Contractor Integrity: Stronger Safeguards Needed for Contractor Access to Sensitive Information
Published: 2010-09-10T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: In performing agency tasks, contractor employees often require access to sensitive information that must be protected from unauthorized disclosure or misuse. This report assesses the (1) extent to which agency guidance and contracts contain safeguards for contractor access to sensitive information, and (2) adequacy of governmentwide guidance on how agencies are to safeguard sensitive information to which contractors may have access. To conduct this work, GAO identified key attributes involving sensitive-information safeguards, analyzed guidance and met with officials at three agencies selected for their extensive reliance on contractor employees, analyzed 42 of their contract actions for services potentially requiring contractor access to sensitive information, and analyzed the Federal Acquisition Regulation (FAR) and pending FAR changes regarding governmentwide guidance on contractor safeguards for access to sensitive information.
section_title: What GAO Found
paragraphs: GAO's analysis of guidance and contract actions at three agencies found areas where sensitive information is not fully safeguarded and thus may remain at risk of unauthorized disclosure or misuse. The Departments of Defense (DOD), Homeland Security (DHS), and Health and Human Services (HHS) have all supplemented the FAR and developed some guidance and standard contract provisions, but the safeguards available in DOD's and HHS's guidance do not always protect all relevant types of sensitive information contractors may access during contract performance. Also, DOD's, DHS's, and HHS's supplemental FAR guidance do not specify contractor responsibilities for prompt notification to the agency if unauthorized disclosure or misuse occurs. Almost half of the 42 contract actions analyzed lacked clauses or provisions that safeguarded against disclosure and inappropriate use of all potential types of sensitive information that contractors might access during contract performance. Additionally, DOD and HHS lack guidance on the use of nondisclosure agreements, while DHS has found that these help accountability by informing contractors of their responsibilities to safeguard confidentiality and appropriate use and the potential consequences they face from violations. There have been numerous recommendations for improved governmentwide guidance and contract provisions in the FAR, such as prohibiting certain types of contractor personnel from using sensitive information for personal gain. To address some of these areas, regulatory changes are pending to develop standardized approaches and contract clauses in the FAR that agencies could use to safeguard sensitive information, rather than developing such safeguards individually. However, similarly to issues identified in agency guidance, GAO found two key areas the FAR does not yet address. These include (1) agency use of nondisclosure agreements as a condition of contractor access to sensitive information, and (2) the need to establish clear requirements for contractors to promptly notify agencies of unauthorized disclosure and misuse of sensitive information. The ongoing rulemaking process provides an opportunity to address the need for additional FAR guidance in both areas.
section_title: What GAO Recommends
paragraphs: GAO recommends that the Office of Federal Procurement Policy (OFPP) ensure pending changes to the FAR address two additional safeguards for contractor access to sensitive information: the use of nondisclosure agreements and prompt notification of unauthorized disclosure or misuse of sensitive information. In oral comments, OFPP agreed with the recommendations. DHS also concurred with the recommendations, while DOD and HHS had no comment.

section_title: Letter
paragraphs: To a great extent, federal agencies rely on support contractor employees  to help accomplish a broad array of complex and mission-critical  functions. In carrying out their day-to-day tasks for federal agencies in  what the Office of Management and Budget (OMB) calls the multisector  workforce, contractor employees often require extensive access to and  use of sensitive government information. Protection of sensitive  information is critical because unauthorized disclosure can erode the  integrity of government operations and lead to situations in which that  information is misused for private gain, potentially harming important  interests such as the privacy of individuals, commercial business  proprietary rights, national security, and law enforcement. The risks  associated with contractor misuse of sensitive information have been the  subject of media attention, such as a recent case involving a contractor  employee’s theft of names, Social Security numbers, and dates of birth for  Transportation Security Administration airport employees in Boston and a  case involving State Department contractor employees’ unauthorized  viewing of the electronic passport files of three 2008 presidential  candidates.
With the growth in use of contractors supporting government operations,  the question of how best to limit contractor misuse and unauthorized  disclosure of sensitive information becomes increasingly important. Many  of the rules governing how contractors operate are articulated in the  Federal Acquisition Regulations (FAR) system, which establishes uniform  policies and procedures for acquisition of supplies and services by all  executive agencies. It consists of the FAR and agency-specific regulations  that supplement and implement the FAR with additional guidance to meet  specific needs of the agencies. In its 2007 report, the Acquisition Advisory  Panel reported a concern that not all federal agencies had established  guidance for how support-services contractor employees should protect  sensitive information such as confidential or proprietary data from release  or improper use. The panel concluded that substantial benefits could be  achieved if governmentwide guidance and contract clauses were  developed in the FAR that federal agencies could use to protect sensitive  information, rather than having agencies develop such clauses  individually. Our work has reported similar concerns and is generally  consistent with the panel’s recommendations about the proper role of  contractor employees in the multisector workforce.
Given the government’s reliance on contractors and their access to  sensitive information, you asked us to review safeguards in the federal  acquisition system to manage risks and control contractor access to  sensitive information. Specifically, we assessed the (1) extent to which  agency guidance and contracts contain safeguards for contractor access to  sensitive information, and (2) adequacy of governmentwide guidance in  the FAR on how agencies are to contractually safeguard sensitive  information to which contractor employees may have access.
To assess agency guidance and contracts relating to contractor access to  sensitive information, we analyzed the type of information agencies  identify as requiring protection; limiting its disclosure; and prohibiting its  misuse based on (1) review of agency practices related to controls over  contractor access to sensitive information, (2) review of applicable  standards drawn from GAO’s Standards for Internal Controls in the  Federal Government, and (3) discussions with government security and  contracting officials responsible for administrative, information, and  contractor personnel security functions. To assess the extent to which  agency guidance required the use of contract clauses and provisions to  safeguard sensitive information, we selected three agencies that rank  among the top procurers of contracted services in fiscal year 2008 and that  our prior work shows rely extensively on contractors—the (1) Department  of Defense (DOD), (2) Department of Homeland Security (DHS), and (3)  Department of Health and Human Services (HHS). At all three agencies,  we analyzed agency FAR supplements as well as policy and guidance  regarding sensitive information safeguards. We also interviewed  acquisition policy, security, and privacy officials to discuss their  supplements to the FAR and the contract provisions they use to meet their  specific agency needs. To assess the extent to which agency contracts  contain such safeguards, we analyzed contract actions for services  potentially requiring contractor access to sensitive information at DOD,  DHS, and HHS. More specifically, at each of five organizational locations  at DOD, DHS, and HHS, we analyzed documentation for a  nongeneralizable sample of 6 to 10 (for a total of 42) contract actions for  support services, selected because they involve contractors working in  close proximity to government employees and to provide a cross section  of services contracts to review by type and functions performed. The  purpose of this contract analysis was to determine whether they contained  contract provisions consistent with attributes we identified for  safeguarding sensitive information from unauthorized contractor  disclosure and misuse. We used content analysis to classify and code the  information in the contract documents. Two GAO analysts independently  reviewed the provisions and clauses in each contract or task order and  then reconciled any differences in how they were coded. For nine of the  contract actions that we judgmentally selected for in-depth case studies,  we also interviewed officials, such as contracting officers, program  managers, contracting officers’ representatives, and security and privacy  officials.
