An IG audit has called for strengthening GSA’s insider threat program, citing issues that it said “expose GSA information to theft or loss, facilities to damage, and personnel to actual or threatened harm.”
The audit was done to examine GSA’s compliance with a 2011 executive order and 2012 guidance setting standards for insider threat programs.
It found that the program:
* “does not consistently collaborate with other GSA staff offices to gather key threat information proactively and does not communicate insider threat risks and program challenges to the GSA administrator as required,” with no annual report to the agency head since 2016;
* “is unaware of and does not monitor insider threat risks from employees who receive termination proposals but retain access to GSA systems and facilities,” citing cases including charges of making threats against supervisors and co-workers, false claims and altering of documents; and
* “does not effectively monitor insider threat risks related to separated and terminated employees” who may pose a heightened risk because the agency does not consistently deactivate their access accounts and recover and destroy their personal identity verification cards within the required time frames.
It said GSA management agreed with its recommendations.