials and Liaison Privacy Officials (LPOs) for conducting Privacy Act reviews as set forth in OMB Circular A-130, Appendix I. The EPA has not developed an oversight process for ensuring that contract reviews are performed biennially. Also, the EPA's Conducting Privacy On-site Reviews procedure does not describe the details for meeting this OMB requirement. By not reviewing a sample of these agency contracts, there is an increased risk that contracts may omit the appropriate language that binds the provisions of the Privacy Act to contractors. As a result, contractors may not be aware that they are responsible for complying with the Privacy Act. 14-P-0122 6 ------- Process for Maintaining Pil System List Needs Improvement The EPA maintains an inaccurate list of systems that contain sensitive PII. OMB Memorandum 07-16 requires agencies to review their current holdings of all PII and ensure, to the maximum extent practical, that such holdings are accurate, relevant, timely and complete. The EPA relies on the program offices to provide information on the agency's systems with sensitive PIL According to the agency, there are no defined intervals as to when program offices are to furnish this to the privacy office, but the process for updating this listing is done on an ad-hoc basis. The agency uses this list of systems to report to OMB and agency management. This report contained inaccuracies. In our sample of six selected systems that contained sensitive PII, we found that only three were valid systems. The agency is not reviewing and updating the list of systems that contain sensitive PII on a regular basis to ensure accuracy. We concluded that the agency updated the list of sensitive systems only as a result of our audit inquiry. Further, agency policies or procedures do not describe the LPO's responsibilities for updating the Privacy Office on the status of systems with PIL Using an inaccurate list of systems with sensitive PII may lead OMB and agency management to make decisions that may not be applicable to the agency's needs. Conclusion The missing elements of the agency's privacy program could significantly degrade the EPA's ability to safeguard PIL Agency employees may not be aware of requirements for safeguarding PII, the EPA could potentially transmit PII without obtaining written agreement, and the agency may have contractors who access PII not informed on responsibilities for complying with privacy requirements. Without additional PII safeguards, the agency may be at risk of PII being mistreated, misused and/or exposed. Recommendations We recommend that the Assistant Administrator for Environmental Information and Chief Information Officer: 1. Develop an implementing procedure for rules of behavior and consequences. 2. Develop and implement updated agency matching program procedures that: a. Define roles and responsibilities for communicating matching activities to the Privacy Office and the DIB. 14-P-0122 7 ------- b. Require a written matching agreement before the agency engages in a matching program. c. Define the agency Privacy Officer's oversight responsibilities. d. Convene the DIB for matching programs, as needed. e. Obtain a written agreement for the current matching program, as needed. 3. Develop and implement an oversight process that describes in detail how the EPA is to perform and document mandated contract reviews. 4. Develop and implement a process for maintaining an accurate, up-to-date listing of systems that contain sensitive PII. Agency Comments and OIG Evaluation The agency agreed with these recommendations and provided us with a response to the draft report which included corrective actions with milestone dates. We found the response to be acceptable and updated the report as appropriate. Subsequent to issuing the draft report, we met with the agency to discuss the report's findings and recommendations. As a result of those discussions and the agency's response to the draft, we updated the report as appropriate. 14-P-0122 8 ------- Chapter 3 Privacy Training Not Well Defined or Tracked The EPA had not annually trained agency personnel on all prescribed topics. The EPA also had not established an oversight process to ensure LPOs and all personnel that access PII are trained. OMB requires agencies to initially train employees on their privacy and security responsibilities before permitting them access to information and information systems. Federal guidance also specifies the topics for training personnel to reduce the possibility that PII will be accessed, used or disclosed inappropriately. The agency incorporates its annual privacy training into the annual information security training but the privacy training portion does not contain all the topics as prescribed by the National Institute of Standards and Technology (NIST). The EPA's process for tracking training lacks steps to ensure that LPOs who miss training obtain training at a later date. Further, the agency's processes lack oversight responsibilities to monitor whether LPOs train their offices' employees. As a result, EPA employees were not trained on all of the prescribed topics for their responsibilities for protecting PII. Senior agency officials may not