U.S. ENVIRONMENTAL PROTECTION AGENCY 

OFFICE OF INSPECTOR GENERAL 

Catalyst for Improving the Environment 

Audit Report 

EPA Needs to Improve 

Physical Security at Its 

Offices in Las Vegas, Nevada 

 Report No. 10-P-0059 

 February 3, 2010 
 

 

 

Report Contributors: Rudolph M. Brevard 

 Charles M. Dade 

Abbreviations 

EPA U.S. Environmental Protection Agency 

LVFC Las Vegas Finance Center 

OIG Office of Inspector General 

ORD Office of Research and Development 

Cover photo: An EPA building in Las Vegas that is protected by a card reader system. 

 (EPA photo) 
 10-P-0059 U.S. Environmental Protection Agency February 3, 2010 Office of Inspector General 

At a Glance 

Catalyst for Improving the Environment 

Why We Did This Review 

The Office of Inspector 

General (OIG) sought to 

determine whether the U.S. 

Environmental Protection 

Agency (EPA) implemented 

oversight practices for securing 

access to key EPA locations in 

Las Vegas, Nevada. 

Background 

EPA occupies space in six 

buildings on or near the 

University of Nevada-Las 

Vegas campus. These buildings 

use a card access system to 

control personnel access to 

these buildings. The Office of 

Research and Development 

(ORD) is responsible for 

managing the process for 

authorizing and removing 

personnel access to these 

buildings and for administering 

the computer system that 

controls the card access system. 

EPA’s Security Management 

Division within the Office of 

Administration and Resources 

Management is the responsible 

and primary agent within EPA 

for physical security. 

For further information, contact 

our Office of Congressional, 

Public Affairs and Management 

at (202) 566-2391. 

To view the full report, 

click on the following link: 

www.epa.gov/oig/reports/2010/ 

20100203-10-P-0059.pdf 

EPA Needs to Improve Physical Security at Its 

Offices in Las Vegas, Nevada 

What We Found 

EPA needs to improve physical security at its Las Vegas facilities. The Las Vegas 

Finance Center’s (LVFC’s) server room and other key areas are susceptible to 

unauthorized access by personnel not a part of LVFC. The LVFC areas are protected 

by an access control system, but the system operator – ORD – does not administer the 

system in a manner that allows LVFC to monitor access to its area. As a result, ORD 

granted personnel access to sensitive LVFC areas without proper authorization. 

During our audit of EPA’s financial statements, we found that these problems are not 

limited to the LVFC. ORD does not administer the system in a manner that permits 

the other organizations in Las Vegas supported by the system to monitor access to 

their space. Also, ORD did not perform its responsibilities associated with managing 

and administering the computer-controlled card access system supporting all of the 

EPA buildings in Las Vegas. 

During subsequent communications with ORD, the office agreed with the findings 

and indicated that it planned to negotiate the transfer of the responsibility for the 

maintenance and oversight of the portion of the card access system relied upon by the 

other offices within Las Vegas to one of the other offices. 

What We Recommend 

We recommend that the ORD Office of Science Information Management develop 

and implement procedures to ensure that all organizations are provided with the 

information necessary to monitor and review the access to their space until one of the 

offices accepts responsibility for oversight and maintenance of the card access 

system. Until ORD completes the transfer, we recommend that each Las Vegas 

office develop and implement a formal procedure that ensures it reviews the access 

reports provided by ORD for anomalies on at least a monthly basis. 

Once one of the offices accepts the responsibility from ORD, we recommend that the 

office develop and implement a formal procedure for managing the card access 

system under its control. After the transfer, we recommend that each of the offices 

establish a formal procedure for reviewing and monitoring the access for the space 

used by their office. We also recommend that the Security Management Division 

conduct an assessment of the physical security practices at EPA’s Las Vegas 

locations and conduct outreach to the Las Vegas offices to provide assistance. EPA 

agreed with the findings and recommendations. 
 

 

UNITED STATES ENVIRONMENTAL PROTECTION AGENCY 

WASHINGTON, D.C. 20460 

OFFICE OF 

INSPECTOR GENERAL 

February 3, 2010 

MEMORANDUM 

SUBJECT: EPA Needs to Improve Physical Security at Its Offices in 

Las Vegas, Nevada 

Report No. 10-P-0059 

FROM: Rudolph M. Brevard 

Director, Information Resources Management Assessments 

Office of Inspector General 

TO: See Below 

This is our report on the subject audit conducted by the Office of Inspector General (OIG) of the 

U.S. Environmental Protection Agency (EPA). This report contains findings that describe the 

problems the OIG has identified and corrective actions the OIG recommends. This report 

represents the opinion of the OIG and does not necessarily represent the final EPA position. 

Final determinations on matters in this report will be made by EPA managers in accordance with 

established audit resolution procedures. 

The estimated cost of this report – calculated by multiplying the project’s staff days by the 

applicable daily full cost billing rates in effect at the time – is $49,122. 

Action Required 

In accordance with EPA Manual 2750, you are required to provide a written response to this 

report within 90 calendar days. Due to the number of offices involved, EPA’s Security 

Management Division within the Office of Administration and Resources Management has been 

designated as the lead office responsible for coordinating a consolidated response to this report. 

You should include a corrective actions plan for agreed-upon actions, including milestone dates. 

We have no objections to the further release of this report to the public. This report will be 

available at http://www.epa.gov/oig. 

If you or your staff have any questions regarding this report, please contact me at (202) 566-0893 

or brevard.rudy@epa.gov; or Charles Dade, Project Manager, at (202) 566-2575 or 

dade.chuck@epa.gov. 
 

