Unauthorized disclosure of sensitive information by government or contractor employees through negligence or misconduct can have a significant effect on the government’s ability to perform its primary functions, potentially resulting in financial loss, damaged reputation, and loss of public trust. Sensitive information may not always be explicitly designated or marked as such. For the purposes of this report, we use the term “sensitive information” to generally refer to information under an agency’s authority or control that has a degree of confidentiality such that its loss, misuse, unauthorized access, or modification could compromise that confidentiality and harm important interests, such as personal and medical privacy to which individuals are entitled under laws, national security, law enforcement, proprietary commercial rights, or the conduct of agency programs. The large but unquantifiable amount of sensitive information generated by the government makes understanding its scope more difficult and agencies’ safeguarding this information from unauthorized disclosure or inappropriate use by contractors a complex challenge. Table 1 shows examples of several types of sensitive information. Additional examples are listed in appendix II. All examples were drawn from a myriad of designations that agencies use to describe sensitive information. The federal government uses a variety of means, whether prescribed by statute, executive order, or other authority, to limit dissemination and protect against the inadvertent disclosure of certain types of sensitive information. For information the government considers critical to our national security, the government may take steps to protect such information by classifying it as Top Secret, Secret, or Confidential pursuant to criteria established by law and executive order. Information that does not meet the thresholds established for classification as national security information but that an agency nonetheless considers sufficiently sensitive to warrant restricted dissemination has generally been referred to as sensitive but unclassified (SBU). In designating information this way, agencies determine that the information they use must therefore be safeguarded from public release. Some, but not all, SBU designations used by agencies have a specific basis in statute. For example, some agencies use the provisions of the Freedom of Information Act (FOIA) as their basis for designating information as SBU. FOIA establishes that federal agencies must generally provide the public with access to government information, thus enabling them to learn about government operations and decisions. FOIA establishes a legal right of access to government records and information, on the basis of the principles of openness and accountability in government. But the act also prescribes nine specific categories of information that are exempt from disclosure: for example, trade secrets and certain privileged commercial or financial information, certain personnel and medical files, and certain law enforcement records or information. Thus the need to safeguard sensitive information from public disclosure while striking the appropriate balance with the goal of government transparency is another challenge agencies must continually address. Protecting legitimate security, law enforcement, and privacy interests also must be carefully balanced with protecting civil liberties. Of critical importance are providing clear rules to those who handle sensitive information and ensuring that the handling and dissemination of information is not restricted unless there is compelling need. Government ethics rules prohibit federal employees from using sensitive nonpublic information, defined below, for personal gain or to further the interests of another, whether by advice or recommendation or through knowing unauthorized disclosure. For federal employees, certain activities and acts that affect a personal financial interest may also result in violations of criminal law with potentially serious consequences, including dismissal, prosecution, fines, and imprisonment. Because not all government ethics rules and related statutes apply to contractors, many of these prohibitions do not extend to contractor employees working in the multisector workforce. Nonpublic Information as Defined in Government Ethics Rules Nonpublic information is information that the employee gains by reason of federal employment and that s/he knows or reasonably should know has not been made available to the general public. It includes information that s/he knows or reasonably should know: 1. Is routinely exempt from disclosure under the Freedom of Information Act, codified at 5 U.S.C. § 552, or otherwise protected from disclosure by statute, Executive order or regulation; 2. Is designated as confidential by an agency; or 3. Has not actually been disseminated to the general public and is not authorized to be made available to the public on request. Our analysis of guidance and contract actions at three agencies found areas where sensitive information is not fully safeguarded and thus may remain at risk of unauthorized disclosure or misuse. DHS, DOD, and HHS FAR supplements include some guidance and standard contract provisions—for example that address contractor safeguards for personal information. However, the policies and procedures available in DOD’s and HHS’s FAR guidance do not contain effective agency management controls for sensitive information needed to help ensure contractor compliance, prevent contractor disclosure and misuse, and promote contractor accountability. Such guidance could help contracting and program officials incorporate safeguards into their contract actions for protecting all types of relevant sensitive information contractors may access, such as agency sensitive information. At the contract level, almost half of the 42 contract actions reviewed did not include solicitation and contract provisions that safeguarded against unauthorized contractor disclosure and inappropriate use of sensitive information contractors may access in program offices during the course of contract performance. In cases where there was agency policy to include contract provisions to protect sensitive information on all contracts, such as regarding the medical privacy of individuals, it was not incorporated in 5 of the 42 contract actions that we reviewed. Additionally, DOD and HHS lack guidance on the use of nondisclosure agreements, while DHS has found that these help improve accountability by informing contractors of their responsibilities and the consequences that may result from their failure to meet those responsibilities. Contractor and subcontractor employees can be responsible for carrying out a range of mission-critical tasks—including studying ways to acquire desired capabilities, developing contract requirements, and advising or assisting on source selection, budget planning, financial management, and regulations development—potentially requiring access to many types of sensitive information. Agencies can use their FAR supplement authority to issue guidance, which may include contract provisions to establish contractor responsibility for safeguarding sensitive information. Review of agency practices and discussions with government security and contracting officials identified three key attributes for assessing the extent that agencies’ guidance or the FAR contain effective safeguards for sensitive information in acquisition guidance and contracts. On the basis of these sources, in order to have more effective safeguards in place, contracts should contain provisions that (1) describe the relevant scope of sensitive information under the