Management and 

Performance Challenges 

Facing the FEC for FY 2024

November 1, 2023
Table of Contents

Introduction and Approach............................................................................................................................ 3

Management and Performance Challenge: Human Capital Management..................................................... 4

Management and Performance Challenge: Growth of Election Contributions............................................. 8

Management and Performance Challenge: Budget .....................................................................................11

Management and Performance Challenge: Identifying and Regulating Unlawful Foreign Contributions . 12

Management and Performance Challenge: Cybersecurity ..........................................................................13

FY 2023 Management Challenges Not Included in FY 2024 Report .........................................................14

Appendix: Hotline Poster...........................................................................................................................15
Management and Performance Challenges Facing the FEC in FY 2024 3 

Introduction and Approach

Why do we publish this report?

In accordance with the Reports Consolidation Act of 2000, the Federal Election Commission 

(the “FEC” or “Commission”) Office of Inspector General (OIG) identifies the most serious 

management and performance challenges facing the Commission and provides a brief 

assessment of the Commission’s progress in addressing those challenges. By statute, this report 

is required to be included in the FEC’s Agency Financial Report. 

What are management challenges?

The Government Performance and Results Modernization Act of 2010 identifies major 

management challenges as programs or management functions that are vulnerable to waste, 

fraud, abuse, and mismanagement, and where a failure to perform well could seriously affect the 

ability of the agency to achieve its mission objectives. Each challenge area is related to the 

agency’s mission and reflects both continuing vulnerabilities and emerging issues. The FEC 

OIG identified the top management and performance challenges facing the Commission as the 

following: 

• Human capital management

• Growth of election contributions 

• Budget 

• Identifying and regulating unlawful foreign contributions

• Cybersecurity

How did we identify these challenges?

We identified the Commission’s major management and performance challenges by 

recognizing and assessing key themes from OIG audits, evaluations, special reviews, hotline 

complaints, investigations, and an internal risk assessment, as well as reports published by 

external oversight bodies, such as the Office of Personnel Management (OPM) and the 

Government Accountability Office (GAO). 

Additionally, we reviewed previous management challenge reports to determine if those 

challenges remain significant for this submission. Finally, we considered publicly available 

information and internal Commission records. As a result, we identified five key management 

and performance challenges, which are detailed herein. 
Management and Performance Challenges Facing the FEC in FY 2024 4

Management and Performance Challenge: Human Capital Management

Human capital management is the process of acquiring, training, managing, and retaining 

employees to effectively execute the agency’s mission. In prior management challenge reports 

the OIG identified, among other things, the unusual salary structure of certain senior leaders at 

the Commission (including Commissioners), the practice of agency personnel serving in acting 

positions for extended periods of time, and the Commission’s attempt to address these issues 

through repeated legislative recommendations to Congress. In addition, the OIG has recently 

identified significant challenges at the FEC concerning management of its human capital 

resources, including employee attrition and retention. 

Strategic Human Capital Management: An audit of the FEC’s Human Capital 

Management Program was performed by an independent public accounting firm and overseen by 

the OIG in accordance with generally accepted government auditing standards. The audit found 

that the FEC has not developed a plan that describes how the FEC will strategically manage its 

human capital resources across the agency. Accordingly, the auditors recommended that the 

FEC develop a strategic human capital management program that is informed by the Office of 

Personnel Management (OPM) Human Capital Framework which, according to OPM, is 

essential to effective management. The final report was issued on April 27, 2023, and included 

five recommendations.

FEC management largely disagreed with the auditors’ findings and recommendations, citing 

the non-applicability of certain requirements in 5 C.F.R. Part 250, including the requirement to 

implement and develop a human capital operating plan. Although it may be true that the FEC is 

not required by law to implement certain requirements in Part 250 (which the audit report 

acknowledged), this engagement was conducted as a performance audit and thus, looked beyond 

compliance with regulatory requirements. Relevant government auditing standards provide: 

“Performance audit objectives vary widely and include assessments of program effectiveness, 

economy, and efficiency; internal control; compliance; and prospective analyses.” Accordingly, 

the auditors looked to guidance provided by OPM, which recently opined that: 

Public and private sector studies have shown organizations that 

achieve and sustain excellence in strategic human capital 

management outperform those that do not. The strategic 

management of human capital not only impacts organizational 

performance but can enable the workforce to accelerate progress to 

achieve strategic objectives.

1

We continue to endorse the recommendations that the FEC develop and implement a 

strategic human capital plan in accordance with OPM guidelines, particularly considering 

additional human capital challenges detailed below. 

1 Office of Personnel Management, Human Capital Operating Plan (HCOP) Guidance Fiscal Years 2022-2026, Issued 

December 2021. 
Management and Performance Challenges Facing the FEC in FY 2024 5

Declining Staffing Levels: As a follow up to our audit of the FEC’s Human Capital 

Management Program for Fiscal Year 2022, our office initiated an evaluation on employee 

staffing, hiring, and retention. Despite dramatic increases in campaign expenditures and the 

number of transactions subject to FEC regulation and oversight (see management challenge #2), 

the agency has lost 12% of its workforce since 2010. These reductions have been entirely among 

career agency staff.2

 They include campaign finance analysts, attorneys, and auditors who carry 

out the essential functions of the FEC. The FEC historically has hired only three personnel for 

every four personnel who depart the agency. As shown in the chart below, that dynamic is 

atypical when compared to comparable agencies. 

Figure: Total full time staffing level at the FEC and FedScope group of medium independent agencies from FY 

2010 through FY 2023. FY 2023 staffing levels are as of March 2023. Source: FedScope. 

It is significant that the FEC has reported that performance has been adversely impacted by 

staff shortages and that performance targets have been reduced as a result. For example, the 

agency reported in its most recent budget justification to Congress that it has not met 

performance goals to complete audits and process committee reports on time due to staff 

shortages. 

In addition, Commissioners have frequently alluded to resource limitations in decisions not 

to proceed with enforcement actions. For example, in July 2023, the Commission published 

Statements of Reason for seven MURs in which Commissioners cited resource limitations as a 

factor in deciding not to proceed with enforcement of campaign finance law. These included 

MURs 7464, 7724, 7752, and 8038, which included split 3-3 votes. The FEC OIG is finalizing a 

more detailed evaluation of the proximate and root causes of human capital attrition at the FEC. 

Upon completion, we will publish a final report to our webpage and to Oversight.gov. 

2 The OIG initiated an evaluation on this topic in February 2023 and has issued a draft report to management for comment. 
Management and Performance Challenges Facing the FEC in FY 2024 6

General Staffing Issues: Recent and dramatic changes in workplace dynamics due to the 

COVID-19 pandemic pose many management and performance challenges for the FEC. Federal 

agencies, including the FEC, have implemented various return-to-office policies. The new FEC 

telework policy (that applies only to non-bargaining unit (NBU) employees) requires employees 

to return to the office four to six days each pay period, dependent upon whether an employee has 

supervisory duties.3

 

In contrast, earlier this year, the FEC and National Treasury Employees Union (NTEU) 

reached an impasse in negotiating an updated telework policy for the FEC bargaining unit 

employees. As a result, the Federal Service Impasse Panel recently ordered a telework policy for 

the Bargaining Unit (BU) employees that requires BU employees to return to the office three

days each pay period. Specifically, the Panel concluded that the evidence supported greater 

telework flexibilities for FEC employees on the basis that, inter alia, employee productivity, 

performance, and morale remained the same or increased when employees were afforded greater 

telework opportunities. 