 

Addressees: 

Tami Franklin 

Acting Director, Security Management Division 

Office of Administration and Resources Management 

Dan Heggem 

Acting Director, National Exposure Research Laboratory 

Environmental Sciences Division 

Office of Research and Development 

Jack Puzak 

Director, Office of Science Information Management 

Office of Research and Development 

Dany Lavergne 

Director, Las Vegas Finance Center 

Office of the Chief Financial Officer 

Sheron Johnson 

Director, Human Resources Management Division – Las Vegas 

Office of Administration and Resources Management 

Dennisses Valdes 

Deputy Director, Environmental Response Team – West 

Office of Solid Waste and Emergency Response 

Jed Harrison 

Director, Radiation and Indoor Environments National Laboratory 

Office of Air and Radiation 
 

 

EPA Needs to Improve Physical Security 10-P-0059 

at Its Offices in Las Vegas, Nevada 

Table of Contents 

Purpose ................................................................................................................................ 1 

Background .......................................................................................................................... 1 

Scope and Methodology ..................................................................................................... 2 

Results of Review ................................................................................................................ 2 

Recommendations............................................................................................................... 4 

Agency Response and OIG Comments ............................................................................. 5
 

Status of Recommendations and Potential Monetary Benefits....................................... 7 

Appendices 

A Response from Office of Research and Development ...................................... 9 

B Response from Las Vegas Finance Center ........................................................ 13 

C Response from Human Resources Management Division – Las Vegas.......... 15 

D Response from Environmental Response Team – West ................................... 17 

E Response from Radiation and Indoor Environments National Laboratory ..... 19 

F Response from Security Management Division ................................................. 21

 G Distribution ............................................................................................................ 22 
 

 

10-P-0059 

Purpose 

The Office of Inspector General (OIG) sought to determine whether the U.S. Environmental 

Protection Agency (EPA) implemented oversight practices for securing access to key EPA 

locations in Las Vegas, Nevada. We looked at these security issues during our review of EPA’s 

consolidated financial statements for Fiscal Years 2009 and 2008. 

Background 

EPA occupies space in six buildings on or near the University of Nevada-Las Vegas campus. 

Several EPA programs with diverse functions occupy these buildings. Details are in Table 1. 

Table 1: EPA Las Vegas Offices and Functions 

Office Program Office Function 

Las Vegas Finance 

Center 

Office of the Chief 

Financial Officer 

Supports payments for all of EPA’s grant award 

offices. Supports the fellowship program by 

making all fellowship payments and providing 

additional services such as maintaining 

completion of studies and payment enrollments. 

Human Resources 

Management Division – 

Las Vegas 

Office of Administration 

and Resources 

Management 

Processes personnel and benefits actions for the 

Agency's 17,000 employees. One of EPA’s 

three human resources shared service centers. 

National Exposure 

Research Laboratory 

Office of Research and 

Development 

Conducts research, development, and 

technology transfer programs on environmental 

exposures to ecological and human receptors. 

Radiation and Indoor 

Environments National 

Laboratory 

Office of Air and 

Radiation 

Protects the public and the environment by 

minimizing exposure to radiation and indoor air 

pollution through environmental measurements, 

applied technologies, and education. 

Environmental 

Response Team – West 

Office of Solid Waste 

and Emergency 

Response 

Provides assistance in environmental 

emergencies. Serves as in-house consultant on 

innovative and emerging technologies and has 

recognized experts in several fields of science. 

Source: EPA Office of Environmental Information Intranet. 

The EPA Las Vegas offices use a card access system to control entry to these buildings. The 

Office of Research and Development (ORD) is responsible for managing the process for 

authorizing and removing personnel access to these buildings. ORD is also responsible for 

administering the computer system that controls the card access system. 

The Standard Operating Procedure for Management/Control of Access to Environmental 

Protection Agency Buildings in Las Vegas, NV, dated February 17, 2004, requires ORD’s 

Environmental Sciences Division Programs Operations Staff to: (1) grant access to EPA Las 

Vegas facilities based on the fully completed submission of an employee data sheet form LV-172 

with all appropriate signatures, (2) perform semiannual reviews of all access provided, and 

(3) perform a review of the signatures on the LV-172 whenever the access requirements of a staff 

member changes. 

1 
 

10-P-0059 

EPA Order 3210, Physical Security Program, designates the Security Management Division 

within the Office of Administration and Resources Management as the responsible and primary 

agent within EPA for physical security. The order requires the division to conduct periodic 

nationwide physical security risk and vulnerability assessments of EPA facilities. 

Scope and Methodology 

We performed this audit from June through November 2009 at EPA offices in Las Vegas, 

Nevada. We performed this audit in accordance with generally accepted government auditing 

standards. These standards require that we plan and perform the audit to obtain sufficient and 

appropriate evidence to provide a reasonable basis for our findings and conclusions based on the 

audit objectives. We believe the evidence obtained provides a reasonable basis for our findings 

and conclusions. 

We interviewed EPA officials responsible for overseeing the administration of the Las Vegas 

card reader system and managing the Las Vegas buildings access processes. We interviewed 

EPA officials responsible for using the card access system reports to monitor personnel access 

they oversee. We reviewed the Standard Operating Procedures that govern the maintenance and 

oversight of the card reader system. We analyzed the card reader system reports provided by 

EPA officials within Las Vegas. We reviewed forms Las Vegas offices use to request personnel 

access to their building space. 

We had not performed past audits of physical security at EPA Las Vegas offices. Therefore, we 

did not perform follow-up work on any open recommendations. 

Results of Review 

EPA needs to improve physical security at its Las Vegas facilities. In particular, the Las Vegas 

Finance Center’s (LVFC’s) server room and other key areas are susceptible to unauthorized 

access by personnel not a part of LVFC. The LVFC areas are protected by an access control 

system, but the system operator – ORD – does not administer the system in a manner that allows 

LVFC to monitor access to its area. In particular, ORD had not obtained authorization from the 

LVFC Director to grant access to key areas to non-LVFC personnel. ORD also had neither 

provided the LVFC reports detailing who has access to their areas nor performed the required 

semiannual review of access rights required by ORD procedures. As a result, personnel were 

granted access to sensitive areas without proper authorization. Problems are not limited to the 

LVFC. ORD does not administer the system in a manner that permits the other EPA 

organizations supported by the system to monitor access to their space. 