agency’s authority or control that should be protected if contractors require access to it for contract purposes; (2) require the contractor to refrain from disclosing such sensitive information to anyone except as needed for contract performance; and (3) address conflicts of interest or other misuse by prohibiting the contractor from using such sensitive information for any purpose other than contract performance. Agency FAR guidance should help contracting and program officials incorporate effective safeguards for sensitive information into their contract actions by including certain management control practices. We identified a range of management control practices sometimes incorporated into acquisition guidance to help prevent contractor disclosure and misuse, and promote contractor accountability for sensitive information breaches that harm important interests. These control practices include requiring contractors to (1) train or inform employees on their obligations to maintain confidentiality and not misuse sensitive information; (2) obtain written consent from the agency to disclose sensitive information; (3) pass sensitive information provisions to subcontractors; (4) execute a nondisclosure agreement for each employee and subcontractor as a condition of access to sensitive information; (5) promptly notify key agency officials of the misuse or unauthorized disclosure of sensitive information; and (6) be informed of the consequences for violations. Our review found DOD, DHS, and HHS all have guidance that supplements the FAR and addresses requirements or standard contract provisions for contractor protection of certain categories of sensitive information. For example, DOD supplements the protection of individual privacy requirements contained in the FAR by incorporating references to the agency rules and regulations. HHS also supplements the FAR with detailed policy that establishes Privacy Act requirements and requires the inclusion of contract provisions to protect the confidentiality of records and the privacy of individuals in contracts where the Privacy Act is not applicable but the contract would involve the collection of individually identifiable personal information by the contractors. However, with respect to other key attributes available in agency FAR policies and procedures reviewed at DOD, DHS, and HHS, the agencies’ guidance differs in how well they help contracting and program officials incorporate necessary safeguards for sensitive information into their contract actions. Of the guidance analyzed at the three agencies, only DHS established effective management control practices through standard contract provisions in its FAR supplement and related guidance requiring contractors to safeguard sensitive information accessed by employees. In contrast, the FAR guidance of DOD and HHS does not contain effective agency management controls for sensitive information needed to help ensure contractor compliance, prevent contractor disclosure and misuse, and promote contractor accountability. (See app. III for the standard contract provisions we identified in DHS, DOD, and HHS FAR supplements.) As shown in table 2, our analysis of agency guidance included in the DHS FAR supplement found that it contained five of six effective management control practices consistent with key attributes for establishing safeguards for sensitive information. For example, the DHS FAR supplement and related guidance aims to (1) make contractors aware of their responsibilities for maintaining confidentiality of sensitive information; (2) address conflicts of interest and potential misuse by prohibiting use of agency information processed, stored, or transmitted by the contractor for any purpose other than contract performance; and (3) deter noncompliance with these requirements and ensure accountability by explaining consequences related to violations. According to agency acquisition policy officials, recognition within DHS of the need for contractor safeguards for homeland security–sensitive information likely led to the establishment of extensive requirements when the agency updated its interim FAR supplement and related guidance in 2006. On the other hand, DHS acquisition policy and security officials acknowledge that the agency’s FAR supplement and contract clause do not directly specify contractor responsibilities for promptly notifying contracting officers of unauthorized use or disclosure of sensitive information. Prompt contractor notification to key government officials is critical to avoid internal delays that would prevent officials from being aware of the unauthorized use or disclosure; delay agency decisions about how to respond; and deny the opportunity for affected parties to take precautions. DHS’s guidance establishes stronger safeguards for sensitive information than what we found at DOD and HHS in their FAR supplements. In contrast with the DHS guidance, the analysis in table 2 shows that DOD’s FAR supplement does not include the same amount of detail as to how contractors are to safeguard sensitive information. At present, DOD’s FAR supplement is limited to requiring the use of a disclosure of information clause in solicitations and contracts when contractors have access to unclassified information that may be sensitive and inappropriate for release to the public—for example, DOD officials said the clause authorizes use in a contractor’s press and marketing materials. In addition, since HHS revised its FAR supplement as of January 2010, guidance and a contract provision that required contractors to obtain written consent before disclosing certain kinds of sensitive information— not already subject to FAR and agency privacy restrictions—was deleted in its entirety. According to the director for acquisition policy, HHS deleted the “Confidentiality of Information” clause because the need for agency guidance will be obviated by pending changes to the FAR expected later in 2010. Besides the supplemental FAR guidance, agencies have developed other policies and control practices to establish additional contractor responsibilities for safeguarding certain categories of sensitive information obtained during contract performance. For example, a 2007 privacy breach involving a DOD contractor that potentially compromised the personal health information of 580,000 households led the privacy office in DOD’s component agency TRICARE Management Activity (TMA) to determine that the agency’s contract provisions did not adequately protect sensitive information. According to the TMA privacy office director, most TMA contracts before 2007 did not specifically require the contractor to safeguard personal health information, notify DOD or beneficiaries of privacy breaches, or to mitigate any harm, such as paying for the cost of free credit monitoring to affected individuals. To address this problem, TMA has required since 2007 that standard contract provisions be included whenever a contract is awarded that requires either the use of or access to personal information. The required contract language is posted on TMA’s Web site and imposes protections for the privacy and security of personally identifiable information and protected health information. It seeks to ensure that contractors understand their responsibility in protecting TRICARE beneficiaries’ sensitive information. Similarly, HHS’s Centers for Medicare and Medicaid Services (CMS) issued an acquisition policy and procedure notice, which took effect in 2005, to advise contracting staff of the requirement to use a clause for contractor protection of health information. This standard CMS clause had been revised to integrate the HIPAA security standards along with the