To assess the adequacy of governmentwide guidance, we analyzed FAR  requirements that prescribe protections associated with sensitive  information. We also reviewed proposed and pending amendments to the  FAR. To further understand steps being taken to amend the FAR, we  interviewed officials at the Office of Federal Procurement Policy (OFPP)  in OMB and other agencies with FAR Council membership. We conducted  this performance audit from May 2009 through September 2010 in  accordance with generally accepted government auditing standards. Those  standards require that we plan and perform the audit to obtain sufficient,  appropriate evidence to provide a reasonable basis for our findings and  conclusions based on our audit objectives. We believe that the evidence  obtained provides a reasonable basis for our findings and conclusions  based on our audit objectives. Additional details of our objectives, scope,  and methodology are included in appendix I.
subsections: section_title: Background
paragraphs: Unauthorized disclosure of sensitive information by government or  contractor employees through negligence or misconduct can have a  significant effect on the government’s ability to perform its primary  functions, potentially resulting in financial loss, damaged reputation, and  loss of public trust. Sensitive information may not always be explicitly  designated or marked as such. For the purposes of this report, we use the  term “sensitive information” to generally refer to information under an  agency’s authority or control that has a degree of confidentiality such that  its loss, misuse, unauthorized access, or modification could compromise  that confidentiality and harm important interests, such as personal and  medical privacy to which individuals are entitled under laws, national  security, law enforcement, proprietary commercial rights, or the conduct  of agency programs.
The large but unquantifiable amount of sensitive information generated by  the government makes understanding its scope more difficult and  agencies’ safeguarding this information from unauthorized disclosure or  inappropriate use by contractors a complex challenge. Table 1 shows  examples of several types of sensitive information. Additional examples  are listed in appendix II. All examples were drawn from a myriad of  designations that agencies use to describe sensitive information.
The federal government uses a variety of means, whether prescribed by  statute, executive order, or other authority, to limit dissemination and  protect against the inadvertent disclosure of certain types of sensitive  information. For information the government considers critical to our  national security, the government may take steps to protect such  information by classifying it as Top Secret, Secret, or Confidential  pursuant to criteria established by law and executive order. Information  that does not meet the thresholds established for classification as national  security information but that an agency nonetheless considers sufficiently  sensitive to warrant restricted dissemination has generally been referred  to as sensitive but unclassified (SBU). In designating information this way,  agencies determine that the information they use must therefore be  safeguarded from public release. Some, but not all, SBU designations used  by agencies have a specific basis in statute.
For example, some agencies use the provisions of the Freedom of  Information Act (FOIA) as their basis for designating information as SBU.  FOIA establishes that federal agencies must generally provide the public  with access to government information, thus enabling them to learn about  government operations and decisions. FOIA establishes a legal right of  access to government records and information, on the basis of the  principles of openness and accountability in government. But the act also  prescribes nine specific categories of information that are exempt from  disclosure: for example, trade secrets and certain privileged commercial  or financial information, certain personnel and medical files, and certain  law enforcement records or information. Thus the need to safeguard  sensitive information from public disclosure while striking the appropriate  balance with the goal of government transparency is another challenge  agencies must continually address. Protecting legitimate security, law  enforcement, and privacy interests also must be carefully balanced with  protecting civil liberties. Of critical importance are providing clear rules to  those who handle sensitive information and ensuring that the handling and  dissemination of information is not restricted unless there is compelling  need.
Government ethics rules prohibit federal employees from using sensitive  nonpublic information, defined below, for personal gain or to further the  interests of another, whether by advice or recommendation or through  knowing unauthorized disclosure. For federal employees, certain activities  and acts that affect a personal financial interest may also result in  violations of criminal law with potentially serious consequences, including  dismissal, prosecution, fines, and imprisonment. Because not all  government ethics rules and related statutes apply to contractors, many of  these prohibitions do not extend to contractor employees working in the  multisector workforce.
Nonpublic Information as Defined in Government Ethics Rules  Nonpublic information is information that the employee gains by reason of federal  employment and that s/he knows or reasonably should know has not been made  available to the general public. It includes information that s/he knows or reasonably  should know:  1.
Is routinely exempt from disclosure under the Freedom of Information Act, codified  at 5 U.S.C. § 552, or otherwise protected from disclosure by statute, Executive order  or regulation;  2. Is designated as confidential by an agency; or  3.  Has not actually been disseminated to the general public and is not authorized to be  made available to the public on request.
section_title: Safeguards to Protect Sensitive Information Not Always Available in Agency Guidance or Included in Contract Actions
paragraphs: Our analysis of guidance and contract actions at three agencies found  areas where sensitive information is not fully safeguarded and thus may  remain at risk of unauthorized disclosure or misuse. DHS, DOD, and HHS  FAR supplements include some guidance and standard contract  provisions—for example that address contractor safeguards for personal  information. However, the policies and procedures available in DOD’s and  HHS’s FAR guidance do not contain effective agency management controls  for sensitive information needed to help ensure contractor compliance,  prevent contractor disclosure and misuse, and promote contractor  accountability. Such guidance could help contracting and program  officials incorporate safeguards into their contract actions for protecting  all types of relevant sensitive information contractors may access, such as  agency sensitive information. At the contract level, almost half of the 42  contract actions reviewed did not include solicitation and contract  provisions that safeguarded against unauthorized contractor disclosure  and inappropriate use of sensitive information contractors may access in  program offices during the course of contract performance. In cases  where there was agency policy to include contract provisions to protect  sensitive information on all contracts, such as regarding the medical  privacy of individuals, it was not incorporated in 5 of the 42 contract  actions that we reviewed. Additionally, DOD and HHS lack guidance on  the use of nondisclosure agreements, while DHS has found that these help  improve accountability by informing contractors of their responsibilities  and the consequences that may result from their failure to meet those  responsibilities.
subsections: section_title: Attributes of Safeguards Needed in Agency Guidance and Contracts to Protect Sensitive Information
paragraphs: Contractor and subcontractor employees can be responsible for carrying  out a range of mission-critical tasks—including studying ways to acquire  desired capabilities, developing contract requirements, and advising or  assisting on source selection, budget planning, financial management, and  regulations development—potentially requiring access to many types of  sensitive information. Agencies can use their FAR supplement authority to  issue guidance, which may include contract provisions to establish  contractor responsibility for safeguarding sensitive information.