As a result, the current disparity between the number of telework days available to NBU and 

BU employees may create an undesired incentive structure for FEC employees. For example, 

this disparity may cause NBU staff (largely supervisors and managers) to seek alternative 

employment with greater telework opportunities. It may further disincentivize BU employees 

from seeking NBU supervisory positions because doing so would limit their telework 

flexibilities. Those factors will potentially exacerbate the FEC’s existing human capital 

challenges.

4

Additionally, the OIG has observed concerns about the impact of limited telework and 

remote work options on employee morale and attrition during numerous recent engagements. 

Concerns include potential employee turnover, given that greater telework and remote work 

options appear to be permanent expectations for the modern public and private sector

workplaces. As such, many stakeholders at the FEC have expressed concerns that the lack of 

telework and remote work flexibilities will cause FEC employees to seek telework and remote

employment options elsewhere, resign, or retire, if eligible. 

Indeed, according to the 2022 Federal Employment Viewpoint Survey (FEVS) results,5 35% 

of FEC respondents answered yes to the question: “Based on your work unit’s current telework 

or remote work options, are you considering leaving your organization...?” For comparison, 

23% of respondents from the FEC peer group (Small Agencies) answered yes to this question. 

3 The FEC is comprised of 47% NBU employees with an average grade level of GS 13.7. Data retrieved from FEC 

Human Resources and FedScope. 

4 The FEC is comprised of 53% BU employees with an average grade level of 11.6. Data retrieved from FEC Human 

Resources and FedScope. 

5 2022 FEC overview data is available at https://bestplacestowork.org/rankings/detail/?c=LF00. 
Management and Performance Challenges Facing the FEC in FY 2024 7

Commissioner Pay: The Federal Election Campaign Act (FECA) specifies that FEC

Commissioners are to be paid equivalent to level IV of the Executive Schedule; however, 

Executive Schedule pay for political appointees has been largely frozen since 2010.6

 As a result, 

FEC Commissioners receive lower salaries than all Senior Level (SL) staff and most General 

Schedule (GS) staff at levels 14 and 15. In total, Commissioners receive lower compensation 

than 107 FEC employees out of 297 total staff as of March 31, 2023.7

 We expect the percentage 

of FEC staff who earn more than FEC Commissioners to approach 40% by the end of FY 2024. 

This unique salary structure has a direct impact on Commissioner morale and may indirectly 

impact staff morale throughout the agency. The problem is intensified by the high costs of living 

and working in Washington, D.C. that Commissioners must bear to serve term appointments. 

Salary Structure (Staff Director and General Counsel): The FECA sets the Staff 

Director’s pay at Level IV of the Executive Schedule and the General Counsel’s pay at Level V 

of the Executive Schedule. However, Executive Schedule salaries have seen virtually no 

increases since 2010 and have been frozen since 2019. These salary limitations have impeded 

the FEC’s ability to recruit qualified candidates for those positions because candidates with the 

necessary qualifications for such critical positions already occupy higher salaried positions. As a 

result, the senior leadership roles of the Staff Director and Chief Information Officer (CIO) have 

been occupied by the same individual since August 2011. Without a fully dedicated CIO to focus 

on technological issues, to ensure resources are properly allocated, and that adequate processes 

are in place for the protection and safeguards of the agency, the agency will remain at risk. 

Similarly, the Deputy General Counsel for Law is concurrently serving as the Acting General 

Counsel and has been doing so since September 2016. This has potential to put the agency at 

risk of not effectively and efficiently meeting its mission requirements, as robust internal 

dialogue and diversity of opinion are essential to ensuring the agency considers competing legal 

theories and courses of action. 

Both the Staff Director and General Counsel positions supervise personnel at the GS 15 and 

Senior Level pay scales who largely have higher salaries than Levels IV or V of the Executive 

Schedule. This disparity creates significant challenges in recruitment and retention of talent for 

two of the most senior career positions at the FEC. Management previously reported that the 

Commission adopted legislative recommendations and urged Congress to remove the statutory 

references to the Executive Schedule in FECA with respect to the FEC Staff Director and 

General Counsel Positions. The removal of that reference would ensure the two positions be 

compensated under the same schedule as the Commission’s other senior managers and create 

balance and effectiveness in administering and enforcing the federal campaign finance law. 

The foregoing human capital challenges are impacting the FEC’s ability to achieve its 

mission objectives effectively and efficiently. Despite the internal resource constraints and 

emerging external issues beyond the Commission’s control, we encourage the Commission to 

continue to invest in the recruitment of quality employees, training employees, and motivating 

employees to complete mission objectives.

6 From 2010 to 2023, FEC Commissioner positions have received a total 13-year salary increase less than 2% or 

approximately 0.1% per year. 

7 OPM FedScope Federal Workforce Data (March 2023 employment dataset). https://www.fedscope.opm.gov/
Management and Performance Challenges Facing the FEC in FY 2024 8

Management and Performance Challenge: Growth of Election Contributions 

Next year will mark the 50th anniversary of the FEC. Much has changed in that half century. 

In 1976, the first presidential election cycle after the FEC was established, federal campaigns 

raised and spent around $300 million total. In the 2020 presidential election, total campaign 

committee receipts exceeded $27 billion. 

Election Receipts: In recent years, federal election fundraising and spending have increased 

dramatically, particularly since the U.S. Supreme Court’s decision in Citizens United v. FEC in 

2010. Online fundraising, the influence of dark money, and potential foreign electoral influence 

continue to place further strain on the FEC’s ability to provide oversight of federal campaigns. 

Total receipts by regulated committees during presidential years increased from $4.0 billion 

in 2000 to $27.2 billion for the 2020 election cycle, a nearly 7-fold increase. Committee receipts 

for the 2022 mid-term elections reached $16.6 billion, a 5-fold increase over the 2002 total of 

$3.2 billion. 

Figure: Campaign committee receipts reported to the FEC by campaign cycle. Contributions are segmented by

candidate, party/PAC, and “other” committee types. All data is obtained from FEC filings. 
Management and Performance Challenges Facing the FEC in FY 2024 9

It is important to distinguish between total receipts and disbursements by all campaign 

committees and the amount spent on federal campaigns. Campaign fundraising has increasingly 

made use of intermediate committees (ActBlue and WinRed, for example) which pass contributions 

through to ultimate recipients. When this happens, each contribution is recorded twice: once when 

received by the intermediary and once when passed on to the final recipient. 

Because all transactions, receipts, and disbursements are subject to FEC review and oversight, 

this total number of transactions and receipts/disbursements is the appropriate measure of FEC 

workload. The more general question “how much money is being spent on elections?” is better 

answered by removing pass-through contributions to avoid double-counting. For context, the 2020 

presidential election generated over $27 billion in total receipts subject to FEC review. Final 

campaign spending, net of pass-through, was just over $14 billion. 

Regulated Transactions: The total number of transactions subject to FEC regulation and 

oversight has also dramatically increased, especially in recent years. Transactions are reported in 

mandatory filings with the FEC and are comprised of itemized details of receipts (including 

contributions), disbursements (including expenditures), and other financial activity. 

Some highlights of transaction growth, which are further illustrated on the following page, 

include: 

• Between 1978 and 2000, the total number of transactions subject to FEC regulation and 

oversight increased from approximately 340,000 to nearly 2.0 million per election cycle.

• By the 2018 election cycle, the number of transactions handled by the FEC had grown to 

nearly 270 million.

