DHS Did Not Always
Promptly Revoke
PIV Card Access andWithdraw Security
Clearances for
Separated Individuals

December 20, 2022
OIG-23-04

DHS OIG HIGHLIGHTSDHS Did Not Always Promptly Revoke PIV Card
Access and Withdraw Security Clearances for
Separated Individuals
December 20, 2022

Why We Did
This Audit
DHS uses PIV cards andsecurity clearances tocontrol access to its
systems and facilities.
Our objective was todetermine whether DHS
terminated PIV card
access and security
clearances for separated
employees andcontractors in accordancewith Federal regulations
and Department policies.

What We
Recommend

What We FoundThe Department of Homeland Security did not always
terminate personal identity verification (PIV) card
access or withdraw security clearances for separated
employees and contractors in accordance with Federal
regulations and Department policies. In 2018, we
identified weaknesses in DHS’ controls over PIV card
collection, revocation, destruction, and management
oversight. Many of the issues we previously reported
remain, and further work is required to improve andenhance processes. Specifically, DHS has notprioritized ensuring that PIV cards are terminatedwhen individuals no longer require access.
We determined that, in thousands of cases, DHS did
not promptly revoke PIV card access privileges ordestroy PIV cards of individuals who separated fromthe Department. In addition, DHS did not always
promptly withdraw security clearances of individuals
who separated from DHS. Unfortunately, we could not
determine the exact magnitude of the problem because
records in DHS’ information systems were incomplete.

This report contains six
recommendations aimed
at improving DHS’
controls over separated
individuals’ PIV card
access and security
clearances.

These issues occurred because DHS did not effectively
manage and monitor its electronic systems of record or
ensure DHS officials followed offboarding processes.
Without effective PIV card and security clearance
management and monitoring, DHS cannot ensure only
authorized employees and contractors have access to
its controlled systems and facilities.

For Further Information:

DHS Response

Contact our Office of Public Affairs at(202) 981-6000, or email us at
DHS-OIG.OfficePublicAffairs@oig.dhs.gov.

www.oig.dhs.gov

DHS concurred with all six recommendations. We
consider them open and resolved.

OIG-23-04

OFFICE OF INSPECTOR GENERAL
Department of Homeland Security

BackgroundIn 2004, the President issued Homeland Security Presidential Directive-12(HSPD-12), Policies for a Common Identification Standard for Federal Employees
and Contractors. HSPD-12 requires Federal agencies to enhance security by
issuing a government-wide, secure, and reliable form of identification. 1 To
implement HSPD-12, the National Institute of Standards and Technology (NIST)
established the personal identity verification (PIV) card as the common form ofidentification across the Federal Government. 2 The Department of Homeland
Security issues PIV cards to individuals who need access to networks andinformation systems or physical access to DHS sites and facilities. The
Department considers PIV cards, which can remain active for up to 6 years,
sensitive and high-value items with “grave potential for misuse if lost, stolen, or
compromised.”3
Each PIV card includes a photo of the cardholder and lists the sponsoring
agency, the cardholder’s name, and an expiration date. Each card also has anembedded chip with certificates and keys to verify the authenticity of the card,
which allows cardholders to access secured areas and information systems.
DHS uses the Identity Management System (IDMS) as its system of record to
store information on an individual’s organization, affiliation, credentials, andPIV card history and status. The DHS PCI Operations Plan4 defines roles andresponsibilities related to the PIV card process. The plan requires DHS toprevent separated individuals from continuing to access Department systems
and facilities. When cardholders separate from a DHS position, security
officials must collect, revoke, and destroy their PIV cards. During this process,security officials must also update IDMS to reflect the status of PIV cards andmaintain accountability for their locations.
DHS uses security clearance determinations to grant personnel access to theappropriate levels of information, systems, and facilities they need to performtheir work. DHS refers to this level of access as “need to know.” In accordancewith Part 1400 of Title 5 of the Code of Federal Regulations, all positions mustbe evaluated for a position sensitivity designation commensurate with theposition’s responsibilities and assignments as they relate to the impact on
1 The DHS Office of the Chief Security Officer (OCSO) is responsible for administratively

implementing HSPD-12 requirements, including program planning, operations, business
management, communications, and technical strategy.
2 HSPD-12 requires “the Secretary of Commerce [to] promulgate in accordance with applicablelaw a Federal standard for secure and reliable forms of identification.” NIST is a part of the
Department of Commerce. Federal Information Processing Standard 201-02, Personal Identity
Verification of Federal Employees and Contractors, issued August 2013, was the version in
effect during our audit.
3 DHS Authorized Authoritative Credential Holder Responsibility Agreement, Version 5.1,
December 2021.
4 DHS PCI Operations Plan, Version 5.0, issued December 23, 2016. PCI stands for PIV card
issuer.
www.oig.dhs.gov
2
OIG-23-04

