Recommendation: The Assistant Administrator of the Office of Water should develop an agreement with HHS's Offices of Child Care and Head Start on their roles and responsibilities in implementing the Memorandum of Understanding on Reducing Lead Levels in Drinking Water in Schools and Child Care Facilities. For example, these agreements may include the ways in which guidance and information will be shared with states and Head Start grantees, such as through webinars or email, and how frequently. (Recommendation 3)

Agency: Environmental Protection Agency
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Assistant Administrator of the Office of Water should direct the Office of Water to specify how it will track progress toward the outcomes of the Memorandum of Understanding on Reducing Lead Levels in Drinking Water in Schools and Child Care Facilities and determine how it will regularly monitor and update the MOU. For example, the Office of Water could develop performance measures for each of the MOU's outcomes. In addition, the Office of Water could submit annual reports on progress toward achieving the MOU's outcomes or it could plan to update the agreement at specific intervals. (Recommendation 4)

Agency: Environmental Protection Agency
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of the Environmental Protection Agency should take steps to consult with respective sector partner(s), such as the SCC, DHS, and NIST, as appropriate, to collect and report sector-wide improvements from use of the framework across its critical infrastructure sector using existing initiatives. (Recommendation 5)

Agency: Environmental Protection Agency
Status: Open

Comments: In written comments provided in July 2020, the Environmental Protection Agency (EPA) stated that it agreed with our recommendation. It noted that it will consult with the Water Sector Coordinating Council, the Department of Homeland Security, and the National Institute of Standards and Technology, as appropriate, to investigate options to collect and report sector-wide improvements, consistent with statutory requirements and the Sector's willingness to participate. However, the department did not provide a timeframe for completing these actions.

Recommendation: The Assistant Administrator for EPA's Office of Enforcement and Compliance Assurance should clearly document in guidance to the regional offices how they should use the definition of informal enforcement actions to collect data on these actions. (Recommendation 1)

Agency: Environmental Protection Agency
Status: Open

Comments: In written comments reproduced in appendix I of this report, EPA stated that it agreed with this recommendation. In July 2020, EPA stated that in a September 30, 2019 guidance document, the agency defined an informal enforcement action. However, on March 24, 2020, the Office of Enforcement and Compliance Assurance (OECA) suspended the September guidance because informal enforcement actions as defined appear to be inconsistent with Section 6 of the White House's Executive Order (EO) 13892, Promoting the Rule of Law Through Transparency and Fairness in Civil Administrative Enforcement and Adjudication, issued on October 9, 2019. EPA said that it would amend the September 2019 guidance to be consistent with the Executive Order. Our recommendation focused on guidance on how regional offices should use the definition of informal enforcement action and we will continue to monitor EPA's implementation of this recommendation.

Recommendation: The Assistant Administrator for EPA's Office of Enforcement and Compliance Assurance should clearly document in guidance to the regional offices that they should collect data on compliance assistance activities and specify which mechanism to use to maintain the data, such as ICIS. (Recommendation 2)

Agency: Environmental Protection Agency
Status: Open

Comments: In written comments reproduced in appendix I of this report, EPA stated that it agreed with this recommendation and would collect data on compliance assistance for each of the National Compliance Initiatives and maintain those data in ICIS. Specifically, in July 2020, the agency stated that in order to further its compliance assistance efforts, the Office of Enforcement and Compliance Assistance (OECA) is including a compliance assistance tool as an important part of each of EPA's National Compliance Initiatives. According to EPA, data on compliance assistance efforts that are part of the NCI will be collected and tracked for management review in the Integrated Compliance Information System. In addition, EPA stated it has collected data in the past on webpage visits related to its national Compliance Assistance Centers and would continue to do so in the future. We will continue to monitor the status of EPA's implementation of this recommendation.

Recommendation: The Assistant Administrator for EPA's Office of Enforcement and Compliance Assurance should include the known limitations of data in its annual reports and provide information on the intended use of EPA's data. (Recommendation 3)

Agency: Environmental Protection Agency
Status: Open

Comments: In written comments reproduced in appendix I of this report, EPA stated that it agreed with this recommendation and acknowledged the importance of providing information about a dataset to facilitate proper interpretation. For that reason, EPA said that, in time for its fiscal year 2020 report, the agency will create a webpage to describe how best to interpret the data presented in its "Fiscal Year EPA Enforcement and Compliance Annual Results" report and include a reference to that webpage in the report itself as well as the "Year in Review" report. In July 2020, EPA reiterated its written comments on the report. We will update the status of EPA's implementation of this recommendation upon the release of its annual reports.