Review of agency practices and discussions with government security and  contracting officials identified three key attributes for assessing the extent  that agencies’ guidance or the FAR contain effective safeguards for  sensitive information in acquisition guidance and contracts. On the basis  of these sources, in order to have more effective safeguards in place,  contracts should contain provisions that (1) describe the relevant scope of  sensitive information under the agency’s authority or control that should  be protected if contractors require access to it for contract purposes;   (2) require the contractor to refrain from disclosing such sensitive  information to anyone except as needed for contract performance; and   (3) address conflicts of interest or other misuse by prohibiting the  contractor from using such sensitive information for any purpose other  than contract performance.
Agency FAR guidance should help contracting and program officials  incorporate effective safeguards for sensitive information into their  contract actions by including certain management control practices. We  identified a range of management control practices sometimes  incorporated into acquisition guidance to help prevent contractor  disclosure and misuse, and promote contractor accountability for sensitive  information breaches that harm important interests. These control  practices include requiring contractors to (1) train or inform employees on  their obligations to maintain confidentiality and not misuse sensitive  information; (2) obtain written consent from the agency to disclose  sensitive information; (3) pass sensitive information provisions to  subcontractors; (4) execute a nondisclosure agreement for each employee  and subcontractor as a condition of access to sensitive information;   (5) promptly notify key agency officials of the misuse or unauthorized  disclosure of sensitive information; and (6) be informed of the  consequences for violations.
section_title: Agency Guidance for Two of Three Agencies Reviewed Lacks Needed Safeguards for Contractor Protection of Sensitive Information
paragraphs: Our review found DOD, DHS, and HHS all have guidance that supplements  the FAR and addresses requirements or standard contract provisions for  contractor protection of certain categories of sensitive information. For  example, DOD supplements the protection of individual privacy  requirements contained in the FAR by incorporating references to the  agency rules and regulations. HHS also supplements the FAR with  detailed policy that establishes Privacy Act requirements and requires the  inclusion of contract provisions to protect the confidentiality of records  and the privacy of individuals in contracts where the Privacy Act is not  applicable but the contract would involve the collection of individually  identifiable personal information by the contractors.
However, with respect to other key attributes available in agency FAR  policies and procedures reviewed at DOD, DHS, and HHS, the agencies’  guidance differs in how well they help contracting and program officials  incorporate necessary safeguards for sensitive information into their  contract actions. Of the guidance analyzed at the three agencies, only DHS  established effective management control practices through standard  contract provisions in its FAR supplement and related guidance requiring  contractors to safeguard sensitive information accessed by employees. In  contrast, the FAR guidance of DOD and HHS does not contain effective  agency management controls for sensitive information needed to help  ensure contractor compliance, prevent contractor disclosure and misuse,  and promote contractor accountability. (See app. III for the standard  contract provisions we identified in DHS, DOD, and HHS FAR  supplements.)
As shown in table 2, our analysis of agency guidance included in the DHS  FAR supplement found that it contained five of six effective management  control practices consistent with key attributes for establishing safeguards  for sensitive information. For example, the DHS FAR supplement and  related guidance aims to (1) make contractors aware of their  responsibilities for maintaining confidentiality of sensitive information;   (2) address conflicts of interest and potential misuse by prohibiting use of  agency information processed, stored, or transmitted by the contractor for  any purpose other than contract performance; and (3) deter  noncompliance with these requirements and ensure accountability by  explaining consequences related to violations. According to agency  acquisition policy officials, recognition within DHS of the need for  contractor safeguards for homeland security–sensitive information likely  led to the establishment of extensive requirements when the agency  updated its interim FAR supplement and related guidance in 2006. On the  other hand, DHS acquisition policy and security officials acknowledge that  the agency’s FAR supplement and contract clause do not directly specify  contractor responsibilities for promptly notifying contracting officers of  unauthorized use or disclosure of sensitive information. Prompt  contractor notification to key government officials is critical to avoid  internal delays that would prevent officials from being aware of the  unauthorized use or disclosure; delay agency decisions about how to  respond; and deny the opportunity for affected parties to take precautions.
DHS’s guidance establishes stronger safeguards for sensitive information  than what we found at DOD and HHS in their FAR supplements. In  contrast with the DHS guidance, the analysis in table 2 shows that DOD’s  FAR supplement does not include the same amount of detail as to how  contractors are to safeguard sensitive information. At present, DOD’s FAR  supplement is limited to requiring the use of a disclosure of information  clause in solicitations and contracts when contractors have access to  unclassified information that may be sensitive and inappropriate for  release to the public—for example, DOD officials said the clause  authorizes use in a contractor’s press and marketing materials. In  addition, since HHS revised its FAR supplement as of January 2010,  guidance and a contract provision that required contractors to obtain  written consent before disclosing certain kinds of sensitive information— not already subject to FAR and agency privacy restrictions—was deleted  in its entirety. According to the director for acquisition policy, HHS  deleted the “Confidentiality of Information” clause because the need for  agency guidance will be obviated by pending changes to the FAR expected  later in 2010.
Besides the supplemental FAR guidance, agencies have developed other  policies and control practices to establish additional contractor  responsibilities for safeguarding certain categories of sensitive  information obtained during contract performance. For example, a 2007  privacy breach involving a DOD contractor that potentially compromised  the personal health information of 580,000 households led the privacy  office in DOD’s component agency TRICARE Management Activity (TMA)  to determine that the agency’s contract provisions did not adequately  protect sensitive information. According to the TMA privacy office  director, most TMA contracts before 2007 did not specifically require the  contractor to safeguard personal health information, notify DOD or  beneficiaries of privacy breaches, or to mitigate any harm, such as paying  for the cost of free credit monitoring to affected individuals.
To address this problem, TMA has required since 2007 that standard  contract provisions be included whenever a contract is awarded that  requires either the use of or access to personal information. The required  contract language is posted on TMA’s Web site and imposes protections  for the privacy and security of personally identifiable information and  protected health information. It seeks to ensure that contractors  understand their responsibility in protecting TRICARE beneficiaries’  sensitive information. Similarly, HHS’s Centers for Medicare and Medicaid  Services (CMS) issued an acquisition policy and procedure notice, which  took effect in 2005, to advise contracting staff of the requirement to use a  clause for contractor protection of health information. This standard CMS  clause had been revised to integrate the HIPAA security standards along  with the privacy standards that were previously adopted in standard  contract provisions.
section_title: Almost Half of Contract Actions Reviewed Lack Contract Provisions That Fully Safeguard Sensitive Information
paragraphs: For our analysis of contract documents for 42 contract actions at DHS,  DOD, and HHS that involved contractor employees supporting mission- critical tasks, in order to be considered to fully safeguard all types of  sensitive information, a contract had to contain provisions that specifically  required contractors to refrain from (1) disclosing sensitive information to  anyone except as needed for contract performance and (2) using such  sensitive information for any purpose other than contract performance. In  addition, the provisions had to cover the relevant types of sensitive  information that may be accessed by a contractor during performance. As  shown in table 3, our analysis found that slightly more than half of  contract actions reviewed—23 of 42—contained contract provisions that  fully safeguard the confidentiality and appropriate use of all types of  sensitive information. In contrast, the remaining 19 contract actions  reviewed did not extend safeguards to all relevant types of sensitive  information that contractors may have had access to through the program  offices they support. In the absence of such safeguards, there is higher risk  of unauthorized disclosure or misuse of sensitive information by  contractors.
