The EPA's Enhanced Personnel Security Program Is on Track, but Challenges to Full Implementation Remain February 8, 2024 ] Report No. 24-E-0020 ------- Report Contributors Gabby Fekete Lauretta Joseph Valerie Madas Gaida Mahgoub Thane Thompson Abbreviations DCSA Defense Counterintelligence and Security Agency EPA U.S. Environmental Protection Agency ODNI Office of the Director of National Intelligence OIG Office of Inspector General PSB Personnel Security Branch Pub. L. Public Law TW Trusted Workforce U.S.C. United States Code Key Definition Continuous Vetting A process that involves regularly reviewing a cleared individual's background to ensure that the individual continues to meet security clearance requirements and should continue to hold positions of trust. Cover Image EPA employee and security imagery depicting the background vetting work. (EPA and OIG images) Are you aware of fraud, waste, or abuse in an EPA program? EPA Inspector General Hotline 1200 Pennsylvania Avenue, NW (2431T) Washington, D.C. 20460 (888) 546-8740 (202) 566-2599 (fax) OIG.Hotline@epa.qov Learn more about our OIG Hotline. EPA Office of Inspector General 1200 Pennsylvania Avenue, NW (2410T) Washington, D.C. 20460 (202) 566-2391 www.epaoiq.gov Subscribe to our Email Updates. Follow us on X (formerly Twitter) @EPAoiq. Send us your Project Suggestions. ------- 24-E-0020 February 8, 2024 At a Glance The EPA's Enhanced Personnel Security Program Is on Track, but Challenges to Full Implementation Remain Why We Did This Evaluation To accomplish this objective: The U.S. Environmental Protection Agency Office of Inspector General conducted this evaluation to determine the EPA Personnel Security Branch's progress in implementing a fair and effective enhanced personnel security program in accordance with the director of National Intelligence's performance standards. Executive Order 13467 requires all executive branch agencies to implement reforms to enhance their personnel security programs. These reforms are intended to establish a single vetting system for the federal government. For this evaluation, we assessed "fairness" and "effectiveness" as the extent to which the EPA is on track to achieve full implementation of the enhanced personnel security program by established milestones and is compliant with the applicable policies and guidance. To support these EPA mission- related efforts: • Compliance with the law. • Operating efficiently and effectively. To address this top EPA management challenge: • Managing grants, contracts, and data systems. What We Found As of October 2023, the EPA's Personnel Security Branch, or PSB, has successfully met all milestones and requirements to date to fairly and effectively implement the director of National Intelligence's enhanced personnel security program, known as the Trusted Workforce, orTW, Program. Specifically, the PSB has completed the first two of the program's three implementation steps, referred to as TW 1.25, TW 1.5, and TW 2.0. The final step, TW2.0, must be completed by March 30, 2026, and will culminate in full implementation of the program. As of October 2023, the PSB is on track to meet full TW 2.0 implementation. To prepare for full implementation, the PSB has already adopted all applicable Office of the Director of National Intelligence policies, procedures, and controls. The TW Program is designed to provide a continuous vetting environment that allows the PSB to track any risks to personnel security in real time. The PSB's most significant remaining challenge is ensuring that there is sufficient capacity to meet the full TW 2.0 continuous vetting requirements by the March 30, 2026 milestone. As of October 2023, the PSB had eight staff to implement the TW 1.5 requirements to provide continuous vetting services for the approximately 1,100 EPA employees classified as the Agency's national security population. Full TW2.0 implementation will require continuous vetting services for the entire population of EPA employees and applicable contractor personnel—nearly 22,000 individuals, or 20 times the number vetted for TW 1.5. In addition, the PSB must also significantly increase the level of continuous vetting services it provides from TW 1.5 to TW 2.0 in 18 months. This rapid increase in workload, both in population served and services provided, will require sufficient implementation capacity, including more PSB staff who are appropriately trained to conduct continuous vetting tasks in a timely manner. If the PSB plans now for its additional resource needs, it will prevent delays in full TW 2.0 implementation, reduce national security risks, and ensure a fair and effective personnel security program. If the EPA does not adequately plan to increase the PSB's capacity to respond to a 20-fold increase in employees receiving continuous vetting services, delays in processing and managing full TW 2.0 implementation may increase the risk to national security from insider threats. Recommendation and Planned Agency Corrective Action We recommend that the assistant administrator for Mission Support develop a plan for how the PSB will achieve the capacity necessary to meet the requirements of full TW 2.0 implementation. The Agency agreed with our recommendation and provided an acceptable planned corrective action and estimated milestone date. We consider the recommendation resolved with the corrective action pending. Address inquiries to our public affairs office at (202) 566-2391 or OIG.PublicAffairs@epa.gov. List of OIG reports. ------- U.S. ENVIRONMENTAL PROTECTION AGENCY OFFICE OF INSPECTOR GENERAL February 8, 2024 MEMORANDUM SUBJECT: The EPA's Enhanced Personnel Security Program Is on Track, but Challenges to Full Implementation Remain Report No. 24-E-0020 This is our report on the subject evaluation conducted by the U.S. Environmental Protection Agency Office of Inspector General. The project number for this evaluation was QSRE-FY23-0076. This report