ORD did not perform its responsibilities associated with managing and administering the 

computer-controlled card access system supporting all of the EPA buildings in Las Vegas. The 

ORD personnel now responsible for this function work within ORD’s Office of Science 

Information Management. We found that ORD: 

2 
10-P-0059 

•	 Did not grant access based on appropriately approved and completed LV-172 forms. Our 

review of access to a small sample of doors for which the LVFC Director was a required 

approving official disclosed personnel with access whose forms were not approved by the 

LVFC Director. 

•	 Did not fully complete the LV-172 forms we reviewed. 

•	 Did not perform the required semiannual reviews of the card access provided. ORD 

indicated that the only review performed was back in 2004, and even for that review it 

could not provide evidence that the review was performed or that any corrective actions 

were taken based on the review. 

Along with not performing the responsibilities identified above, ORD has not been providing the 

necessary information to the various EPA organizations serviced by the card access system to 

allow them to monitor and review the access to their space. Radiation and Indoor Environments, 

Human Resources, and LVFC all indicated that ORD has not provided them with the information 

necessary to validate personnel who have access to their space. We also found that ORD was not 

responsive to the offices supported by the card access system. The LVFC Information Security 

Officer mentioned in a report that she attempted to review the access granted within the card 

access system but found that the reports provided by ORD were not accurate and complete and 

that the responses to her requests were not timely. To enable each organization to properly 

monitor and review the access to its space, ORD needs to provide the following standard reports 

to each organization on a monthly basis: 

•	 A report showing all of the access groups in Las Vegas that lists for each group (1) each 

of the doors the group can access, and (2) the days of the week and times that the group 

can access each of the doors. 

•	 A report showing all of the access groups in Las Vegas that lists all of the users, their 

associated card ID, and the expiration date of the access for each of the users for each 

group. 

•	 For reviewing the logged history of users’ access, a report that shows the: (1) criteria 

used for the creation of the report, (2) date and time of the access attempt, (3) action 

taken by the device, (4) location/site, (5) door, (6) user name, and (7) card ID. 

Additionally, ORD needs to be responsive to the organizations’ special requests for reports and 

provide them in a timely manner. 

During subsequent communications with ORD, the office agreed with the finding and indicated 

that it planned to negotiate the transfer of the responsibility for the maintenance and oversight of 

the portion of the card access system relied upon by the other offices within Las Vegas to one of 

the other offices. Because this transfer of responsibility will result in a change in the way EPA 

will be providing physical security to the facilities in Las Vegas, we believe it would be in EPA’s 

best interest for the Office of Administration and Resources Management’s Security 

Management Division to conduct a review to ensure the procedures are implemented and 

working as management intends. Furthermore, in response to the draft report, offices within Las 

Vegas felt the Security Management Division should have involvement with ensuring security 

responsibilities are appropriately transferred within the Las Vegas offices. 

3 
10-P-0059 

Recommendations 

We recommend that the Director, Office of Science Information Management, within the Office 

of Research and Development: 

1.	 Develop and implement procedures to ensure that all organizations are provided with 

the information necessary to monitor and review the access to their space both if and 

when the transfer takes place as well as in the interim until the transfer takes place, 

including: 

a.	 Providing electronic copies of the following reports to the director of each 

organization supported by the system on a monthly basis to enable them to 

monitor and review the access to their space. 

i.	 A Standard Report showing all of the access groups in Las Vegas that 

lists for each group: 

1.	 Each of the doors the group can access, and 

2.	 The days of the week and times that the group can access each of 

the doors. 

ii.	 A Standard Report showing all of the access groups in Las Vegas that 

lists all of the users, their associated Card ID, and the expiration date of 

the access for each of the users for each group. 

iii.	 For reviewing the logged history of users’ access, a standard report that 

shows the: (1) criteria used for the creation of the report, (2) date and 

time of the access attempt, (3) action taken by the device, (4) 

location/site, (5) door, (6) user name, and (7) card ID. 

b.	 Providing, upon request, the reports as requested by the organizations in a timely 

manner (within 2 working days) for special situations. 

2.	 Fully implement the standard operating procedures for the facilities that remain in the 

card access system for the National Exposure Research Laboratory, Environmental 

Sciences Division 

3.	 Perform a review to ensure the standard operating procedures are implemented and 

working and document the review, associated results, and corrective actions taken. 

For the (a) Director, Las Vegas Finance Center, within the Office of the Chief Financial Officer; 

(b) Director, Human Resources Management Division – Las Vegas, within the Office of 

Administration and Resources Management; (c) Director, Environmental Response Team – 

West, within the Office of Solid Waste and Emergency Response; and (d) Director, Radiation 

and Indoor Environments National Laboratory, within the Office of Air and Radiation, we 

recommend that: 

4.	 If your office accepts the transfer of the responsibility for management and oversight of 

the card access system, develop and implement formal procedures for managing and 

overseeing the card access system for all of the facilities/organizations supported by the 

system. The procedures should include: 

4 
10-P-0059 

a.	 Listing steps for granting and removing access to the system. 

b.	 Providing on a monthly basis the reports noted in Recommendation 1 to the 

director for each organization supported by the system, 

c.	 Providing, upon request, the reports as requested by the organizations in a 

timely manner (within 2 working days) for special situations. 

d.	 Performing periodic reviews to validate 

i.	 the access provided is limited to the access authorized and 

ii.	 the access authorized is still needed. 

5.	 Develop and implement a formal procedure to review for anomalies, on a monthly basis, 

the logs and access reports provided by the Office of Science Information Management, 

within the Office of Research and Development, that are associated with the current 

card access system for the space used by its office. 

6.	 Once responsibility for overseeing the card access system is transferred, develop and 

implement a formal procedure for reviewing and monitoring the access for the space 

used by its office. The procedure should include continuing to review system logs and 

reports on a monthly basis for anomalies, as well as verifying at least annually that all 

users associated with the office space still need their current access. 

We recommend the Director, Security Management Division, within the Office of 

Administration and Resources Management: 

7.	 Schedule and conduct an assessment of the physical security practices at EPA’s 

Las Vegas locations to make sure the procedures are implemented and working as 

management intends. 

8.	 Conduct outreach to EPA offices within Las Vegas and provide technical assistance, as 

required, to ensure security responsibilities and practices meet Agency requirements. 

