Unauthorized disclosure of sensitive information by government or contractor employees through negligence or misconduct can have a significant effect on the government’s ability to perform its primary functions, potentially resulting in financial loss, damaged reputation, and loss of public trust. Sensitive information may not always be explicitly designated or marked as such. For the purposes of this report, we use the term “sensitive information” to generally refer to information under an agency’s authority or control that has a degree of confidentiality such that its loss, misuse, unauthorized access, or modification could compromise that confidentiality and harm important interests, such as personal and medical privacy to which individuals are entitled under laws, national security, law enforcement, proprietary commercial rights, or the conduct of agency programs. The large but unquantifiable amount of sensitive information generated by the government makes understanding its scope more difficult and agencies’ safeguarding this information from unauthorized disclosure or inappropriate use by contractors a complex challenge. Table 1 shows examples of several types of sensitive information. Additional examples are listed in appendix II. All examples were drawn from a myriad of designations that agencies use to describe sensitive information. The federal government uses a variety of means, whether prescribed by statute, executive order, or other authority, to limit dissemination and protect against the inadvertent disclosure of certain types of sensitive information. For information the government considers critical to our national security, the government may take steps to protect such information by classifying it as Top Secret, Secret, or Confidential pursuant to criteria established by law and executive order. Information that does not meet the thresholds established for classification as national security information but that an agency nonetheless considers sufficiently sensitive to warrant restricted dissemination has generally been referred to as sensitive but unclassified (SBU). In designating information this way, agencies determine that the information they use must therefore be safeguarded from public release. Some, but not all, SBU designations used by agencies have a specific basis in statute. For example, some agencies use the provisions of the Freedom of Information Act (FOIA) as their basis for designating information as SBU. FOIA establishes that federal agencies must generally provide the public with access to government information, thus enabling them to learn about government operations and decisions. FOIA establishes a legal right of access to government records and information, on the basis of the principles of openness and accountability in government. But the act also prescribes nine specific categories of information that are exempt from disclosure: for example, trade secrets and certain privileged commercial or financial information, certain personnel and medical files, and certain law enforcement records or information. Thus the need to safeguard sensitive information from public disclosure while striking the appropriate balance with the goal of government transparency is another challenge agencies must continually address. Protecting legitimate security, law enforcement, and privacy interests also must be carefully balanced with protecting civil liberties. Of critical importance are providing clear rules to those who handle sensitive information and ensuring that the handling and dissemination of information is not restricted unless there is compelling need. Government ethics rules prohibit federal employees from using sensitive nonpublic information, defined below, for personal gain or to further the interests of another, whether by advice or recommendation or through knowing unauthorized disclosure. For federal employees, certain activities and acts that affect a personal financial interest may also result in violations of criminal law with potentially serious consequences, including dismissal, prosecution, fines, and imprisonment. Because not all government ethics rules and related statutes apply to contractors, many of these prohibitions do not extend to contractor employees working in the multisector workforce. Nonpublic Information as Defined in Government Ethics Rules Nonpublic information is information that the employee gains by reason of federal employment and that s/he knows or reasonably should know has not been made available to the general public. It includes information that s/he knows or reasonably should know: 1. Is routinely exempt from disclosure under the Freedom of Information Act, codified at 5 U.S.C. § 552, or otherwise protected from disclosure by statute, Executive order or regulation; 2. Is designated as confidential by an agency; or 3. Has not actually been disseminated to the general public and is not authorized to be made available to the public on request. Our analysis of guidance and contract actions at three agencies found areas where sensitive information is not fully safeguarded and thus may remain at risk of unauthorized disclosure or misuse. DHS, DOD, and HHS FAR supplements include some guidance and standard contract provisions—for example that address contractor safeguards for personal information. However, the policies and procedures available in DOD’s and HHS’s FAR guidance do not contain effective agency management controls for sensitive information needed to help ensure contractor compliance, prevent contractor disclosure and misuse, and promote contractor accountability. Such guidance could help contracting and program officials incorporate safeguards into their contract actions for protecting all types of relevant sensitive information contractors may access, such as agency sensitive information. At the contract level, almost half of the 42 contract actions reviewed did not include solicitation and contract provisions that safeguarded against unauthorized contractor disclosure and inappropriate use of sensitive information contractors may