Of the 19 contracts reviewed that did not have provisions for all  safeguards, our content analysis found that one HHS blanket purchase  agreement and an associated order we reviewed contained no evidence of  contract provisions for contractor safeguarding of sensitive information,  except for standard FAR clauses related to the Privacy Act in the base  contract. In addition, some contract provisions included in 18 other  contract actions provided too few safeguards, given the range of tasks  being performed and the potential opportunities to gain access to many  types of sensitive information. For example, at HHS several contract  actions specified that contractors must safeguard certain types of sensitive  information, but did not specify contractor protection of agency-sensitive  information from nondisclosure or misuse. In other cases, clauses  addressed limitations on the disclosure of certain types of sensitive  information, but not its misuse, and therefore did not fully safeguard these  types of information. Some HHS contract actions require that contractors  perform acquisition functions related to other contractors, such as  strategic planning in support of future task awards or auditing business  proposals, and thus could require access to proprietary information. These  contract actions did not always include safeguards addressing limits on  unauthorized disclosure and misuse of proprietary information. Similarly,  several DOD contract actions included provisions to prevent contractors  from disclosing any nonpublic information they obtained during contract  performance, but provisions to prohibit contractors from misusing the  information for purposes other than contract performance were absent.
In cases where there was agency policy to include specific contract  provisions to protect sensitive information, it was not incorporated in five  of the contract actions we reviewed. For example, 3 DHS task orders of  the 14 contract actions reviewed did not include the contract clause  required when contractors need recurring access to government facilities  or sensitive information. At HHS, 2 task orders of the 10 contract actions  reviewed did not include standard contract provisions regarding HIPAA  privacy and security standards required by agency policy to be in all  contracts.
section_title: Two of Three Agencies Reviewed Lack Guidance on Using Contractor Nondisclosure Agreements for Full Range of Sensitive Information
paragraphs: Several of the contract actions we reviewed used nondisclosure  agreements as a mechanism to help protect sensitive information from  conflicts of interest and preserve its confidentiality. These agreements  generally outline the exchange of confidential information or knowledge  that at least two parties need to share for certain purposes, but wish to  restrict access to by third parties. When used by agencies as a condition of  contractor access to sensitive information, a nondisclosure agreement  may serve several important accountability purposes. These include  informing contractor employees and subcontractors of (1) the trust that is  placed in them by providing them access to sensitive information; (2) their  responsibilities to protect that information from unauthorized disclosure  and use; and (3) the consequences that may result from their failure to  meet those responsibilities.
All of the agencies we reviewed had established guidance requiring  contractor employees participating in source-selection activities to sign an  agreement to not disclose procurement sensitive, proprietary, or source- selection information. Beyond addressing this one area of sensitive  information however, only DHS and TMA (in DOD) had guidance requiring  the use of standard contractor nondisclosure agreements for a broader  range of sensitive information that may be handled by contractors. Under  the DHS and TMA guidance, certain contracts are to contain provisions  that require contractors to submit to a designated agency official an  executed nondisclosure agreement for each employee and subcontractor  within a stipulated time following contract award or before they are given  access to certain types of agency sensitive information. Appendix IV  provides examples of standard nondisclosure agreements we reviewed.
DHS and TMA security and acquisition policy officials responsible for  jointly developing agency guidance on nondisclosure agreements view  these agreements as critical to promoting contractor accountability.
According to the DHS administrative security chief, the agencywide  nondisclosure agreement was developed in coordination with agency  acquisition policy, information technology (IT) security, and privacy  officials to educate contractor personnel on the agency’s standards for  safeguarding sensitive information and provide a mechanism to hold them  accountable should they violate the terms of the agreement. The  agencywide form was also developed to eliminate use of nonstandard  forms to cover different types of sensitive information that were causing  confusion and required contractor employees to sign multiple forms.  According to DOD’s acquisition executive for TMA, having contractor  employees sign nondisclosure agreements provides additional benefits for  the government by (1) requiring that contractors will protect and not  disclose sensitive information; (2) protecting against conflicts of interest  that could occur if contractors use sensitive information for future  competitive advantage; and (3) making contractors and their employees  aware of the government’s expectations and their obligations to safeguard  sensitive information.
As shown in table 4, due to the agencywide use of nondisclosure  agreements at DHS and DOD’s TMA, 20 of 42 contract actions reviewed  contained contract provisions requiring nondisclosure agreements for  each employee and subcontractor. All 10 of the Air Force contracts  reviewed and 1 contract at HHS required contractors to enter into third- party agreements with other contractors about the confidentiality and use  of their proprietary information obtained during contract performance.
One case study of an Air Force contract illustrated the practical challenges  for agency monitoring of such third-party agreements in contrast to agency  use of its own contractor nondisclosure agreements. In this case study,  although the contractor’s conflict of interest mitigation plan indicated the  company maintained nondisclosure agreements and proprietary  protection agreements with many third-party contractors, no copies of  executed nondisclosure agreements were available from the Air Force  contracting and program officials responsible for administering the  contract. In addition, officials told us they knew that the contractor had  entered into such agreements, but they had not reviewed them.
