U.S. ENVIRONMENTAL PROTECTION AGENCY
CUSTOMER SERVICE ~ INTEGRITY ~ ACCOUNTABILITY
Operating efficiently and effectively
EPA Effectively Planned for
Future Remote Access
Needs but Should
Disconnect Unneeded
Services in Timely Manner
Report No. 21-P-0241
September 20, 2021
Remote
Access
Solution
-------
Report Contributors: LaSharn Barnes
Nii-Lantei Lamptey
lantha Maness
Christina Nelson
Teresa Richardson
Albert Schmidt
Abbreviations:
EIS Enterprise infrastructure Solutions
E-MORRIS Enhanced Monthly On-line Records and Reports
of Information
EPA U.S. Environmental Protection Agency
GSA U.S. General Services Administration
OIG Office of Inspector General
Cover Image:
The EPA relies on its remote access capability to ensure continuity of
operations in pandemic and natural disaster situations. (EPA OIG image)
Are you aware of fraud, waste, or abuse in an
EPA program?
EPA Inspector General Hotline
1200 Pennsylvania Avenue, NW (2431T)
Washington, D.C. 20460
(888) 546-8740
(202) 566-2599 (fax)
OIG Hotline@epa.gov
Learn more about our OIG Hotline.
EPA Office of Inspector General
1200 Pennsylvania Avenue, NW (2410T)
Washington, D.C. 20460
(202) 566-2391
www.epa.gov/oiq
Subscribe to our Email Updates
Follow us on Twitter @EPAoig
Send us your Project Suggestions
-------
Office of Inspector General
U.S. Environmental Protection Agency
At a Glance
21-P-0241
September 20, 2021
Why We Did This Audit
We performed this audit to
determine whether the
U.S. Environmental Protection
Agency effectively planned a
long-term solution to address
remote access concerns while
transitioning to the U.S. General
Services Administration's
Enterprise Infrastructure
Solutions contract. This contract
will replace its predecessor
contracts, which expire in
May 2023, forgovernmentwide
network and telecommunications
solution programs.
Remote network access became
mission critical in March 2020 as
the EPA responded to the
coronavirus pandemic.
Continuing operations under the
duress of pandemics and natural
disasters requires the Agency to
adapt its network to support a
virtual workforce.
This audit supports an EPA
mission-related effort:
• Operating efficiently and
effectively.
This audit addresses these top
EPA management challenges:
• Maintaining operations during
pandemic and natural disaster
responses.
• Complying with key internal
control requirements (risk
assessments).
• Enhancing information
technology security.
Address inquiries to our public
affairs office at (202) 566-2391 or
OIG WEBCOMMENTS@epa.gov.
List of OIG reports.
EPA Effectively Planned for Future Remote
Access Needs but Should Disconnect
Unneeded Services in Timely Manner
Because the EPA did
not disconnect
unneeded GSA services
in a timely manner, the
Agency paid at least
$7,850 for services it
was not using.
What We Found
The EPA effectively planned a long-term solution
to address remote access concerns while
transitioning to the U.S. General Services
Administration's Enterprise Infrastructure
Solutions contract. Specifically, in its solicitation
for network and telecommunications services
under the EIS contract, the EPA included a
requirement that the selected vendor provide remote access solutions to
support 12,500 concurrent remote users, with the capability to expand to
20,000 concurrent remote users. This range of concurrent remote users should
meet the EPA's future workforce needs, since it exceeds the EPA's fiscal
year 2020 workforce by almost 6,000 users.
During our audit fieldwork, we identified a matter not directly related to our
objective but related to the EPA's transition to the EIS contract. The EPA did
not disconnect GSA services, such as analog phone and digital subscriber
lines, that were no longer needed in a timely manner. Specifically, as part of its
EIS transition activities, which began in 2015, the EPA identified unneeded
GSA services, but as of May 2021, 268 of the services determined to be
unneeded were still not disconnected. In addition, we reviewed eight EPA
disconnection orders for unneeded services and found that it took from one to
61 months to disconnect them. These delays cost the EPA at least $7,850.
The EPA did disconnect over 18,000 of unneeded GSA services from
November 2016 through April 2021. Because the EPA has taken steps to
disconnect unneeded services as part of its EIS transition activities, we make
no recommendations regarding this finding.
The Agency did not provide a formal written response to the draft report.