have the information necessary to take additional measures to address weaknesses in the privacy training program due to the lack of oversight for ensuring personnel are trained. Privacy Training Topics Not Covered The EPA had not covered all topics during its annual security awareness training as prescribed by the NIST. OMB memorandum 07-16 requires agencies to initially train employees on their privacy and security responsibilities before permitting them access to information and information systems. It also requires agencies to provide annual refresher training to ensure employees continue to understand their responsibilities. NIST SP 800-122 states that organizations should reduce the possibility that PII will be accessed, used or disclosed inappropriately by training all individuals before being granted access to systems containing PII. The EPA incorporates privacy training within its annual Information Security Awareness Training. However, this training contains only some of the training topics specified by NIST. As a result, as shown by table 1, the EPA's privacy training program only covers 50 percent of the topics prescribed by NIST. 14-P-0122 9 ------- Table 1: Training topics and EPA training NIST-specified privacy training topics Topic included In EPA training Applicable privacy laws, regulations and policies N Restrictions on data collection, storage and use of PII Y Roles and responsibilities for using and protecting PII N Appropriate disposal of PII Y Sanctions for misuse of PII N Recognition of a security or privacy incident involving PII Y Retention schedules for PII N Roles and responsibilities in responding to Pll-related incidents and reporting. Y Source: NIST topics and OIG analysis. The agency is developing and updating its privacy training. However, the agency had not evaluated the current privacy awareness training available on its online training portal before it contracted to develop a new training program. When we reviewed the plan progress in July 2013, the training program was approximately 9 percent complete with $9,722 expended. We estimate that the EPA will spend approximately $100,000 to complete development of the new training program. Without ensuring all privacy training topics are taught, the EPA faces the possibility that agency employees are unaware of all the measures necessary to protect sensitive PII before they are granted access to agency information and information systems. Privacy Training Not Tracked in Program Offices The EPA does not have a formal process for tracking the training of agency personnel. The EPA indicated that it has a system in place to track training for their LPOs. In addition, the EPA indicated that the annual security awareness training is tracked centrally, but the EPA has issues with some program offices' training and tracking the training of their staff. We requested verifications from three LPOs regarding the training they provide to their office personnel before they are given access to agency information systems. Two LPOs indicated they did not have training records and appeared to not know the training requirement when they responded that employees did not need training, even though the system in question was identified as containing sensitive PII. One LPO did not respond to our request for information. Our audit also disclosed that the EPA lacks processes to verify whether LPOs responsible for training personnel within their offices monitor the training status of personnel. The EPA's Privacy Policy states that the LPOs are to ensure proper training for individuals in their area of responsibility, including monitoring online training for employees. The policy also designates the agency's Privacy Act Officer with providing oversight to ensure the EPA requirements are met and with training personnel on the policy's privacy requirements. 14-P-0122 10 ------- The EPA offers specialized LPO training once per year and had not set up a process to ensure LPOs that miss the training are trained. While the EPA uses sign-in sheets to track training attendance, the agency neither uses the rosters to identify who missed training nor provides supplemental training to the LPOs to ensure they are kept current about their duties. Once training is given, it is important to ensure the agency has processes in place to track who completes the training and inform senior agency officials on the status of the training program. The agency lacks necessary internal control processes, including tracking the training status of employees and a mechanism to inform management on the status of their office's training, to ensure the effectiveness of provided training and to make decisions regarding whether additional training is required to ensure employees are aware of their responsibilities necessary to protect PII. Conclusion The EPA had not trained all individuals on all prescribed topics for safeguarding PII. Ensuring that agency employees are aware of their responsibilities for protecting PII is critical in order for the agency to ensure it is taking all steps necessary to safeguard PII. Furthermore, the agency does not have an oversight process to track the training of those individuals throughout