Agency Response and OIG Comments 

The Agency agreed with our findings and provided tentative corrective action plans to address 

our recommendations. However, we noted the offices indicated differences in when they felt the 

transfer of the responsibility for management and oversight of the card access system would 

occur. ORD estimated that the transfer would take place on July 31, 2010, whereas the other 

offices estimated it would take place no later than March 31, 2010. 

ORD indicated that in December 2009 it implemented corrective actions that address 

Recommendation 1. The corrective actions described appear to address our concerns and we 

closed this recommendation in our audit tracking system. 

We also noted that the Security Management Division will schedule and conduct its assessment 

upon notification that the offices have completed the procedures required in response to 

Recommendations 1 through 6. 

5 
10-P-0059 

Additionally, both the (a) Human Resources Management Division – Las Vegas, within the 

Office of Administration and Resources Management, and the (b) Radiation and Indoor 

Environments National Laboratory, within the Office of Air and Radiation requested that the 

Security Management Division be involved, provide technical advice, and assist with the transfer 

and implementation of the door access system into the LaPlaza offices. 

We believe that EPA should have one lead office serve as the coordinator for ensuring the 

redistribution of security responsibilities at its Las Vegas offices. This should help to ensure 

each office’s planned corrective actions are properly aligned and that all agreed-to actions are 

tracked through completion. We request that the EPA’s Security Management Division, the 

primary agent within EPA for physical security, coordinate the final consolidated response to this 

report and the division agreed to do so. We also modified the report to request that the Security 

Management Division conduct outreach to those Las Vegas offices that need assistance in 

establishing security practices and the division agreed to do so. 

Appendices A through F contain the complete responses provided by each office. 

6 
 

 

 

10-P-0059 

Status of Recommendations and 

Potential Monetary Benefits 

POTENTIAL MONETARY 

RECOMMENDATIONS BENEFITS (in $000s) 

Rec. 

No. 

Page 

No. Subject Status1 Action Official 

Planned 

Completion 

Date 

Claimed 

Amount 

Agreed To 

Amount 

1 4 Develop and implement procedures to ensure that 

all organizations are provided with the information 

necessary to monitor and review the access to 

their space both if and when the transfer takes 

place as well as in the interim until the transfer 

takes place, including: 

a. Providing electronic copies of the following 

reports to the director of each organization 

supported by the system on a monthly basis 

to enable them to monitor and review the 

access to its space.

 i. A Standard Report showing all of the 

access groups in Las Vegas that lists for 

each group: 

1. Each of the doors the group can 

access, and 

2. The days of the week and times 

that the group can access each of 

the doors. 

ii. A Standard Report showing all of the 

access groups in Las Vegas that lists all 

of the users, their associated Card ID, and 

the expiration date of the access for each 

of the users for each group. 

iii. For reviewing the logged history of users’ 

access, a standard report that shows the: 

(1) criteria used for the creation of the 

report, (2) date and time of the access 

attempt, (3) action taken by the device, 

(4) location/site, (5) door, (6) user name, 

and (7) card ID. 

b. Providing, upon request, the reports as 

requested by the organizations in a timely 

manner (within 2 working days) for special 

situations. 

O Director, National Exposure Research 

Laboratory, Environmental Sciences 

Division, within Office of Research and 

Development 

2 

3 

4 

4 

Fully implement the standard operating procedures 

for the facilities that remain in the card access 

system for the National Exposure Research 

Laboratory, Environmental Sciences Division 

Perform a review to ensure the standard operating 

procedures are implemented and working and 

document the review, associated results, and 

corrective actions taken. 

O 

O 

Director, National Exposure Research 

Laboratory, Environmental Sciences 

Division, within Office of Research and 

Development 

Director, National Exposure Research 

Laboratory, Environmental Sciences 

Division, within Office of Research and 

Development 

7 
 

 

 

 

 

 

 

 

 

 

 

10-P-0059 

POTENTIAL MONETARY 

RECOMMENDATIONS BENEFITS (in $000s) 

Planned 

Rec. Page Completion Claimed Agreed To 

No. No. Subject Status1 Action Official Date Amount Amount 

4 4 If your office accepts the transfer of the 

responsibility for management and oversight of the 

card access system, develop and implement 

formal procedures for managing and overseeing 

the card access system for all of the 

facilities/organizations supported by the system. 

The procedures should include: 

a. Listing steps for granting and removing 

access to the system. 

b. Providing on a monthly basis the reports 

noted in Recommendation 1 to the director 

for each organization supported by the 

system, 

c. Providing, upon request, the reports as 

requested by the organizations in a timely 

manner (within 2 working days) for special 

situations. 

d. Performing periodic reviews to validate 

i. the access provided is limited to the 

access authorized and 

ii. the access authorized is still needed. 

5 5 Develop and implement a formal procedure to 

review for anomalies, on a monthly basis, the logs 

and access reports provided by the Office of 

Science Information Management, within the Office 

of Research and Development, that are associated 

with the current card access system for the space 

used by its office. 

O (a) Director, Las Vegas Finance Center, 

within Office of the Chief Financial Officer; 

(b) Director, Human Resources 

Management Division – Las Vegas, within 

Office of Administration and Resources 

Management; 

(c) Director, Environmental Response 

Team – West, within Office of Solid Waste 

and Emergency Response; and 

(d) Director, Radiation and Indoor 

Environments National Laboratory, within 

Office of Air and Radiation 

O (a) Director, Las Vegas Finance Center, 

within Office of the Chief Financial Officer; 

(b) Director, Human Resources 

Management Division – Las Vegas, within 

Office of Administration and Resources 

Management; 

(c) Director, Environmental Response 

Team – West, within Office of Solid Waste 

and Emergency Response; and 

(d) Director, Radiation and Indoor 

Environments National Laboratory, within 

Office of Air and Radiation 

6 5 Once responsibility for overseeing the card access 

system is transferred, develop and implement a 

formal procedure for reviewing and monitoring the 

access for the space used by its office. The 

procedure should include continuing to review 

system logs and reports on a monthly basis for 

anomalies, as well as verifying at least annually 

that all users associated with the office space still 

need their current access. 