contains findings that describe the problems the OIG has identified and corrective actions the OIG recommends. Final determinations on matters in this report will be made by EPA managers in accordance with established audit resolution procedures. The Office of Mission Support has the primary responsibility for the issues discussed in this report. In accordance with EPA Manual 2750, your office provided a planned corrective action and acceptable milestone date in response to the OIG's recommendation. The recommendation is resolved, and no final response to this report is required. If you submit a response, however, it will be posted on the OIG's website, along with our memorandum commenting on your response. Your response should be provided as an Adobe PDF file that complies with the accessibility requirements of section 508 of the Rehabilitation Act of 1973, as amended. The final response should not contain data that you do not want to be released to the public; if your response contains such data, you should identify the data for redaction or removal along with corresponding justification. We will post this report to our website at www.epaoig.gov. FROM: Sean W. O'Donnell, Inspector General ' fm j TO: Kimberly Patrick, Principal Deputy Assistant Administrator Office of Mission Support To report potential fraud, waste, abuse, misconduct, or mismanagement, contact the OIG Hotline at (888) 546-8740 or OIG.Hotline@epa.gov. ------- Table of Contents Purpose 1 Background 1 Trusted Workforce 2.0 Initiative 2 Continuous Vetting Process at the EPA 5 Defining Fair and Effective Personnel Vetting Outcomes 5 Responsible Offices 6 Scope and Methodology 6 Prior Reports 7 Results 7 The PSB Successfully Met TW 1.25 and 1.5 Milestones and Is on Track to Meet TW 2.0 Requirements 7 The PSB Must Increase Its Implementation Capacity to Mitigate Risk of Processing Delays 9 Recommendation 11 Agency Response and OIG Assessment 11 Status of Recommendation 12 A Agency's Response to the Draft Report 13 B Distribution 16 24-E-0020 i ------- Purpose The U.S. Environmental Protection Agency Office of Inspector General initiated this evaluation to determine the EPA's progress in implementing a fair and effective enhanced personnel security program in accordance with the director of National Intelligence's performance standards. Top Management Challenge Addressed This evaluation addresses the following top management challenge for the Agency, as identified in OIG Report No. 24-N-0008. The EPA's Fiscal Year 2024 Top Management Challenges, issued November 15, 2023: • Managing grants, contracts, and data systems. Background Certain EPA positions require security clearances, which are granted on an individual and need-to-know basis, to enable access to classified national security information and secure facilities. To receive a security clearance, an employee undergoes a background investigation. Prior to recent background investigation reform efforts, which began in 2008 and is detailed in the next paragraph, the federal government required periodic reinvestigations every five to ten years to reassess an employee's suitability or fitness to retain access to classified information. If any security risks or behaviors were discovered during reinvestigation, they were adjudicated to determine the employee's continued eligibility to remain in the position. However, because periodic reinvestigations were infrequent, ongoing employee actions were not assessed in real time for behaviors that may have indicated the existence of an insider threat. Additionally, the security clearance process is lengthy. In fiscal year 2022, it generally took at least two-and-a-half months and as long as six-and-a-half months to complete the process, depending on the type of clearance. Long processing times increase national security risks, prevent personnel from beginning work, hinder the hiring of experienced and the best-qualified personnel, and increase costs to the federal government. Key Terminology • An insider threat is defined as the threat that an employee or a contractor will use authorized access, wittingly or unwittingly, to do harm to the security of the United States. • Adjudication is an evaluation of the information contained in the national security background investigations and other source documents. This evaluation determines an individual's initial or continued national security eligibility. To address these limitations, the federal government began overhauling personnel security clearance processes in the early 2000s. Continuous evaluation and subsequent continuous vetting policies form the cornerstone of these efforts. Authorized and defined by Executive Order 13467 in 2008, continuous evaluation leverages automated record checks to assist in the ongoing assessment of an individual's continued eligibility for access to classified information. Continuous evaluation supplements, but does not replace, periodic reinvestigations. Added to Executive Order 13467 in 2017, continuous vetting 24-E-0020 1 ------- replaces periodic reinvestigations by providing a real-time review of a covered individual's background. The Office of the Director of National Intelligence, or ODNI, describes continuous vetting as an "evolution of the continuous evaluation concept." There are three key mandates of the vetting reforms: • Executive Order 13467, Reforming Processes Related to Suitability for Government Employment, Fitness for Contractor Employees, and Eligibility for Access to Classified National Security Information, as amended: This executive order requires all executive branch agencies, including the EPA, to implement reforms to enhance their personnel security programs. In addition to authorizing the continuous evaluation of covered individuals, meaning employees or contractors eligible to access classified information or hold a sensitive position, the executive order designated the director of National Intelligence