• That number exceed 630 million transactions for the 2020 election cycle and 590 million 

transactions for the 2022 mid-term cycle.
Management and Performance Challenges Facing the FEC in FY 2024 10

FEC Total Transactions (1978 - 2022) 

 

Between 1978 and 2000, the 

total number of transactions subject to 

FEC regulation and oversight increased 

from approximately 340,000 to nearly 

2.0 million per election cycle. 

By 2018, the FEC handled 

nearly 270 million transactions in that 

cycle. That number exceeded 632 

million in 2020 and 590 million for 

2022. 
Management and Performance Challenges Facing the FEC in FY 2024 11

Management and Performance Challenge: Budget

Despite dramatic increases in campaign expenditures and the number of transactions subject 

to FEC regulation and oversight, the Commission’s budget has remained largely static which 

appear to be a root cause of declining staffing levels. Since 2010, the FEC’s budget has 

increased by an average of only 1.6% per year. 

In fact, the agency’s annual budget has decreased when adjusted for inflation. The FEC’s 

2023 budget was approximately 10.6% less than its 2010 budget in current dollars. 
Management and Performance Challenges Facing the FEC in FY 2024 12

One important consideration is that the FEC has generally either not received its full budget 

request, or not requested a meaningful increase to begin with. As a result, since 2010, only four 

out of 13 years have seen budget increases of 1.0% or more. When adjusted for increasing yearover-year costs, the FEC has experienced budget reduction in 10 of 13 years. 

As a result of the FEC’s current budget position, the Commission reported in its recent 

budget justifications to Congress that it has not met performance goals to complete audits and 

process committee reports on time due to staff shortages. In addition, budgetary constraints have 

limited the FEC’s ability to modernize IT resources and keep pace with the growth of campaign 

transactions and costs. As the FEC reported in its FY 2024 Congressional Budget Justification:

Between FY 2016 and FY 2022, the FEC reduced IT operational costs 

and refrained from funding the modernization of certain systems to stay 

within appropriated levels. This has placed strain on IT operations and 

the agency predicts that additional funding is needed during the FY 2024 

presidential election year to continue services at current levels. 

The FEC recently attempted to accelerate hiring but is has presently reduced the rate of 

hiring due to FY 2024 budgetary limitations and uncertainty. Indeed, the FEC would require an 

FY 2024 appropriation of approximately $98.7 million to return to FY 2012 staffing levels 

agency wide (see management challenge #1). The FEC FY 2024 budget request of $93.5 million 

would move the FEC meaningfully toward restoring historical staffing levels.

Management and Performance Challenge: Identifying and 

Regulating Unlawful Foreign Contributions 

Identifying and regulating unlawful foreign campaign contributions continues to pose a 

significant challenge to the FEC. As campaign expenditures and the number of transactions 

subject to FEC regulation and oversight increase, potential contributions by foreign nationals 

also increase, which demands greater scrutiny by agency regulators. However, an August 2021 

OIG report found that the FEC’s practice of relying on filers’ self-certifications concerning 

potential foreign contributions poses a national security risk and provides insufficient oversight 

of possible illegal foreign donations. Indeed, recent and past cases continue to highlight the risk 

of unlawful foreign influence in U.S. elections. 

The FECA, related statutes, and implementing regulations prohibit direct and indirect 

contributions to candidates, political committees, and inaugural committees by foreign nationals. 

As noted above, campaign expenditures and transactions subject to FEC regulation and oversight 

have dramatically increased in recent years. The increase in transactions subject to review, in 

conjunction with declining resources (in real terms), poses a challenge for the FEC in identifying 

and regulating unlawful contributions. 

Moreover, recent and past cases demonstrate that the risk of foreign electoral influence is real 

and not hypothetical. For example, an individual was sentenced in February 2023 by a federal 

judge to 18 months in prison for his role in funneling illegal foreign contributions from a Russian 
Management and Performance Challenges Facing the FEC in FY 2024 13

national to a 2016 presidential campaign. The individual acted as a straw donor8 and contributed 

$25,000 of the Russian national’s money to the campaign, falsely identified himself as the 

contributor. Because the individual falsely claimed to have given the contribution himself, the 

relevant campaign entities unwittingly filed reports with the FEC that inaccurately reported the

individual as the source of the funds. Numerous other reported cases further illustrate the risk. 

Notwithstanding these risks, an August 2021 investigative report by the OIG found that the 

FEC’s current practices provide limited oversight of potential foreign contributions. The OIG 

investigation found that the FEC identifies many potential foreign national donations based on 

the reported addresses of donors, but generally defers to a committee’s self-certification that it 

verified the U.S. citizenship of those donors. However, that practice does not appear to be 

memorialized in policy and relies heavily on the good faith and due diligence of filers. 

Accordingly, the OIG recommended that the FEC update and memorialize its practice 

concerning donors with foreign addresses to identify unlawful foreign donations more 

effectively. In response to the OIG’s recommendation, the agency had proposed to revise its 

internal policy to provide guidance to staff on how to address potential foreign donations. 

Additionally, the agency had proposed to update its Report of Donations Accepted form to 

ensure filers are aware of verification requirements imposed by federal regulation for donations 

and contributions from sources with foreign addresses. However, the Commission did not 

include the revised policy in its February 2023 update, and the form revision is currently 

awaiting Commission approval and guidance. Without Commission action, identifying and 

regulating foreign contributions will likely continue to challenge the FEC. 

Management and Performance Challenge: Cybersecurity

Protecting data, systems, and networks from threats remains a top challenge. The FEC was 

established to protect the integrity of federal campaign finance by providing transparency and 

enforcing and administering federal campaign finance laws. In doing so, the FEC discloses 

campaign finance data to the public and as a result, encounters large volumes of webpage traffic 

from stakeholders and members of the public. In efforts to streamline transparency initiatives 

and improve business processes, the Commission is more technology reliant today, as is society; 

as such, it is imperative that the Commission continue to prioritize cybersecurity. 

Cybersecurity encompasses attempts from criminals and adversaries to obtain sensitive 

information linked to government networks, personal identifiable information, intellectual 

property, and other sensitive data. Cyber threats may arise from phishing, ransomware, or other 

malware attacks and can infiltrate any level within an organization. In response to ever-growing 

threats, the Commission has partnered with the Department of Homeland Security (DHS) and the 

Cybersecurity and Infrastructure Security Agency, an operational component under DHS, to 

improve its overall security posture by identifying, protecting, and responding to network 

vulnerabilities. We encourage the agency to continue to utilize these partnerships and work to 

develop the in-house expertise to protect the network. 

8 A straw donor is a person who illegally uses another person’s money to make a political contribution in their own name. 
Management and Performance Challenges Facing the FEC in FY 2024 14

It is essential that the Commission continue to maintain the integrity and availability of its 

information, as it looks to modernize its systems, which includes moving towards a cloud 

environment. We recognize that federal agencies have struggled to compete with the private 

sector for cyber expertise and talent; however, the Commission should continue to seek and 

adequately compensate industry experts to manage the FEC’s cybersecurity requirements. We

encourage the Commission to continue to be proactive in establishing a cybersecurity framework 

and strengthen internal controls to mitigate external threats from entering the FEC’s network. 

Conclusion

The OIG presents these challenges as ongoing issues facing the FEC in FY 2024. These

challenges impede efficiency and effectiveness in the management of FEC operations and 

programs. The OIG remains dedicated to independent oversight to ensure accountability of the 

mission of the FEC. 