the agency who have a specialized role in providing privacy training. Without this process, the agency does not have assurance that all individuals are trained in carrying out their duties in support of ensuring that all users who access agency PII know the requirements for safeguarding PII. Recommendations We recommend that the Assistant Administrator for Environmental Information and Chief Information Officer: 5. Establish and implement a process to train all individuals who access PII based on their roles and responsibilities. This process should include training on all PII topics as prescribed by NIST. 6. Continue with current privacy training plans and establish a process to fully document business cases and due diligence reviews and follow this process should future modifications be needed in the current privacy training contract. 7. Develop and implement an oversight process to monitor that LPOs and all individuals who access PII are trained on their responsibilities for protecting PII. The oversight process should include a method to inform senior agency officials on the status of their office's completion of training. 14-P-0122 11 ------- Agency Comments and OIG Evaluation The agency agreed with recommendations 5 and 7 and provided high-level corrective action plans with milestone dates which we found acceptable. The agency initially did not agree with recommendation 6. The agency stated the Agency Privacy Officer exercised due diligence by conducting market research before entering into the current contract with the privacy training vendor. However, the agency was not able to provide us evidence to support its assertion. We subsequently met with agency representatives to discuss the finding and related corrective action. Management agreed that steps could be taken to strengthen its oversight processes and we updated the recommendation to be more specific as to the corrective action needed to address the finding. The agency concurred with the updated recommendation and provided us with a high-level corrective action plan with completion dates, which we found acceptable. 14-P-0122 12 ------- Status of Recommendations and Potential Monetary Benefits RECOMMENDATIONS POTENTIAL MONETARY BENEFITS (In $000s) Rec. No. Page No. Subject Status1 Action Official Planned Completion Date Claimed Amount Agreed-To Amount Develop an implementing procedure for rules of behavior and consequences. Develop and implement updated agency matching program procedures that: a. Define roles and responsibilities for communicating matching activities to the Privacy Office and the DIB. b. Require a written matching agreement before the agency engages in a matching program. c. Define the agency Privacy Officer's oversight responsibilities. d. Convene the DIB for matching programs, as needed. e. Obtain a written agreement for the current matching program, as needed. Develop and implement an oversight process that describes in detail how the EPA is to perform and document mandated contract reviews. Develop and implement a process for maintaining an accurate, up-to-date listing of systems that contain sensitive PI I. Establish and implement a process to train all individuals who access Pll based on their roles and responsibilities. This process should include training on all Pll topics as prescribed by NIST. Continue with current privacy training plans and establish a process to fully document business cases and due diligence reviews and follow this process should future modifications be needed in the current privacy training contract. Develop and implement an oversight process to monitor that LPOs and all individuals who access Pll are trained on their responsibilities for protecting Pll. The oversight process should include a method to inform senior agency officials on the status of their office's completion of training. Assistant Administrator for Environmental Information and Chief Information Officer Assistant Administrator for Environmental Information and Chief Information Officer 9/30/14 6/30/14 Assistant Administrator for Environmental Information and Chief Information Officer Assistant Administrator for Environmental Information and Chief Information Officer Assistant Administrator for Environmental Information and Chief Information Officer Assistant Administrator for Environmental Information and Chief Information Officer Assistant Administrator for Environmental Information and Chief Information Officer 3/31/14 6/30/14 9/30/14 3/31/14 9/30/14 O = recommendation is open with agreed-to corrective actions pending C = recommendation is closed with all agreed-to actions completed U = recommendation is unresolved with resolution efforts in progress 14-P-0122 13 ------- Appendix A Agency Response to Draft Report UNITED STATES ENVIRONMENTAL PROTECTION AGENCY WASHINGTON, D C. 20460 NOV '7 2013 OFFICE OF ENVIRONMENTAL INFORMATION MEMORANDUM SUBJECT: Response to Office of Inspector General Draft Report No. OA-FY13- 0082 "EPA Needs to Improve Processes for Safeguarding Personally Identifiable Information," dated August 19,2013 Thank you for the opportunity to respond to the issues and recommendations described in the draft audit report. The Office of Environmental