and the director of the Office of Personnel Management as the Executive Agents responsible for developing policies and procedures for personnel vetting reform. The executive order also established a Security, Suitability, and Credentialing Performance Accountability Council, directed by the Executive Agents and which we refer to hereafter as the Performance Accountability Council, to drive implementation of personnel security reform, ensure accountability of agencies, and establish annual goals and progress metrics. • Intelligence Authorization Act for Fiscal Year 2016 (Pub. L. 114-113, codified at 5 U.S.C. § 11001): This Act required the director of National Intelligence to direct each agency to implement a program to provide enhanced personnel security reviews of covered individuals. The program was to include automated record checks for each covered individual not less than two times every five years. • Security Executive Agent Directive 6: The ODNI established a series of directives to guide personnel security reform. On January 12, 2018, the ODNI issued Security Executive Agency Directive 6, which instructed all executive branch agencies to implement the continuous evaluation of covered individuals and which outlined the agencies' responsibilities to achieve the successful implementation of that directive. Trusted Workforce 2.0 Initiative To meet the continuous evaluation requirements of Executive Order 13467, as amended, and to revise the federal personnel vetting process, the Performance Accountability Council launched the Trusted Workforce 2.0, or TW 2.0, Program in 2018. TW 2.0 is being implemented in two phases. Phase one, which has been completed, focused on reducing and removing the backlog of periodic reinvestigations. Phase two, which is ongoing, focuses on establishing a new governmentwide approach to personnel vetting. Phase two involves a multistep implementation process that progresses from TW 1.25 to TW 1.5 and finally to TW 2.0, with continuous vetting requirements gradually increasing through the steps. For example, TW 1.5 requires automated record checks for just the national security population, while the fully implemented TW 2.0 requires that the entire workforce be enrolled in the program for continuous vetting. Agencies were required to meet the TW 1.25 milestones by September 30, 2021, and 24-E-0020 2 ------- TW 1.5 milestones by September 30, 2022.1 In June 2023, the Performance Accountability Council extended the milestone for full TW 2.0 implementation, originally scheduled for the end of fiscal year 2024, to March 30, 2026. The Performance Accountability Council has issued policies and guidance governing phase two of TW 2.0 Program implementation, including Transforming Federal Personnel Vetting: Continuous Vetting and Other Measures to Expedite Reform and Transition to Trusted Workforce 2.0, published in January 2021, and Trusted Workforce 2.0 Implementation Strategy Endorsement, originally published in April 2022 and routinely updated. A key component of TW 2.0 includes incorporating automated record checks into the continuous vetting processes. Automated record checks help ensure the continued eligibility of each covered individual to access classified information and hold a sensitive position by continuously identifying security risks related to seven categories: • Terrorism, such as cases that are flagged for additional research in the ODNI's Terrorist Identities Datamart Environment system, the U.S. government's central database on known or suspected international terrorists. • Foreign travel, including the U.S. Department of Homeland Security's advanced passenger information system and border crossing information, which provide international-travel-related information for personnel, such as airport codes and dates of travel. • Financial activity, such as an unusual infusion of assets of $10,000 or more; the failure to pay taxes; and bankruptcy claims from courts and the Internal Revenue Service. • Criminal activity, such as daily criminal record checks and monthly checks of the U.S. Treasury's Financial Crimes Enforcement Network. • Personal credit, including annual credit checks and credit history information. • Public records, including quarterly public record checks via commercial databases that provide these types of services. • Employment eligibility, such as validation checks for eligibility for enrollment in continuous evaluation through the Scattered Castles intelligence community personnel security database.2 These automated record checks are conducted by the U.S. Department of Defense through its Defense Counterintelligence and Security Agency, or DCSA. The DCSA conducts nearly all security background investigations provided for the federal workforce. The DCSA also provides personnel vetting services 1 TW 1.25 was not required for agencies that were able to meet the TW 1.5 minimum standards following the publication of the Performance Accountability Council's Executive Agents' Transforming Federal Personnel Vetting: Continuous Vetting and Other Measures to Expedite Reform and Transition to Trusted Workforce 2.0. 2 Scattered Castles is an intelligence community database that verifies personnel security access and visit certifications. Intelligence Community Policy Guidance 704.5 Intelligence Community Personnel Security Database Scattered Castles, dated October 2008, mandates the recognition, use, and reciprocity of Scattered Castles across all components of the intelligence community. 