FY 2023 Management Challenges Not Included in FY 2024 Report

All FY 2023 management challenges have been included in this report although some have 

been updated, re-titled, and/or consolidated. 
SEMIANNUAL REPORT to CONGRESS | APRIL 1, 2023 – SEPTEMBER 30, 2023 33

APPENDIX A: PEER REVIEW

Federal Election Commission

Office of the Inspector General

REPORT

FRAUD, WASTE, & ABUSE

OIG Hotline Portal

https://fecoig.ains.com

* Also accessible via: 

http://www.fec.gov/oig

OIG Hotline Phone

202-694-1015

* Available from 9:00 a.m. to 5:00 p.m. 

Eastern Standard Time, Monday through 

Friday, excluding federal holidays.

Or you may call toll free at 1-800-424-9530 (press 0; then dial 1015). You may also file 

a complaint by completing the Hotline Complaint Form (http://www.fec.gov/oig) and 

mailing it to: 1050 First Street, N.E., Suite 1010, Washington DC 20463.
1 

Management’s Response to the Office of Inspector General’s Statement on the 

Federal Election Commission’s Management and Performance Challenges1

November 13, 2023 

In its Statement on the FEC’s Management and Performance Challenges (“Statement”), the Office 

of the Inspector General (“OIG”) identified five overarching management and performance 

challenges for the FEC for Fiscal Year 2024. Management’s response to the OIG’s Statement is 

below. 

Challenge 1: Strategic Human Capital Management

An audit of the FEC’s Human Capital Management Program was performed by an independent 

public accounting firm and overseen by the FEC’s Office of the Inspector General between August 

8, 2022, and March 23, 2023. The overarching recommendation of the auditors was that the FEC 

develop a strategic human capital management (HCM) plan informed by the Office of Personnel 

Management (OPM) Human Capital Operating Plan and Human Capital Framework (HCF) 

guidance. Although Management shares the auditors' commitment to ensuring the FEC's Human 

Capital Management program supports the agency's success in meeting its mission and strategic 

objectives, Management does not agree with the specific recommendations of this audit, including 

the recommendation to develop a strategic HCM plan. 

Management already has plans and programs in place and under development that address relevant 

elements of the OPM's human capital framework. For example, Management performs informal 

and formal workforce assessments, skill gap analyses, and staffing planning on an ongoing basis. 

Succession planning is conducted at the FEC in a manner designed to meet the agency's size and 

recruiting challenges. Management currently maintains effective, decentralized training programs, 

with individual offices determining the necessary trainings for their highly specialized subjectmatter experts. Management already maintains consistency within a well-documented 

performance review system. 

The recommendations included in the audit focus primarily on how activities that address elements 

of the OPM's human capital framework should be documented by the FEC. For example, the 

auditors conclude that, 

"While the FEC has several documents that enumerate some of its human capital 

challenges and how it has worked around some of them as an organization, none of 

those documents single-handedly fulfills the criteria for a HCM plan." 

Management disagrees that creating a document that, “single-handedly fulfills the criteria for a 

HCM plan,” is a requirement for the agency. The requirement to develop and maintain a Human 

Capital Operating Plan does not apply to Non-CFO Act agencies, such as the FEC. In December 

2016, OPM issued new final regulations at 5 CFR part 250, subpart B, Strategic Human Capital 

Management. These regulations require, among other things, that federal agencies as defined at 31 

U.S.C. § 901(6) must develop a Human Capital Operating Plan (HCOP). Notably, the Explanation 

1

 Management consists of the agency’s senior managers, including the Staff Director, Acting General Counsel and Chief 

Financial Officer. 
2 

and Justification for the final rules explains that in response to comments from small agencies 

expressing concern regarding to whom the regulation applied, "OPM revised § 250.201, Coverage 

and Purpose, to explicitly state that Subpart B applies to agencies covered by sec. 901(6) of the 

Chief Financial Officers (CFO) Act of 1990 (Pub. L. 101-576), as well as 5 U.S.C. 1401." See 81 

Fed. Reg. 89,358 (December 12, 2016). Thus, the FEC, like all other Non-CFO Act agencies, is 

excluded from the Strategic Human Capital Management regulatory requirements in part 250, 

subpart B, including the Human Capital Framework (HCF) requirements in section 250.204 and 

Human Capital Operating Plan requirements in section 250.205. As such, the FEC has not 

implemented OPM's HCF, as described in 5 CFR § 250.204, nor has it developed an HCOP, as 

described in 5 CFR § 250.205. 

OPM specifically grants small agencies, like the FEC, greater flexibility in how to utilize their 

limited staff resources in creating and maintaining such documentation. Thus, FEC Management 

will consider the human capital challenges facing the agency and the staff and budgetary resources 

available to address these challenges to determine, in consultation with the Commission, whether 

the FEC's limited resources are best directed toward creating a Human Capital Operating Plan, 

strategic human capital plan or another similar document.

Declining Staffing Levels 

In recent years, the FEC has been challenged to recruit and retain talent necessary to meet the 

agency’s workload and hiring goals, in part as a result of the FEC’s relatively flat funding levels 

over this period. Indeed, between FY 2012 and FY 2022, the FEC’s overall staffing levels were 

reduced by over 17 percent. 

With nearly 70 percent of the agency’s annual obligations composed of expenses related to 

personnel, the agency’s ability to increase or even maintain FTE levels in a given year is 

disproportionately affected by increases in personnel costs, most notably required employee salary 

and benefits increases. The FEC’s appropriation increased by a total of only 4.8 percent between 

FY 2016 and FY 2022. Increases in overall personnel costs and unexpected expenses related to the 

COVID-19 pandemic placed further pressure on the FEC’s budget during FYs 2020 and 2021, and 

into FY 2022. These constraints only served to magnify longer-term staffing challenges for the 

agency. During this period the FEC has been able to meet its statutory mission primarily due to 

efficiencies gained by reassigning staff using details, maximizing operational efficiencies through 

reorganizations, and improving technology and processes, among other efficiencies. However, in 

recent years the FEC has begun to exhaust the benefits that can be gained through such efficiencies 

and has, in some situations, reduced performance targets in response to these reductions in staffing 

amid increasing campaign finance activity. 

The FEC’s ability to complete hiring plans and implement long-term human capital management 

strategies is also impeded by year-over-year funding uncertainty that results from lengthy periods 

under continuing resolutions and appropriation levels that have not kept up with inflation. For 

example, the agency’s current budget does not allow for backfilling all vacated positions, and as a 

result, vacancies are prioritized by leadership and approved for filling by the Personnel Committee 

on an ongoing basis. Hiring managers are advised to keep hiring documents as up-to-date as 

possible, evaluate what their office/division needs regarding staffing, establish relationships with 

recruitment outlets, and move quickly if and when approval is received and it is determined that 
3 

the agency has the funds to fill the position. However, without the ability to hire throughout the 

fiscal year as needed, managers can lose valuable time filling vacancies with interim internal 

appointments and other staffing remedies and may lose opportunities to hire permanently when 

staff is most needed. Moreover, long-term strategic staffing plans cannot easily be developed or 

implemented in an environment that does not allow for predictable hiring projections or for the 

achievement of targets identified in staffing plans. 

