.vtffcD STA?.
*. U.S. Environmental Protection Agency	12-P-0543
-	\ Officeof Inspector General	Juneis,20i2
22 /
¦° ° At a Glance
Why We Did This Review
The Office of Inspector
General (OIG) is responsible
for independently reviewing
U.S. Environmental Protection
Agency (EPA) programs
related to national security.
We evaluated EPA's classified
national security information
(NSI) infrastructure. We
performed this review as
required by the Reducing
Over-Classification Act.
Background
Executive Order 13526,
Classified National Security
Information, prescribes a
uniform system for classifying,
safeguarding, and declassifying
national security information.
According to the executive
order and the related
regulations, national security
information can be classified as
Top Secret, Secret, or
Confidential, depending on the
damage that may be caused by
its release. The Office of
Administration and Resources
Management manages EPA's
NSI program.
For further information, contact
our Office of Congressional and
Public Affairs at (202) 566-2391.
The full report is at:
www.epa.gov/oiq/reports/2012!
20120618-12-P-0543.pdf
EPA's National Security Information Program
Could Be Improved
What We Found
Under its classified NSI program, EPA has assigned responsibilities and provided
guidance, training, and oversight. EPA program offices provide secure equipment
and space, following NSI program specifications. EPA has procedures in place so
employees can obtain security clearances and classify information. Annual
reports are prepared on the status of the program. Thus, EPA can create, receive,
handle, and store classified material needed to fulfill its responsibilities related to
its homeland security, emergency response, and continuity missions.
We found that EPA's NSI program needs improved internal controls to address
the following deficiencies:
•	Although EPA keeps three copies of an employee's signed Classified
Information Nondisclosure Agreement, Standard Form 312, it does not
store a copy in the employee's Official Personnel Folder, as provided in
guidance from the Office of Personnel Management (OPM). OPM's
regulation requires that personnel records be maintained in accordance
with OPM guidance.
•	Not all individuals with an EPA security clearance are completing the
required annual refresher training.
•	EPA does not always promptly withdraw a clearance when an employee
leaves EPA, which may result in a person accessing classified NSI to
which he or she is no longer privileged.
•	EPA regulation, policies, and basic guidance document for the NSI
program do not reflect the current government-wide requirements, and
the basic guidance document is currently not an Agency-wide directive
even though it impacts the entire EPA.
We did not assess the readiness of EPA's NSI program in the event of an actual
national security incident.
Recommendation/Planned Agency Corrective Actions
We recommend that the Assistant Administrator for Administration and
Resources Management issue a directive to establish controls that address the
deficiencies identified in this report. The Agency partially agreed with our
recommendation, and provided alternate corrective actions with completion dates
that we consider acceptable. We consider the recommendation resolved.

-------