DHS is in only partial compliance Homeland Security Presidential Directive (HSPD) 12, which requires the use of a standard, secure, and reliable form of identification for federal employees and contractors across government, an IG report has found.
While DHS “has an effective process for issuing personal identity verification cards” and those cards meet standards set by the National Institute of Standards and Technology, it “has made limited progress implementing the controls necessary to regulate access to DHS facilities and systems,” the report said.
“At the time of our audit, no DHS component had fully addressed key physical access control requirements, such as inventorying, assigning risk levels, and identifying existing mechanisms for securing owned and leased facilities. This occurred because of insufficient guidance, funding, staffing, and oversight to ensure compliance,” the auditors reported.
Other issues included that the department did not independently verify reports by its components on implementing logical access controls on their unclassified information systems; and that DHS did not ensure termination of the cards for separated contractors who no longer require access.
“As a result of these deficiencies, DHS cannot ensure that only authorized employees have access to its controlled facilities and systems. The potential remains for individuals who misrepresent their identities to circumvent controls, enter DHS buildings and controlled areas, and cause harm to people and assets. The potential also exists for unauthorized access to information systems, which could result in loss, theft, or misuse of sensitive information,” they said.
The report recommended a series of steps to address those issues, to which the department concurred.