OFFICE OF INSPECTOR GENERAL
Department of Homeland Security

national security. The position description sensitivity level establishes the levelof access necessary for a specific role.
DHS uses the Integrated Security Management System (ISMS) as its system ofrecord to manage and process personnel security–related clearance actions andeligibility for access to information, positions, and assignments. When an
individual separates from a DHS position, 5 responsible DHS officials must
deactivate or administratively withdraw the accompanying security clearance in
ISMS. DHS Instruction 121-01-007-01 6 defines roles and responsibilities
related to the security clearance withdrawal process.
Previously Reported Challenges
In 2018, the DHS Office of Inspector General identified weaknesses in DHS’
controls over PIV card collection, revocation, destruction, and management
oversight.7 In that audit, we determined that unauthorized individuals could
gain access to Department facilities because DHS did not promptly collect, andrevoke separated individuals’ PIV cards. We recommended DHS develop andimplement a process to collect, revoke, and destroy PIV cards for all contractors
who no longer required access to DHS facilities or systems. In response to therecommendation, DHS created the Access Lifecycle Management (ALM) system
to automate, streamline, centralize, and manage identity-based access rights
for DHS employees and contractors.8

Results of Audit
DHS did not always terminate PIV card access and withdraw security
clearances for separated employees and contractors in accordance with Federal
regulations and Department policies. Many of the issues we previously
reported remain unresolved. Specifically, DHS has not prioritized ensuringthat PIV cards are terminated when individuals no longer require access. We
determined that, in thousands of cases, DHS did not promptly revoke PIV card
access privileges or destroy PIV cards of individuals who separated from the
5 An individual may separate because of a failed background check, detail or contract

completion or cancellation, transfer, retirement, resignation, termination, or death, thereby
revoking their “need to know.”
6 DHS Instruction 121-01-007-01, The Department of Homeland Security Personnel Security,
Suitability and Fitness Program, Revision 01, issued August 8, 2016, and updated June 14,
2017.
7 Department-wide Management of the HSPD-12 Program Needs Improvement, OIG-18-51,
February 14, 2018, https://www.oig.dhs.gov/sites/default/files/assets/2018-02/OIG-18-51Feb18.pdf.
8 ALM is currently operational at DHS Headquarters (HQ), the Federal Emergency Management
Agency, and U.S. Immigration and Customs Enforcement. DHS planned to complete
implementation of ALM throughout the Department from fiscal years 2018 through 2021.
However, DHS has not met this milestone.
www.oig.dhs.gov

3

OIG-23-04

OFFICE OF INSPECTOR GENERAL
Department of Homeland Security

Department. In addition, DHS did not always promptly withdraw security
clearances of individuals who separated from DHS. Unfortunately, we could
not determine the exact magnitude of the problem because records in DHS’
information systems were incomplete.
These issues occurred because DHS did not effectively manage and monitor
IDMS and ISMS or ensure DHS officials followed offboarding processes.
Without effective PIV card and security clearance management and monitoring,
DHS cannot ensure only authorized individuals have access to its controlled
electronic systems and facilities.

DHS Did Not Always Revoke Access for Separated Individuals
DHS Did Not Always Revoke PIV Cards
DHS requires that individuals have their access privileges terminated (i.e.,
revoked) immediately after separating from the Department. 9 This is consistent
with Office of Management and Budget (OMB) guidance 10 to revoke PIV cards
within 18 hours of cardholder separation. To ensure access is revoked swiftly,
Federal managers, such as first-line supervisors and contracting officer’s
representatives, must notify system administrators when employees orcontractors no longer require access to DHS information systems. 11
We analyzed DHS data for 137,375 cardholders who separated from DHS fromFY 2018 through FY 2021 and determined that DHS did not always revoke PIV
cards within 18 hours as OMB recommends. According to our analysis, DHS:

revoked 70,065 (51 percent) cards within 18 hours of cardholder
separation;
did not revoke 67,310 (49 percent) cards within 18 hours of cardholder
separation, including 30,536 cards that it revoked late; andmay not have revoked 36,774 cards (DHS officials did not record
revocation dates for these cards in IDMS).