O (a) Director, Las Vegas Finance Center, 

within Office of the Chief Financial Officer; 

(b) Director, Human Resources 

Management Division – Las Vegas, within 

Office of Administration and Resources 

Management; 

(c) Director, Environmental Response 

Team – West, within Office of Solid Waste 

and Emergency Response; and 

(d) Director, Radiation and Indoor 

Environments National Laboratory, within 

Office of Air and Radiation 

7 5 Schedule and conduct an assessment of the 

physical security practices at EPA’s Las Vegas 

locations to make sure the procedures are 

implemented and working as management intends. 

O Director, Security Management Division, 

within Office of Administration and 

Resources Management 

8 5 Conduct outreach to EPA offices within Las Vegas 

and provide technical assistance, as required, to 

ensure security responsibilities and practices meet 

Agency requirements. 

O Director, Security Management Division, 

within Office of Administration and 

Resources Management 

1 O = recommendation is open with agreed-to corrective actions pending 

C = recommendation is closed with all agreed-to actions completed 

U = recommendation is undecided with resolution efforts in progress 

8 
 

 

 

 

10-P-0059 

Appendix A 

Response from Office of 

Research and Development 

January 8, 2010 

MEMORANDUM 

SUBJECT: Response and Corrective Action Plan For OIG Draft Report 

Entitled: “EPA Needs to Improve Physical Security at Its Offices in Las Vegas, 

Nevada” Assignment No. OA-FY09-0842 

FROM: Daniel Heggem /s/ Daniel T. Heggem 

Acting Director, Environmental Sciences Division 

National Exposure Research Laboratory 

Office of Research and Development 

Jack Puzak /s/ Christopher S. Robbins for 

Director, Office of Science Information Management 

Office of Research and Development 

TO: Rudolph M. Brevard, Director 

Information Resources Management Assessments 

Office of Inspector General 

Thank you for the opportunity to review and comment on the subject draft report. We 

generally agree with the findings contained in the draft report and are taking steps to address 

each of the three recommendations. 

 As previously stated in our response to the position paper, since the creation of the 2004 

Standard Operating Procedure (SOP) for card access referenced in the IG report, the number and 

location of EPA staff in Las Vegas has increased significantly at the off-campus La Plaza 

facility. On campus EPA staff includes ORD and a few OAR lab staff. Therefore, we believe 

that the AA-ships (OSWER, OARM, OCFO, and OAR) located off-campus on Maryland 

Parkway, should make minor modifications to their existing system and operate and maintain 

access control independently of ORD's system. During the last Las Vegas Directors’ meeting, 

local management from the other AAships agreed on this approach and a contract action has 

9 
 

10-P-0059 

been initiated to establish a separate access system. With this in mind, we plan to address the 

OIG’s recommendations by implementing the corrective actions set forth in the attachment and 

summarized below. 

 In addition, due to organizational and staffing changes within ORD, the recently 

established ORD “Office of Science Information Management” (OSIM) will have the primary 

responsibility for implementing the corrective actions described below. NERL/ESD 

management will work with staff in ORD/OSIM to facilitate implementation of the corrective 

actions. 

Recommendation 1: 

Develop and implement procedures to ensure that all organizations are provided with the 

information necessary to monitor and review the access to their space both if and when the 

transfer takes place as well as in the interim until the transfer takes place, including: 

a. Providing electronic copies of the following reports to the director of each organization 

supported by the system on a monthly basis to enable them to monitor and review the 

access to their space. 

i. A Standard Report showing all of the access groups in Las Vegas that lists for 

each group: 

1. Each of the doors the group can access, and 

2. The days of the week and times that the group can access each of the 

doors. 

ii. A Standard Report showing all of the access groups in Las Vegas that lists all 

of the users, their associated Card ID, and the expiration date of the access for 

each of the users for each group. 

iii. For reviewing the logged history of users’ access, a standard report that shows 

the: (1) criteria used for the creation of the report, (2) date and time of the access 

attempt, (3) action taken by the device, (4) location/site, (5) door, (6) user name, 

and (7) card ID. 

b. Providing, upon request, the reports as requested by the organizations in a timely 

manner (within 2 working days) for special situations. 

Corrective Action: 

We concur with the finding. As of December 2009, the procedures developed and contained in 

the existing SOP are being followed and implemented. Additionally, when the next quarterly colocated Directors’ meeting is held, the NERL/ESD Division Director will confirm with the other 

directors that they are receiving the necessary reports. This process will continue until the other 

organizations have their stand-alone system. A contract action has been initiated to establish a 

separate card access system. The separate system is expected to be in place by July 31, 2010. 

ORD/OSIM has distributed two reports entitled “User-all by access group” and “access group” 

to all Las Vegas Division Directors. These reports will continue to be distributed on a monthly 

basis. These Standard Reports show all of the access groups in Las Vegas and, for each group, 

list all OIG recommended information. These reports will continue to be distributed to all 

Division Directors until the transfer takes place at which time the report will be distributed to 

10 
 

 

10-P-0059 

only the ESD Division Director. All special reports “upon request” will be provided in a timely 

manner for special situations. 

Recommendation 2: 

Fully implement the standard operating procedures for the facilities that remain in the card 

access system for the National Exposure Research Laboratory, Environmental Sciences Division 

Corrective Action: 

We concur with the finding. The SOP will be fully implemented for the ESD-LV facility within 

3 months of the completion of the transfer. 

Recommendation 3 

Perform a review to ensure the standard operating procedures are implemented and working and 

document the review, associated results, and corrective actions taken. 

Corrective Action: 

We concur with the finding. For the facilities that remain on the NERL/ESD card access system, 

we will perform a review within 6 months after the updated standard operating procedures are 

completed to ensure the procedures are being followed. The results of the review will be 

documented. 

Thank you again for the opportunity to address the findings contained in the subject draft report. 

Please feel free to contact Chris Sibert at (702) 798-2234 if you have any questions. 