24-E-0020 3 ------- through its information technology system, the National Background Investigative Services. Once fully deployed, that system will include a range of tools and data repositories to support agencies through aii stages of personnel vetting, including continuous vetting. In July 2023, the EPA's Personnel Security Branch, commonly referred to as the PSB, informed us that the National Background Investigative Services are not fully operational, and not ail systems and software applications are consistently available to input new data or generate continuous vetting reports. However, if the record checks identify any security risks, the DCSA assesses the alert validity and the need for further investigation. Another key component of TW 2.0 is a streamlined set of investigative tier categories. A tier is a general grouping that refers to a position's sensitivity and risk. Sensitivity involves the position's potential impact on the national security of the United States, and risk involves the position's potential to damage the public's trust in the federal government. As shown in Figure 1, the previous personnel security standards had five investigative tiers, but the new continuous vetting process under TW 2.0 will have three tiers: low, moderate, and high. When the TW 2.0 Program is fully operational, the EPA must provide TW 2.0-level vetting services to the Agency's entire national security and non-sensitive public trust populations, as well as TW 1,25-level vetting services to its entire low-risk population. Figure 1: Comparison of current investigative tiers and TW 2.0 investigative tiers The Federal Personnel Vetting Investigative Standards: Then and Now Current Investigative Position Designations bvTier Tiers low Risk . Non-Sensitive ,er Physical and Logical Access (H5PD-12) Credentialing Tier 2 Moderate Risk Public Trust Tier 3 Non-critical sensitive Secret/Confidential "I"Access Tier 4 High Risk Public Trust Tier 5 Critical Sensitive Special Sensitive Top Secret Sensitive Compartmented information "Q" Access TW 2. Investigative Tiers Position Designations by Tier Low Tier Low Risk Non-Sensitive Physical and Logical Access (HSPD-12) C red entia ling Moderate Tier Moderate Risk public trust Non-critical sensitive Secret/Conf id e ntia 1 "L" Access High Tier High Risk public trust Critical Sensitive Special Sensitive Top Secret Sensitive Compartmented Information "Q" Access Note: "HSPD-12" is the personal identity verification card mandated by Homeland Security Presidential Directive 12. "'L' Access" corresponds to Confidential and Secret National Security Information access clearances at the U.S. Department of Energy. "'Q' Access" corresponds to Top-Secret National Security Information access clearance at the Department of Energy, Source: Transforming Federal Personnel Vetting. (DCSA Center for Development of Security Excellence image) 24-E-0020 4 ------- Continuous Vetting Process at the EPA Like it is for ail nondefense agencies, the EPA's continuous vetting process is facilitated by the data that the DCSA collects and reports. As shown in Figure 2, the EPA's process involves continuous review of data related to the seven types of automated record check areas, with reports being generated by the DCSA if any data meet the designated alert criteria. If a report is generated, the adjudication process falls within the EPA's area of responsibility. The PSB conducts personnel vetting for the EPA, and Agency procedure requires that reports must be logged and, if necessary, adjudication must begin within five business days. Figure 2: Scope of the EPA's continuous vetting efforts Note: Overlay of dotted blue line identifies the EPA's TW 2.0 Program implementation responsibilities. Source: The DCSA. (DCSA image. Dotted line added by the EPAOIG.) The EPA's TW 2.0 Program responsibilities begin once an alert is generated by the DCSA's continuous vetting system, and the subsequent report is provided to the PSB, Likewise, EPA employees are required to alert the PSB about changes or incidents that may impact their clearances. In either situation, the PSB's responsibility is to verify any alert and then, based on the employee's security status, adjudicate whether that alert increases risks sufficiently to require revocation of that security status. Defining Fair and Effective Personnel Vetting Outcomes Using the policies outlined in the Federal Personnel Vetting Core Doctrine,3 the Performance Accountability Council's Executive Agents designed the ODNI's personnel security policies to achieve fair and effective outcomes. The Executive Agents published the Federal Personnel Vetting Performance Management Standards in September 2022, which defined fairness and effectiveness in the context of personnel vetting programs. Specifically, the performance standards establish performance metrics for agencies to assess the efficiency, effectiveness, and risk of their personnel security programs and policies. The performance standards also require agencies to develop quality management programs to ensure 3 Federal Personnel Vetting Core Doctrine, 86 Fed, Reg. 2705 (Jan. 13, 2021). 24-E-0020 5 ------- the fair implementation of their personnel security programs. Until implementation guidance is published by the Executive Agents, however, agencies are not required to implement the performance standards. Without the benefit of this guidance and for the purposes of our objective, we assessed fairness and effectiveness as the extent to which the PSB is on track to achieve full implementation of TW 2.0 by established milestones and is compliant with the ODNI's TW 2.0 policies and guidance. The performance standards define fairness in the context of a quality assurance programs: Fairness: Ensure all personnel vetting processes and procedures comply with applicable laws, Executive Orders, and policy regarding the collection, use, retention, and dissemination of protected information. The performance standards define effectiveness in the context of performance metrics: Effectiveness: Performance metrics that reflect whether an activity is achieving the intended result and whether the activity is aligned with intent of Federal personnel vetting policy. These metrics support achieving quality and desired outcomes. Responsible Offices The EPA's PSB conducts personnel vetting for the EPA and is responsible for