Safeguards to Protect Sensitive Information Not Always Available in Agency Guidance or Included in Contract Actions

Our analysis of guidance and contract actions at three agencies found  areas where sensitive information is not fully safeguarded and thus may  remain at risk of unauthorized disclosure or misuse. DHS, DOD, and HHS  FAR supplements include some guidance and standard contract  provisions—for example that address contractor safeguards for personal  information. At the contract level, almost half of the 42  contract actions reviewed did not include solicitation and contract  provisions that safeguarded against unauthorized contractor disclosure  and inappropriate use of sensitive information contractors may access in  program offices during the course of contract performance. Additionally, DOD and HHS lack guidance on  the use of nondisclosure agreements, while DHS has found that these help  improve accountability by informing contractors of their responsibilities  and the consequences that may result from their failure to meet those  responsibilities. Almost Half of Contract Actions Reviewed Lack Contract Provisions That Fully Safeguard Sensitive Information

For our analysis of contract documents for 42 contract actions at DHS,  DOD, and HHS that involved contractor employees supporting mission- critical tasks, in order to be considered to fully safeguard all types of  sensitive information, a contract had to contain provisions that specifically  required contractors to refrain from (1) disclosing sensitive information to  anyone except as needed for contract performance and (2) using such  sensitive information for any purpose other than contract performance. In the absence of such safeguards, there is higher risk  of unauthorized disclosure or misuse of sensitive information by  contractors. While the FAR establishes governmentwide guidance on certain  contractor sensitive-information safeguards prescribed in statute—for  example, to require contractor protection of individual privacy—FAR  guidance does not address certain key areas relating to contractor access  to sensitive information. Such changes to the FAR could provide agencies clear  guidance on the use of contractor nondisclosure agreements as a  condition of access to sensitive information and could include  requirements for contractors to promptly notify agencies of unauthorized  disclosure and misuse of sensitive information to enable timely decisions  regarding an agency’s response when use of sensitive information is  compromised. Rather than having agencies develop their own guidance and  clauses individually, several amendments are pending to improve guidance  and contract clauses in the FAR. Recommendations for Executive Action

To address the need for clearly defining contractor responsibilities in  governmentwide guidance in the FAR, we recommend that the  Administrator of OFPP ensures that the FAR Council incorporates  changes in the FAR that address safeguards for contractor access to  sensitive information by    providing guidance to agency acquisition policy officials, in coordination  with IT security and privacy officials, chief information officers, and other  affected parties, on agency development and use of contractor  nondisclosure agreements as a condition of access to sensitive  information; and    establishing a requirement for prompt notification to appropriate agency  officials of a contractor’s unauthorized disclosure or misuse of sensitive  information so that timely agency responses are facilitated and  appropriate contractor accountability mechanisms can be enforced. In oral comments, OFPP generally concurred  with our recommendations. To assess the extent to which agency guidance contains safeguards for  contractor protection of sensitive information, we analyzed applicable  guidance available in the respective Federal Acquisition Regulation (FAR)  supplements of the Department of Defense (DOD), the Department of  Homeland Security (DHS), and the Department of Health and Human  Services (HHS).
Why GAO Did This Study

In performing agency tasks, contractor employees often require access to sensitive information that must be protected from unauthorized disclosure or misuse. This report assesses the (1) extent to which agency guidance and contracts contain safeguards for contractor access to sensitive information, and (2) adequacy of governmentwide guidance on how agencies are to safeguard sensitive information to which contractors may have access. To conduct this work, GAO identified key attributes involving sensitive-information safeguards, analyzed guidance and met with officials at three agencies selected for their extensive reliance on contractor employees, analyzed 42 of their contract actions for services potentially requiring contractor access to sensitive information, and analyzed the Federal Acquisition Regulation (FAR) and pending FAR changes regarding governmentwide guidance on contractor safeguards for access to sensitive information.

What GAO Found

GAO's analysis of guidance and contract actions at three agencies found areas where sensitive information is not fully safeguarded and thus may remain at risk of unauthorized disclosure or misuse. The Departments of Defense (DOD), Homeland Security (DHS), and Health and Human Services (HHS) have all supplemented the FAR and developed some guidance and standard contract provisions, but the safeguards available in DOD's and HHS's guidance do not always protect all relevant types of sensitive information contractors may access during contract performance. Also, DOD's, DHS's, and HHS's supplemental FAR guidance do not specify contractor responsibilities for prompt notification to the agency if unauthorized disclosure or misuse occurs. Almost half of the 42 contract actions analyzed lacked clauses or provisions that safeguarded against disclosure and inappropriate use of all potential types of sensitive information that contractors might access during contract performance. Additionally, DOD and HHS lack guidance on the use of nondisclosure agreements, while DHS has found that these help accountability by informing contractors of their responsibilities to safeguard confidentiality and appropriate use and the potential consequences they face from violations. There have been numerous recommendations for improved governmentwide guidance and contract provisions in the FAR, such as prohibiting certain types of contractor personnel from using sensitive information for personal gain. To address some of these areas, regulatory changes are pending to develop standardized approaches and contract clauses in the FAR that agencies could use to safeguard sensitive information, rather than developing such safeguards individually. However, similarly to issues identified in agency guidance, GAO found two key areas the FAR does not yet address. These include (1) agency use of nondisclosure agreements as a condition of contractor access to sensitive information, and (2) the need to establish clear requirements for contractors to promptly notify agencies of unauthorized disclosure and misuse of sensitive information. The ongoing rulemaking process provides an opportunity to address the need for additional FAR guidance in both areas.

What GAO Recommends

GAO recommends that the Office of Federal Procurement Policy (OFPP) ensure pending changes to the FAR address two additional safeguards for contractor access to sensitive information: the use of nondisclosure agreements and prompt notification of unauthorized disclosure or misuse of sensitive information. In oral comments, OFPP agreed with the recommendations. DHS also concurred with the recommendations, while DOD and HHS had no comment.