U.S. ENVIRONMENTAL PROTECTION AGENCY 

OFFICE OF INSPECTOR GENERAL 

Catalyst for Improving the Environment 

Briefing Report 

Steps Taken But More Work Needed to 

Strengthen Governance, Increase 

Utilization, and Improve Security 

Planning for the Exchange Network 

Report No. 09-P-0184 

 June 30, 2009 
Report Contributors Rudolph M. Brevard 

 Cheryl Reid 

 David Cofer 

 Anita Mooney 

 Sejal Shah 

 Christina Nelson 

Abbreviations 

ASSERT Automated System Security Evaluation and Remediation Tracking 

CDX Central Data Exchange 

EPA U.S. Environmental Protection Agency 

NIST National Institute for Standards and Technology 

OIG Office of Inspector General 

SP Special Publication 
UNITED STATES ENVIRONMENTAL PROTECTION AGENCY 

WASHINGTON, D.C. 20460 

OFFICE OF 

INSPECTOR GENERAL 

June 30, 2009 

MEMORANDUM 

SUBJECT:	 Steps Taken But More Work Needed to Strengthen Governance, Increase 

Utilization, and Improve Security Planning for the Exchange Network 

Report No. 09-P-0184 

FROM:	 Rudolph M. Brevard 

Director, Information Resources Management Assessments 

TO: Linda Travers 

Acting Assistant Administrator and Chief Information Officer 

Office of Environmental Information 

Lisa Schlosser 

Director, Office of Information Collection 

Office of Environmental Information 

This is our report on the subject audit conducted by the Office of Inspector General (OIG) of the 

U.S. Environmental Protection Agency (EPA). This report consists of the briefing presentation 

we provided to Office of Environmental Information managers on May 4, 2009. This report 

contains findings that describe the problems the OIG has identified and corrective actions the 

OIG recommends. This report represents the opinion of the OIG and does not necessarily 

represent the final EPA position. Final determinations on matters in this report will be made by 

EPA managers in accordance with established audit resolution procedures. 

We sought to determine whether EPA has taken: 

•	 Corrective actions for recommendations made in the audit report Improved Management 

Practices Needed to Increase Use of Exchange Network, Report No. 2007-P-00030 

issued August 20, 2007; and 

•	 Steps to ensure all Exchange Network components comply with federal security 

requirements. 
We conducted this audit from January through May 2009 at EPA Headquarters in Washington, 

DC, in accordance with the generally accepted government auditing standards issued by the 

Comptroller General of the United States. These standards require that we plan and perform the 

audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and 

conclusions. We believe that the evidence obtained provides a reasonable basis for our findings 

and conclusions. 

We interviewed EPA personnel responsible for implementing the corrective actions in the prior 

report and personnel responsible for managing the security activities reviewed. We reviewed 

relevant security documents and evaluated them against prescribed federal and EPA guidance. 

We reviewed self-reported security information entered into the Agency’s Automated System 

Security Evaluation and Remediation Tracking (ASSERT) system and compared it against 

information contained in the provided security documents. 

The estimated cost of this report – calculated by multiplying the project’s staff days by the 

applicable daily full cost billing rates in effect at the time – is $253,562. 

Action Required 

In accordance with EPA Manual 2750, you are required to provide a written response to this 

report. We are requesting your response within 45 calendar days. You should include a 

corrective actions plan for agreed upon actions, including milestone dates. 

We would like to thank your staff for their cooperation. We have no objections to the further 

release of this report to the public. This report will be available at http://www.epa.gov/oig. 

If you or your staff have any questions regarding this report, please contact me at (202) 566-0893 

or brevard.rudy@epa.gov; or Cheryl Reid, Project Manager, at (919) 541-2256 or 

reid.cheryl@epa.gov. 
Steps Taken But More Work Ne

to Strengthen Governance, Incre

Utilization, and Improve Secur

Planning for the Exchange Netw

Results of Review
 

Report No. 09-P-0184 
Objective 1
 

Status of Prior Audit Report Recommendations
 

Report No. 09-P-0184 
Prior Audit Report Recommenda

	 Recommendation 2.1 - Acting Assistant Admin

for Environmental Information execute recently developed Exchange Network Communications Marketing Plan elements that include actively prthe business value of participating in Network into EPA and partner environmental program man

Status - Ongoing and progressing 

Report No. 09-P-0184 
Prior Audit Report Recommenda

(Cont.) 	 Recommendation 2.2 - Acting Assistant Admin

for Environmental Information modify Exchange change management policies and procedures to step-by-step processes for fully testing and certiimplementation tools before release to the ExchNetwork community. 

Status – Completed; published Principles, Rule

Procedures for Change Management on the ExcNetwork, V1.1, February 19, 2009. 

Report No. 09-P-0184 
Prior Audit Report Recommenda

(Cont.) 

	 Recommendation 3.1 - Acting Assistant Admini

for Environmental Information work with ExchangNetwork governance bodies to develop and implprocess that uses the Network Business plan critevaluate data flows for future Network implemen

Status – Completed; published 2009 Annual Exc

Network Grant Program Solicitation Notice, Sept2008. 

Report No. 09-P-0184 
Prior Audit Report Recommenda

(Cont.) 

	 Recommendation 4.1 - Acting Assistant Admini

Environmental Information develop a new milestfor completing the Exchange Network performanmeasures project. 

Status – Completed; first Performance Measure

reported May 2008. 