implementing the TW 2.0 Program. The PSB is housed in the Labor, Suitability, and Conduct Division in the EPA Office of Mission Support's Office of Human Capital Operations. The PSB determines whether to initially grant a security clearance to EPA personnel based on information gathered and verified in the initial background investigation, and it reviews and adjudicates security risks that may arise from the data that it receives from the continuous vetting process. The fiscal year 2023 budget for the PSB was approximately $3.4 million, which was 0.03 percent of the EPA's total fiscal year 2023 budget of $10.14 billion. Scope and Methodology We conducted this evaluation from May to November 2023 in accordance with the Quality Standards for Inspection and Evaluation published in December 2020 by the Council of the Inspectors General on Integrity and Efficiency. Those standards require that we perform the evaluation to obtain sufficient and appropriate evidence to support our findings. We reviewed applicable law, policy, and other criteria documents related to the program. We reviewed the status of the PSB's TW implementation efforts as of October 2023. This included verifying that the PSB submitted required reports to the Performance Accountability Council's chair and interviewing PSB personnel to determine whether the Agency met the Performance Accountability Council's TW 1.25 and 1.5 milestones. We also assessed whether the Agency continued to meet ongoing milestones provided in the quarterly policy updates published by the Performance Accountability Council. We reviewed procedures adopted by the PSB and collected the necessary documentation and reports to verify the program's implementation progress. As previously stated in this report, given that the Executive Agents 24-E-0020 6 ------- have designed the personnel security program policies and procedures to be fair and effective, but that the Executive Agents have not yet published all the required implementation guidance, we assessed fairness and effectiveness as the extent to which the PSB has achieved TW 1.25 and TW 1.5 milestones and is on track to achieve full implementation of TW 2.0 by the established milestones. Prior Reports Prior to the issuance of this report, we had not reviewed the PSB's TW 2.0 Program implementation status. The U.S. Government Accountability Office has issued reports on the governmentwide development and implementation of theTW Program, including: • Personnel Vetting: Actions Needed to Implement Reforms, Address Challenges, and Improve Planning, GAQ-22-104093, which determined that the Performance Accountability Council has made progress in implementing TW 2.0. The report further stated that the Performance Accountability Council principals reduced a backlog of investigations, began to develop a policy framework for a new approach to personnel vetting, and began to develop needed information technology systems. • Personnel Vetting: DOD Needs a Reliable Schedule and Cost Estimate for the National Background Investigation Services Program, GAQ-23-105670, which found that the lack of a reliable schedule for implementing the National Background Investigative Services could cause delays and which recommended that Congress should consider requiring the Department of Defense to develop a reliable National Background Investigative Services program schedule and cost estimate based on the Government Accountability Office's best practices. Results The PSB met all TW 1.25 and TW 1.5 milestones to fairly and effectively implement the EPA's enhanced personnel security program in accordance with the ODNI's performance standards. In addition, as of October 2023, the PSB was meeting all TW 2.0 implementation milestones identified by the Performance Accountability Council's policies and guidance and was on track to meet the full TW 2.0 implementation milestone of March 30, 2026. At the time of our review, the PSB had eight staff to implement the TW 1.5 requirements, which provide for continuous vetting services for the EPA's approximately 1,100 national security population. As additional TW 2.0 implementation requirements come into effect, which will require the PSB to expand its services to continuously vet the Agency's entire population of nearly 22,000 employees, the EPA will need to proportionally increase the PSB's implementation capacity. Without adequate implementation capacity, the PSB may not be able to adjudicate continuous vetting alerts effectively or in a timely manner, putting national security at risk to insider threats. The PSB Successfully Met TW 1.25 and 1.5 Milestones and Is on Track to Meet TW 2.0 Requirements The PSB met all TW 1.25 and TW 1.5 milestones to fairly and effectively implement the enhanced personnel security program in accordance with the ODNI's performance standards. The Executive 24-E-0020 7 ------- Agents required that agencies develop TW implementation plans, report on enrollment metrics for TW transitional steps, certify their compliance with minimum standards, and meet enrollment milestones. As evidence that it successfully met these requirements, the PSB provided us with its TW implementation plan, its correspondence to the ODNI containing quarterly reports of its enrollment metrics, and the self-certification of its compliance with TW 1.25 and TW 1.5 minimum standards and enrollment milestones. Additionally, on October 17, 2022, the ODNI concurred with the PSB's self-certification and issued a memorandum affirming that the Agency met the minimum standards for TW 1.5. Table 1 lists the key TW implementation milestones and shows the EPA's progress in meeting those milestones. Table 1: Key TW milestones and EPA implementation analysis TW phase Milestone date Milestone Source EPA progress TW 1.25 & TW 1.5 2/15/21 Establish an enrollment plan that reflects efforts to fully enroll national security population. Transforming Federal Personnel Vetting Met Milestone