Table 1 summarizes the time it took DHS officials to revoke separated
cardholders’ PIV cards, according to IDMS records.

9 DHS National Security Systems Handbook, Version 2.1, July 26, 2004, Sections 5.2 and4.1.5.2.
10 OMB M-06-06, Sample Privacy Documents for Agency Implementation of HSPD-12, February

17, 2006.
11 DHS PCI Operations Plan, Section 8.6.

www.oig.dhs.gov

4

OIG-23-04

OFFICE OF INSPECTOR GENERAL
Department of Homeland Security

Table 1. DHS PIV Card Revocation from FY 2018 through FY 2021
Number of
Revocation Timeframe
Total
Cards
Revoked within 18 Hours
70,06570,065
Not Revokedwithin 18 Hours

Within 14 Days
Within 60 Days
Within 180 Days
After 180 Days
May Not Have Been Revoked

8,188
7,395
6,078
8,875
36,77467,310Source: DHS OIG analysis of DHS data

The revocation delays occurred because DHS did not have an adequate
mechanism to ensure managers promptly notified security officials whencardholders separated from the Department. Although DHS requires managers
to notify security officials that an individual has separated, managers did notalways adhere to that guidance. In addition, DHS’ guidance does not clearlyspecify when the notification must take place. Specifically, the DHS PCI
Operations Plan requires that PIV cards be revoked within 18 hours after
security officials receive notification of separation. However, the plan does not
specify a timeframe for managers to notify security officials after a cardholder
separates. To compensate for late or absent notifications, some security
officials used an ad hoc process of comparing a 2-week-old National FinanceCenter report to IDMS to determine if employees had separated.
Further, DHS did not have a mechanism to ensure security officials recorded
PIV card revocation dates in IDMS as the DHS PCI Operations Plan requires.
Instead, IDMS allowed users to bypass the revocation date field without
entering a date. Some DHS officials also told us they intentionally did notenter a revocation date after revoking PIV cards because doing so caused
reports to become too large, resulting in IDMS slowing down. 12 For records
missing revocation dates in IDMS, it was impossible for DHS OIG toconclusively determine if DHS officials revoked PIV card access promptly or atall.
We reported on similar findings in a prior audit 13 of the Department’s controls
to restrict access to its systems and data. Specifically, we reported that U.S.
Citizenship and Immigration Services (USCIS) did not consistently manage or
remove access for its personnel once they departed positions within thecomponent.

12 DHS management said that this problem has been resolved.
13 USCIS Should Improve Controls to Restrict Unauthorized Access to Its Systems andInformation, OIG-22-65, September 7, 2022.
www.oig.dhs.gov

5

OIG-23-04

OFFICE OF INSPECTOR GENERAL
Department of Homeland Security

Although DHS officials acknowledged that thousands of PIV cards that shouldhave been revoked were not, they calculated 22,878 PIV cards as opposed tothe 36,774 we identified. According to DHS officials, they were not required to
revoke the remaining 13,896 PIV cards because:

DHS officials revoked the cards before the dates included in our analysis;
the employees transferred within the same component; orthe certificates or the cards had expired.

Additionally, DHS officials said they did not always enforce existing revocation
policy and revoke all PIV cards whether they were collected or not. DHS
officials assured us that although some PIV cards were not revoked, alltokens14 were revoked, preventing access to electronic systems.
DHS Did Not Always Destroy PIV Cards
DHS policy requires that PIV cards be destroyed no later than 90 days after
they are returned to the issuing office and revoked. 15 Security officials mustalso update IDMS to reflect the destruction. 16
We analyzed the 137,375 separated cardholders’ records and determined DHS
did not always destroy PIV cards within 90 days. Of the 137,375 records weanalyzed, DHS:

destroyed 77,677 (56 percent) cards within 90 days of revocation;
did not destroy 59,698 (44 percent) cards within 90 days of revocation,
including 3,622 cards it destroyed late; andmay not have destroyed 56,076 cards (DHS officials did not enter
destruction dates for these cards in IDMS).

Table 2 summarizes the time it took DHS officials to destroy separated
cardholders’ PIV cards, according to IDMS records.