While the Commission considers many factors when weighing agency staffing decisions, funding 

constraints represent the most immediate cause of the FEC’s reduced staffing levels. Funding 

constraints affect the agency’s ability to hire in multiple ways. At the most basic level, with higher 

funding levels the FEC is able to bring on additional staff, and with consistently higher funding 

levels the FEC would be able to meet and maintain its staffing goal for FY 2024, which is 340 

FTE. However, with no funding increase in FY 2024 the agency would only strive to maintain 

staffing levels during the fiscal year or temporarily decrease staffing levels through attrition, and 

at continued flat funding through FY 2025 the agency could need to again plan for reduced staffing 

levels. 

General Staffing Issues

The OIG identified the intersection of telework policies and morale as a particular staffing concern. 

In February 2023, following a one-year pilot, the Commission established and approved a new 

Workplace Flexibilities Program for non-bargaining (NBU) employees. This program calls for 

NBU employees to be regularly scheduled to work at the official duty station three to six days per 

pay period, depending upon employees’ positions. Additionally, as the OIG notes, in October 2023 

the Federal Service Impasses Panel imposed a requirement that bargaining unit employees 

participating in regularly scheduled telework must work at the official duty station no less than 

three days per pay period under the permanent Workplace Flexibilities Program for bargaining 

unit (BU) employees, on par with the requirements under the pilot program. The new Workplace 

Flexibilities Programs for both NBU and BU employees provide expanded telework options for 

employees as compared to the agency’s pre-pandemic policies. 

One tool Management uses to understand how workplace changes impact employees is the Office 

of Personnel Management’s (OPM) Federal Employee Viewpoint Survey (FEVS). Management 

recently received preliminary data from the 2023 FEVS and is in the process of analyzing the data 

and preparing it for publication. Upon preliminary review, the FEC’s score on OPM’s Employee 

Engagement Index, which measures employees’ perceptions of senior leaders, supervisors, and the 

intrinsic work experience, held steady from 2022 to 2023 (74%). While the agency has yet to 

receive full data comparison reports for the 2022 FEVS, Management notes that it will continue 

to process the 2023 FEVS data and make information from the survey accessible for review by 

employees at all levels of the organization.

The agency has undertaken significant efforts to increase morale and employee satisfaction across 

the agency, including instituting an Employee Engagement Steering Committee, and supporting 

the implementation of the Diversity, Equity and Inclusion Council. The Engagement Steering 

Committee was established to help foster improved employee engagement across the agency. The 

Steering Committee, through the FEVS results and internal surveys, identifies key areas for 

improvement. Some of the areas that have been identified have been better and more frequent 
4 

communication from Management to staff, more transparency in the hiring and budget processes, 

and suggested improvements with work/life balance issues. The Steering Committee also works 

with offices across the Agency to promote training and development opportunities to the FEC 

workforce and co-sponsors Public Service Recognition Week. The Diversity, Equity and Inclusion 

Council was established to promote diversity, equity and inclusion efforts across the agency. 

Through its efforts, the Council has put on numerous programs and trainings, organized the first 

ever Diversity, Equity and Inclusion Week, and have made several recommendations to help 

improve hiring, promotion, and retention throughout the agency. 

Commissioner Pay

As identified by the OIG, the FEC Commissioners are currently compensated at level IV of the 

Executive Schedule (EX) as specified in FECA. The full compensation for this level in 2023 is 

$183,500. However, the compensation for certain political appointees, including Members of the 

FEC, has been frozen. A pay freeze has been in effect since 2014, which set commissioner pay at 

2013 levels. A small adjustment was made in 2019, which set the frozen pay level at $158,500, 

or 1.9% more than the 2013 amount. EX salaries are uniform nationwide, while the General 

Schedule (GS) salaries include locality adjustments. The relatively high cost of living in the 

Washington, D.C. region means that salaries at the top of the GS scale applicable to FEC 

employees have outpaced frozen salaries on the EX scale. Thus, the pay freeze exacerbates a salary 

discrepancy where commissioners receive less compensation than FEC employees in Senior Level 

(SL) positions, and less compensation than some agency employees in the GS-14 and GS-15 

positions, including many of their direct reports. Under these circumstances, it may be difficult to 

find individuals willing to serve as FEC commissioners in the future, and recruitment will be 

limited to a smaller pool of potential commissioners due to this salary constraint. While FEC 

Management is not responsible for recruiting potential commissioners, the lack of quorum that 

could result from vacant commissioner seats would be a management challenge for the FEC. 

Salary Structure (Staff Director and General Counsel) 

Section 306 of FECA links salaries to Level IV and Level V of the Executive Schedule for the 

Staff Director and General Counsel. Both positions supervise personnel at the GS-15 and Senior 

Level pay scales, which often provide higher salaries than Levels IV and V of the Executive 

Schedule. The Commission has approved a Legislative Recommendation that proposes to remove 

the statutory references to the Executive Schedule and amend FECA to specify that the Staff 

Director and General Counsel would be compensated under the same schedule as the 

Commission’s other senior managers. This revision would remedy the current situation where the 

Commission’s top managers are compensated at a lower rate than many of their direct reports and 

will ensure that the Commission can retain highly qualified individuals to serve in those positions 

as well as enable it to remain competitive in the marketplace for Federal executives when vacancies 

arise.

Management continues to fully support the Commission’s ongoing efforts to change the salary 

structure for key leadership positions of Staff Director and General Counsel. Meanwhile, the 

Commission has implemented interim solutions for these positions that, very importantly, have 

allowed the Commission to maintain consistency and needed stability in its two most senior staff 

leadership positions. Moreover, the Commission has been able to continue to receive the services 
5 

of agency leaders who were selected for these positions after substantial experience working in 

positions of significant responsibility for the FEC. Instability in these positions has been the subject 

of prior management challenges identified by the OIG, and the Commission attributes the stability 

in these positions that has been achieved to the use of the interim solutions. 

Challenge 2: Growth of Election Contributions 

As illustrated in the OIG’s description of this management challenge, increases in the amount of 

money raised and spent in federal elections, and changes in the way political committees raise and 

report contributions, have resulted in a steep growth in the number of campaign finance 

transactions reported to the FEC each election cycle. Campaign finance disclosure data must be 

received, processed and made available to the public within tight deadlines for public disclosure, 

and it must be safeguarded to ensure the integrity and accessibility of the information. Each of 

these transactions represents a data element that must be received by the FEC, added to our 

database and disclosed and made searchable on the FEC website and via the FEC campaign finance 

Application Programming Interface (API). 

The FEC receives campaign finance reports, statements and other disclosure documents from more 

than 16,000 political committees and other filers. During the 2020 election cycle, these filers 

reported more than 600 million financial transactions, which were reviewed by FEC staff and 

disclosed to the public on the FEC’s website and through the agency’s API. This is more than 

double the number of transactions reported in the previous election cycle, and a nearly 400% 

increase compared to 2016, the last presidential election cycle. During the 2022 election cycle, 

these filers reported more than 590 million financial transactions, also which were reviewed by 

FEC staff and disclosed to the public on the FEC's website. This is a nearly 120 percent increase 

compared to 2018, the last nonpresidential election cycle. 

With the steep rise in transactions reported every election cycle comes a heavier burden on the 

FEC’s API to quickly search across the FEC’s campaign finance database and display the data 

requested by the public. The FEC’s API received over 407 million hits during 2020, the last 

presidential election cycle. During 2022, the last nonpresidential election cycle, the API received 

480 million hits. With the steep rise in transactions reported every election cycle comes a heavier 

burden on the FEC’s API to quickly search across the FEC’s campaign finance database and 

display the data requested by the public. Thus, the FEC is facing challenges in processing and 

reviewing historically high levels of campaign finance disclosure information, while satisfying an 

increased demand for customer service and data information requests from the public. 