TW 1.25 & TW 1.5 3/31/21 Enroll all Tier 3 and Tier 5 individuals whose periodic reinvestigations are currently deferred in a TW 1.25 or TW 1.5 capability. Transforming Federal Personnel Vetting Met Milestone TW 1.25 & TW 1.5 6/30/21, quarterly thereafter Submit a quarterly report on TW enrollment and continuous vetting alert management metrics. Transforming Federal Personnel Vetting Met Milestone TW 1.25 9/30/21 Enroll the full national security population at a minimum in a TW 1.25 capability. Transforming Federal Personnel Vetting Met Milestone ~ TW 2.0 6/12/22 Submit an initial report on the TW 2.0 implementation plan. Trusted Workforce 2.0 Implementation Strategy Endorsement Met Milestone ~ TW 1.5 9/30/22 Enroll the full national security population in the TW 1.5 capability. Transforming Federal Personnel Vetting Met Milestone TW 2.0 The DCSA will have phased enrollment and will notify agencies of start date. Identify and achieve preconditions for enrolling non-sensitive public trust positions. Trusted Workforce 2.0 Implementation Strategy (September 2023) Met Milestone S TW 2.0 7/31/23* Submit the 2023 TW 2.0 Implementation Report. Trusted Workforce 2.0 Implementation Strategy (June 2023) Met Milestone ~ TW 2.0 9/30/23 Work with the DCSA to complete enrollment of individuals in the Record of Arrest and Prosecution Back system using existing fingerprints maintained by the DCSA from 2010 to present. Trusted Workforce 2.0 Implementation Strategy (September 2023) Met Milestone TW 2.0 9/30/23* Transition to full adoption of eApplication. Trusted Workforce 2.0 Implementation Strategy (June 2023) Met Milestone ~ 24-E-0020 8 ------- TW phase Milestone date Milestone Source EPA progress TW 2.0 9/30/24* Modify internal policies and procedures to align with new investigative tiers. Trusted Workforce 2.0 Implementation Strategy (June 2023) Pending TW 2.0 9/30/25 Enroll 100 percent of national security sensitive population and 100 percent of non-sensitive public trust population in TW2.0 continuous vetting. Trusted Workforce 2.0 Implementation Strategy (June 2023) Pending TW 2.0 3/30/26 Enroll 100 percent of low-risk population in continuous vetting. Trusted Workforce 2.0 Implementation Strategy (June 2023) Pending Source: OIG analysis of the EPA's progress in meeting TW implementation milestones. (EPA OIG table) * These dates were identified in the June 2023 strategy update only by month and year, such as "May 2023." We interpret those milestone dates as the last day of the month. As of October 2023, the PSB was on track to meet the final TW 2.0 implementation requirements by the March 30, 2026 milestone issued by the Performance Accountability Council. The PSB had already adopted the applicable ODNI policies, procedures, and managerial processes necessary to fully implement the TW 2.0 requirements. In addition, the PSB was meeting the interim milestone requirements outlined in the quarterly updates to the Trusted Workforce 2.0 Implementation Strategy, including the milestones provided in the September 2023 update. For example, the PSB stated that it completed the transition to using eApplication, an automated system for initial background checks of new employees. However, the PSB informed us that the eApplication software system can be unstable so when processing issues occur, the PSB must revert to using the Electronic Questionnaires for Investigations Processing system, the legacy automated application program. The PSB also informed us that, while it completed transferring the necessary data to fully enroll the applicable employee populations into the Record of Arrest and Prosecution Back system to the DCSA as of September 28, 2023, the DCSA was experiencing delays in fully processing and uploading the data to the National Background Investigative Services system. While continuous vetting for the EPA's non-sensitive public trust and low-risk populations is not required until September 30, 2025, and March 30, 2026, respectively, the PSB plans to manage the continuous vetting needs for these non-national security populations the same way as it does for the Agency's national security population. Providing this level of service, however, will not be possible if the required system tools are unstable or are not fully available for agencies to use by those key milestone dates. The PSB Must Increase Its Implementation Capacity to Mitigate Risk of Processing Delays As of October 2023, the PSB had eight employees who are appropriately trained to adjudicate continuous vetting alerts in a timely manner. The PSB's workload is expected to significantly increase as TW 2.0 becomes fully implemented due, in part, to the large volume of personnel data that must undergo adjudication within five business days, as required by EPA procedure. 24-E-0020 9 ------- On September 30, 2022, the PSB team began operating under TW 1.5 requirements to provide continuous vetting services for the EPA's approximately 1,100 national security population employees. When TW 2.0 is fully implemented, the PSB will also be responsible for providing some level of continuous vetting for 100 percent of all EPA staff, including employees occupying non-sensitive public trust and low-risk positions. To put this in perspective, on August 25, 2023, the PSB stated that there were 16,429 employees occupying non-sensitive public trust positions and 4,270 employees occupying low-risk positions. This means that, if full TW 2.0 implementation would take effect immediately, the PSB would have to provide continuous vetting services for 21,799 individuals—a 20-fold increase from TW 1.5 requirements. As shown in Figure 3, the EPA's most significant continuous-vetting population increase occurs from September 30, 2022, through September 30, 2024, at which time the PSB must be providing TW 1.5-level vetting services to the 1,100 national security employees, as well as have enrolled and be providing TW 1.25-level vetting services