Attachment 

cc: 

Jewel Morris 

Marshall Gray 

Christopher Sibert 

Caroline Parton 

Ardra Morgan Kelly 

11 
 

 

 

 

 

10-P-0059 

Rec. 

No. 

OIG Recommendation Responsible 

Office 

Corrective Action Planned 

Completion 

Date 

1 

Develop and implement procedures to 

ensure that all organizations are 

provided with the information 

necessary to monitor and review the 

access to their space both if and when 

the transfer takes place as well as in the 

interim until the transfer takes place, 

including: 

a. Providing electronic copies of the 

following reports to the director of each 

organization supported by the system 

on a monthly basis to enable them to 

monitor and review the access to their 

space. 

i. A Standard Report showing all of the 

access groups in Las Vegas that lists 

for each group: 

1. Each of the doors the group can 

access, and 

2. The days of the week and times that 

the group can access each of the doors. 

ii. A Standard Report showing all of the 

access groups in Las Vegas that lists all 

of the users, their associated Card ID, 

and the expiration date of the access for 

each of the users for each group. 

iii. For reviewing the logged history of 

users’ access, a standard report that 

shows the: (1) criteria used for the 

creation of the report, (2) date and time 

of the access attempt, (3) action taken 

by the device, (4) location/site, (5) 

door, (6) user name, and (7) card ID. 

b. Providing, upon request, the reports 

as requested by the organizations in a 

timely manner (within 2 working days) 

for special situations. 

ORD/OSIM We concur with the finding. 

As of December 2009, the procedures developed 

and contained in the existing SOP are being 

followed and implemented. Additionally, when 

the next quarterly co-located Directors’ meeting 

is held, the NERL/ESD Division Director will 

confirm with the other directors that they are 

receiving the necessary reports. This process 

will continue until the other organizations have 

their stand-alone system. A contract action has 

been imitated to establish a separate card access 

system. The separate system is expected to be in 

place by July 31, 2010. 

ORD/OSIM has distributed two reports entitled 

“User-all by access group” and “ access group” 

to all Las Vegas Division Directors. These 

reports will continue to be distributed on a 

monthly basis. These Standard Reports show all 

of the access groups in Las Vegas and, for each 

group, list all OIG recommended information. 

These reports will continue to be distributed to 

all Division Directors until the transfer takes 

place at which time the report will be distributed 

to only the ESD Division Director. 

All special reports “upon request” will be 

provided in a timely manner for special 

situations. 

Complete 

2 

Fully implement the standard operating 

procedures for the facilities that remain 

in the card access system for the 

National Exposure Research 

Laboratory, Environmental Sciences 

Division. 

ORD/OSIM We concur with the finding. The SOP will be 

fully implemented for the ESD-LV facility 

within 3 months of the completion of the 

transfer. 

October 2010 

3 

Perform a review to ensure the standard 

operating procedures are implemented 

and working and document the review, 

associated results, and corrective 

actions taken. 

ORD/OSIM We concur with the finding. For the facilities 

that remain on the NERL/ESD card access 

system, we will perform a review within 

6 months after the updated standard operating 

procedures are completed to ensure the 

procedures are being followed. The results of the 

review will be documented. 

April 2011 

12 
 

 

 

 

10-P-0059 

Appendix B 

Response from Las Vegas Finance Center 

January 7, 2010 

MEMORANDUM 

SUBJECT:	 Las Vegas Finance Center Response to OIG Draft Audit Report, “EPA Needs to 

Improve Physical Security at Its Offices in Las Vegas, Nevada,” Assignment No. 

OA-FY09-0842, dated December 11, 2009 

FROM:	 Dany Lavergne, Director 

Las Vegas Finance Center 

TO:	 Rudolph M. Brevard 

Director, Information Resources Management Assessments 

Office of Inspector General 

Below is LVFC’s response to the subject Audit Report. We concur with all of the IG’s 

recommendations for LVFC and will implement the required corrective actions. Details on the 

recommendations pertaining to LVFC are provided below. 

We appreciate the opportunity to review and comment on the draft report. If you have any 

questions or need additional information, please call me at (702) 798-2483. 

Recommendation #4: If your office accepts the transfer of the responsibility for management 

and oversight of the card access system, develop and implement formal procedures for managing 

and overseeing the card access system for all of the facilities/organizations supported by the 

system. 

LVFC Response: The EPA La Plaza offices are currently working with ORD to transfer 

management of the La Plaza card access system as quickly as possible; the target transfer date is 

no later than March 31, 2010. LVFC will work with the other La Plaza offices to ensure that 

formal procedures for management and oversight are completed within 90 days after the transfer. 

Recommendation #5: Develop and implement a formal procedure to review for anomalies, on a 

monthly basis, the logs and access reports provided by the National Exposure Research 

13 
 

 

10-P-0059 

Laboratory, Environmental Sciences Division, that are associated with the current card access 

system for the space used by their office. 

LVFC Response: LVFC currently has procedures for reviewing the logs and reports when they 

are received, but they are not formally documented. A formal procedure will be developed by 

January 29, 2010. 

Recommendation #6: Once responsibility for overseeing the card access system is transferred, 

develop and implement a formal procedure for reviewing and monitoring the access for the space 

used by their office. The procedure should include continuing to review system logs and reports 

on a monthly basis for anomalies, as well as verifying at least annually that all users associated 

with the office space still need their current access. 

LVFC Response: The EPA La Plaza offices are currently working with ORD to transfer 

management of the La Plaza card access system as quickly as possible; the target transfer date is 

no later than March 31, 2010. LVFC will develop and implement a procedure for reviewing and 

monitoring access to LVFC space within 90 days after the transfer. 

cc: Raffael Stein 

 Melvin Visnick 

 Kechi Elliott 

 Shelly Norland 

Peter Boudreau 

Charles Dade 

14 
10-P-0059 

Appendix C 

Response from Human Resources Management 

Division – Las Vegas 

January 8, 2010 

MEMORANDUM 

SUBJECT:	 Human Resources Management Division – Las Vegas Response to OIG Draft 

Audit Report, “EPA Needs to Improve Physical Security at Its Offices in Las 

Vegas, Nevada, Assignment No. OA-FY-09-0842, dated December 11, 2009 

FROM: Sheron E. Johnson, Director 

Human Resources Management Division – Las Vegas 

TO:	 Rudolph M. Brevard 

Director, Information Resources Management Assessments 

Office of Inspector General 

Below is HRMD-LV response to the subject Audit Report. We concur with all of the IG’s 

recommendations for HRMD-LV and will implement the required corrective actions. Details on 

the recommendations pertaining to HRMD-LV are provided below. 