-------
^£Dsr/%
' JL \
\«/
UNITED STATES ENVIRONMENTAL PROTECTION AGENCY
WASHINGTON, D.C. 20460
THE INSPECTOR GENERAL
September 20, 2021
MEMORANDUM
SUBJECT: EPA Efficiently Planned for Future Remote Access Needs but Should Disconnect
Unneeded Services in Timely Manner
Report No. 21-P-0241
This is our report on the subject audit conducted by the U.S. Environmental Protection Agency's Office
of Inspector General. This project number for this audit was OA-FY21-0066. This report contains findings
that describe the problems the OIG has identified.
You are not required to respond to this report because this report contains no recommendations. If you
submit a response, however, it will be posted on the OIG's website, along with our memorandum
commenting on your response. Your response should be provided as an Adobe PDF file that complies
with the accessibility requirements of Section 508 of the Rehabilitation Act of 1973, as amended. The
final response should not contain data that you do not want to be released to the public; if your response
contains such data, you should identify the data for redaction or removal along with corresponding
justification.
FROM:
Sean W. O'Donnell
TO:
Lynnann Hitchens, Acting Principal Deputy Assistant Administrator
Office of Mission Support
We will post this report to our website at www.epa.gov/oig.
-------
EPA Effectively Planned for Future 21-P-0241
Remote Access Needs but Should Disconnect
Unneeded Services in Timely Manner
Table of
Purpose 1
Background 1
GSA Network and Telecommunications Contracts 1
GSA EIS Transition Milestones 1
EPA Remote Access Is Critical Function 2
Responsible Offices 2
Scope and Methodology 2
Results 3
EPA Effectively Planned for Remote Access Needs 3
EPA Needs to Disconnect GSA Services in Timely Manner 4
Conclusions 5
Appendix
A Distribution 6
-------
Purpose
The Office of Inspector General initiated this audit to determine whether the U.S. Environmental
Protection Agency effectively planned a long-term solution to address remote access concerns while
transitioning to the U.S. General Services Administration's Enterprise Infrastructure Solutions, or EIS,
contract.
Top Management Challenges Addressed
This audit addresses the following top management challenges for the Agency, as identified in OIG Report
No. 20-N-0231. EPA's FYs 2020-2021 Top Management Challenges, issued July 21, 2020:
• Maintaining operations during pandemic and natural disaster responses.
• Complying with key internal control requirements (risk assessments).
• Enhancing information technology security.
Background
GSA Network and Telecommunications Contracts
The GSA is responsible for providing contracts for network and telecommunications services to federal
agencies. Until May 31, 2023, the EPA will obtain its network and telecommunication services via four
The Working Capital Fund is an
intragovernmental revolving fund of
working capital authorized by law to finance
a cycle of operations, to which the cost of
goods and services provided are charged to
the users on a fee-for-service basis.
with the GSA—the Local Service Agreement contract—allows the Agency to order services directly from
the GSA for distribution to EPA locations.
After May 31, 2023, the EPA will obtain its network and telecommunications services under one GSA
contract: the EIS contract. The EIS contract will be managed through the EPA's Working Capital Fund.
EPA representatives indicated that the transition from the four predecessor GSA contracts to the single
EIS contract will allow the EPA to centralize the order-and-review process associated with GSA network
and telecommunication services.
GSA EIS Transition Milestones
The GSA outlined transition activities and milestone dates for federal agencies transitioning to the EIS
contract to ensure that network and telecommunications services remain uninterrupted when the
predecessor GSA contracts expire on May 31, 2023. These activities began in 2015, when the GSA
provided the transitioning federal agencies with access to its Enhanced Monthly On-line Records and
Reports of Information Technology Services, or E-MORRIS, database so
that they could validate their inventory of services by October 2016.
Table 1 documents the schedule of EIS transition activities, the EIS
milestone dates, and the EPA's status.
GSA contracts, three of which—the Networx Enterprise, the
Networx Universal, and the Washington Interagency
Telecommunications Systems contracts—are managed
through the EPA's Working Capital Fund. Services ordered
through the Working Capital Fund are reviewed annually to
determine if they are still needed or should be disconnected.
The EPA's fourth network and telecommunications contract
The GSA's E-MORRIS database
supports billing and inventory
for the Networx contracts.
21-P-0241
1
-------
Table 1: Status of EPA's EIS transition activities, as of July 2021
EIS transition activity I
I GSA milestone date I
I EPA status 1
Agencies validate service
inventory against
E-MORRIS database.
October 31
, 2016
Not completed due to the E-MORRIS database containing
over 60,000 flawed entries. The EPA estimated that it
would cost over $160,000 to conduct a full reconciliation.
Agencies develop
Agency Transition Plan.