to all 16,429 non-sensitive public trust employees. However, in 18 months, from September 30, 2024, to March 30, 2026, the EPA must also significantly increase the level of continuous vetting services it provides. Specifically, by September 30, 2025, the PSB must be providing the full TW 2.0-level vetting services to all 17,529 national security and non-sensitive public trust employees, in addition to enrolling 50 percent of the low-risk employees in TW 1.25-level vetting services. When the TW 2.0 Program is fully operational on March 30, 2026, the PSB must have enrolled the remaining 50 percent of low-risk employees in TW 1.25-level vetting services. Figure 3: The EPA's anticipated continuous vetting population growth by milestone date 25,000 ¦z. O < 20,000 3 Q. 0 Q. « 15,000 k i— LU > w 10,000 < _l 3 1 5,000 o TW 2.0 MILESTONE DATES Source: Anticipated TW 2.0 enrollment milestones, based on EPA employee data provided by the PSB on August 25, 2023. (EPAOIG image) Type of Continous Vetting Services Required TW 1.25 ¦ TW 1.5 ¦ TW 2.0 Solid green line shows trend line of entire population requiring continuous vetting services. 9/30/22 9/30/24 9/30/25 3/30/26 24-E-0020 10 ------- These service population increases mean that the PSB will need to have sufficient resources, including any additional staff and equipment, in place to enroll and begin providing continuous vetting services for each of the implementation phases. As final TW 2.0 implementation is achieved, the Agency must expand its continuous vetting capacity to keep pace with both the increasing numbers of employees enrolled for continuous vetting services, and the level of services provided to those employees. The most significant challenge to the PSB achieving full TW 2.0 implementation is developing sufficient capacity to effectively implement all the TW 2.0 requirements once they come into effect. While the largest number of enrollments into the system must occur by the September 30, 2024 milestone, the increase in required service levels between September 30, 2024 and the final March 30, 2026 milestone will likely cause the most significant need for additional staff effort and resources. The PSB informed us that, between October 2022 and July 2023, it had adjudicated roughly 3,000 self-reported alerts for the national security population of nearly 1,100 employees. If that number of continuous vetting alerts is consistent for all employees, the PSB would need to address and adjudicate as many as 60,000 continuous vetting alerts per year after full TW 2.0 implementation. The PSB team said that additional alerts from a larger population would exponentially increase their workload. Without sufficient capacity to respond to the increase in enrolled populations and, subsequently, the expected increase in adjudication services needed, the PSB could experience delays in processing and managing full TW 2.0 implementation, which may increase the risks to national security from insider threats. Recommendation We recommend that the assistant administrator for Mission Support: 1. Develop a plan for how the Personnel Security Branch will achieve the capacity necessary to meet the requirements of full Trusted Workforce 2.0 implementation. Agency Response and OIG Assessment The Office of Mission Support agreed with our recommendation and described its planned corrective action to develop a plan and associated guidance documents to meet full TW 2.0 requirements. The Agency's response noted, however, that its capability to achieve capacity for "TW 2.0 success is dependent on various capabilities to which other government agencies, namely the Defense Counterintelligence and Security Agency, have not released for use currently." Based on this information, and as the Agency awaits the final updated Trusted Workforce 2.0 Implementation Strategy, the EPA provided an acceptable planned corrective action and estimated milestone date. We consider the recommendation resolved with corrective action pending. Appendix A contains the Agency's response to the draft report. 24-E-0020 11 ------- Status of Recommendation Planned Rec. Page Completion No. No. Recommendation Status* Action Official Date 1 11 Develop a plan for how the Personnel Security Branch will R Assistant Administrator for 3/30/25 achieve the capacity necessary to meet the requirements of full Mission Support Trusted Workforce 2.0 implementation. * C = Corrective action completed. R = Recommendation resolved with corrective action pending. U = Recommendation unresolved with resolution efforts in progress. 24-E-0020 ------- Appendix A Agency's Response to the Draft Report ^tosx i£¦ \ \WU ,-v PRO^4, OFFICE OF MISSION SUPPORT WASHINGTON, D.C. 20460 MEMORANDUM SUBJECT: Response to Office of Inspector General Draft Report No. OSRE-FY23-0076, "The EPA's Enhanced Personnel Security Program Is on Track, but Challenges to Full Implementation RemainProject No. OSRE-FY23-0076 dated December IS, 2023. FROM: KimberlyY. Patrick, Principal Deputy Assistant Administrator KIMBERLY kimeerlypatrick PATpipLf Date: 2024.01.18 I r\.IVjr\ 14:49:04 -05'OJ TO: Lauretta Joseph, Director Programs, Offices, and Centers Oversight Office of Special Review and Evaluation Thank you for the opportunity to respond to the issues and recommendation in the subject evaluation draft report. Following in a summary of the agency's overall positions, along with its position on the report's recommendation. The Office of Mission Support agrees with the recommendation outlined in the Office of Inspector General's Draft Report and has developed one corrective action to address it. AGENCY'S OVERALL POSITION The agency agrees with the recommendation and will develop a plan in accordance with timely Trusted Workforce 2.0 Implementation Strategy documents and associated guidance. The agency has faced challenges with implementing Trusted Workforce 2.0 (TW 2.0) requirements given that the government-wide objectives