14 A token is like an electronic key imbedded in the PIV card’s chip. It is used to prove an
individual’s identity in conjunction with entering the correct personal identification number.
15 DHS PCI Operations Plan, Section 8.6.2 (referencing DHS/All--026 Personal Identity
Verification Management System Systems of Records, 74 Fed. Reg. 30,301 (June 25, 2009)).
16 DHS PCI Operations Plan, Section 4.4.2.1.

www.oig.dhs.gov

6

OIG-23-04

OFFICE OF INSPECTOR GENERAL
Department of Homeland Security

Table 2. DHS PIV Card Destruction from FY 2018 through FY 2021
Number of
Destruction Timeframe
Total
Cards
Destroyed within 90 Days
77,677
77,677
1,316
Within 180 Days
Not Destroyed within
2,306
59,698After 180 Days
90 Days
56,076
May Not Have Been Destroyed
Source: DHS OIG analysis of DHS data

DHS officials acknowledged that thousands of PIV cards were not destroyed,
but they calculated 39,772 PIV cards rather than the 56,076 that we reported.
DHS could not explain why it destroyed PIV cards late or not at all. Without arecorded destruction date, it is difficult to conclusively establish how many PIV
cards DHS officials destroyed within 90 days as required. Further, we could
not determine the severity of the security risks raised by the PIV cards thatremain unaccounted for.
DHS Did Not Always Withdraw Separated Individuals’ Security Clearances
When a cleared individual separates from a DHS position, DHS officials mustwithdraw the assigned security clearance, update ISMS to reflect the
separation, and terminate DHS’ interest in the individual’s clearance. 17
Although DHS requires DHS officials to withdraw a security clearance as soon
as an individual separates from a position, DHS does not give a specifictimeframe (e.g., number of hours) to do so. For our analysis, we used 1 day as
the baseline.
We analyzed security records from ISMS for 98,234 cleared individuals who
separated from DHS from FY 2018 through FY 2021 and determined DHS did
not always withdraw separated individuals’ security clearances as required.
According to our analysis, DHS:


withdrew 44,580 (45 percent) security clearances within 1 day;did not withdraw 80 (less than 1 percent) security clearances within 1day, which included 11 security clearances it withdrew late and 69
clearances it did not withdraw; andmay not have withdrawn security clearances for 53,574 (54 percent)individuals.

17 DHS Instruction 121-01-007-01, The Department of Homeland Security Personnel Security,
Suitability and Fitness Program, Revision 01, issued August 8, 2016, and updated June 14,2017 (referencing ISMS quick reference guides), and ISMS Quick Guide - Separation Process,March 20, 2014.

www.oig.dhs.gov

7

OIG-23-04

OFFICE OF INSPECTOR GENERAL
Department of Homeland Security

Of the 69 separated individuals whose security clearances DHS did notwithdraw, 5 also had PIV cards that DHS neither revoked nor destroyed. Of
the 53,574 individuals whose security clearance status remained unknown,
1,272 also had PIV cards that DHS did not revoke or destroy.
Table 3 summarizes the time it took DHS officials to withdraw separated
individuals’ security clearances, according to ISMS.
Table 3. DHS Security Clearance Withdrawal from FY 2018 through FY
2021
Number of
Clearance Withdrawal Timeframe
Total
Individuals
Withdrawn within 1 Day
44,58044,580Within 14 Days
6
Within 60 Days
1
Not
80
Withdrawn
Within 180 Days
2
within 1 Day
After 180 Days
2
Clearance Not Withdrawn
69
Unknown Status
53,57453,574
Source: DHS OIG analysis of ISMS data

DHS security officials did not always update ISMS records for security
clearance levels, statuses, and withdrawals, making it impossible to determine
if DHS withdrew security clearances for the 53,574 individuals whose clearance
status remains unknown. DHS officials could not tell us why they did notwithdraw some security clearances or input security clearance withdrawal
dates in ISMS as required when individuals separated. However, DHS officials
explained that some late withdrawals had occurred because managers did notpromptly notify security officials when individuals separated from the
Department. According to DHS officials, it would be possible for DHS to
implement a mechanism to automatically withdraw security clearances in ISMS
and revoke PIV cards in IDMS based on separation. However, DHS would haveto implement other policies and processes to handle PIV card revocations forother reasons.
Overall, the issues we found with revoking and destroying PIV cards andwithdrawing security clearances occurred because DHS did not effectively
manage and monitor IDMS and ISMS or ensure DHS officials followed
offboarding processes. Without effective PIV card and security clearance
management and monitoring, DHS cannot ensure only authorized individuals
have access to its controlled systems and facilities. As a result, there is a riskthat individuals who no longer require access to systems and facilities could
circumvent controls and enter DHS buildings and controlled areas.
www.oig.dhs.gov