privacy standards that were previously adopted in standard contract provisions. For our analysis of contract documents for 42 contract actions at DHS, DOD, and HHS that involved contractor employees supporting mission- critical tasks, in order to be considered to fully safeguard all types of sensitive information, a contract had to contain provisions that specifically required contractors to refrain from (1) disclosing sensitive information to anyone except as needed for contract performance and (2) using such sensitive information for any purpose other than contract performance. In addition, the provisions had to cover the relevant types of sensitive information that may be accessed by a contractor during performance. As shown in table 3, our analysis found that slightly more than half of contract actions reviewed—23 of 42—contained contract provisions that fully safeguard the confidentiality and appropriate use of all types of sensitive information. In contrast, the remaining 19 contract actions reviewed did not extend safeguards to all relevant types of sensitive information that contractors may have had access to through the program offices they support. In the absence of such safeguards, there is higher risk of unauthorized disclosure or misuse of sensitive information by contractors. Of the 19 contracts reviewed that did not have provisions for all safeguards, our content analysis found that one HHS blanket purchase agreement and an associated order we reviewed contained no evidence of contract provisions for contractor safeguarding of sensitive information, except for standard FAR clauses related to the Privacy Act in the base contract. In addition, some contract provisions included in 18 other contract actions provided too few safeguards, given the range of tasks being performed and the potential opportunities to gain access to many types of sensitive information. For example, at HHS several contract actions specified that contractors must safeguard certain types of sensitive information, but did not specify contractor protection of agency-sensitive information from nondisclosure or misuse. In other cases, clauses addressed limitations on the disclosure of certain types of sensitive information, but not its misuse, and therefore did not fully safeguard these types of information. Some HHS contract actions require that contractors perform acquisition functions related to other contractors, such as strategic planning in support of future task awards or auditing business proposals, and thus could require access to proprietary information. These contract actions did not always include safeguards addressing limits on unauthorized disclosure and misuse of proprietary information. Similarly, several DOD contract actions included provisions to prevent contractors from disclosing any nonpublic information they obtained during contract performance, but provisions to prohibit contractors from misusing the information for purposes other than contract performance were absent. In cases where there was agency policy to include specific contract provisions to protect sensitive information, it was not incorporated in five of the contract actions we reviewed. For example, 3 DHS task orders of the 14 contract actions reviewed did not include the contract clause required when contractors need recurring access to government facilities or sensitive information. At HHS, 2 task orders of the 10 contract actions reviewed did not include standard contract provisions regarding HIPAA privacy and security standards required by agency policy to be in all contracts. Several of the contract actions we reviewed used nondisclosure agreements as a mechanism to help protect sensitive information from conflicts of interest and preserve its confidentiality. These agreements generally outline the exchange of confidential information or knowledge that at least two parties need to share for certain purposes, but wish to restrict access to by third parties. When used by agencies as a condition of contractor access to sensitive information, a nondisclosure agreement may serve several important accountability purposes. These include informing contractor employees and subcontractors of (1) the trust that is placed in them by providing them access to sensitive information; (2) their responsibilities to protect that information from unauthorized disclosure and use; and (3) the consequences that may result from their failure to meet those responsibilities. All of the agencies we reviewed had established guidance requiring contractor employees participating in source-selection activities to sign an agreement to not disclose procurement sensitive, proprietary, or source- selection information. Beyond addressing this one area of sensitive information however, only DHS and TMA (in DOD) had guidance requiring the use of standard contractor nondisclosure agreements for a broader range of sensitive information that may be handled by contractors. Under the DHS and TMA guidance, certain contracts are to contain provisions that require contractors to submit to a designated agency official an executed nondisclosure agreement for each employee and subcontractor within a stipulated time following contract award or before they are given access to certain types of agency sensitive information. Appendix IV provides examples of standard nondisclosure agreements we reviewed. DHS and TMA security and acquisition policy officials responsible for jointly developing agency guidance on nondisclosure agreements view these agreements as critical to promoting contractor accountability. According to the DHS administrative security chief, the agencywide nondisclosure agreement was developed in coordination with agency acquisition policy, information technology (IT) security, and privacy officials to educate contractor personnel on the agency’s standards for safeguarding sensitive information and provide a mechanism to hold them accountable should they violate the terms of the agreement. The agencywide form was also developed to eliminate use of nonstandard forms to cover different types of sensitive information that were causing confusion and required contractor employees to sign multiple forms. According to DOD’s acquisition executive for TMA, having contractor employees sign nondisclosure agreements provides additional benefits for the government by (1) requiring that contractors will protect and not disclose sensitive information; (2) protecting against conflicts of interest that could occur if contractors use sensitive information for future competitive advantage; and (3) making contractors and their employees aware of the government’s expectations and their obligations to safeguard sensitive information. As shown in table 4, due to the agencywide use of nondisclosure agreements at DHS and DOD’s TMA, 20 of 42 contract actions reviewed contained contract provisions requiring nondisclosure agreements for each employee and subcontractor. All 10 of the Air Force contracts reviewed and 1 contract at HHS required contractors to enter into third- party agreements with other contractors about the confidentiality and use of their proprietary information obtained during contract performance. One case study of an Air Force contract illustrated the practical challenges for agency monitoring of such third-party agreements in contrast to agency use of its own contractor nondisclosure agreements. In this case study, although the contractor’s conflict of interest mitigation plan indicated the company maintained nondisclosure agreements and proprietary protection agreements with many third-party contractors, no copies of executed nondisclosure agreements were available from the Air Force