We discussed a less challenging approach for implementing agency  contractor nondisclosure agreements with the Department of the  Treasury’s (Treasury) contract administrator responsible for management  and oversight of contractors and financial agents supporting the Troubled  Asset Relief Program (TARP). He agrees with DHS and TMA views that  nondisclosure agreements are critical to promoting contractor  accountability for maintaining confidentiality of sensitive information and  providing other benefits, such as helping to prevent conflicts of interest  that could arise from contractor misuse of the information. Treasury uses  an alternative way to implement these agreements that reduces  administrative burden without compromising contractor compliance for  their use. Language included in certain TARP Financial Agency  Agreements requires the financial agent to have each employee and all  affiliate and contractor personnel to whom nonpublic information is or  may be disclosed execute the agency’s nondisclosure agreement form— included as an exhibit to the agreement—as a condition of access to  sensitive government information. According to the Treasury official, it is  better to have the contractor responsible for retaining the executed  agreements in its own files, rather than have the government contracting  officer or program office retain them. The official explained that as long as  the terms of the contract require contractors to certify to the government  they have collected the agency’s nondisclosure agreement for all  individuals they assign to perform on the contract, and the agreements are  available to the government for inspection, it is better to hold contractors  accountable for retaining the signed agreements.
section_title: Efforts Underway to Improve Governmentwide Guidance in the FAR for Contractor Access to Sensitive Information
paragraphs: The FAR Council in recent years has made progress improving guidance  for security and oversight related to contractor access to sensitive  government facilities and information systems, but challenges remain.  While the FAR establishes governmentwide guidance on certain  contractor sensitive-information safeguards prescribed in statute—for  example, to require contractor protection of individual privacy—FAR  guidance does not address certain key areas relating to contractor access  to sensitive information. Several amendments are pending before the FAR  Council to implement recommended changes and to improve FAR  guidance in the complex areas involving contractor access to sensitive  information. Such changes to the FAR could provide agencies clear  guidance on the use of contractor nondisclosure agreements as a  condition of access to sensitive information and could include  requirements for contractors to promptly notify agencies of unauthorized  disclosure and misuse of sensitive information to enable timely decisions  regarding an agency’s response when use of sensitive information is  compromised. With the rulemaking process underway to develop these  amendments, the FAR Council has an opportunity to consider additional  changes to strengthen FAR guidance to ensure remaining gaps in  contractor safeguards identified in this review are addressed.
subsections: section_title: Governmentwide Guidance Currently Addresses Certain Contractor Safeguards for Sensitive Information
paragraphs: The FAR is the primary regulation that provides uniform policies and  procedures for acquisitions by executive agencies. During the acquisition  process, the FAR emphasizes basic planning that has to be coordinated  among agency personnel responsible for significant aspects of the  acquisition, such as contracting, fiscal, legal, and technical personnel. In  describing agency needs during acquisition planning, the FAR directs  agencies to address all significant considerations that will control each  acquisition, including security considerations for acquisitions requiring  routine contractor physical access to a federal facility or IT system.
The FAR has several provisions that establish policy and contract clauses  implementing requirements prescribed in statute or executive order for  contractor protection of certain categories of sensitive information, such  as information related to the privacy of individuals. When these FAR  provisions, which are described in table 5, are applicable, certain sensitive- information requirements are included in solicitation and contract  provisions that are intended to safeguard procurement integrity, classified  information, organizational conflicts of interest, and privacy. Agencies  use this guidance to incorporate requirements during acquisition planning  and when describing agency needs.
Finally, to address the need for improved governmentwide contracting  guidance required by presidential directive or law and to assist agencies in  addressing identified risks from contractor access to sensitive federal  facilities and information systems, OFPP and the FAR Council revised  contractor personnel and IT security requirements in the FAR. Key aspects  of the revised contractor personnel and IT security safeguards are  summarized as follows:    Securing personal identity verification of contractor personnel—in 2007  the FAR was amended in part to implement the August 2004 Homeland  Security Presidential Directive 12 (HSPD-12), which required the  establishment of a governmentwide standard for secure and reliable forms  of identification for federal employees and contractors alike.  Implementing HSPD-12 requirements through contract provisions may  help address the risks of contractors gaining unauthorized physical or  electronic access to federal information or contractors using outmoded  identification cards that can be easily forged, stolen, or altered to allow  unauthorized access.
Strengthening federal information security oversight of contractor IT  operations—in 2005 an interim rule amended the FAR to implement the  Federal Information Security Management Act of 2002 (FISMA)  information-technology-security provisions. According to the FAR  Council, the addition of specific FISMA-related provisions was intended to  provide clear, consistent guidance to acquisition officials and program  managers, and to encourage and strengthen communication with IT  security officials, chief information officers, and other affected parties.
See appendix V for greater detail on these changes to the FAR.
section_title: Addition of Recommended Changes in FAR Contract Provisions Underway to Improve Sensitive Information Safeguards
paragraphs: There have been numerous recommendations in recent years for improved  governmentwide guidance and contract provisions for contractor  protection of sensitive information. The emphasis has been on  standardizing approaches and establishing accountability mechanisms  when access to information is compromised. Problems and  recommendations to address them include the following:  In 2007, the Acquisition Advisory Panel found that increased use of  contractor employees in the government workforce to support the  evaluation of other contractors raises questions regarding the potential for  organizational conflicts of interest and how to preserve the confidentiality  of proprietary information. To address such risks, the panel recommended  that the FAR Council provide additional regulatory guidance for  contractor access to and responsibilities for protecting proprietary  information belonging to other companies. It specifically called for  developing standardized contract provisions and approaches for agencies’  use of nondisclosure agreements and in creating remedies for improper  information sharing. It also suggested the use of standardized clauses for  organizational conflicts of interest to address issues of unfair competitive  advantage when a firm gains access to information as part of its  performance of government contract responsibilities.
Similarly, on the basis of lessons learned from agency responses to loss of  personally identifiable information, in April 2007 we noted that agencies  need to clearly define contractor responsibilities for protecting privacy  information. In this report, contractors were prominently involved in  privacy data breaches at three of six agencies reviewed, including one  case in which a contractor inadvertently released informational compact  discs to several FOIA requesters that contained Social Security numbers  and tax identification data on 350,000 individuals receiving government  program payments. We noted that contractor obligations for mitigating  damage from data breaches, such as notifying affected individuals or  providing credit monitoring, may be unclear unless specified in the  contract. Consistent with and in response to our report, DHS acquisition  policy officials told us in June 2009 of their recommendations for revisions  to the FAR Subpart 24.1 to (1) expand existing Privacy Act coverage and  (2) implement a standard approach that promotes contractor  accountability. According to DHS officials, to avoid agency-by-agency  development of inconsistent clauses or other contractual terms, the FAR  needs a revised privacy policy and clause for establishing basic  government and contractor and subcontractor expectations, roles, and  responsibilities—including prompt breach notification procedures for  contractors to inform officials of privacy data breaches to enable the  agency’s timely response.
Additionally, in 2008 we reported that certain defense contractor  employees who support key mission-critical tasks that have the potential  to significantly influence DOD decisions are not subject to the same  ethical safeguards as federal employees. Furthermore, no FAR policy  obliges government agencies using these contractor employees to require  that they be free from personal conflicts of interest or addresses the issue  of contractor employee misuse of the government’s nonpublic information  obtained while performing work under a contract for private gain. To  address this problem, we recommended that DOD develop and implement  policy that would require a contract clause, among other safeguards, to  prohibit contractor personnel from using nonpublic government  information for personal gain. DOD postponed implementing the  recommendation once OFPP and the FAR Council began responding to  legislation from Congress. Among other changes, the legislation required  a standard policy to be developed and issued to prevent personal conflicts  of interest by contractor employees performing acquisition functions  closely associated with inherently governmental functions. This policy was  to require each contractor whose employees performed these functions to  prohibit covered employees with access to nonpublic government  information from using it for personal gain.
