^edU.S. Environmental Protection Agency	17-P-0409
Office of Inspector General	September 27,2017
? Q \
\mj
% PRO^
At a Glance
Why We Did This Review
The Office of Inspector
General (OIG) is conducting
an audit to determine
whether the U.S.
Environmental Protection
Agency (EPA) completed
required background
investigations for contractor
personnel with privileged
access to EPA information
systems. While the audit is
ongoing, we are issuing this
management alert to make
the EPA aware of certain
issues that need immediate
attention.
Background investigations
are required for all
individuals to be employed or
contracted by the federal
government. Background
investigations are particularly
critical for information
security personnel in
high-risk positions as they
develop, implement and
administer the system's
security controls to resist and
identify cybersecurity threats.
This report addresses the
following:
• Operating efficiently and
effectively.
Management Alert: EPA Has Not Initiated
Required Background Investigations for
Information Systems Contractor Personnel
What We Found
The required background investigation was
not initiated for any of the nine contractor
personnel we reviewed prior to their obtaining
privileged access to EPA networks, systems
and data. The EPA is required to initiate a
background investigation prior to granting
access to agency systems and data. This
failure to appropriately vet personnel leaves
the agency vulnerable to a cyberattack.
Not vetting contractor
personnel before granting
them network access exposes
the EPA to risks. Contractor
personnel with potentially
questionable backgrounds
who access sensitive agency
data could cause harm.
Management action is needed to correct how the EPA implements its
background screening. In particular, we noted the following control weaknesses:
•	The EPA was not initiating required background investigations for
contractor personnel in high-risk positions.
•	The EPA has not identified all high-risk information technology positions.
•	The EPA has not assigned a risk determination for information security
contractor personnel.
•	EPA system owners, service managers and contracting officer's
representatives did not verify whether contractor personnel possessed the
required background investigations.
•	The EPA's internal websites do not specify background investigation
requirements for contractor personnel.
•	The EPA does not have an accurate number for how many information
security contractor personnel require high-risk background investigations.
Recommendation and Planned Agency Corrective Actions
We recommend that the agency implement controls over the EPA's personnel
screening practices for initiating the required high-level background investigation
for contractor personnel with privileged access to agency networks, information
systems and data. We briefed the EPA on August 21, 2017. Management agreed
with our findings and recommendation. The EPA will provide planned completion
dates in a formal response to this report.
Send all inquiries to our public
affairs office at (202) 566-2391
or visit www.epa.aov/oia.
Listing of OIG reports.

-------