In FY 2015 the FEC proactively launched a comprehensive, multi-year IT Modernization project

in part in response to projected increases in campaign finance activity. The IT Modernization plan 

outlines reducing the agency’s physical data center footprint by migrating applications to a cloud 

environment, modernizing internal applications, modernizing the electronic filing platform, 

adopting open-source software solutions, and increasing the use of shared services. 

Budget and staffing constraints have limited the FEC’s progress, but the agency has accomplished 

several of the plan’s goals. As part of the FEC’s website redesign, the FEC redesigned its website 

and migrated both the website and the campaign finance database that supports it to a cloud 
6 

environment. In addition to providing faster and easier access to campaign finance data hosted in 

the cloud, this migration allowed the agency to shut down one of its physical data centers during 

FY 2018, realizing attendant costs associated with maintaining that data center. During FY 2020, 

the FEC made additional database enhancements to improve database performance and control 

costs of hosting and maintaining the database. 

During FY 2022, the FEC completed the initial migration of legacy applications to a cloud 

environment. As a result, the agency was able to further reduce its physical data center footprint 

during FY 2023. Planning is underway to modernize mission-critical internal applications to 

ensure they take advantage of all the cost-saving benefits of cloud-native technologies. The trends 

in campaign finance activity of increasing spending, increasing transactions and increasing API 

hits illustrate how crucial it is for the agency to continue to implement new programs and systems 

to ensure the timely disclosure of campaign finance data. The migration of campaign finance data 

to a cloud environment and modernization of applications migrated to the cloud during previous 

fiscal years are essential components of these efforts. Modernizing the applications and data 

pipelines will permit users to utilize all the advantages of the cloud, which will help the agency to 

efficiently, fairly and effectively achieve its mission objectives. Data pipelines are a set of 

automated methods and procedures that process raw data files received from filers into the primary 

campaign database for internal agency use and for public consumption on FEC.gov. They are 

essential to processing and reviewing campaign finance disclosure information in compliance with 

the statutory mandates as well as government-wide customer service initiatives. The data pipeline 

modernization initiative will enhance and streamline the infrastructure and processes that facilitate 

the flow of information received through the eFiling system to internal review applications, like 

RAD Modules, and other systems, then to agency’s public website. By modernizing the data 

pipeline, the FEC can avoid purchasing additional database licenses under the legacy database 

architecture and ensure that it can continue to effectively fulfill its disclosure mission. 

To continue to mitigate an anticipated steep rise in future costs from maintaining physical 

datacenters, the FEC will continue to pursue its IT modernization plan which requires investment 

now and over the next several years to continue cloud migration and realize improvements in its 

IT processes. The FEC will continue to strive to implement the recommendations of this study 

during FY 2024 by modernizing migrated legacy applications to ensure they take full advantage 

of cloud-native technology, with the goal of generating efficiencies in future years while 

maintaining high levels of service to the public. The FEC’s IT Modernization projects comprise 

a multi-year plan to migrate and modernize applications and data assets to a cloud environment in 

order to more effectively process transaction-level data, improve application performance and 

enhance security. The FEC is undertaking these projects primarily to ensure the agency can 

continue to receive, review and publicly disclose the increasing volume of campaign finance 

transactions that are reported.

Efforts to modernize the FEC’s eFiling system are also essential components of the agency’s 

efforts to ensure the timely disclosure of this increasing volume of campaign finance data. The 

FEC is currently working to upgrade its eFiling platform. In FY 2017, the Commission published 

a study of its current eFiling platform, including a survey of the existing functionality of the FEC’s 

free filing software and an in-depth investigation of needs expressed by filers. The FEC is relying 

on the recommendations of this study to improve its eFiling platform to support efforts to improve 
7 

ease of use for this software, make the software platform independent, and increase the 

consistency and accuracy of reporting. 

Once completed, the new eFiling software will be cloud hosted. The new eFiling platform is 

expected to improve data quality and data validation and provide users with inline feedback. The 

redesigned eFiling platform will improve ease of filing for users by allowing greater operating 

system flexibility when generating filings for submission to the Commission. In addition, the 

modernization efforts will provide for seamless integration with the data portion of the website 

and, therefore, more efficient use of the agency’s resources. The FEC will continue development 

work toward a phased public release of the new eFiling platform beginning in FY 2025. 

Challenge 3: Budget 

In its Statement, OIG describes how the FEC’s budget has not kept pace with inflation. Without 

an appropriate level of funding, the agency will be unable to fund several modernization projects 

and hire and retain staff needed to address the increased volume of campaign finance data, 

specifically, and increased FECA related activity, generally. Over the past several years, the FEC 

has advocated for increases to its budget in its annual submissions to Congress. For example, for 

FY 2024 the FEC requested a 4.46 percent increase in its appropriation. 

As the OIG recognizes, the FEC continues to confront a heavy workload alongside relatively flat 

funding levels that have contributed to the reduced staffing levels the FEC has seen over the past 

several years. Over the past decade, the FEC has been able to meet its statutory mission primarily 

due to efficiencies gained by reassigning staff using details, maximizing operational efficiencies 

through reorganizations, and improving technology and processes, among other 

efficiencies. However, in recent years the FEC has begun to exhaust the benefits that can be gained 

through such efficiencies and has, in some situations, reduced performance targets in response to 

these reductions in staffing amid increasing campaign finance activity. The FEC intends to 

continue its current efforts to maintain the current high performance of staff and the excellent 

service that they provide to the public. A critical part of this effort is obtaining adequate funding, 

promoting adequate staffing levels across the agency, and ensuring improvements in the agency’s 

salary structure to be able to compete and retain top talent in leadership positions. 

Challenge 4: Identifying and regulating unlawful foreign contributions 

Management has undertaken a number of actions over the last several years to prioritize 

enforcement of the foreign national prohibition. Along with cases that are statute-of-limitations 

imperiled when OGC receives them, foreign national prohibition cases are assigned to OGC staff 

attorneys before any other class of cases. OGC has also modified its Status of Enforcement reports 

to the Commission so that the Commission is provided with complete data on every foreign 

national prohibition case on a quarterly basis. Further, OGC has revised its procedures so that it 

may more efficiently track the progress of all foreign national prohibition matters through the 

enforcement process. OGC has also modified its case management software to make it easier to 

run reports for the Commission concerning all foreign national prohibition matters. 

Moreover, requirements for committee actions to prevent the receipt of foreign national, or other 

illegal, contributions are extensive. All committee treasurers are required by regulation to examine 

all contributions received for evidence of illegality. 11 C.F.R. 103.3(b). Contributions that present 
8 

genuine questions as to whether they were made by foreign nationals, such as by coming from a 

foreign address or being drawn on a non-U.S. bank, may be, within ten days of receipt, either 

deposited in the campaign depository or returned to the contributor. If deposited, the treasurer 

shall make his or her best efforts to determine the legality of the contribution, including at least 

one written or oral request for evidence of legality. If the contribution cannot be determined to be 

legal, the treasurer shall refund the contribution within 30 days of receipt. 11 C.F.R. 103.3(b)(1). If 

the treasurer determines that the contribution did not appear to be made by a foreign national, but 

later discovers that it is illegal based on new evidence not available at the time of deposit, the 

treasurer shall refund the contribution within 30 days of discovering the illegality. 11 C.F.R. 

103.3(b)(2). Any contribution which appears to be illegal but is deposited in a campaign 

depository may not be used for any disbursements until the contribution has been determined to 

be legal, and the receiving committee must either establish a separate account for such 

contributions or maintain sufficient funds to make any required refunds. 11 C.F.R. 