8

OIG-23-04

OFFICE OF INSPECTOR GENERAL
Department of Homeland Security

Recommendations
Recommendation 1: We recommend that the DHS Chief Security Officer
clarify policies and procedures to require managers to notify security officials to
revoke personal identity verification cards and withdraw security clearances
within a specific timeframe after individuals separate from DHS.
Recommendation 2: We recommend that the DHS Chief Security Officer
strengthen internal processes to ensure accountability and oversight for all
personal identity verification cards that are collected and destroyed when
individuals separate from DHS.
Recommendation 3: We recommend that the DHS Chief Security Officer
implement additional controls to ensure personal identity verification card
revocation and card destruction are completed and recorded when individuals
separate from DHS.
Recommendation 4: We recommend that the DHS Chief Security Officer
implement controls to ensure DHS officials record security clearance
withdrawal dates in the Integrated Security Management System when
individuals separate from DHS.
Recommendation 5: We recommend that the DHS Chief Security Officer
develop and implement a solution to verify and validate the personal identity
verification card access termination process across the Department and amechanism to monitor its effectiveness.
Recommendation 6: We recommend that the DHS Chief Security Officer
develop and implement a solution to verify and validate the security clearance
withdrawal process across DHS and a mechanism to monitor its effectiveness.

www.oig.dhs.gov

9

OIG-23-04

OFFICE OF INSPECTOR GENERAL
Department of Homeland Security

Management Comments and OIG Analysis
DHS’ Director, Departmental Audit Liaison provided written comments in
response to our draft of this report. Appendix B contains DHS’ management
response in its entirety. In its management response, DHS concurred with all
six report recommendations. We consider all six recommendations open andresolved. Although DHS concurred with all recommendations, its management
response highlighted several concerns regarding the underlying audit work.
First, DHS asserted that our report contains inaccuracies and lacks context for
metrics in the findings. Specifically, DHS expressed concern about thepersonnel separations, clearance withdrawals, and PIV card revocation anddestruction numbers we used. We noted in the report the limitations of ourdata analysis and acknowledged that we could not determine the exact
magnitude of the issue because records in DHS’ information systems wereincomplete. We also acknowledged the difference in the results of OIG’s and
DHS’ analyses in the report and listed possible reasons for the differences
according to DHS officials. Although we did not agree on the exact number of
PIV cards DHS did not revoke or destroy, both DHS and OIG agreed it was tensof thousands.
Second, according to DHS, its inability to reconcile the numbers in our findings
will adversely affect DHS’ ability to address our recommendations. We disagreewith this assertion because reconciling the number of PIV cards revoked or
destroyed is not necessary for DHS to implement mechanisms and strengthen
policies, procedures, and oversight to improve the Department’s controls overseparated individuals’ PIV card access and security clearances.
Finally, DHS asserted that security clearances are not terminated or withdrawn
and do not expire just by virtue of an individual leaving an organization forroutine separation or offboarding. Although we agree security clearances are
not terminated or expire just because an employee separates from anorganization, DHS officials must withdraw the assigned security clearance
eligibility and update ISMS when a cleared individual separates from a DHS
position. Further, although DHS noted that in our audit, we did not review any
data related to administration of Form SF-312, Classified Information
Nondisclosure Agreement, we performed procedures to ensure the data we used
was sufficiently reliable for the purposes of our audit.
DHS Response to Recommendation 1: Concur. DHS OCSO is currently
pursuing a solution to streamline and automate new and existing PIV card
revocation and destruction processes in IDMS and ISMS. DHS plans to fully
implement these enhancements by February 2024. In the interim, OCSO, thewww.oig.dhs.gov