access in program offices during the course of contract performance. In cases where there was agency policy to include contract provisions to protect sensitive information on all contracts, such as regarding the medical privacy of individuals, it was not incorporated in 5 of the 42 contract actions that we reviewed. Additionally, DOD and HHS lack guidance on the use of nondisclosure agreements, while DHS has found that these help improve accountability by informing contractors of their responsibilities and the consequences that may result from their failure to meet those responsibilities. Contractor and subcontractor employees can be responsible for carrying out a range of mission-critical tasks—including studying ways to acquire desired capabilities, developing contract requirements, and advising or assisting on source selection, budget planning, financial management, and regulations development—potentially requiring access to many types of sensitive information. Agencies can use their FAR supplement authority to issue guidance, which may include contract provisions to establish contractor responsibility for safeguarding sensitive information. Review of agency practices and discussions with government security and contracting officials identified three key attributes for assessing the extent that agencies’ guidance or the FAR contain effective safeguards for sensitive information in acquisition guidance and contracts. On the basis of these sources, in order to have more effective safeguards in place, contracts should contain provisions that (1) describe the relevant scope of sensitive information under the agency’s authority or control that should be protected if contractors require access to it for contract purposes; (2) require the contractor to refrain from disclosing such sensitive information to anyone except as needed for contract performance; and (3) address conflicts of interest or other misuse by prohibiting the contractor from using such sensitive information for any purpose other than contract performance. Agency FAR guidance should help contracting and program officials incorporate effective safeguards for sensitive information into their contract actions by including certain management control practices. We identified a range of management control practices sometimes incorporated into acquisition guidance to help prevent contractor disclosure and misuse, and promote contractor accountability for sensitive information breaches that harm important interests. These control practices include requiring contractors to (1) train or inform employees on their obligations to maintain confidentiality and not misuse sensitive information; (2) obtain written consent from the agency to disclose sensitive information; (3) pass sensitive information provisions to subcontractors; (4) execute a nondisclosure agreement for each employee and subcontractor as a condition of access to sensitive information; (5) promptly notify key agency officials of the misuse or unauthorized disclosure of sensitive information; and (6) be informed of the consequences for violations. Our review found DOD, DHS, and HHS all have guidance that supplements the FAR and addresses requirements or standard contract provisions for contractor protection of certain categories of sensitive information. For example, DOD supplements the protection of individual privacy requirements contained in the FAR by incorporating references to the agency rules and regulations. HHS also supplements the FAR with detailed policy that establishes Privacy Act requirements and requires the inclusion of contract provisions to protect the confidentiality of records and the privacy of individuals in contracts where the Privacy Act is not applicable but the contract would involve the collection of individually identifiable personal information by the contractors. However, with respect to other key attributes available in agency FAR policies and procedures reviewed at DOD, DHS, and HHS, the agencies’ guidance differs in how well they help contracting and program officials incorporate necessary safeguards for sensitive information into their contract actions. Of the guidance analyzed at the three agencies, only DHS established effective management control practices through standard contract provisions in its FAR supplement and related guidance requiring contractors to safeguard sensitive information accessed by employees. In contrast, the FAR guidance of DOD and HHS does not contain effective agency management controls for sensitive information needed to help ensure contractor compliance, prevent contractor disclosure and misuse, and promote contractor accountability. (See app. III for the standard contract provisions we identified in DHS, DOD, and HHS FAR supplements.) As shown in table 2, our analysis of agency guidance included in the DHS FAR supplement found that it contained five of six effective management control practices consistent with key attributes for establishing safeguards for sensitive information. For example, the DHS FAR supplement and related guidance aims to (1) make contractors aware of their responsibilities for maintaining confidentiality of sensitive information; (2) address conflicts of interest and potential misuse by prohibiting use of agency information processed, stored, or transmitted by the contractor for any purpose other than contract performance; and (3) deter noncompliance with these requirements and ensure accountability by explaining consequences related to violations. According to agency acquisition policy officials, recognition within DHS of the need for contractor safeguards for homeland security–sensitive information likely led to the establishment of extensive requirements when the agency updated its interim FAR supplement and related guidance in 2006. On the other hand, DHS acquisition policy and security officials acknowledge that the agency’s FAR supplement and contract clause do not directly specify contractor responsibilities for promptly notifying contracting officers of unauthorized use or disclosure of sensitive information.