contracting and program officials responsible for administering the contract. In addition, officials told us they knew that the contractor had entered into such agreements, but they had not reviewed them. We discussed a less challenging approach for implementing agency contractor nondisclosure agreements with the Department of the Treasury’s (Treasury) contract administrator responsible for management and oversight of contractors and financial agents supporting the Troubled Asset Relief Program (TARP). He agrees with DHS and TMA views that nondisclosure agreements are critical to promoting contractor accountability for maintaining confidentiality of sensitive information and providing other benefits, such as helping to prevent conflicts of interest that could arise from contractor misuse of the information. Treasury uses an alternative way to implement these agreements that reduces administrative burden without compromising contractor compliance for their use. Language included in certain TARP Financial Agency Agreements requires the financial agent to have each employee and all affiliate and contractor personnel to whom nonpublic information is or may be disclosed execute the agency’s nondisclosure agreement form— included as an exhibit to the agreement—as a condition of access to sensitive government information. According to the Treasury official, it is better to have the contractor responsible for retaining the executed agreements in its own files, rather than have the government contracting officer or program office retain them. The official explained that as long as the terms of the contract require contractors to certify to the government they have collected the agency’s nondisclosure agreement for all individuals they assign to perform on the contract, and the agreements are available to the government for inspection, it is better to hold contractors accountable for retaining the signed agreements. The FAR Council in recent years has made progress improving guidance for security and oversight related to contractor access to sensitive government facilities and information systems, but challenges remain. While the FAR establishes governmentwide guidance on certain contractor sensitive-information safeguards prescribed in statute—for example, to require contractor protection of individual privacy—FAR guidance does not address certain key areas relating to contractor access to sensitive information. Several amendments are pending before the FAR Council to implement recommended changes and to improve FAR guidance in the complex areas involving contractor access to sensitive information. Such changes to the FAR could provide agencies clear guidance on the use of contractor nondisclosure agreements as a condition of access to sensitive information and could include requirements for contractors to promptly notify agencies of unauthorized disclosure and misuse of sensitive information to enable timely decisions regarding an agency’s response when use of sensitive information is compromised. With the rulemaking process underway to develop these amendments, the FAR Council has an opportunity to consider additional changes to strengthen FAR guidance to ensure remaining gaps in contractor safeguards identified in this review are addressed. The FAR is the primary regulation that provides uniform policies and procedures for acquisitions by executive agencies. During the acquisition process, the FAR emphasizes basic planning that has to be coordinated among agency personnel responsible for significant aspects of the acquisition, such as contracting, fiscal, legal, and technical personnel. In describing agency needs during acquisition planning, the FAR directs agencies to address all significant considerations that will control each acquisition, including security considerations for acquisitions requiring routine contractor physical access to a federal facility or IT system. The FAR has several provisions that establish policy and contract clauses implementing requirements prescribed in statute or executive order for contractor protection of certain categories of sensitive information, such as information related to the privacy of individuals. When these FAR provisions, which are described in table 5, are applicable, certain sensitive- information requirements are included in solicitation and contract provisions that are intended to safeguard procurement integrity, classified information, organizational conflicts of interest, and privacy. Agencies use this guidance to incorporate requirements during acquisition planning and when describing agency needs. Finally, to address the need for improved governmentwide contracting guidance required by presidential directive or law and to assist agencies in addressing identified risks from contractor access to sensitive federal facilities and information systems, OFPP and the FAR Council revised contractor personnel and IT security requirements in the FAR. Key aspects of the revised contractor personnel and IT security safeguards are summarized as follows: Securing personal identity verification of contractor personnel—in 2007 the FAR was amended in part to implement the August 2004 Homeland Security Presidential Directive 12 (HSPD-12), which required the establishment of a governmentwide standard for secure and reliable forms of identification for federal employees and contractors alike. Implementing HSPD-12 requirements through contract provisions may help address the risks of contractors gaining unauthorized physical or electronic access to federal information or contractors using outmoded identification cards that can be easily forged, stolen, or altered to allow unauthorized access. Strengthening federal information security oversight of contractor IT operations—in 2005 an interim rule amended the FAR to implement the Federal Information Security Management Act of 2002 (FISMA) information-technology-security provisions. According to the FAR Council, the addition of specific FISMA-related provisions was intended to provide clear, consistent guidance to acquisition officials and program managers, and to encourage and strengthen communication with IT security officials, chief information officers, and other affected parties. See appendix V for greater detail on these changes to the FAR. There have been numerous recommendations in recent years for improved governmentwide guidance and contract provisions for contractor protection of sensitive information. The emphasis has been on standardizing approaches and establishing accountability mechanisms when access to information is compromised. Problems and recommendations to address them include the following: In 2007, the Acquisition Advisory Panel found that increased use of contractor employees in the government workforce to support the evaluation of other contractors raises questions regarding the potential for organizational conflicts of interest and how to preserve the confidentiality of proprietary information. To address such risks, the panel recommended that the FAR Council provide additional regulatory guidance for contractor access to and responsibilities for protecting proprietary information belonging to other companies. It specifically called for developing standardized contract provisions and approaches for agencies’ use of nondisclosure agreements and in creating remedies for improper information sharing. It also suggested the use of standardized clauses for organizational conflicts of interest to address issues of unfair competitive advantage when a firm gains access to information as part of its performance of government contract responsibilities. Similarly, on the basis of lessons learned from agency responses to loss of