10

OIG-23-04

OFFICE OF INSPECTOR GENERAL
Department of Homeland Security

DHS HSPD-12 Program, and the National Security Services Division Personnel
Security Program Management Office will review and clarify current policies,
including responsibilities and procedures to revoke PIV card access andwithdraw security clearances within a specified timeframe for separated
individuals, by June 2023. OCSO will submit any policy revisions to the
Department for review by September 2023 and will issue updated policies by
December 2024. OCSO will communicate immediate guidance to the
Department through provisional directives, including guidance to enforce the18-hour PIV card revocation policy.
OIG Analysis: We consider these actions responsive to the recommendation,
which we consider open and resolved. We will close this recommendation when
DHS submits documentation showing that it has clarified and reiterated
existing policies and procedures and implemented additional controls to ensure
PIV card revocation and destruction are completed and recorded when
individuals separate from DHS.
DHS Response to Recommendation 2: Concur. OSCO is working with the
DHS Office of the Chief Readiness Support Officer to develop policy revisions
that strengthen accountability and oversight. On October 13, 2022, the Officeof the Chief Readiness Support Officer published DHS Personal Property
Bulletin 2023-001, Personal Identity Verification (PIV) Cards Sensitivity
Elevation, as a department-wide notification to inform personnel that DHS
increased the sensitivity designation of PIV cards from Equipment Control
Class Level 3 to Equipment Control Class Level 1. In addition, OCSO is
updating existing policies and procedures to include remedial actions for
personnel who do not destroy PIV cards or document destruction promptly.
DHS plans to implement these controls by February 2024.
Further, OCSO plans to assess PIV card collection, revocation, and destruction
processes at its DHS credentialing facilities annually for compliance with NIST
Special Publication 800-79-2. The assessments will include document review,interviews, process testing, and observations.
Further, the DHS HSPD-12 Program, in collaboration with the DHS Office of
the Chief Information Officer (OCIO), is:

developing new automated workflows for data sharing between DHS
access, credential, identity, and security management systems by March
2023;
finalizing data sharing models and the associated interface control
document and interconnection security agreement by June 2023;
deploying new system interfaces by September 2023; andwww.oig.dhs.gov

11

OIG-23-04

OFFICE OF INSPECTOR GENERAL
Department of Homeland Securityplanning to begin onboarding DHS components to the enhanced
automated solution by December 2023.

OIG Analysis: We consider these actions responsive to the recommendation,
which we consider open and resolved. We will close this recommendation when
DHS submits documentation showing its updated policies, procedures, andsecurity agreement strengthening internal processes to ensure accountability
and oversight for all PIV cards that are collected and destroyed when
individuals separate from DHS.
DHS Response to Recommendation 3: Concur. OCSO will update existing
policies and procedures to include remedial actions for personnel who do not
destroy and document PIV card destruction promptly. Also, OCSO is
implementing technological mechanisms to mitigate human errors. OCSO
plans to use a new Technology Refresh Project to modernize DHS’
infrastructure and, among other things, better track and enforce PIV card
revocation and destruction. DHS plans to implement these enhancements by
February 2024. In addition, OCSO will assess PIV card collection, revocation,and destruction processes at DHS credentialing facilities annually forcompliance with NIST Special Publication 800-79-2.
Further, the DHS HSPD-12 Program, in collaboration with OCIO, plans todevelop and deploy new data-sharing workflows and interfaces, as summarized
above in the DHS response to Recommendation 2.
In addition, OCSO is augmenting the existing PIV lifecycle management
process with new technology. Specifically, DHS is implementing a physicalaccess control system (PACS), which will support PIV card revocation
compliance and reduce threats associated with potential unauthorized entry
using a lost, expired, or stolen PIV card by automatically de-activating the cardin all connected Federal Identity Credential Access Management PACS in nearreal-time when a certificate is revoked or expires. DHS plans to complete theseactions by February 2024.
OIG Analysis: We consider these actions responsive to the recommendation,
which we consider open and resolved. We will close this recommendation when
DHS provides documentation showing that the planned corrective actions arecompleted.
DHS Response to Recommendation 4: Concur. DHS is pursuingenhancements to its existing Identity, Credential, and Access Management
architecture to implement near real-time data sharing through the Trusted
Identity Exchange and ALM systems to ensure that security clearance
withdrawal dates are promptly recorded in ISMS when individuals separate
www.oig.dhs.gov