Information's (OEI) response to the audit's findings and recommendations is attached. For the recommendations with which we agree, we provide high- level intended corrective actions and estimated completion dates. For the recommendations with which OEI does not agree, we explain our position and provide proposed alternatives to the recommendations, as appropriate. EPA's National Privacy Program, established in 2007, is striving to ensure that EPA is in compliance with statutory requirements, guidance and standards issued by the Office of Management and Budget and the National Institute of Standards and Technology. The Program is currently revising the Agency's Privacy Policy to address emerging privacy areas such as social media and cloud computing, and to address privacy needs not identified when the initial policy was issued. The revised Policy is scheduled to be issued in Q2 FY 2014. The Program also is engaged in developing a five-year strategic plan to guide the Agency in meeting its responsibilities to ensure Personally Identifiable Information (PII) is adequately protected. FROM: Acting Assf!stant^\cl|r)ihfetr^c" and Chief lnforajation Officer TO: Arthur A. Elkins, Jr. Inspector General 14-P-0122 ------- OEI appreciates this evaluation by the Office of Inspector General (OIG) and the opportunity to address each finding and recommended action. We are committed to ensuring full compliance with federal privacy requirements for protecting Agency PII. If you have questions regarding this response, please contact Judy Hutt, the Agency Privacy Officer, in the Office of Information Collection, Collection Strategies Division, FOIA and Privacy Branch at 202-566-1668. Attachment cc: Vaughn Noga Andrew Battin Jeff Wells John Moses Deborah Williams Judy Hutt Scott Dockum Brenda Young 14-P-0122 15 ------- Attachment 1 Response to OIG Findings and Recommendations Chapter 2 - EPA's Documented Processes for Protecting PII Need Improvement OIG Recommendation 1: Finalize and implement a rules and consequences policy related to safeguarding PII. Corrective Action 1: OEI agrees and will develop implementing procedures for rules of behavior and consequences by September 30, 2014. However, we believe we do have a formal rules and consequences policy. (See Agency Privacy Policy, Section 6.) OIG Recommendation 2: Develop and implement updated Agency "matchingprogram " policies and procedures. Corrective Action 2: OEI agrees that implementing procedures for a matching program are needed and these will be developed. The implementing procedures are planned for completion by June 30, 2014, and will outline the steps required to ensure compliance with the Privacy Act when establishing a matching program. OEI will also include "matching agreements" as a topic in the privacy trainings under development to ensure that key privacy personnel, including managers, are aware of this requirement. Discussion of OIG Finding 2: Lack of Oversight Over a Matching Program. OEI believes the report is not accurate in its supporting narrative. The OIG states, "EPA has not created written policies or procedures that require a written matching agreement before the Agency engages in a matching program." EPA's Privacy Policy addresses the matching program requirements for a written matching agreement, along with the requirement to establish a Data Integrity Board (DIB) to oversee any matching activity (see pp. 7, 14 and 15). As we stated previously, the Privacy Act requirements for a matching agreement did not apply to Phase I of the "Do Not Pay" data sharing activity referenced in the report. A matching agreement will be in place to support Phase II of the "Do Not Pay" data sharing activity which will commence in CY 2014. OIG Recommendation 3: Develop and implement an oversight process that describes in detail how the EPA is to perform and document mandated contract reviews. Corrective Action 3: OEI will develop an oversight process in Q2 of FY 2014 to ensure contract reviews are performed every two years. OEI is currently collaborating with the Office of Administration Resources (OARM) to develop a process for OARM to conduct privacy reviews of contracts and report the results to the Privacy Program. The biennial review process will be documented to guide future reviews. 14-P-0122 16 ------- Discussion of OIG Finding 3: Contract Reviews Not Performed. The draft report states that OEI could not provide the 010 with either the name of the individual who performed the previous reviews or evidence they were conducted. OEI provided the names of the individuals who performed the contract reviews, along with documentation, but was unable to locate the additional supporting evidence required by the OIG. OIG Recommendation 4: Develop and implement a process for maintaining an accurate, up-to-date listing of systems that contain sensitive PII. Corrective Action 4: OEI will develop a process for regularly requesting inventory updates from Liaison Privacy Officials (LPOs) and posting the updates to the privacy website. OEI plans to complete this action by June 30, 2014. In addition, OEI will revise its Privacy Policy to describe the LPO's responsibility for reporting on the status of PII systems in