personally identifiable information, in April 2007 we noted that agencies need to clearly define contractor responsibilities for protecting privacy information. In this report, contractors were prominently involved in privacy data breaches at three of six agencies reviewed, including one case in which a contractor inadvertently released informational compact discs to several FOIA requesters that contained Social Security numbers and tax identification data on 350,000 individuals receiving government program payments. We noted that contractor obligations for mitigating damage from data breaches, such as notifying affected individuals or providing credit monitoring, may be unclear unless specified in the contract. Consistent with and in response to our report, DHS acquisition policy officials told us in June 2009 of their recommendations for revisions to the FAR Subpart 24.1 to (1) expand existing Privacy Act coverage and (2) implement a standard approach that promotes contractor accountability. According to DHS officials, to avoid agency-by-agency development of inconsistent clauses or other contractual terms, the FAR needs a revised privacy policy and clause for establishing basic government and contractor and subcontractor expectations, roles, and responsibilities—including prompt breach notification procedures for contractors to inform officials of privacy data breaches to enable the agency’s timely response. Additionally, in 2008 we reported that certain defense contractor employees who support key mission-critical tasks that have the potential to significantly influence DOD decisions are not subject to the same ethical safeguards as federal employees. Furthermore, no FAR policy obliges government agencies using these contractor employees to require that they be free from personal conflicts of interest or addresses the issue of contractor employee misuse of the government’s nonpublic information obtained while performing work under a contract for private gain. To address this problem, we recommended that DOD develop and implement policy that would require a contract clause, among other safeguards, to prohibit contractor personnel from using nonpublic government information for personal gain. DOD postponed implementing the recommendation once OFPP and the FAR Council began responding to legislation from Congress. Among other changes, the legislation required a standard policy to be developed and issued to prevent personal conflicts of interest by contractor employees performing acquisition functions closely associated with inherently governmental functions. This policy was to require each contractor whose employees performed these functions to prohibit covered employees with access to nonpublic government information from using it for personal gain. In response, since 2007 the FAR Council has opened several cases, shown in table 6, to amend the FAR to provide additional regulatory coverage and clauses. These open cases, with implementing regulations pending as of July 2010, have significant potential for addressing these identified problems. Discussions with OFPP and DOD officials responsible for these FAR changes, and review of information they provided on these cases, indicate that the steps the FAR Council has been taking to revise governmentwide guidance are consistent with the recommendations. For example, a review of information on these pending FAR cases indicates significant changes are being considered to amend the FAR so that it addresses access to nonpublic information and conflicts of interest. Changes being considered also contain other policies and clauses consistent with safeguards we identified for protecting contractor sensitive information, and these changes may mitigate the risks of unauthorized disclosure and misuse. FAR cases generally follow a lengthy process that allows the public, as well as federal agencies, to comment on proposed changes to the FAR. Because of other rulemaking priorities and the many steps involved—including legal and interagency reviews—FAR Council officials told us the rulemaking process could take many more months to complete. Until the FAR Council completes the rulemaking process for the pending cases listed in table 6, it is unclear the extent to which the changes will address risks and better control contractor confidentiality and authorized use of sensitive information. With regard to unauthorized disclosure and use of sensitive information, these risks include (1) unauthorized access by contractor employees or subcontractors not involved with contract performance, (2) conflicts of interest in using sensitive information for financial gain or unfair competitive advantage, and (3) unauthorized disclosure. Similarly to issues we identified in agency guidance, our review found that FAR guidance does not address certain areas relating to contractor access to sensitive information. Moreover, rather than having agencies develop stronger safeguards individually, the FAR Council is developing a standardized approach to address many of these areas. This is particularly relevant with regard to changes being considered under the open FAR Case 2007-019, Contractor Access to Non-Public Information, listed above. Nevertheless, our review of potential changes to FAR guidance identified two key areas yet to be addressed where the FAR does not contain guidance that could help agencies address problems identified in this report. The first key area is the development and use of contractor nondisclosure agreements as a condition of access to sensitive information. Additional FAR guidance also could ensure nondisclosure agreements used across the government include clear and complete information to contractors. Without uniform emphasis in the FAR on how agencies use contractor nondisclosure agreements, contractors may not be adequately informed of their responsibilities to protect that information from unauthorized disclosure and use and the consequences that may result from their failure to meet those responsibilities. The second key area is the establishment of requirements for contractors to provide agencies prompt notification of deviations by their employees or subcontractors from provisions for use and confidentiality of all types of sensitive information. Without such guidance in the FAR, contractors may not be adequately required to make key government officials aware of unauthorized disclosure or inappropriate use of sensitive information involving their employees. A contractor’s prompt notification is critical to avoiding delays in internal agency decisions about how to respond to the misuse or unauthorized disclosure of sensitive information and the opportunity for affected parties to take precautions. Also, without such guidance, agencies may be less able to act on a timely basis to hold contractors accountable for their failure to properly use and maintain confidentiality of sensitive information. The government’s extensive use of contractors in the multisector workforce to support management activities and administrative functions, coupled with contractors’ increasing access to government facilities, has in recent years prompted several constructive efforts by the FAR Council to establish uniform contract provisions. However, of the three agencies reviewed for this report, only DHS has established guidance for controlling contractor use and limiting unauthorized disclosure of sensitive information obtained during contract performance. OFPP and the FAR Council have recognized that FAR guidance does not address certain key areas. Rather than having agencies develop their own guidance and clauses individually, several amendments are pending to improve guidance and contract