12

OIG-23-04

OFFICE OF INSPECTOR GENERAL
Department of Homeland Security

from DHS. DHS plans to fully implement these enhancements by February2024.
In the interim, the DHS HSPD-12 Program, in collaboration with OCIO, plans
to develop and deploy new data-sharing workflows and interfaces, assummarized above in the DHS response to recommendation 2.
OIG Analysis: We consider these actions responsive to the recommendation,
which we consider open and resolved. We will close this recommendation when
DHS provides documentation showing that the planned corrective actions arecompleted.
DHS Response to Recommendation 5: Concur. DHS is pursuing
technological improvements to verify and validate the PIV card accesstermination process across the Department, as well as a mechanism to monitor
effectiveness, which it plans to fully implement by February 2024.
In the interim, the DHS HSPD-12 Program is implementing the DHS PACS
Connector, which will automate the process of revoking facility accessprivileges across the Department when a PIV card is deactivated in IDMS. DHS
plans to finalize the governance documents for the DHS PACS Connector by
December 2023. The Federal Emergency Management Agency, U.S.
Immigration and Customs Enforcement, the Transportation Security
Administration’s HQ, and the DHS HQ’s St. Elizabeth’s campus are tentatively
scheduled to transition to the PACS Connector during FY 2023. All other DHS
components and facilities will begin the transition in FY 2024.
In addition, the DHS HSPD-12 Program, in collaboration with OCIO, plans todevelop and deploy new data-sharing workflows and interfaces, as summarized
above in the DHS response to Recommendation 2.
OIG Analysis: We consider these actions responsive to the recommendation,
which we consider open and resolved. We will close this recommendation when
DHS provides documentation showing that the planned corrective actions arecompleted.
DHS Response to Recommendation 6: Concur. DHS is pursuing
technological improvements to automate existing processes necessary to verify
and validate security clearance withdrawals in ISMS, as well as a mechanism
to monitor effectiveness. DHS expects that the improvements will be available
by February 2024.
In the interim, the DHS HSPD-12 Program, in collaboration with OCIO, plans
to develop and deploy new data-sharing workflows and interfaces, assummarized above in the DHS response to Recommendation 2.
www.oig.dhs.gov

13

OIG-23-04

OFFICE OF INSPECTOR GENERAL
Department of Homeland Security

As an additional control, OCSO will audit and distribute monthly reports to
DHS components beginning on January 3, 2023, to monitor compliance andensure components take action to resolve all identified discrepancies in theirsecurity clearance data for inactive positions. Further, OCSO will pursue
robotics process automation to enhance data analytics and discrepancy
remediation.
OIG Analysis: We consider these actions responsive to the recommendation,
which we consider open and resolved. We will close this recommendation when
DHS provides documentation showing that the planned corrective actions arecompleted.

Objective, Scope, and Methodology
The Department of Homeland Security Office of Inspector General wasestablished by the Homeland Security Act of 2002 (Public Law 107−296) byamendment to the Inspector General Act of 1978.
Our objective was to determine whether DHS terminated security clearancesand PIV card access for separated employees and contractors in accordancewith Federal regulations and Department policies. To answer our objective, we
reviewed and analyzed:
•
•
•
•
•
•

applicable laws, regulations, executive orders, and other guidance related
to security clearances and PIV card access;records for individuals who separated from DHS from FY 2018 throughFY 2021 available in ISMS, IDMS, ALM, and component Human
Resources systems;
process workflows;
monitoring mechanisms such as checklists, communications, andmeeting minutes;
procedures for operating and accessing the systems and equipment used
to withdraw security clearances and revoke PIV cards; andprocedures for databases and other systems used to store, track, andmanage PIV card and security clearance access.

To determine the reliability of systems and controls, we reviewed prior audit
results, enterprise systems’ manuals, and privacy impact assessments.
We also interviewed DHS and field office personnel responsible for security
clearance and access authorization and badge issuance and recovery from:•Cybersecurity and Infrastructure Security Agency

www.oig.dhs.gov

14

OIG-23-04

OFFICE OF INSPECTOR GENERAL
Department of Homeland Security

•
•
•
•
•
•
•
•
•
•

DHS HQ
Federal Emergency Management Agency
Federal Law Enforcement Training Centers
Federal Protective Service
Transportation Security Administration
U.S. Citizenship and Immigration Services
U.S. Customs and Border Protection
U.S. Immigration and Customs Enforcement
United States Coast Guard
United States Secret Service

To assess whether DHS effectively managed and monitored PIV cards andaccess to controlled systems and facilities, we surveyed and interviewed DHS
officials and tested the Department’s controls over access termination using
separation data from ISMS and DHS and component Human Resource offices.
We reviewed ISMS records to determine whether DHS withdrew its interests inseparated employees’ and contractors’ security clearances as required.
To assess the reliability of ISMS, IDMS, and ALM-generated data, we:
•
•
•
•
•
•

obtained read-only access to ISMS and IDMS;
compared names and separation dates to data from component Human
Resource systems;
tested data to identify anomalies such as duplicate, incomplete, or
missing records;
attended virtual walkthroughs to observe the code used to generatereports;
traced data from 310 records back to source documents to determine if
information was entered correctly; andinterviewed DHS officials who were knowledgeable about the data.