their organizations and include this requirement in the privacy training currently being developed for Agency LPOs. Discussion of OIG Finding 4: Data Used for Official Reporting Not Always U p to Date. OEI disagrees with the statement that an inaccurate listing of systems is used to report to the Chief Information Officer (CIO) and OMB. The Privacy Program regularly updates the list of systems that contain sensitive PII based on information provided by LPOs on the status of these systems. At the time the OIG reviewed the listing of sensitive PII systems posted on the Privacy intranet site, the master list of sensitive PII systems was being reconciled with a recent data call on sensitive PII systems initiated by the Senior Agency Information Security Officer (SAISO). Chapter 3-Privacy Training Not Weil-Defined or Tracked OIG Recommendation 5: Establish and implement a process to train all individuals who access Pll based on their roles and responsibilities. This process should include training on all Pll topics as prescribed by NIST. Corrective Action 5: The Privacy Program is developing online role-based training courses for key privacy personnel and mandatory general awareness training for all employees, which will be available in Q4 FY 2014. Online trainings for personnel who access PII will cover all PII topics as prescribed by the National Institute of Standards and Technology. Discussion of OIG Finding 5: Privacy Training Topics Not Covered. The OIG report states current annual information security training, which has a privacy component, does not cover all the privacy training topics prescribed by the National Institute of Standards and Technology. Privacy trainings conducted by the Agency Privacy Officer, that augment the annual information security training, meet the requirements. OIG Recommendation 6: Establish and implement a process to conduct due diligence reviews of available training before the Agency enters into contract s to develop further privacy training. Corrective Action 6: OEI disagrees with this finding. The Agency Privacy Officer exercised due diligence by conducting market research before entering into the current contract with the 14-P-0122 17 ------- privacy training vendor. The Agency Privacy Officer was involved in the review and testing of the training identified in the report as "the training on the on line training portal" (i.e., Skillport) and determined the training was not sufficient to meet Privacy Program needs. This evaluation process will continue. OIG Recommendation 7: Develop and implement an oversight process to monitor that LPOs and all individuals who access PII are trained on their responsibilities for protecting PI! The oversight process should include a method to inform senior Agency officials on the status of their office's completion of training. Corrective Action 7: Online privacy trainings will be offered and tracked via Skillport, the Agency's online training portal. The Agency Privacy Officer, LPOs and EPA managers will be able to track who has taken the training and provide training opportunities for all who require it. The role-based training for LPOs is scheduled to be available in Q1 FY 2014. The general awareness training is expected to be available later in FY 2014. 14-P-0122 18 ------- Attachment 2 Agency's Response To Report Recommendations Agreement No. Recommendation High-Level Intended Corrective Action(s) Estimated Completion by Quarter and FY 1 Finalize and implement a rules and consequences policy related to safeguarding PH. The Agency agrees to develop implementing procedures for rules of behavior and consequences. 4th Quarter FY 2014 (9/30/14) 2 Develop and implement updated Agency matching program policies and procedures that: a. Define roles and responsibilities for communicating matching activities to the APO and the DIB. b. Require a written matching agreement before the Agency engages in a matching program. c. Define the APO's oversight responsibilities. d. Convene the DIB for matching programs, as needed. e. Obtain a written agreement for the current matching program, as needed. The implementing procedures will outline the steps required to ensure compliance with the Privacy Act when establishing a matching program. The Agency will also include "matching agreements" as a topic in the privacy trainings under development to ensure that key privacy personnel, including managers, are aware of this requirement. 3rd Quarter FY 2014 (6/30/14) 3 Develop and implement an oversight process that describes in detail how the EPA is to perform and document mandated contract reviews. The Agency will develop an oversight process by March 31, 2014, to ensure contract reviews are performed every two years. 2nd Quarter FY 2014 (3/31/14) 4 Develop and implement a process for maintaining an accurate, up- to-date listing of systems that contain sensitive PII. The Agency will develop a process for regularly requesting inventory updates from LPOs and posting the updates to the privacy website. 3rd Quarter FY 2014 (6/30/14) 14-P-0122 19 ------- 5 Establish and implement a process to train all individuals who access PII based on their roles and responsibilities. This process should include training on all PII topics as prescribed by NIST. Online trainings for personnel who access PH will cover all PII topics as prescribed by the National Institute of Standards and Technology. 