We appreciate the opportunity to review and comment on the draft report. If you have any 

questions or need additional information, please call me at (702) 798-2413. 

Recommendation #4: If your office accepts the transfer of the responsibility for management 

and oversight of the card access system, develop and implement formal procedures for managing 

and overseeing the card access system for all of the facilities/organizations supported by the 

system. 

HRMD-LV Response: The EPA La Plaza offices are currently working with ORD to transfer 

management of the La Plaza card access system. The target date is no later than March 31, 2010. 

HRMD-LV will work with the other La Plaza offices to ensure that formal procedures for 

management and oversight are completed within 90 days after the transfer. 

15 
10-P-0059 

Recommendation #5: Develop and implement a formal procedure to review for anomalies, on a 

monthly basis, the logs and access reports provided by the National Exposure Research 

Laboratory, Environmental Sciences Division, that are associated with the current card access 

system for the space used by their office. 

HRMD-LV Response: HRMD-LV has procedures for reviewing the logs and reports when 

they are received, but they are not formally documented. A formal procedure will be developed 

by January 29, 2010. 

Recommendation #6: Once responsibility for overseeing the card access system is transferred, 

develop and implement a formal procedure for reviewing and monitoring the access for the space 

used by their office. The procedure should include continuing to review system logs and reports 

on a monthly basis for anomalies, as well as verifying at least annually that all users associated 

with the office space still need their current access. 

HRMD-LV Response: The EPA La Plaza offices are currently working with ORD to transfer 

management of the La Plaza card access system as quickly as possible; the transfer date is no 

later than March 31, 2010. HRMD-LV will develop and implement a procedure for reviewing 

and monitoring access to the HRMD-LV space within 90 days after the transfer. 

Recommendation #7: Schedule and conduct an assessment of the physical security practices at 

EPA’s Las Vegas locations to make sure the procedures are implemented and working as 

management intends. 

HRMD-LV Response: HRMD-LV would like for Security Management Division to be 

involved and assist with the migration of La Plaza Building A into a separate system that is 

managed by OAR/R&IE, The system should be integrated with the EPA Official Identification 

Card (EPASS). HRMD-LV would like for Security Management Division to provide technical 

advice, options for optimal service and performance, and guidance for becoming HSPD-12 

compliant. 

cc: Susan Kantrowitz 

 Matt Crouch

 Marsha Bush 

 Fernando Gomez 

 Chuck Dade 

16 
 

 

 

 

10-P-0059 

Appendix D 

Response from Environmental 

Response Team – West 

MEMORANDUM 

SUBJECT:	 Response to OIG Draft Audit Report, “EPA Needs to Improve Physical Security 

at Its Offices in Las Vegas, Nevada,” Assignment No. OA-FY09-0842, dated 

December 11, 2009 - from Environmental Response Team - West 

FROM:	 Dennisses Valdés, Deputy Director 

 Environmental Response Team-West 

TO:	 Rudolph M. Brevard 

Director, Information Resources Management Assessments 

Office of Inspector General 

We appreciate the opportunity to review and comment on the draft Audit Report. One correction 

needed in the report is the name of my organization. It is the Environmental Response Team. 

This is erroneously called emergency on pages 1,2,4, and three times on page 7. 

We concur with the IG’s recommendations pertaining to ERT-W and will implement the 

required corrective actions. Below is the response to the ERT-W recommendations. 

If you have any questions or need additional information, please call me at (702) 784-8003. 

# # # 

Recommendation #4: If your office accepts the transfer of the responsibility for management 

and oversight of the card access system, develop and implement formal procedures for managing 

and overseeing the card access system for all of the facilities/organizations supported by the 

system. 

ERT-W Response: The EPA La Plaza offices are currently working with ORD to transfer 

management of the La Plaza card access system as quickly as possible; the target transfer date is 

no later than March 31, 2010. ERT-W will work with the other EPA La Plaza offices to ensure 

that formal procedures for management and oversight are completed within 90 days after the 

transfer. 

17 
 

 

 

10-P-0059 

Recommendation #5: Develop and implement a formal procedure to review for anomalies, on a 

monthly basis, the logs and access reports provided by the National Exposure Research 

Laboratory, Environmental Sciences Division, that are associated with the current card access 

system for the space used by their office. 

ERT-W Response: ERT-W currently reviews the logs and reports when they are received, 

procedures for the review are not formally documented. A formal procedure will be developed 

by January 29, 2010. 

Recommendation #6: Once responsibility for overseeing the card access system is transferred, 

develop and implement a formal procedure for reviewing and monitoring the access for the space 

used by their office. The procedure should include continuing to review system logs and reports 

on a monthly basis for anomalies, as well as verifying at least annually that all users associated 

with the office space still need their current access. 

ERT-W Response: The EPA La Plaza offices are currently working with ORD to transfer 

management of the EPA La Plaza portion of the card access system as quickly as possible; the 

target transfer date is no later than March 31, 2010. ERT-W, with the other EPA La Plaza 

offices, will develop and implement a procedure for reviewing and monitoring access to ERT-W 

space within 90 days of the transfer. 

cc: Dany Lavergne, LVFC 

Jed Harrison, R&IE 

Sheron Johnsons, LVHRO 

Joe Lavergne, ERT-W 

Dave Wright, ERT 

18 
 

 

 

 

10-P-0059 

Appendix E 

Response from Radiation and 

Indoor Environments National Laboratory 

January 11, 2010 

MEMORANDUM 

SUBJECT: Radiation and Indoor Environments National Laboratory’s Response to 

OIG Draft Audit Report, “EPA Needs to Improve Physical Security at Its Offices 

in Las Vegas, Nevada,” Assignment No. OA-FY09-0842, dated December 11, 

2009 

FROM: Jed Harrison, Director

 Radiation and Indoor Environments National Laboratory 

TO: Rudolph M. Brevard 

Director, Information Resources Management Assessments 

Office of Inspector General 

Below is R&IE’s response to the subject Audit Report. We concur with all of the IG’s 

recommendations for R&IE and will implement the required corrective actions. Details on the 

recommendations pertaining to R&IE are provided below. 