We could not match IDMS inventory information to source documents because
DHS did not keep a PIV card activity log. In cases when we used computerprocessed data without source documents, we performed additional procedures
to ensure that the data was sufficiently reliable for the purposes of our audit;
we determined that it was.
The audit also included tests of internal controls and compliance with the laws
and regulations to the extent necessary to satisfy the audit objective.
We conducted this audit from October 2021 through July 2022 pursuant to theInspector General Act of 1978, as amended, and according to the generally
accepted government auditing standards. Those standards require that weplan and perform the audit to obtain sufficient, appropriate evidence to provide
www.oig.dhs.gov

15

OIG-23-04

OFFICE OF INSPECTOR GENERAL
Department of Homeland Securitya reasonable basis for our findings and conclusions based on our audit
objective. We believe that the evidence obtained provides a reasonable basis for
our findings and conclusions based on our audit objective.
The Office of Audits major contributors to this report are Sean Pettersen,
Director; Melissa Powe Williams, Audit Manager; Lori Smith, Auditor-inCharge; Patricia Epperly, Auditor; Audra Morris, Auditor; Azriel Krongauz, Data
Analyst; Maria Romstedt, Communications Analyst; and Nicole Kraft,
Independent Referencer.

www.oig.dhs.gov

16

OIG-23-04

OFFICE OF INSPECTOR GENERAL
Department of Homeland Security

Appendix A
DHS Comments to the Draft Reportwww.oig.dhs.gov

17

OIG-23-04

OFFICE OF INSPECTOR GENERAL
Department of Homeland Security

www.oig.dhs.gov

18

OIG-23-04

OFFICE OF INSPECTOR GENERAL
Department of Homeland Security

www.oig.dhs.gov

19

OIG-23-04

OFFICE OF INSPECTOR GENERAL
Department of Homeland Security

www.oig.dhs.gov

20

OIG-23-04

OFFICE OF INSPECTOR GENERAL
Department of Homeland Security

www.oig.dhs.gov

21

OIG-23-04

OFFICE OF INSPECTOR GENERAL
Department of Homeland Security

www.oig.dhs.gov

22

OIG-23-04

OFFICE OF INSPECTOR GENERAL
Department of Homeland Security

www.oig.dhs.gov

23

OIG-23-04

OFFICE OF INSPECTOR GENERAL
Department of Homeland Security

www.oig.dhs.gov

24

OIG-23-04

OFFICE OF INSPECTOR GENERAL
Department of Homeland Security

www.oig.dhs.gov

25

OIG-23-04

OFFICE OF INSPECTOR GENERAL
Department of Homeland Security

www.oig.dhs.gov

26

OIG-23-04

OFFICE OF INSPECTOR GENERAL
Department of Homeland Security

Appendix B
Report Distribution
Department of Homeland Security
Secretary
Deputy Secretary
Chief of Staff
Deputy Chiefs of Staff
General Counsel
Executive Secretary
Director, U.S. Government Accountability Office/OIG Liaison Office
Under Secretary, Office of Strategy, Policy, and Plans
Assistant Secretary for Office of Public Affairs
Assistant Secretary for Office of Legislative Affairs
Office of Management and Budget
Chief, Homeland Security Branch
DHS OIG Budget Examiner
Congress
Congressional Oversight and Appropriations Committees

www.oig.dhs.gov

27

OIG-23-04

Additional Information and Copies
To view this and any of our other reports, please visit our website at:www.oig.dhs.gov.
For further information or questions, please contact Office of Inspector General
Public Affairs at: DHS-OIG.OfficePublicAffairs@oig.dhs.gov.
Follow us on Twitter at: @dhsoig.

OIG Hotline
To report fraud, waste, or abuse, visit our website at www.oig.dhs.gov and clickon the red "Hotline" tab. If you cannot access our website, call our hotline at(800) 323-8603, fax our hotline at (202) 254-4297, or write to us at:
Department of Homeland Security
Office of Inspector General, Mail Stop 0305
Attention: Hotline
245 Murray Drive, SW
Washington, DC 20528-0305