4th Quarter FY 2014 (9/30/14) 7 Develop and implement an oversight process to monitor that LPOs and all individuals who access PII are trained on their responsibilities for protecting PII. The oversight process should include a method to inform senior Agency officials on the status of their office's completion of training. Online privacy trainings will be offered and tracked via Skillport, the Agency's online training portal. 4th Quarter FY 2014 (9/30/14) Disagreements No. Recommendation Agency Explanation/Response Proposed Alternative 6 Establish and implement a process to conduct due diligence reviews of available training before the Agency enters into contracts to develop further privacy training. The Agency Privacy Officer exercised due diligence by conducting market research before entering into the current contract with the privacy training vendor. The Agency Privacy Officer was involved in the review and testing of the training identified in the report as "the training on the online training portal" (i.e., Skill port) and determined the training was not sufficient to meet Privacy Program needs. EPA will continue with the current training plans for privacy training in Skillport, the Agency's online training portal. 14-P-0122 20 ------- Appendix B Attachment 2 Revised Agency Response to Report Recommendations Agreements No. Recommendation High-Level Intended Corrective Action(s) Estimated Completion by Quarter and FY 1 Finalize and implement a rules and consequences policy related to safeguarding PII. The Agency agrees to develop implementing procedures for rules of behavior and consequences. 4th Quarter FY 2014 (9/30/14) 2 Develop and implement updated Agency matching program policies and procedures that: a. Define roles and responsibilities for communicating matching activities to the APO and the DIB. b. Require a written matching agreement before the Agency engages in a matching program. c. Define the APO's oversight responsibilities. d. Convene the DIB for matching programs, as needed. e. Obtain a written agreement for the current matching program, as needed. The implementing procedures will outline the steps required to ensure compliance with the Privacy Act when establishing a matching program. The Agency will also include "matching agreements" as a topic in the privacy trainings under development to ensure that key privacy personnel, including managers, are aware of this requirement. 3rd Quarter FY 2014 (6/30/14) 3 Develop and implement an oversight process that describes in detail how the EPA is to perform and document mandated contract reviews. The Agency will develop an oversight process by March 31, 2014, to ensure contract reviews are performed every two years. 2nd Quarter FY 2014 (3/31/14) 4 Develop and implement a process for maintaining an accurate, up-to-date listing of systems that contain sensitive PII. The Agency will develop a process for regularly requesting inventory updates from LPOs and posting the updates to the privacy website. 3rd Quarter FY 2014 (6/30/14) 14-P-0122 21 ------- No. Recommendation High-Level Intended Corrective Action(s) Estimated Completion by Quarter and FY 5 Establish and implement a process to train all individuals who access PII based on their roles and responsibilities. This process should include training on all PII topics as prescribed by NIST. Online trainings for personnel who access PII will cover all PII topics as prescribed by the National Institute of Standards and Technology. 4th Quarter FY 2014 (9/30/14) 6 Continue with current privacy training plans and establish a process to fully document business cases and due diligence reviews and follow this process should future modifications be needed in the current privacy training contract. The Agency will develop a process to document business cases and due diligence reviews should future trainings be required. 2nd Quarter FY2014 (3/31/14) 7 Develop and implement an oversight process to monitor that LPOs and all individuals who access PII are trained on their responsibilities for protecting PII. The oversight process should include a method to inform senior Agency officials on the status of their office's completion of training. Online privacy trainings will be offered and tracked via Skillport, the Agency's online training portal. 4th Quarter FY 2014 (9/30/14) 14-P-0122 22 ------- Appendix C Distribution Office of the Administrator Assistant Administrator for Environmental Information and Chief Information Officer Agency Follow-Up Official (the CFO) Agency Follow-Up Coordinator General Counsel Associate Administrator for Congressional and Intergovernmental Relations Associate Administrator for External Affairs and Environmental Education Principal Deputy Assistant Administrator for Environmental Information Director, Office of Information Collection, Office of Environmental Information Deputy Director, Office of Information Collection, Office of Environmental Information Audit Follow-Up Coordinator, Office Environmental Information 14-P-0122 23 ------- |