103.3(b)(4). The treasurer must keep a written record noting the basis for the appearance of 

illegality of any such contribution, and if a committee’s disclosure report is due while resolution 

of a contribution’s legality is still pending, a statement to that effect must be included in the 

disclosure report. 11 C.F.R. 103.3(b)(5).

In another document, OIG has suggested additional requirements for disclosure to the Commission 

about suspected foreign national contributions. However, legal and practical concerns block 

immediate implementation of additional requirements for disclosure. Disclosure of additional 

information would require a legislative change, which of course is solely the purview of 

Congress. Specifics as to what must be reported to the Commission as part of disclosure reports 

are exhaustively described in 52 U.S.C. 30104. Moreover, given that all disclosure reports must 

be made available to the public, 52 U.S.C. 30111(a)(4), reporting of information such as 

contributors’ U.S. passport numbers, as suggested elsewhere by OIG, would potentially raise 

serious privacy concerns. 

The Commission has approved two legislative recommendations to expand the foreign national 

prohibition to encompass a broader scope of activity. The first recommendation is that “Congress 

should revise FECA’s foreign national prohibition to prohibit knowingly helping or assisting a 

foreign national in violating the prohibition.” The second is that “Congress should revise FECA’s 

foreign national prohibition to include state and local ballot initiatives, referenda and any recall 

elections that are not already included in the prohibition.” These recommendations were part of 

the Legislative Recommendations approved by the Commission in December 2022. 

In its Statement, OIG recounts its recommendation that the FEC update and memorialize its 

practice concerning donors with foreign addresses to identify unlawful foreign contributions more 

effectively. That practice is already memorialized and regularly updated. The practice is based 

on a regulation, duly promulgated by the Commission, 11 C.F.R. § 110.20(a)(7), which provides 

a regulatory safe harbor for these situations. The practice is memorialized in the Reports Analysis 

Division’s Policies and Procedures, which are updated for every election cycle and approved by 

the Commission, and which are publicly available on FEC.gov, with certain redactions unrelated 

to this practice. 
9 

Finally, Management notes that as of September 30, 2023, only four cases on OGC-Enforcement 

Division’s docket pertain to FECA’s foreign national prohibition, which is a marked reduction 

over recent years. 

Challenge 5: Cybersecurity

The federal government continues to issue numerous cybersecurity-related initiatives to defend 

against the escalation of cyber-attacks, the increased activity of ransomware compromises and the 

attacks to widespread use of software systems. In response to these ever-growing cybersecurity 

threats, the FEC continually works to improve its security posture to protect its information 

systems.

The Office of the Chief Information Officer secures the Commission’s IT infrastructure against 

the threats of data misuse, destruction and inappropriate disclosures, while ensuring continuity of 

operations in the event of a disaster. The Commission actively secures its IT infrastructure, 

including implementing cybersecurity directives from the Cybersecurity and Infrastructure 

Security Agency (CISA) of the Department of Homeland Security (DHS) as well as 

implementing mandatory security awareness training programs for its employees and 

contractors. In addition, the FEC continues to develop strategies and initiatives relating to risk 

assessments of operations, disaster recovery and continuity of operations in the event of a 

disaster. In 2021, the Commission completed work on the update of its Continuity of Operations 

Plan (COOP) as well as its Disaster Recovery Plan and held tabletop exercises in 2022 and 2023 

to ensure that staff involved in the COOP are adequately trained. Currently, the staff is 

modifying the agency’s Disaster Recovery Plan to incorporate our cloud-based IT assets. 

As noted in the previous paragraph, DHS’s CISA regularly issues numerous cybersecurity 

directives with which federal agencies must comply by the stated deadlines. With only a small 

number of employees who are able to work on information security mandates and remediation 

measures, the Commission must rely on outside vendors to help meet these requirements. 

In 2018, the FEC—and all federal agencies—were directed to fund and implement a governmentwide program to better safeguard information technology assets. (See DHS Binding Operational 

Directive 18-02 (May 7, 2018); available at: https://www.cisa.gov/binding-operational-directive18-02.) This direction was further made mandatory by OMB M-19-03, Strengthening the 

Cybersecurity of Federal Agencies by enhancing the High Value Asset Program, issued on December 

10, 2018. That directive expanded the High Value Asset Program (HVA) to non-CFO agencies and 

therefore, applies to the FEC. DHS’s HVA program requires federal agencies to identify and submit 

lists of their high value assets to DHS, participate in DHS-led assessments, ensure timely remediation 

of identified vulnerabilities and report mitigation plans and progress. Within the agency’s austere 

budget climate, the FEC had made the difficult decision to defer funding for some high-priority 

security projects in favor of yet more pressing agency requirements. As a result, the agency was not 

in a position to execute some cybersecurity initiatives, such as HVA, on the timeline initially 

proposed. In FY2022, however, the agency contracted with a HVA vendor to help the agency comply 

with this mandate and has begun working on this program. 

The Commission continuously improves its security architecture. The Commission’s security 

operation, along with continuous diagnostics and mitigation, allows the agency to identify and 

remediate vulnerabilities. In partnership with DHS and other strategic partners, the FEC identifies, 
10

protects, detects, responds to and recovers from the impact of known and potential security threats. In 

recent years, the FEC has worked with DHS to complete a security architecture review, a risk 

vulnerability assessment, two threat hunts, and a remote penetration test. Of note, the penetration test 

performed on FEC.gov found no major vulnerabilities. Through the engagement with the DHS, the 

FEC has recently implemented various cybersecurity tools, including vulnerability scanning tools 

and mobile threat defense. These engagements with DHS enable the FEC to identify and address 

cybersecurity gaps and thus improve its overall security posture. The FEC also works with vendors to 

ensure security and performance in its internal network. For example, in 2022, it completed an Office 

365 Network Performance Assessment and plans to conduct an Office 365 Security Assessment later 

this year. 

 

The Commission also responds as quickly as possible to executive orders and DHS mandates. For 

example, OMB Memorandum M-23-13, “No TikTok on Government Devices” Implementation 

Guidance, was recently issued to prohibit the use of TikTok on government-owned devices due to 

potential security concerns. In response to this directive, the FEC has implemented various technical 

and administrative controls to ensure compliance, including updating the agency's Rules of Behavior 

and Acceptable Use Standards to explicitly prohibit the use of TikTok on any FEC computing 

resources. 

In 2022, the Commission renewed its general systems Authority to Operate (ATO) after a thorough 

review and audit conducted by the Department of the Interior. It also recently renewed the ATO for 

its legacy eFiling system. As of this writing, the FEC is in the process of renewing the ATO for 

FEC.gov and plans to seek an ATO for its cloud environment. 

The FEC recognizes that perfect security is not feasible; rather, it is a continuing process of detecting 

risks, making process improvements and hardening defenses. For that reason, the benchmark of the 

FEC’s approach to cybersecurity has always been practicability and continuous improvement. The 

FEC’s cybersecurity strategy, noted in the FEC IT Strategic Plan, outlines an approach of securing its 

infrastructure and preventing intrusions through a holistic cybersecurity program led by the Chief 

Information Security Officer (CISO). The strategy implements leading practices for a comprehensive 

cybersecurity from the National Institute for Standards and Technology’s (NIST) Cyber Security 

Framework (CSF) and industry best practices. 