and metrics have shifted repeatedly since 2018. The Performance Accountability Council (PAC) introduced TW 2.0 in 2018 and initially targeted full TW 2.0 implementation by end of Fiscal Year 2024. In June 2023, the PAC extended the full TW 2.0 implementation date to March 30, 2026 via the June 2023 Trusted Workforce Implementation Strategy. Since the June 2023 Trusted Workforce Implementation Strategy, the PAC issued the September 2023 Trusted Workforce 2.0 Implementation Strategy which provided 24-E-0020 13 ------- updated milestone objectives related to successful implementation of TW 2.0. The agency routinely receives updated quarterly Trusted Workforce 2.0 Implementation Strategy documents which update milestone objectives. A commonality within the quarterly updates is the statement of, "Updated milestone dates with greater precision and marked completed tasks," with the reason of, "To better enable implementation planning and reflect progress." As notated within OIG's draft report "The EPA's Enhanced Personnel Security Program Is on Track, but Challenges to Full Implementation Remain," the Defense Counterintelligence and Security Agency (DCSA) is the agency's investigative service provider and is providing personnel vetting services through the National Background Investigative Services (NBIS) system. DCSA's NBIS system is not fully operational and the capability to enroll public trust personnel within continuous vetting has not been released for agency use. NBIS's capabilities not being fully deployed hinders the agency's ability to meet the milestone objective of "begin enrolling non- sensitive public trust population into TW 1.25" by the target date of October 2023, as the capability has not been released for the agency's use. The agency is operating at a disadvantage due the NBIS's delayed deployment of capabilities necessary to enroll the non- sensitive public trust population into continuous vetting. EPA's capability to develop a plan to achieve capacity to meet Trusted Workforce 2.0 requirements (pursuant to OIG's recommendation) is contingent on PAC's and DCSA's final implementation requirements. Due to continuously changing and quarterly updated milestones within Trusted Workforce 2.0 Implementation Strategy documents and unreleased NBIS system capabilities, the agency will continue to assess Trusted Workforce 2.0 (TW 2.0) requirements and NBIS developments to plan accordingly to meet milestone objectives. TW 2.0 success is dependent on various capabilities to which other government agencies, namely the Defense Counterintelligence and Security Agency, have not released for use currently. The agency is expecting an updated Trusted Workforce 2.0 Implementation Strategy that will adjust milestone objectives consistent to the various updated Trusted Workforce 2.0 Implementation Strategy the agency has received since the initiation of TW 2.0. AGENCY'S RESPONSE TO REPORT RECOMMENDATIONS Agreements No. Recommendation High-Level Intended Corrective Action(s) Estimated Completion by Quarter and FY 1 Develop a plan for how the Personnel Security Branch will achieve the capacity necessary to meet the requirements of full Trusted Workforce 2.0 Implementation Agency will develop a plan relative to updated Trusted Workforce 2.0 Implementation Strategy and associated guidance documents. March 30, 2025 24-E-0020 14 ------- CONTACT INFORMATION If you have any questions regarding the response, please contact Afreeka Wilson, Audit Follow- up Coordinator, Office of Resources and Business Operations, (202) 564-0867 or wilson.afreeka@epa.gov. Attachments: cc: Gabby Fekete Valerie Madas Gaida Mahgoub Thane Thompson Helena Wooden-Aguilar Krysti Wells Jeremy Taylor Kathryn Smith John J. Goldsby Yulia Kalikhman Gregory Scott Janice Jablonski Marilyn Armstrong Afreeka Wilson Darryl Perez Susan Perkins Andrew LeBlanc Jose Kercado-Deleon 24-E-0020 15 ------- Appendix B Distribution The Administrator Deputy Administrator Chief of Staff, Office of the Administrator Deputy Chief of Staff for Management, Office of the Administrator Agency Follow-Up Official (the CFO) Assistant Administrator for Mission Support Agency Follow-Up Coordinator General Counsel Associate Administrator for Congressional and Intergovernmental Relations Associate Administrator for Public Affairs Principal Deputy Assistant Administrator for Mission Support Chief Information Officer and Deputy Assistant Administrator for Information Technology and Information Management, Office of Mission Support Deputy Assistant Administrator for Workforce Solutions and Inclusive Excellence, Office of Mission Support Deputy Assistant Administrator for Infrastructure and Extramural Resources, Office of Mission Support Director, Office of Resources and Business Operations, Office of Mission Support Director, Office of Human Capital Operations, Office of Mission Support Director, Office of Continuous Improvement, Office of the Chief Financial Officer Director, Office of Technology Solutions, Office of the Chief Financial Officer Office of Policy OIG Liaison Office of Policy GAO Liaison Audit Follow-Up Coordinator, Office of the Administrator Audit Follow-Up Coordinator, Office of Mission Support Audit Liaison, Office of Technology Solutions, Office of the Chief Financial Officer 24-E-0020 16 ------- Whistleblower Protection U.S. Environmental Protection Agency The whistleblower protection coordinator's role is to educate Agency employees about prohibitions against retaliation for protected disclosures and the rights and remedies against retaliation. For more information, please visit the OIG's whistleblower protection webpage. Contact us: Congressional Inquiries: OIG.CongressionalAffairs(5)epa.gov Media Inquiries: OIG.PublicAffairs@epa.gov EPA OIG Hotline: 01G.Hotline@epa.gov Web: epaoig.gov us: X (formerly Twitter): (5>epaoig Linkedln: linkedin.com/company/epa-oig YouTube: voutube.com/epaoig Instagram: (5>epa.ig,on.ig ------- |