October 31
, 2016
Completed on October 31, 2016.
Agencies issue Fair
Opportunity solicitation
to industry.
March 31,
2019
Completed on December 30, 2020. The GSA awarded the
final authorization to operate to eligible vendors on
December 18, 2019. Solicitations could not be sent to
vendors without an authorization to operate.
Agencies award EIS task
orders *
September 30, 2019
Not completed. The EPA planned to award its EIS task
order by June 29, 2021. As of July 2021, the EPA had not
selected an EIS vendor.
Agencies achieve 50%
transition of services.*
March 31,
2021
Not completed. The EPA cannot start transitioning
services until after awarding its EIS task order.
Source: OIG summary of GSA and EPA EIS information. (EPA OIG table)
* Task order award and transition of services follow planning and occur during development and implementation
of the long-term solution, which is outside the scope of this audit.
EPA Remote Access Is Critical Function
EPA employees use remote access to connect to the EPA's network from remote locations. This
capability became mission critical in March 2020 at the beginning of the coronavirus pandemic—that is,
the SARS-CoV-2 virus and the resultant COVID-19 virus. Continuing EPA operations under the duress of
pandemics and other natural disasters requires the Agency to adapt its network to support a primarily
virtual workforce and provide an unprecedented number of remote employees with a reliable, stable
means to communicate and access critical applications and data.
Responsible Offices
The Office of Mission Support is responsible for providing EPA employees with remote access to the
Agency's network. Within the Office of Mission Support, the Office of Information Technology Operations
is responsible for implementing and managing the enterprise information technology infrastructure
services and solutions to support the EPA's mission, including the EPA's transition to the GSA EIS contract.
Scope and Methodology
We conducted our work from January to August 2021. We conducted this performance audit in
accordance with generally accepted government auditing standards. Those standards require that we
plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for
our findings and conclusions based on our audit objective. We believe that the evidence obtained
provides a reasonable basis for our findings and conclusions based on our audit objective.
We assessed the internal controls necessary to satisfy our audit objective.1 Specifically, we assessed the
internal control components—as outlined in the U.S. Government Accountability Office's Green Book—
1 An entity designs, implements, and operates internal controls to achieve its objectives related to operations,
reporting, and compliance. The U.S. Government Accountability Office sets internal control standards for federal
entities in GAO-14-704G, Standards for Internal Control in the Federal Government (also known as the "Green
Book"), issued September 10, 2014.
21-P-0241
2
-------
significant to our audit objectives: the risk assessment and the information and communication internal
control components. Any internal control deficiencies we found are discussed in this report. Because our
audit was limited to the internal control components deemed significant to our audit objective, it may
not have disclosed all internal control deficiencies that may have existed at the time of the audit.
We reviewed federal and Agency guidance for system development life cycle and information
technology contracts, as well as the EPA's Agency Transition Plan submitted to the GSA. We interviewed
and met with the EPA's GSA representatives and the Agency personnel responsible for the EIS transition.
We created a timeline to correlate the EPA's EIS transition with GSA milestone dates and other dates
that may have impacted the EPA's EIS transition. We reviewed the remote access solutions identified in
the EPA's EIS solicitation statement of work and the EPA's validated inventory of GSA services as of
April 2021. We obtained the GSA spreadsheet of EPA disconnection orders and selected a sample of
eight to determine whether services were disconnected in a timely manner.
Results
EPA Effectively Planned for Remote Access Needs
The EPA effectively planned a long-term solution to address remote access concerns and provide for
adequate remote access capability as part of its transition to the EIS contract. In its solicitation package
to award a task order under the EIS contract, the EPA included a requirement that the selected vendor
be able to provide remote access solutions to support 12,500 concurrent remote users, with the
capability to expand to 20,000 concurrent remote users. As shown in Figure 1, this range of concurrent
remote users should meet the EPA's future workforce needs, since it exceeds the EPA's fiscal year 2020
workforce numbers by almost 6,000 users.