We appreciate the opportunity to review and comment on the draft report. If you have any 

questions or need additional information, please call me at (702) 784-8220. 

Recommendation #4: If your office accepts the transfer of the responsibility for management 

and oversight of the card access system, develop and implement formal procedures for managing 

and overseeing the card access system for all of the facilities/organizations supported by the 

system. 

R&IE Response: The EPA La Plaza offices are currently working with ORD to transfer 

management of the La Plaza card access system as quickly as possible; the target transfer date is 

no later than March 31, 2010. R&IE will work with the other La Plaza offices to ensure that 

formal procedures for management and oversight are completed within 90 days after the transfer. 

19 
 

 

10-P-0059 

Recommendation #5: Develop and implement a formal procedure to review for anomalies, on a 

monthly basis, the logs and access reports provided by the National Exposure Research 

Laboratory, Environmental Sciences Division, that are associated with the current card access 

system for the space used by their office. 

R&IE Response: R&IE currently has procedures for reviewing the logs and reports when they 

are received, but they are not formally documented. A formal procedure will be developed by 

January 29, 2010. 

Recommendation #6: Once responsibility for overseeing the card access system is transferred, 

develop and implement a formal procedure for reviewing and monitoring the access for the space 

used by their office. The procedure should include continuing to review system logs and reports 

on a monthly basis for anomalies, as well as verifying at least annually that all users associated 

with the office space still need their current access. 

R&IE Response: The EPA La Plaza offices are currently working with ORD to transfer 

management of the La Plaza card access system as quickly as possible; the target transfer date is 

no later than March 31, 2010. R&IE will develop and implement a procedure for reviewing and 

monitoring access to R&IE space within 90 days after the transfer. 

Recommendation #7: Schedule and conduct an assessment of the physical security practices at 

EPA’s Las Vegas locations to make sure the procedures are implemented and working as 

management intends. 

R&IE Response: R&IE would like for Security Management Division to be involved and assist 

with the transfer and implementation of the Door Access System into the LaPlaza Office, 

including technical advice, options for optimal service and performance, guidance for becoming 

HSPD-12 compliant. Additionally, R&IE would like the Security Management Division to 

provide an assessment of Building E at LaPlaza, as well as assistance with aligning the Building 

E system with EPA IT procedures and protocols; and guidance in managing different systems 

that perform the same function or integrate into one system. 

cc: Gina Costantino 

Andrea Sibert 

Fernando Gomez 

Dany Lavergne 

Dennisses Valdes 

Sheron Johnson 

20 
 

 

10-P-0059 

Appendix F 

Response from Security Management Division 

 January 8, 2010 

MEMORANDUM 

SUBJECT:	 Response to Draft Audit Report OA-FY09-0842 

FROM:	 Tami Franklin, Acting Director 

Security Management Division 

Office of Administration and Resources Management 

TO:	 Rudolph M. Brevard, Director 

Information Resources Management Assessments 

Office of Inspector General 

Thank you for the opportunity to comment on the Office of Inspector General’s Draft 

Audit Report (“Report”) of December 11, 2009: “EPA Needs to Improve Physical Security at Its 

Offices in Las Vegas, Nevada.” 

The Security Management Division (SMD) concurs with the Report’s recommendations 

and has no additional comments. Below is SMD’s plan for completing Recommendation 7. 

Please note that specific completion dates for Recommendation 7 are dependent on completion 

of Recommendations 1-6 by other EPA organizations. 

Recommendation 7: “Schedule and conduct an assessment of the physical security 

practices at EPA’s Las Vegas locations to make sure the procedures are implemented 

and working as management intends.” 

SMD will schedule an assessment of the physical security practices at EPA’s Las Vegas 

locations within 3 months of being notified that the procedures in Recommendations 1-6 

of the Report have been completed. We will conduct the assessment to make sure the 

procedures are implemented and working as management intends within 6 months of 

being notified that the procedures in Recommendations 1-6 have been completed. 

Again, we appreciate this opportunity to review the Report. If you have additional questions, 

please contact me at 202-564-9218. 

21 
10-P-0059 

Appendix G 

Distribution 

Office of the Administrator 

Chief Financial Officer 

Assistant Administrator for Research and Development 

Assistant Administrator for Administration and Resources Management 

Assistant Administrator for Solid Waste and Emergency Response 

Assistant Administrator for Air and Radiation 

Director, Las Vegas Finance Center, Office of the Chief Financial Officer 

Acting Director, National Exposure Research Laboratory, Environmental Sciences Division, 

Office of Research and Development 

Director, Office of Science Information Management, Office of Research and Development 

Director, Human Resources Management Division – Las Vegas, Office of Administration and 

 Resources Management 

Acting Director, Security Management Division, Office of Administration and 

 Resources Management 

Deputy Director, Environmental Response Team – West, Office of Solid Waste and 

 Emergency Response 

Director, Radiation and Indoor Environments National Laboratory, Office of Air and Radiation 

Agency Follow-up Official (the CFO) 

Agency Follow-up Coordinator 

General Counsel 

Associate Administrator for Congressional and Intergovernmental Relations 

Associate Administrator for Public Affairs 

Audit Follow-up Coordinator, Office of the Chief Financial Officer 

Audit Follow-up Coordinator, Office of Research and Development 

Audit Follow-up Coordinator, Office of Administration and Resources Management 

Audit Follow-up Coordinator, Office of Solid Waste and Emergency Response 

Audit Follow-up Coordinator, Office of Air and Radiation 

Acting Inspector General 

22