NASA’s Compliance with Executive Order 13526: Classified National Security Information
In December 2009, the President signed Executive Order 13526, “Classified National Security Information” (Order), to reform the security classification and declassification processes.The Order was intended to produce greater openness and transparency in the Government’s classification and declassification programs while maintaining the Government’s legitimate interests to protect certain information from unauthorized disclosure.
Public Law 111-258, “Reducing Over-Classification Act” of 2010, requires the Inspector General of each Federal department or agency with an employee who is authorized to make original classifications to assess agency compliance with the Order.In response to the Act, we (1) assessed whether NASA has adopted, followed, and effectively administered classification policies, procedures, rules, and regulations and (2) identified policies, procedures, rules, regulations, or management practices that may be contributing to misclassification of material at the Agency. In accordance with the Act, we will conduct a second evaluation by September 30, 2016, to review the actions NASA takes in response to this review. Details on the scope and methodology for our review can be found in Appendix A.
Results
NASA has adopted classification policies and issued regulations that comply with security classification reform requirements. Specifically, NASA has established procedural requirements for the proper implementation and management of a uniform system for classifying, accounting for, safeguarding, and declassifying national security information under its control. However, while the Agency’s procedures meet Federal requirements, its implementing directive does not require Agency personnel with classification authority to receive all necessary training. Additionally, we found instances in which Agency personnel were not consistently following these NASA policies.
Specifically, we found classified documents that were improperly marked,training requirements that were not met, and self-inspections that were not fully implemented. Although these deficiencies were relatively minor in nature, failure to comply with these requirements increases the risk that personnel may inadvertently misclassify material.
Management Action
We recommended that the NASA Assistant Administrator for Protective Services revise NASA’s classification implementing policy so it is consistent with the Order. In addition, we recommended the Assistant Administrator ensure that persons with classification authority receive all required training and the Agency’s self-inspection program identifies and mitigates future occurrences of marking and training deficiencies.
In response to our draft report, the Assistant Administrator for Protective Services concurred with our recommendations. Specifically, the Office of Protective Services (OPS) agreed to revise NASA policy to clarify that individuals who apply derivative classification markings must receive the required training prior to classifying any information. Additionally, the Assistant Administrator will issue an interim policy to all Centers containing the revised mandatory requirements. Further, to improve the Agency’s self-inspection program OPS will formalize criteria for annual Center self-inspections, provide self-inspection sheets for tracking purposes, and measure the Centers’ progress as part of the Integrated Security Functional Reviews. We consider the proposed actions to be responsive and will close the recommendations upon completion and verification of the corrective actions. Management’s full response is reprinted in Appendix B.
X