In response, since 2007 the FAR Council has opened several cases, shown  in table 6, to amend the FAR to provide additional regulatory coverage and  clauses. These open cases, with implementing regulations pending as of  July 2010, have significant potential for addressing these identified  problems. Discussions with OFPP and DOD officials responsible for these  FAR changes, and review of information they provided on these cases,  indicate that the steps the FAR Council has been taking to revise  governmentwide guidance are consistent with the recommendations. For  example, a review of information on these pending FAR cases indicates  significant changes are being considered to amend the FAR so that it  addresses access to nonpublic information and conflicts of interest.  Changes being considered also contain other policies and clauses  consistent with safeguards we identified for protecting contractor  sensitive information, and these changes may mitigate the risks of  unauthorized disclosure and misuse. FAR cases generally follow a lengthy  process that allows the public, as well as federal agencies, to comment on  proposed changes to the FAR. Because of other rulemaking priorities and  the many steps involved—including legal and interagency reviews—FAR  Council officials told us the rulemaking process could take many more  months to complete.
section_title: Opportunity Exists for FAR Council to Consider Additional Changes in the FAR to Further Address Safeguards for Contractor Access to Sensitive Information
paragraphs: Until the FAR Council completes the rulemaking process for the pending  cases listed in table 6, it is unclear the extent to which the changes will  address risks and better control contractor confidentiality and authorized  use of sensitive information. With regard to unauthorized disclosure and  use of sensitive information, these risks include (1) unauthorized access  by contractor employees or subcontractors not involved with contract  performance, (2) conflicts of interest in using sensitive information for  financial gain or unfair competitive advantage, and (3) unauthorized  disclosure.
Similarly to issues we identified in agency guidance, our review found that  FAR guidance does not address certain areas relating to contractor access  to sensitive information. Moreover, rather than having agencies develop  stronger safeguards individually, the FAR Council is developing a  standardized approach to address many of these areas. This is particularly  relevant with regard to changes being considered under the open FAR  Case 2007-019, Contractor Access to Non-Public Information, listed above.  Nevertheless, our review of potential changes to FAR guidance identified  two key areas yet to be addressed where the FAR does not contain  guidance that could help agencies address problems identified in this  report.
The first key area is the development and use of contractor nondisclosure  agreements as a condition of access to sensitive information. Additional  FAR guidance also could ensure nondisclosure agreements used across  the government include clear and complete information to contractors.  Without uniform emphasis in the FAR on how agencies use contractor  nondisclosure agreements, contractors may not be adequately informed of  their responsibilities to protect that information from unauthorized  disclosure and use and the consequences that may result from their failure  to meet those responsibilities.
The second key area is the establishment of requirements for contractors  to provide agencies prompt notification of deviations by their employees  or subcontractors from provisions for use and confidentiality of all types  of sensitive information. Without such guidance in the FAR, contractors  may not be adequately required to make key government officials aware of  unauthorized disclosure or inappropriate use of sensitive information  involving their employees. A contractor’s prompt notification is critical to  avoiding delays in internal agency decisions about how to respond to the  misuse or unauthorized disclosure of sensitive information and the  opportunity for affected parties to take precautions. Also, without such  guidance, agencies may be less able to act on a timely basis to hold  contractors accountable for their failure to properly use and maintain  confidentiality of sensitive information.
section_title: Conclusions
paragraphs: The government’s extensive use of contractors in the multisector  workforce to support management activities and administrative functions,  coupled with contractors’ increasing access to government facilities, has  in recent years prompted several constructive efforts by the FAR Council  to establish uniform contract provisions. However, of the three agencies  reviewed for this report, only DHS has established guidance for controlling  contractor use and limiting unauthorized disclosure of sensitive  information obtained during contract performance. OFPP and the FAR  Council have recognized that FAR guidance does not address certain key  areas. Rather than having agencies develop their own guidance and  clauses individually, several amendments are pending to improve guidance  and contract clauses in the FAR. While these are steps in the right  direction, opportunities exist to address certain gaps we identified in  pending FAR guidance. These include the need for guidance on agency use  of contractor nondisclosure agreements and the need to establish  requirements for contractors to promptly notify agencies of unauthorized  disclosure or misuse of sensitive information, which is critical to enabling  timely agency decisions and responses.
section_title: Recommendations for Executive Action
paragraphs: To address the need for clearly defining contractor responsibilities in  governmentwide guidance in the FAR, we recommend that the  Administrator of OFPP ensures that the FAR Council incorporates  changes in the FAR that address safeguards for contractor access to  sensitive information by    providing guidance to agency acquisition policy officials, in coordination  with IT security and privacy officials, chief information officers, and other  affected parties, on agency development and use of contractor  nondisclosure agreements as a condition of access to sensitive  information; and    establishing a requirement for prompt notification to appropriate agency  officials of a contractor’s unauthorized disclosure or misuse of sensitive  information so that timely agency responses are facilitated and  appropriate contractor accountability mechanisms can be enforced.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to OMB’s OFPP, DOD, HHS, and DHS  for review and comment. In oral comments, OFPP generally concurred  with our recommendations. DOD provided technical comments that were  incorporated into the report as appropriate and HHS did not have  comments.
In written comments, included in appendix VI, DHS generally concurred  with our report. However, DHS took exception to the analysis for 1 of the  14 contract actions reviewed, which we found did not contain adequate  safeguards to protect sensitive information. While we agree that the task  order identified in DHS’ response includes contract provisions with  prohibitions against disclosing sensitive information, the language does  not address safeguards to ensure contractors’ appropriate use of sensitive  information.
DHS also stated that although this task order lacks a contract clause  required in DHS acquisition regulations, it includes comparable provisions  in the statement of work. We reviewed the task order and the guidance for  the clause HSAR 3052.204-71, Contractor Employee Access, which  requires the use of the clause or one substantially the same in solicitations  and contracts when contractor employees require recurring access to  government facilities or access to sensitive information. On the basis of  our review, we continue to believe that the task order does not contain  HSAR clause 3052.204-71 or a contract clause that is substantially the same  as that clause. Although some provisions in the task order contain similar  information and requirements, these provisions do not cover the same  breadth or detail as HSAR clause 3052.204-71. For example, the task order  does not include a comprehensive definition section such as the one in  HSAR clause 3052.204-71. Without the use of such comprehensive  definitions, it is not clear that the various provisions of the task order  noted by DHS collectively and effectively protect the same range of  sensitive government information as set forth in HSAR clause 3052.204-71.  In addition, the task order specified in DHS’ response does not include  provisions that limit contractors from disclosing sensitive information  without authorization from the contracting officer. Also, the portions of  the statement of work cited as comparable with HSAR clause 3052.204- 71(e) relate specifically to information technology, and not necessarily to  information that contractors and their employees may otherwise gain  access to in the course of their contractual responsibilities.