NIST Cyber Security Framework: The CSF functions provide a common language regarding 

cybersecurity issues that can help facilitate important discussions between different organizations and 

encourages effective collaboration and communication with FEC leadership and partner agencies and 

industries. The FEC’s cybersecurity strategy strives to mature the five functions of the NIST CSF: 

Identify: This function seeks to develop a deep understanding to manage cybersecurity risks to 

systems, assets, data and capabilities. The projects in this function are foundational for effective 

use of the framework. Understanding the business context, the resources that support critical 

functions and the related cybersecurity risks will enable the OCIO to focus and prioritize efforts. 

This action will be consistent with the organization’s risk management action plans and business 

objectives. 

Protect: This function seeks to help the team develop and implement the appropriate safeguards to 

ensure delivery of critical infrastructure services. This function supports the ability to limit or 

contain the impact of a potential cybersecurity event.
11

Detect: This function seeks to develop and implement the appropriate activities to identify the 

occurrence of a cybersecurity event. This will enable the OCIO to timely discover a cybersecurity 

event.

Respond: This function seeks to develop and implement the appropriate activities to take action 

regarding a detected cybersecurity event. The respond function supports the ability to contain the 

impact of a potential cybersecurity event.

Recover: This function seeks to develop and implement the appropriate activities to maintain plans 

for resilience and to restore any capabilities or services that were impaired due to a cybersecurity 

event. The recover function supports timely recovery to normal operations to reduce the impact 

from a cybersecurity event. 

Moreover, the goal of the Commission’s IT Strategic Plan is to define a robust, innovative and 

holistic security architecture that mitigates modern threats.

Through rigorous assessment and authorization methods, such as ATOs, and active participation 

in programs such as the DHS Continuous Diagnostics and Mitigation program, the OCIO will 

continue to improve its cybersecurity program and security architecture to safeguard FEC’s 

infrastructure, networks and applications against cyber threats and malicious activities. 

Following NIST guidelines and considering the Commission’s own prioritization and resources, 

the first wave of projects primarily focuses on the “Protect” function to hinder threat actors from 

gaining access to the FEC’s IT assets and data. For example, one project includes strengthening 

perimeter defenses using software-defined perimeter (SDP) and protecting FEC users from 

inadvertently infecting their systems by using a robust end-point security solution. SDP will ensure 

that anyone attempting to access the FEC infrastructure is authenticated and authorized at the 

perimeter prior to being able to access any resources on the network. The FEC will continue to 

implement the most advanced endpoint security solution to combat security threats.

Robust Security Architecture

As a result of, and in support of, the RMF, the FEC’s Office of the Chief Information Officer 

(OCIO) continues to take steps to implement a robust security architecture. For example, in 

partnership with the Department of Homeland Security (DHS), the OCIO has collaborated with 

FEC stakeholders and technical experts to identify, protect, detect and respond to the impact of 

known and unknown threats, continuously assessing security controls and addressing residual and 

new risks. The FEC has also entered into an inter-agency agreement with DHS to participate in 

the Federal Continuous Diagnostics and Mitigation program. By partnering with DHS, the FEC 

is able to leverage that agency’s cybersecurity resources, which would be cost prohibitive for an 

agency of the FEC’s size to procure independently. 

As identified in OIG’s description of this management challenge, the FEC has proactively pursued 

significant joint efforts with DHS over the past two years to better identify and remediate emerging 

threats to the FEC’s systems and networks. In addition, the FEC maintains ongoing information 
12

security efforts, including our security operation center participation in CISA’s Continuous 

Diagnostics and Mitigation (CDM) program, c and security controls to address identified 

cybersecurity gaps. These efforts help to ensure that identified risks are appropriately addressed 

and that its cybersecurity program and security architecture will continue to safeguard the agency’s 

infrastructure, networks, and applications against cyber threats and malicious activities. 

Continuous Monitoring and Mitigation

OCIO Security has worked with DHS to improve security capability by integrating with the 

Continuous Diagnostics and Mitigation (CDM) program. OCIO Security has also introduced the 

use of secure baselining standards, such as the use of Defense Information Systems Agency 

(DISA) Security Technical Implementation Guides (STIGs) and Benchmarks. System hardening 

and secure baselining practices are being expanded in OCIO teams. The OCIO security team has 

developed a privileged user account agreement and recently updated the password policy to add 

administrative controls to supplement the technical access controls. The addition of the new 

password policy and multi-factor authentication (MFA) has improved the security posture of 

authentication types within the FEC’s information systems. 

Cloud-First Initiative

The FEC has also adopted a cloud first initiative for security, accessibility and recoverability. 

The FEC has migrated targeted legacy applications and systems to the cloud. Leveraging cloud 

computing allows the Commission to take advantage of cloud service providers’ significant 

resources and expertise dedicated to maintaining the highest level of security. Hosting 

information, data and systems in the cloud will allow the FEC to better leverage government and 

industry best practices, such as DevSecOps, which improves our security posture by adding 

security mechanisms into the development and operation processes. Adopting a cloud first 

initiative will ultimately result in the consolidation and the modernization of all FEC’s 

application and systems. Moreover, in cloud architecture, the security controls are built into the 

native configuration. 

 

Operating applications in a cloud environment, however, requires specialized design, 

development, and security considerations to ensure both the security of the FEC’s systems and 

the integrity and accessibility of its data. In implementing cloud architecture, it is essential that 

the FEC takes a more comprehensive view of the risk to information systems, establishes a 

governance framework and remediates the vulnerabilities of critical infrastructure. OCIO 

anticipates that it will begin the process of seeking a third-party assessment of its cloud 

environment in order to seek an ATO in 2023, pending funding approval by the Commission. It 

is also necessary that staff possess the necessary skillset to administer the Commission’s cloud 

resources. Seeking the expertise to manage the FEC’s cybersecurity requirements in a cloud 

environment and the growing federal mandates is necessary. 

Building a Cybersecurity Culture

At the same time, the FEC is working to build a cybersecurity culture among its employees. For 

this comprehensive cybersecurity strategy to be successful, the OCIO will partner with federal 

agencies and industry leaders to leverage best practices for our IT workforce. The first line of 
13

defense in maintaining the protection and integrity of the agency’s network is the ongoing 

education of employees about their role in identifying and preventing malicious activities. Efforts 

to build a cybersecurity culture include steps to educate staff about FEC IT security policies and 

to ensure staff awareness of potential cybersecurity threats, such as phishing scams. The FEC 

promotes this cybersecurity culture in part through annual, mandatory IT security trainings and 

through year-round communication and notices to staff from the CISO. This year, the FEC 

continued additional training for all staff to help staff recognize and avoid social engineering 

attempts.

Building Capacity in the Information Security Office

Beyond training its staff, the Commission also seeks to recruit and train talent with cybersecurity 

expertise. In April 2019, the FEC entered into a partnership with the Partnership for Public Service 

to participate in the Cybersecurity Talent Initiative. This selective, cross-sector program, which 

provides loan forgiveness to top bachelors and masters graduates around the United States in 

exchange for two-years’ service at a federal agency, addressed the immediate cybersecurity talent 

deficiency faced by the Commission. With a two-year limit on the fellowship expiring, and in the 

hopes of retaining employees with cybersecurity expertise, the Commission has recently created a 

permanent position to replace this fellowship position and hired a permanent cybersecurity 

specialist. This brought the total staffing level of the Security team up to three employees. The 

Commission’s CISO has recommended that the agency expand its cybersecurity staff further and 

create additional positions in order to address the heightened security risks.