Report No. 09-P-0184 
Prior Audit Report Recommenda

(Cont.) 	 Recommendation 4.2 - Acting Assistant 

Administrator for Environmental Information devprocedures for establishing ad-hoc workgroups Exchange Network projects. 

Status - Unimplemented 

Report No. 09-P-0184 
Prior Audit Report Recommenda

(Cont.) 	 Recommendation 5.1 - Acting Assistant Admin

for Environmental Information publish standards specify when EPA program offices must use theExchange Network when modernizing or develoapplications. The standards should also specify processes EPA offices must follow when the officannot adhere to the established standards or salternate technology solution to the one prescrib

Status - Unimplemented 

Report No. 09-P-0184 
Prior Audit Report Recommenda

(Cont.) 

	 Recommendation 5.2 - Acting Assistant Admini

Environmental Information include the Exchange and related technologies as part of the Agency’s Enterprise Architecture. 

Status - Unimplemented 

Report No. 09-P-0184 
Prior Audit Report Recommenda

(Cont.) 	 Recommendation 5.3 - Acting Assistant Admin

for Environmental Information have Office of InfoCollection complete its plans to develop a tool ocan use to evaluate their applications in regard tNetwork technologies. 

Status – Completed March 27, 2008; created a 

on Investment Estimator tool for program offices in the early stages of planning new data flows. 

Report No. 09-P-0184 
OIG Recommendations 

The Acting Assistant Administrator for Environmental Information should:
 1. Submit an updated Corrective Action Plan for

unimplemented recommendations 4-2, 5-1, an

2. Update EPA’s Management Audit Tracking Sy

regarding unimplemented recommendations. 

Report No. 09-P-0184 
Objective 2
 

Compliance with Federal Security Requirements
 

Report No. 09-P-0184 
Certification & Accreditation (C&

	 The current Central Data Exchange (CDX) Certi

and Accreditation package is not in compliance federal security requirements because the approsystem security plan, the security assessment reand the plan of action and milestones do not mefederal and agency requirements. 

Report No. 09-P-0184 
Security Plan & Risk Assessmen

	 Minimum Security Controls are not in complianc

latest National Institute for Standards and Techn(NIST) Special Publication (SP) 800-53, Revisio

	 Security plan does not comply with NIST SP 800

Revision 1, because the Minimum Security ContSection does not thoroughly describe how each control is being implemented, or planned to beimplemented. 

	 The latest CDX Risk Assessment, dated Decem

2004, is outdated. 

Report No. 09-P-0184 
Contingency Plan 

	 Record of Changes is not maintained, as require

SP 800-34 guidance and the EPA’s Agency NetSecurity Policy. 

	 Office of Environmental Information did not prov

documentation to (1) support the existence of a plan that meets federal policy or guidance, and personnel have been trained on contingency plaresponsibilities and procedures within the last tw

	 Office of Environmental Information has not con

annual Contingency Plan testing, as required by Contingency Plan, Section 5. Last test was condMarch 2006. 

Report No. 09-P-0184 
ASSERT Reporting 

	 ASSERT reporting for CDX is not accurate. 

Only: 

 33% of the ASSERT data reviewed is support

the corresponding data in the official security 

 25% of the ASSERT assessment entries are 

compliant with NIST SP 800-18, Revision 1. 

	 42% of the control elements evaluated in the 

security plan are compliant with NIST SP 800Revision 1. 

Report No. 09-P-0184 
Vulnerability Scanning 

	 Monthly server full system scans and Patchlink 

are not performed, as required by both EPA and policy and procedures. 

	 Weekly server full system scans are not being 

performed, as required by both EPA and CDX pand procedures. 

Report No. 09-P-0184 
Summary
 

	 Steps needed to ensure the Exchange Network 

recognized as the preferred method for exchanenvironmental information between EPA and its and to strengthen Exchange Network governan

	 Emphasis needed to ensure CDX meets the pre

federal security requirements. 

Without action, management hinders its ability tachieve the desired utilization of the Exchange and ensure the Network is operating without vulnerabilities that could put needed data at risk

Report No. 09-P-0184 
OIG Recommendations
 

The Director, Office of Information Collectioshould: 3. Recertify and reaccredit CDX. 

4. Update the CDX Security Plan to comply with N

800-18, and ensure the plan describes how CDimplements the minimum security controls conNIST SP 800-53. 

5. Conduct a formal, independent risk assessmen

and ensure CDX is reassessed every three yearequired by EPA policy. 

Report No. 09-P-0184 
OIG Recommendations (cont.) 

6.	 Maintain the CDX Contingency Plan Record o

Changes, as required by NIST SP 800-34 guiand EPA’s Network Security Policy. 

7.	 Develop a CDX Contingency Plan training pla

meets federal requirements and ensure perso

contingency plan responsibilities receive requtraining on responsibilities and procedures. 

8.	 Conduct CDX Contingency Plan testing at lea

annually, as required by Agency policy and N

guidance. 

Report No. 09-P-0184 
OIG Recommendations (cont.) 

9. Ensure data entered into ASSERT are support

by the system security plan or by other documreferenced in the system security plan. 

10. Perform required weekly and monthly network 

vulnerability testing, as required by EPA and C

policy and procedures. 

11. Issue an Interim Authorization to Operate CDX 

CDX is reaccredited. 

12. Enter a Plan of Actions and Milestones in the A

information security weakness tracking system recommendations 3 through 11. 

Report No. 09-P-0184