DHS also provided technical comments, which were incorporated into the  draft where appropriate.
We are sending copies of this report to the Director of OMB; the  Secretaries of Defense, Homeland Security, and Health and Human  Services; and interested congressional committees. The report also is  available at no charge on GAO’s Web site at http://www.gao.gov.
If you or your staff have any questions concerning this report, please  contact me at (202) 512-4841 or needhamjk1@gao.gov. Contact points for  our Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made major contributions to  this report are listed in appendix VII.
section_title: Appendix I: Scope and Methodology
paragraphs: To assess the extent that agency guidance and contracts establish effective  safeguards for sensitive information, we identified key attributes of the  safeguards that should be contained in acquisition guidance and contracts  to manage the risks of contractor unauthorized disclosure and misuse  based on (1) review of agency practices related to controls over contractor  access to sensitive information, (2) review of applicable standards drawn  from GAO’s Standards for Internal Control in the Federal Government,  and (3) discussions with government security and contracting officials  responsible for administrative, information, and contractor personnel  security functions. Specifically the acquisition guidance and contracts  should contain safeguards that (1) describe the relevant scope of sensitive  information under the agency’s authority or control that should be  protected if contractors require access to it for contract purposes, (2)  require the contractor to refrain from disclosing such sensitive  information to anyone except as needed for contract performance, and (3)  prohibit the contractor from using such sensitive information for any  purpose other than contract performance.
To assess the extent to which agency guidance contains safeguards for  contractor protection of sensitive information, we analyzed applicable  guidance available in the respective Federal Acquisition Regulation (FAR)  supplements of the Department of Defense (DOD), the Department of  Homeland Security (DHS), and the Department of Health and Human  Services (HHS). We selected these departments for review because they  ranked among the top procurers of contracted services in fiscal year 2008,  based on a review of the Federal Procurement Data System–Next  Generation (FPDS-NG), and because prior GAO work shows that their  component agencies and organizations rely extensively on support  contractors to perform mission-critical tasks that would potentially require  access to sensitive information. We assessed the reliability of the FPDS- NG data through corroboration with agency officials and contract files and  determined they were sufficiently reliable for our purposes. We analyzed  applicable policy and guidance available from the departments and some  of their selected component agencies and organizations to identify the  extent their guidance provides for contractor protection of sensitive  information, including guidance contained in agency FAR supplements as  well as security and privacy program policies and procedures applicable to  contractor employees. We also interviewed acquisition policy, security,  and privacy officials to discuss their supplements to FAR guidance and the  contract provisions they use to meet their specific agency needs.
To assess the extent to which agency contracts contain safeguards for  contractor protection of sensitive information, we analyzed DOD, DHS,  and HHS contract actions (defined as a contract, task order, and blanket  purchase agreement and associated order) for services potentially  requiring contractor access to sensitive information from the following  five component agencies or organizations and locations:  within DOD, the (1) TRICARE Management Activity (TMA) in Falls  Church, Virginia, and the contracting activity supporting TMA at the Army Medical Research Acquisition Activity at Fort Detrick, Maryland, (2) the Air Force Materiel Command’s Electronic Systems Cente Hanscom Air Force Base, Massachusetts;  within DHS in Washington, D.C., (3) U.S. Customs and Border Protect ns within the Office of the  and (4) the Office of Procurement Operatio Chief Procurement Officer, which is the contracting activity supporting  headquarters organizations; and  within HHS, the (5) Centers for Medicaid and Medicare Services (CMS)  Baltimore, Maryland.
U.S.
At each of these five organizations, we selected for review a  nongeneralizable sample of 6 to 10 contract actions (42 in total) in which  contractor employees worked in close proximity to government  employees and provided professional and administrative services that  supported the agencies’ missions, in addition to providing a cross section  of contract types and services. In making our selection, we reviewed lists  of contract actions and reported dollar values drawn from data provided  by DOD, DHS, and HHS component agency and organization officials to  confirm that the contract actions belonged to their agencies and that they  involved contractors working on-site or in close proximity with  government employees, to perform services potentially requiring access to sensitive information.
For each of the 42 contract actions, we analyzed the contract  documentation provided, including base contracts from which task orders  or blanket purchase agreements and their associated orders were issued,  to determine whether they contained provisions or clauses that direct  contractors to safeguard sensitive information consistent with key  attributes we identified for safeguarding sensitive information. In  conducting this content analysis, two GAO analysts independently  reviewed the provisions in each contract or task  any differen ces in how they were coded. We dete order and then reconciled  rmined whether the  contract provisions addressed limiting disclosure of sensitive information  and preventing its misuse. We also assessed the scope of information  protected—whether these protections applied to certain categories or to  n  all relevant types of sensitive information that may potentially have bee accessed during contract performance. We also determined whether the contract actions required the use of contractor nondisclosure agreements .
To obtain an in-depth understanding of the reasons why certain contract  were required  clauses and provisions to safeguard sensitive information and obtain views on their effectiveness and how contractor compliance  with the requirements was being monitored by the government at a cross  section of DOD, DHS, and HHS offices, we selected 9 of the 42 contract  actions as case studies. For each case study, we conducted semistructured  oping  interviews with the DOD, DHS, or HHS officials responsible for devel contract requirements and monitoring con contracting officers, contracting officers’ representatives, and program  managers.
To assess the adequacy of governmentwide guidance in the FAR on how  agencies are to contractually safeguard sensitive information to which  contractor employees  prescribe protections associated with sensitive information, i 4 (Administrative Matters); Part 7 (Acquisition Planning); Subpart 9.5  (Organizational and Consultant Conflicts of Interest); Part 24 (Pro of Privacy and Freedom of Information); and Part 52 (Solicitation tection  Provisions and Contract Clauses). We reviewed pending amendments to  the FAR and legislation to determine the safeguards they might add to have access, we analyzed FAR requirements that  existing FAR guidance. To further understand steps being taken to amendthe FAR, we interviewed government officials supporting members of the FAR Council, which oversees the development and maintenance of the   (OFPP)  FAR, and officials with the Office of Federal Procurement Policy in the Office of Management and Budget. The OFPP Administrator serves  as chair of the FAR Council.
We conducted this performance audit from May 2009 through  2010 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis fo eve r  our findings and conclusions based on our audit objectives. We beli ings  that the evidence obtained provides a reasonable basis for our find and conclusions based on our audit objectives.
section_title: Appendix II: Sensitive But Unclassified Markings Identified by President’s Task Force on Controlled Unclassified Information
paragraphs: In 2006 we reported on a survey of federal agencies that showed 26 were  using 56 different designations to protect information they deem critical to  their missions—such as law-enforcement sensitive, sensitive security  information, and unclassified controlled nuclear information. Because of  the many different and sometimes confusing and contradictory ways thatagencies identify and protect sensitive but unclassified (SBU) information,  the sharing of information about possible threats to homeland security has  been difficult.