Recommendation: The Director of Water Security of EPA, as Chair of the Water Sector Government Coordinating Council, should work with the council to identify existing technical assistance providers and engage these providers in a network to help drinking water and wastewater utilities incorporate climate resilience into their projects and planning on an ongoing basis. (Recommendation 1)

Agency: Environmental Protection Agency
Status: Open
Priority recommendation

Comments: In June 2020, EPA said that it will continue to work with its wide-ranging, existing technical assistance providers and coordinate with its stakeholders to identify additional providers as applicable. According to the agency, it is already taking action on the recommendation. While we agree that EPA should continue to work with its providers to improve technical assistance to utilities, our recommendation was for EPA to work with stakeholders to develop a network to provide coverage for the many drinking water and wastewater utilities across the country. EPA has not provided information to show that its plans will develop such a network. We will continue to monitor this recommendation to determine how the agency is working with stakeholders to build a network of providers.

Recommendation: The Administrator of EPA should update security plan for the selected operational system to identify a description of security controls, and the individual reviewing and approving the plan and date of approval. (Recommendation 19)

Agency: Environmental Protection Agency
Status: Open

Comments: In June 2020, EPA stated it is taking actions to address this recommendation, but the agency did not provide evidence of its corrective actions. We will continue to monitor the agency's progress and update the recommendation's status when EPA provides its corrective actions.

Recommendation: The Administrator of EPA should update the security assessment report for the selected operational system to identify the summarized results of control effectiveness tests. (Recommendation 20)

Agency: Environmental Protection Agency
Status: Open

Comments: EPA did not concur with this recommendation and as of September 2020, the agency has not provided any evidence of its corrective actions. We will continue to monitor the agency's progress and update the recommendation's status when EPA provides its corrective actions.

Recommendation: The Administrator of EPA should update the list of corrective actions for the selected operational system to identify the specific weakness, estimated funding and anticipated source of funding, key remediation milestones with completion dates, changes to milestones and completion dates, and source of the weaknesses. (Recommendation 21)

Agency: Environmental Protection Agency
Status: Open

Comments: In June 2020, EPA stated it is taking action to address this recommendation, but the agency did not provide evidence of its corrective actions. We will continue to monitor the agency's progress and update the recommendation's status when EPA provides its corrective actions.

Recommendation: The Administrator of EPA should prepare the letter authorizing the use of cloud service for the selected operational system and submit the letter to the FedRAMP program management office. (Recommendation 22)

Agency: Environmental Protection Agency
Status: Open

Comments: EPA did not concur with this recommendation and as of September 2020, the agency has not provided any evidence of its corrective actions. We will continue to monitor the agency's progress and update the recommendation's status when EPA provides its corrective actions.

Recommendation: The Administrator of EPA should develop guidance requiring that cloud service authorization letter be provided to the FedRAMP program management office. (Recommendation 23)

Agency: Environmental Protection Agency
Status: Open

Comments: EPA did not concur with this recommendation and as of September 2020, the agency has not provided any additional evidence. We will continue to monitor the agency's progress and update the recommendation's status when EPA provides its corrective actions.

Recommendation: The Environmental Protection Agency Administrator should evaluate training needs for agency officials or others involved in reviewing the merits of researchers' data management plans and, if additional training is found to be warranted, develop and provide such training. (Recommendation 20)

Agency: Environmental Protection Agency
Status: Open

Comments: The Environmental Protection Agency agreed with this recommendation stating that, during fiscal year 2020, the agency will evaluate training needs for agency officials who review researchers' data management plans. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of the Environmental Protection Agency should ensure that the agency fully implements each of the eight key IT workforce planning activities it did not fully implement. (Recommendation 11)

Agency: Environmental Protection Agency
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of the Office of Superfund Remediation and Technology Innovation should establish a schedule for standardizing and improving information on the boundaries of nonfederal NPL sites. (Recommendation 1)

Agency: Environmental Protection Agency
Status: Open

Comments: In its June 2020 response, EPA stated that it had convened a working group comprising of Superfund and regional officials to collect and disseminate geospatial information for all NPL sites to help EPA analyze, communicate, and respond to the impacts of natural disasters and weather. EPA has not, however, provided a schedule for completing this effort.

Recommendation: The Administrator of EPA should clarify how EPA's actions to manage risks to human health and the environment from the potential impacts of climate change effects at nonfederal NPL sites align with the agency's current goals and objectives. (Recommendation 2)

Agency: Environmental Protection Agency
Status: Open
Priority recommendation

Comments: As of June 2020, EPA has stated that it agrees with the recommendation but does not plan to take any action to respond to it because it believes its actions are aligned with agency goals and objectives. We continue to believe that clarifying this alignment to the agency's current goals and objectives is warranted.

Recommendation: The Director of the Office of Superfund Remediation and Technology Innovation should provide direction on how to integrate information on the potential impacts of climate change effects into risk assessments at nonfederal NPL sites. (Recommendation 3)

Agency: Environmental Protection Agency
Status: Open
Priority recommendation

Comments: As of June 2020, EPA stated that it will be issuing a memorandum that would provide direction on integrating information on the potential impacts of climate change effects into risk assessments at nonfederal NPL sites in the fourth quarter of fiscal year 2020. At that time, we will review the memorandum to determine if it is responsive to our recommendation.