clauses in the FAR. While these are steps in the right direction, opportunities exist to address certain gaps we identified in pending FAR guidance. These include the need for guidance on agency use of contractor nondisclosure agreements and the need to establish requirements for contractors to promptly notify agencies of unauthorized disclosure or misuse of sensitive information, which is critical to enabling timely agency decisions and responses. To address the need for clearly defining contractor responsibilities in governmentwide guidance in the FAR, we recommend that the Administrator of OFPP ensures that the FAR Council incorporates changes in the FAR that address safeguards for contractor access to sensitive information by providing guidance to agency acquisition policy officials, in coordination with IT security and privacy officials, chief information officers, and other affected parties, on agency development and use of contractor nondisclosure agreements as a condition of access to sensitive information; and establishing a requirement for prompt notification to appropriate agency officials of a contractor’s unauthorized disclosure or misuse of sensitive information so that timely agency responses are facilitated and appropriate contractor accountability mechanisms can be enforced. We provided a draft of this report to OMB’s OFPP, DOD, HHS, and DHS for review and comment. In oral comments, OFPP generally concurred with our recommendations. DOD provided technical comments that were incorporated into the report as appropriate and HHS did not have comments. In written comments, included in appendix VI, DHS generally concurred with our report. However, DHS took exception to the analysis for 1 of the 14 contract actions reviewed, which we found did not contain adequate safeguards to protect sensitive information. While we agree that the task order identified in DHS’ response includes contract provisions with prohibitions against disclosing sensitive information, the language does not address safeguards to ensure contractors’ appropriate use of sensitive information. DHS also stated that although this task order lacks a contract clause required in DHS acquisition regulations, it includes comparable provisions in the statement of work. We reviewed the task order and the guidance for the clause HSAR 3052.204-71, Contractor Employee Access, which requires the use of the clause or one substantially the same in solicitations and contracts when contractor employees require recurring access to government facilities or access to sensitive information. On the basis of our review, we continue to believe that the task order does not contain HSAR clause 3052.204-71 or a contract clause that is substantially the same as that clause. Although some provisions in the task order contain similar information and requirements, these provisions do not cover the same breadth or detail as HSAR clause 3052.204-71. For example, the task order does not include a comprehensive definition section such as the one in HSAR clause 3052.204-71. Without the use of such comprehensive definitions, it is not clear that the various provisions of the task order noted by DHS collectively and effectively protect the same range of sensitive government information as set forth in HSAR clause 3052.204-71. In addition, the task order specified in DHS’ response does not include provisions that limit contractors from disclosing sensitive information without authorization from the contracting officer. Also, the portions of the statement of work cited as comparable with HSAR clause 3052.204- 71(e) relate specifically to information technology, and not necessarily to information that contractors and their employees may otherwise gain access to in the course of their contractual responsibilities. DHS also provided technical comments, which were incorporated into the draft where appropriate. We are sending copies of this report to the Director of OMB; the Secretaries of Defense, Homeland Security, and Health and Human Services; and interested congressional committees. The report also is available at no charge on GAO’s Web site at http://www.gao.gov. If you or your staff have any questions concerning this report, please contact me at (202) 512-4841 or needhamjk1@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix VII. To assess the extent that agency guidance and contracts establish effective safeguards for sensitive information, we identified key attributes of the safeguards that should be contained in acquisition guidance and contracts to manage the risks of contractor unauthorized disclosure and misuse based on (1) review of agency practices related to controls over contractor access to sensitive information, (2) review of applicable standards drawn from GAO’s Standards for Internal Control in the Federal Government, and (3) discussions with government security and contracting officials responsible for administrative, information, and contractor personnel security functions. Specifically the acquisition guidance and contracts should contain safeguards that (1) describe the relevant scope of sensitive information under the agency’s authority or control that should be protected if contractors require access to it for contract purposes, (2) require the contractor to refrain from disclosing such sensitive information to anyone except as needed for contract performance, and (3) prohibit the contractor from using such sensitive information for any purpose other than contract performance. To assess the extent to which agency guidance contains safeguards for contractor protection of sensitive information, we analyzed applicable guidance available in the respective Federal Acquisition Regulation (FAR) supplements of the Department of Defense (DOD), the Department of Homeland Security (DHS), and the Department of Health and Human Services (HHS). We selected these departments for review because they ranked among the top procurers of contracted services in fiscal year 2008, based on a review of the Federal Procurement Data System–Next Generation (FPDS-NG), and because prior GAO work shows that their component agencies and organizations rely extensively on support contractors to perform mission-critical tasks that would potentially require access to sensitive information. We assessed the reliability of the FPDS- NG data through corroboration with agency officials and contract files and determined they were sufficiently reliable for our purposes. We analyzed applicable policy and guidance available from the departments and some of their selected component agencies and organizations to identify the extent their guidance provides for contractor protection of sensitive information, including guidance contained in agency FAR supplements as well as security and privacy program policies and procedures applicable to contractor employees. We also interviewed acquisition policy, security, and privacy officials to discuss their supplements to FAR guidance and the contract provisions they use to meet their specific agency needs. To assess the extent to which agency contracts contain safeguards for contractor protection of sensitive information, we analyzed DOD, DHS, and HHS contract actions (defined as a contract, task order, and blanket purchase agreement and associated order) for services potentially requiring contractor access to sensitive information from the following five component agencies or organizations and locations: within DOD, the (1) TRICARE Management Activity (TMA) in Falls Church, Virginia, and the contracting activity supporting TMA at the Army Medical Research Acquisition Activity at Fort Detrick, Maryland, (2) the Air Force Materiel Command’s Electronic