To address this challenge, efforts are underway to establish new  governmentwide processes for designating, marking, safeguarding, and  disseminating SBU information. Since 2008, in response to a presidential  memorandum that replaced SBU information with “controlled unclassified  information” (CUI) as the single categorical designation for SBU  information, the executive branch is attempting to overhaul its CUI  framework. The ongoing effort is also addressing a 2009 presidential task  force report that found too many labels for sensitive information and  recommended that agencies reduce them and balance the need for  nondisclosure (to protect privacy or other legitimate interests) and  transparency and openness in government.
The task force found that currently, across the executive branch, this  information is identified by over 100 unique markings and at least 130  different labeling or handling regimes (a partial listing of SBU markings  the task force found currently in use are shown below). The SBU  challenge, according to the task force, is that although SBU regimes or  markings are typically derived from an identifiable authority, collectively  they reflect a disjointed, inconsistent, and unpredictable system for  protecting, sharing, and disclosing sensitive information.
section_title: Appendix III: Agency Contract Provisions Containing Contractor Safeguards for Sensitive Information
paragraphs: The Department of H 4, Safeg Subpart 3004. Industry ( clause at HSAR 3052. shen contr same, in solicitation  and contracts w recurring access to government facilities or access to sensitive  information. T requir information.  ecurity Acquisit d and Sen ion Regulation (H sitive Information Within  SAR)  48 C.F.R. 3004), states that contracting officers shall insert the  n in figure 1, or one substantially the  se shall not be used unless contractor employees wi e recurring access to government facilitie s or access to sen sitive  The “Confidentiality of Information” contract clause shown in figure 3 was  to be used in solicitations and resultant contracts whenever the need  existed to keep information confidential, for example in contracts that  involve the use of proprietary plans or processes or confid information of organizations other than the contractors. In addition, any  solicitation or contract including this clause was to indicate, as specifically  as possible, the types of data that would be covered and the requirements  for handling the data.
section_title: Appendix IV: Contractor Employee Nondisclosure Agreements Used by Agencies
subsections: section_title: Air Force Source Selection Non- disclosure Agreement
paragraphs: The Air Force Federal Acquisition Regulation Supplement (AFFARS)  section on procurement integrity states that any individuals requiring  access to source-selection information as a result of participating on a  source selection or to perform their duties shall sign a Source Selection  Non-disclosure Agreement identified in the Air Force mandatory  procedure for source selection, and shown in figure 4. The Source  Selection Non-disclosure Agreement may be used on an annual basis for  individuals who must have access to source-selection information in the  performance of their official duties throughout the year, whether or not  they participate as part of the actual source-selection team.
section_title: TRICARE Management Activity Confidentiality Agreement (Non- Federal Employee) and Non-disclosure Agreement for Contractor Employees and Subcontractors
section_title: DHS Non-disclosure Agreement
section_title: Department of the Treasury
paragraphs: The Department of the  resources to assist with implementing the Troubled Asset Relief Program  (TARP) since its 2008 beginning underscores the importance of addressing  conflict-of-interest issues. As we have previously reported, Treasury has  strengthened its processes for managing and monitoring conflicts of  interest among contractors and financial agents. In January 2009,  Treasury issued an interim regulation on TARP conflicts of interest, which  was effective immediately. Among other provisions, the regulation  requires a certification, in the form of a nondisclosure agreement, from  each retained entity’s management official and key individuals performing  work under a contract or financial agency agreement stating that he or she  will comply with the requirements for confidentiality of nonpublic  information before performing work and annually thereafter. An example  of a nondisclosure agreement Treasury uses with its TARP contractors is  shown in figure 8.
section_title: Appendix V: Recent FAR Changes to Add Guidance and Contract Provisions for Information Technology (IT) Security
subsections: section_title: Federal Information- Security Oversight of Contractor IT Operations
paragraphs: Our April 2005 report concerning the federal government’s extensive  reliance on contractors to provide IT systems and services found that  without appropriate policies and guidance on how to develop effective  information-security oversight of contractors, agencies may not develop  sufficient policies to address the range of risks posed by contractors, and  that as a result, federal information and operations can be placed at undue  risk. Since FAR Council efforts to update the FAR provisions had  stretched over 3 years, we recommended expeditious completion to  ensure that agencies develop appropriate information-security oversight  capabilities.
FAR Subpart 2.1 Definition of Information Security Added in 2005  Information security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in ord provide—  1.  hich means guarding against improper information modification or  n, and includes ensuring information nonrepudiation and authenticity;  2.  Confidentiality, which means preserving authorized restrictions on access and  disclosure, including means for protecting personal privacy and proprietary  information; and  3.  Availability, which means ensuring timely and reliable access to, and use of,  information.
section_title: Personal Identity Verification of Contractor Personnel
paragraphs: In 2007 the FAR was amended to add personnel-security requirements, in  recognition that contractors increasingly are required to have physical  e  access to federally controlled facilities and information systems in th performance of government contracts and the President’s issuance of  Homeland Security Presidential Directive 12 (HSPD-12). Specifically, the  FAR was amended to require agencies to include a standard clause in their  solicitations and contracts when contractor performance requires  recurring access to government facilities and systems. This clause states that the contractors shall comply with agency personal identity  verification procedures for issuance of identification cards. This action to unify FAR guidance has assisted agencies in implementing HSPD-12,  requiring the establishment of a governmentwide standard for secure and reliable forms of identification cards for federal employees and  contractors alike. For example, updates issued since 2007 to some ag FAR supplements have added agency-specific HSPD-12 policies,  procedures, contract clauses, and solicitation provisio employees requiring routine access to their facilities and sensitive  information stored in agency networks.
Implementing HSPD-12 requirements through contract provisions helps  address the risks of contractors gaining unauthorized physical or  electronic access to federal information or contractors using outmoded ow  identification cards that can be easily forged, stolen, or altered to allnauthorized access. In 2009 the FAR Council opened a FAR case in  u recognition of the need for return of the physical identification cards  i c t ssued to contractors. According to the FAR Council, our re ontractor employees’ access to sensitive information reinforced the o resolve this shortcoming in FAR guidance.
section_title: Appendix VI: Comments from the Department of Homeland Security
section_title: Appendix VII: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Carolyn Kirby, Assistant Director;  Jennifer Dougherty; Guisseli Reyes-Turnell; Greg Campbell; Vijay D’Souza;  Claudia Dickey; Ralph Roffo; Tind Shepper Ryen; Alyssa Weir; and Bill  Woods made key contributions to this report.