Arms Control and Disarmament Agency:

Better Controls Are Needed to Protect Classified Information

NSIAD-89-26: Published: Nov 10, 1988. Publicly Released: Nov 15, 1988.

Additional Materials:

Contact:

Joseph E. Kelley
(202) 275-4128
contact@gao.gov

 

Office of Public Affairs
(202) 512-4800
youngc1@gao.gov

In response to a congressional request, GAO reviewed the extent to which the Arms Control and Disarmament Agency (ACDA) complied with standards governing the protection of classified documents.

GAO found that ACDA did not comply with regulations designed to protect classified material from unauthorized disclosure, since it: (1) improperly marked and stored classified documents; (2) did not regularly conduct close-of-business security checks; (3) did not change safe combinations; (4) did not have updated records on its safes and could not locate 62 headquarters safes; (5) could not locate all of its top secret documents at its headquarters; (6) did not have a top secret control officer or a system for controlling top secret documents at its Geneva office; and (7) had not implemented the Information Security Oversight Office's (ISOO) recommendations regarding ACDA information security weaknesses. GAO also found that, in May 1988, ACDA began to take corrective action to address some of its security deficiencies.

Recommendations for Executive Action

  1. Status: Closed - Implemented

    Comments: ACDA has conducted inspections in its offices since April 1991. In each case, the security officer noted that security check sheets and security container sheet were being used.

    Recommendation: The Director, ACDA, should enforce regulations to ensure the physical protection of classified information, including meeting storage requirements, changing lock combinations, and taking basic security precautions such as checking safes at the close of business, and marking documents properly.

    Agency Affected: United States Arms Control and Disarmament Agency

  2. Status: Closed - Implemented

    Comments: ACDA established an automated inventory of security containers to maintain accurate records. ACDA stated its 1990 investigation resolved all discrepancies. In April 1991, GAO selected 16 of the 62 previously unaccounted-for containers to verify that they were located as indicated on ACDA records. ACDA was able to locate or account for these containers through old records or employee testimony.

    Recommendation: The Director, ACDA, should: (1) account for the safes that are on ACDA records but not located in ACDA; and (2) develop and maintain accurate records regarding the location of safes approved for storage of classified information.

    Agency Affected: United States Arms Control and Disarmament Agency

  3. Status: Closed - Implemented

    Comments: ACDA conducted top secret document inventories in Washington and Geneva. On July 20, 1990, ACDA notified originating agencies that it could not account for missing top secret documents.

    Recommendation: The Director, ACDA, should conduct an inventory of all top secret documents in the agency's possession at both Washington and Geneva to determine what ACDA should be accountable for and identify what documents may be missing. If documents cannot be accounted for, report the documents to the originating agency so that an assessment can be conducted to determine if security was compromised.

    Agency Affected: United States Arms Control and Disarmament Agency

  4. Status: Closed - Implemented

    Comments: Since April 4, 1991, ACDA has conducted three inventories of Top Secret holdings in Geneva. ACDA reported that there were no Top Secret documents being stored in the designated Top Secret container or in randomly selected security containers.

    Recommendation: The Director, ACDA, should implement and enforce existing regulations to ensure proper handling, control, and accountability of top secret, codeword, and other sensitive documents, including appointing a top secret control officer for Geneva, developing control procedures for all ACDA and delegation staff in Geneva, and establishing procedures to ensure that top secret document information is recorded in a timely and accurate manner.

    Agency Affected: United States Arms Control and Disarmament Agency

  5. Status: Closed - Implemented

    Comments: ACDA has started implementing some ISOO recommendations. In January 1990, ACDA began a mandatory security briefing program and developed a self-inspection plan.

    Recommendation: The Director, ACDA, should act on the ISOO recommendations for improving the ACDA information security program, including security education programs, self-inspections to ensure proper storage, and adherence to classification regulations.

    Agency Affected: United States Arms Control and Disarmament Agency

 

Explore the full database of GAO's Open Recommendations »

Sep 29, 2016

Sep 20, 2016

Sep 15, 2016

Jun 29, 2016

Jun 21, 2016

Apr 28, 2016

Apr 14, 2016

Apr 12, 2016

Mar 23, 2016

Dec 17, 2015

Looking for more? Browse all our products here