Systems Cente Hanscom Air Force Base, Massachusetts; within DHS in Washington, D.C., (3) U.S. Customs and Border Protect ns within the Office of the and (4) the Office of Procurement Operatio Chief Procurement Officer, which is the contracting activity supporting headquarters organizations; and within HHS, the (5) Centers for Medicaid and Medicare Services (CMS) Baltimore, Maryland. U.S. At each of these five organizations, we selected for review a nongeneralizable sample of 6 to 10 contract actions (42 in total) in which contractor employees worked in close proximity to government employees and provided professional and administrative services that supported the agencies’ missions, in addition to providing a cross section of contract types and services. In making our selection, we reviewed lists of contract actions and reported dollar values drawn from data provided by DOD, DHS, and HHS component agency and organization officials to confirm that the contract actions belonged to their agencies and that they involved contractors working on-site or in close proximity with government employees, to perform services potentially requiring access to sensitive information. For each of the 42 contract actions, we analyzed the contract documentation provided, including base contracts from which task orders or blanket purchase agreements and their associated orders were issued, to determine whether they contained provisions or clauses that direct contractors to safeguard sensitive information consistent with key attributes we identified for safeguarding sensitive information. In conducting this content analysis, two GAO analysts independently reviewed the provisions in each contract or task any differen ces in how they were coded. We dete order and then reconciled rmined whether the contract provisions addressed limiting disclosure of sensitive information and preventing its misuse. We also assessed the scope of information protected—whether these protections applied to certain categories or to n all relevant types of sensitive information that may potentially have bee accessed during contract performance. We also determined whether the contract actions required the use of contractor nondisclosure agreements . To obtain an in-depth understanding of the reasons why certain contract were required clauses and provisions to safeguard sensitive information and obtain views on their effectiveness and how contractor compliance with the requirements was being monitored by the government at a cross section of DOD, DHS, and HHS offices, we selected 9 of the 42 contract actions as case studies. For each case study, we conducted semistructured oping interviews with the DOD, DHS, or HHS officials responsible for devel contract requirements and monitoring con contracting officers, contracting officers’ representatives, and program managers. To assess the adequacy of governmentwide guidance in the FAR on how agencies are to contractually safeguard sensitive information to which contractor employees prescribe protections associated with sensitive information, i 4 (Administrative Matters); Part 7 (Acquisition Planning); Subpart 9.5 (Organizational and Consultant Conflicts of Interest); Part 24 (Pro of Privacy and Freedom of Information); and Part 52 (Solicitation tection Provisions and Contract Clauses). We reviewed pending amendments to the FAR and legislation to determine the safeguards they might add to have access, we analyzed FAR requirements that existing FAR guidance. To further understand steps being taken to amendthe FAR, we interviewed government officials supporting members of the FAR Council, which oversees the development and maintenance of the (OFPP) FAR, and officials with the Office of Federal Procurement Policy in the Office of Management and Budget. The OFPP Administrator serves as chair of the FAR Council. We conducted this performance audit from May 2009 through 2010 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis fo eve r our findings and conclusions based on our audit objectives. We beli ings that the evidence obtained provides a reasonable basis for our find and conclusions based on our audit objectives. In 2006 we reported on a survey of federal agencies that showed 26 were using 56 different designations to protect information they deem critical to their missions—such as law-enforcement sensitive, sensitive security information, and unclassified controlled nuclear information. Because of the many different and sometimes confusing and contradictory ways thatagencies identify and protect sensitive but unclassified (SBU) information, the sharing of information about possible threats to homeland security has been difficult. To address this challenge, efforts are underway to establish new governmentwide processes for designating, marking, safeguarding, and disseminating SBU information. Since 2008, in response to a presidential memorandum that replaced SBU information with “controlled unclassified information” (CUI) as the single categorical designation for SBU information, the executive branch is attempting to overhaul its CUI framework. The ongoing effort is also addressing a 2009 presidential task force report that found too many labels for sensitive information and recommended that agencies reduce them and balance the need for nondisclosure (to protect privacy or other legitimate interests) and transparency and openness in government. The task force found that currently, across the executive branch, this information is identified by over 100 unique markings and at least 130 different labeling or handling regimes (a partial listing of SBU markings the task force found currently in use are shown below). The SBU challenge, according to the task force, is that although SBU regimes or markings are typically derived from an identifiable authority, collectively they reflect a disjointed, inconsistent, and unpredictable system for protecting, sharing, and disclosing sensitive information. The Department of H 4, Safeg Subpart 3004. Industry ( clause at HSAR 3052. shen contr same, in solicitation and contracts w recurring access to government facilities or access to sensitive information. T requir information. ecurity Acquisit d and Sen ion Regulation (H sitive Information Within SAR) 48 C.F.R. 3004), states that contracting officers shall insert the n in figure 1, or one substantially the se shall not be used unless contractor employees wi e recurring access to government facilitie s or access to sen sitive The “Confidentiality of Information” contract clause shown in figure 3 was to be used in solicitations and resultant contracts whenever the need existed to keep information confidential, for example in contracts that involve the use of proprietary plans or processes or confid information of organizations other than the contractors. In addition, any solicitation or contract including this clause was to indicate, as specifically as possible, the types of data that would be covered and the requirements for handling the data. The Air Force Federal Acquisition Regulation Supplement (AFFARS) section on procurement integrity states that any individuals requiring access to source-selection information as a result of participating on a source selection or to perform their duties shall sign a Source Selection Non-disclosure Agreement identified in the Air Force mandatory procedure for source selection, and shown in figure 4. The Source Selection Non-disclosure Agreement may be used on an annual basis for individuals who must have access to source-selection information in the performance of their official duties throughout the year, whether or not they participate as part of the actual source-selection team. The Department of