Figure 1: EPA workforce compared to EIS solicitation concurrent remote user capability
20,000
18,000 EPA's requirement for a
__ range of 12,500 to
16,000 r- 20,000 concurrent
14,000 remote users
120Q0
10,000 1—
8,000 1- ¦
6,000
4,000
2,000
o
CM
<3-
U3
00
o
CM
<3"
UD
00
o
CM
00
o
CM
CD
00
o
-
>
>
>-
>-
>
>
>"
>
>-
>
>
>-
>-
>-
>
>
>-
>
>-
>-
>-
>-
>-
>
Source: OIG analysis of EPA EIS solicitation package and EPA workforce data. (EPA OIG image)
Legend: FY = Fiscal Year
21-P-0241
3
-------
EPA Needs to Disconnect GSA Services in Timely Manner
During the audit, we identified a matter not directly related to our audit objective but related to the
transition to the EIS contract. Specifically, the EPA did not disconnect GSA services that were no longer
needed in a timely manner. This likely occurred because the EPA did not have a process to regularly
review all of its GSA services. Also, the EPA did not validate its GSA service inventory against the
E-MORRIS database, as requested by the GSA.
As part of its EIS transition activities, the EPA developed an inventory of GSA services to transfer to the
EIS contract and submitted disconnection orders for those services determined to be unneeded. Over
18,000 unneeded GSA services were disconnected from November 2016 through April 2021, but as of
May 2021, 268 unneeded services had not been disconnected. EPA representatives stated that
disconnection orders for the remaining services are being resubmitted.
We judgmentally selected eight EPA disconnection orders to review to determine how long it took to
disconnect the unneeded GSA services. These eight disconnection orders covered 107 analog and digital
subscriber line services, and the time frame between when the services were no longer needed and
when they were disconnected varied from one to 61 months:
• One disconnection order for one service within the Office of Enforcement and Compliance
Assurance was completed within one month of the service no longer being needed.
• One disconnection order for 34 services within Region 8 was completed within one month of the
services no longer being needed.
• Of six disconnection orders for 72 services within the Office of Mission Support, 41 services
were disconnected within two to 61 months of the services no longer being needed. As Table 2
shows, the delay in disconnection cost the EPA at least $7,850. The Office of Mission support did
not provide the dates of when 31 of the 72 services were no longer needed, so the costs
incurred may be higher.
Table 2: Disconnection of unneeded services in Office of Mission Support
Time from when services
was no longer needed to
disconnection date
Number of services
Cost incurred after service was
no longer needed until it was
disconnected
Unknown
31
Unknown
Two months
25
$2,074.81
10-12 months
6
1,143.53
14-19 months
4
1,551.14
47-48 months
3
1,459.35
61 months
3
1,621.62
Total
72
$7,850.45
at a minimum
Source: OIG analysis of EPA data. (EPA OIG table)
Since we only looked at eight of the EPA's disconnection orders, we do not know the total cost that the
EPA paid for unnecessary services and whether that would have exceeded the estimated $160,000 for
the EPA to reconcile its inventory of services with the E-MORRIS database in 2016, as outlined in Table 1.
21-P-0241
4
-------
Conclusions
The EPA effectively planned a long-term solution to address remote access concerns and provide for
adequate remote access capacity as part of its transition to the EIS contract. The EPA's EIS solicitation
included a requirement that the selected vendor provide a concurrent remote access capability that
exceeds the fiscal year 2020 EPA workforce by almost 6,000 users.
As part of its EIS transition activities, the EPA identified unneeded GSA services and has taken steps to
disconnect these services. As a result, we make no recommendations regarding this finding.
Furthermore, all future GSA network and telecommunications acquisitions will be funneled through the
EIS contract, which will be managed through the EPA's Working Capital Fund. Since the EPA annually
reviews all Working Capital Fund orders to determine whether they remain valid or should be
disconnected, the EPA will have a regular process in place to disconnect all unnecessary network and
telecommunications services after fully transitioning to the EIS contract.
The Agency did not provide a formal written response to the draft report.
21-P-0241
5
-------
Appendix A
Distribution
The Administrator
Deputy Administrator
Chief of Staff, Office of the Administrator
Deputy Chief of Staff, Office of the Administrator
Agency Follow-Up Official (the CFO)
Assistant Administrator for Mission Support
Agency Follow-Up Coordinator
General Counsel
Associate Administrator for Congressional and Intergovernmental Relations
Associate Administrator for Public Affairs
Principal Deputy Assistant Administrator for Mission Support
Associate Deputy Assistant Administrator for Mission Support
Deputy Assistant Administrator for Environmental Information and Chief Information Officer, Office of
Mission Support
Director, Office of Continuous Improvement, Office of the Chief Financial Officer
Director, Office of Information Technology Operations, Office of Mission Support
Director, Office of Resources and Business Operations, Office of Mission Support
Audit Follow-Up Coordinator, Office of the Administrator
Audit Follow-Up Coordinator, Office of Mission Support
Audit Liaison, Office of Information Technology Operations, Office of Mission Support
21-P-0241
6
------- |