NASA’s Processes for Providing Personal Identity Verification Cards Were Not Completely Effective in Meeting Federal Requirements
As of January 9, 2009, NASA had issued more than 70,000 PIV cards to staff and contractors, more than 98 percent of the PIV cards NASA planned to issue, from a PIV card issuer that had not been accredited because NASA did not fully comply with Federal guidance. While NASA properly assessed the PIV card issuer for satisfaction of Federal requirements at both organization and facility levels, found deficiencies, and developed a corrective action plan in accordance with Federal guidance, the Agency did not monitor corrective actions to ensure that identified deficiencies were corrected nor initiate timely reassessment.
If the reassessment of the PIV card issuer reveals that significant deficiencies continue to exist and those deficiencies affect the integrity of the PIV cards, NASA could be required to discontinue PIV card issuer operations and reissue its PIV cards, which we estimate could cost a minimum of $1 million. NASA’s noncompliance with Federal guidance resulted from the lack of a project management plan for the Agency’s transition to HSPD-12 compliant PIV cards.