the resources to assist with implementing the Troubled Asset Relief Program (TARP) since its 2008 beginning underscores the importance of addressing conflict-of-interest issues. As we have previously reported, Treasury has strengthened its processes for managing and monitoring conflicts of interest among contractors and financial agents. In January 2009, Treasury issued an interim regulation on TARP conflicts of interest, which was effective immediately. Among other provisions, the regulation requires a certification, in the form of a nondisclosure agreement, from each retained entity’s management official and key individuals performing work under a contract or financial agency agreement stating that he or she will comply with the requirements for confidentiality of nonpublic information before performing work and annually thereafter. An example of a nondisclosure agreement Treasury uses with its TARP contractors is shown in figure 8. Our April 2005 report concerning the federal government’s extensive reliance on contractors to provide IT systems and services found that without appropriate policies and guidance on how to develop effective information-security oversight of contractors, agencies may not develop sufficient policies to address the range of risks posed by contractors, and that as a result, federal information and operations can be placed at undue risk. Since FAR Council efforts to update the FAR provisions had stretched over 3 years, we recommended expeditious completion to ensure that agencies develop appropriate information-security oversight capabilities. FAR Subpart 2.1 Definition of Information Security Added in 2005 Information security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in ord provide— 1. hich means guarding against improper information modification or n, and includes ensuring information nonrepudiation and authenticity; 2. Confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and 3. Availability, which means ensuring timely and reliable access to, and use of, information. In 2007 the FAR was amended to add personnel-security requirements, in recognition that contractors increasingly are required to have physical e access to federally controlled facilities and information systems in th performance of government contracts and the President’s issuance of Homeland Security Presidential Directive 12 (HSPD-12). Specifically, the FAR was amended to require agencies to include a standard clause in their solicitations and contracts when contractor performance requires recurring access to government facilities and systems. This clause states that the contractors shall comply with agency personal identity verification procedures for issuance of identification cards. This action to unify FAR guidance has assisted agencies in implementing HSPD-12, requiring the establishment of a governmentwide standard for secure and reliable forms of identification cards for federal employees and contractors alike. For example, updates issued since 2007 to some ag FAR supplements have added agency-specific HSPD-12 policies, procedures, contract clauses, and solicitation provisio employees requiring routine access to their facilities and sensitive information stored in agency networks. Implementing HSPD-12 requirements through contract provisions helps address the risks of contractors gaining unauthorized physical or electronic access to federal information or contractors using outmoded ow identification cards that can be easily forged, stolen, or altered to allnauthorized access. In 2009 the FAR Council opened a FAR case in u recognition of the need for return of the physical identification cards i c t ssued to contractors. According to the FAR Council, our re ontractor employees’ access to sensitive information reinforced the o resolve this shortcoming in FAR guidance. In addition to the contact named above, Carolyn Kirby, Assistant Director; Jennifer Dougherty; Guisseli Reyes-Turnell; Greg Campbell; Vijay D’Souza; Claudia Dickey; Ralph Roffo; Tind Shepper Ryen; Alyssa Weir; and Bill Woods made key contributions to this report.

Summary: In performing agency tasks, contractor employees often require access to sensitive information that must be protected from unauthorized disclosure or misuse. This report assesses the (1) extent to which agency guidance and contracts contain safeguards for contractor access to sensitive information, and (2) adequacy of governmentwide guidance on how agencies are to safeguard sensitive information to which contractors may have access. To conduct this work, GAO identified key attributes involving sensitive-information safeguards, analyzed guidance and met with officials at three agencies selected for their extensive reliance on contractor employees, analyzed 42 of their contract actions for services potentially requiring contractor access to sensitive information, and analyzed the Federal Acquisition Regulation (FAR) and pending FAR changes regarding governmentwide guidance on contractor safeguards for access to sensitive information. GAO's analysis of guidance and contract actions at three agencies found areas where sensitive information is not fully safeguarded and thus may remain at risk of unauthorized disclosure or misuse. The Departments of Defense (DOD), Homeland Security (DHS), and Health and Human Services (HHS) have all supplemented the FAR and developed some guidance and standard contract provisions, but the safeguards available in DOD's and HHS's guidance do not always protect all relevant types of sensitive information contractors may access during contract performance. Also, DOD's, DHS's, and HHS's supplemental FAR guidance do not specify contractor responsibilities for prompt notification to the agency if unauthorized disclosure or misuse occurs. Almost half of the 42 contract actions analyzed lacked clauses or provisions that safeguarded against disclosure and inappropriate use of all potential types of sensitive information that contractors might access during contract performance. Additionally, DOD and HHS lack guidance on the use of nondisclosure agreements, while DHS has found that these help accountability by informing contractors of their responsibilities to safeguard confidentiality and appropriate use and the potential consequences they face from violations. There have been numerous recommendations for improved governmentwide guidance and contract provisions in the FAR, such as prohibiting certain types of contractor personnel from using sensitive information for personal gain. To address some of these areas, regulatory changes are pending to develop standardized approaches and contract clauses in the FAR that agencies could use to safeguard sensitive information, rather than developing such safeguards individually. However, similarly to issues identified in agency guidance, GAO found two key areas the FAR does not yet address. These include (1) agency use of nondisclosure agreements as a condition of contractor access to sensitive information, and (2) the need to establish clear requirements for contractors to promptly notify agencies of unauthorized disclosure and misuse of sensitive information. The ongoing rulemaking process provides an opportunity to address the need for additional FAR guidance in both areas. GAO recommends that the Office of Federal Procurement Policy (OFPP) ensure pending changes to the FAR address two additional safeguards for contractor access to sensitive information: the use of nondisclosure agreements and prompt notification of unauthorized disclosure or misuse of sensitive information. In oral comments, OFPP agreed with the recommendations. DHS also concurred with the recommendations, while DOD and HHS had no comment.