Recommendation: The Director of the Office of Superfund Remediation and Technology Innovation should provide direction on how to integrate information on the potential impacts of climate change effects into risk response decisions at nonfederal NPL sites. (Recommendation 4)

Agency: Environmental Protection Agency
Status: Open
Priority recommendation

Comments: As of June 2020, EPA stated that it will be issuing a memorandum that would provide direction on integrating information on the potential impacts of climate change effects into risk response decisions at nonfederal NPL sites in the fourth quarter of fiscal year 2020. At that time, we will review the memorandum to determine if it is responsive to our recommendation.

Recommendation: The Administrator of EPA, as chair of the working group, should develop guidance for agencies on what they should include in their environmental justice strategic plans. (Recommendation 21)

Agency: Environmental Protection Agency
Status: Open

Comments: In its comments on our report, EPA agreed with this recommendation. We will continue to review the agency's actions and update this information.

Recommendation: The Administrator of EPA, as chair of the working group, should develop guidance or create a committee of the working group to develop guidance on methods the agencies could use to assess progress toward their environmental justice goals. (Recommendation 22)

Agency: Environmental Protection Agency
Status: Open

Comments: In its comments on our report, EPA agreed with this recommendation. We will continue to review the agency's actions to update its progress in implementing this recommendation.

Recommendation: The Administrator of EPA, as chair of the working group, and in consultation with the working group, should clearly establish, in its organizational documents, strategic goals for the federal government's efforts to carry out the 1994 Executive Order. (Recommendation 23)

Agency: Environmental Protection Agency
Status: Open

Comments: In its comments on our report, EPA disagreed with this recommendation, but also stated that it would lead efforts to update the working group's fiscal year 2016-2018 Framework for Collaboration to include guidance for strategic plans, tracking progress toward goals, and defining alignment with the executive order. We believe that if the agency carries out these actions, it will meet the intent of the recommendation. We will continue to review the agency's actions to update its progress in implementing the recommendation.

Recommendation: The Administrator of EPA, as chair of the working group, and in consultation with the other working group members, should update the 2011 Memorandum of Understanding and renew the agencies' commitments to participate in the interagency collaborative effort and the working group. (Recommendation 24)

Agency: Environmental Protection Agency
Status: Open

Comments: In its comments on our report, EPA disagreed with this recommendation and stated that it should be combined with the recommendation to update the Environmental Justice working group's strategic documents. We believe the agency misunderstood the recommendation. As we stated in the report, we believe that the MOU needs to be updated to address the matter of participation by the members who signed it but do not participate. We will continue to review the agency's actions to update its progress in implementing this recommendation.

Recommendation: The Administrator of the Environmental Protection Agency (EPA) should fully develop a cybersecurity risk management strategy that includes the key elements identified in this report. (Recommendation 38)

Agency: Environmental Protection Agency
Status: Open
Priority recommendation

Comments: The Environmental Protection Agency did not state whether or not it concurred with this recommendation. As of January 2020, EPA stated that its strategic plans are under review beginning in the fourth quarter of fiscal year 2020. Once the agency has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Administrator of EPA should update the agency's policies to require an organization-wide cybersecurity risk assessment. (Recommendation 39)

Agency: Environmental Protection Agency
Status: Open

Comments: The Environmental Protection Agency did not state whether or not it concurred with this recommendation. As of January 2020, EPA stated that it is establishing a process to review, update, and reissue its policies. Once the agency has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Administrator of EPA should establish a process for conducting an organization-wide cybersecurity risk assessment. (Recommendation 40)

Agency: Environmental Protection Agency
Status: Open
Priority recommendation

Comments: The Environmental Protection Agency did not state whether or not it concurred with this recommendation. As of January 2020, we had not received information pertaining to this recommendation. Once the agency has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Administrator of EPA should fully establish and document a process for coordination between cybersecurity risk management and enterprise risk management functions. (Recommendation 41)

Agency: Environmental Protection Agency
Status: Open

Comments: The Environmental Protection Agency did not state whether or not it concurred with this recommendation. As of January 2020, we had not received information pertaining to this recommendation. Once the agency has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The EPA Administrator should direct EPA officials responsible for appointing advisory committee members to follow a key step in its appointment process—developing and including draft membership grids in appointment packets with staff rationales for proposed membership—for all committees. (Recommendation 1)

Agency: Environmental Protection Agency
Status: Open

Comments: In September 2019, EPA restated its reasons for disagreeing with this recommendation. (EPA's rationale for disagreeing was originally stated in a June 2019 letter included in an appendix in our report.) We will provide updated information regarding this recommendation when it becomes available.

Recommendation: EPA's Designated Agency Ethics Official should direct EPA's Ethics Office, as part of its periodic review of EPA's ethics program, to evaluate—for example, through audits or spot-checks—the quality of financial disclosure reviews for special government employees appointed to EPA advisory committees. (Recommendation 2)

Agency: Environmental Protection Agency
Status: Open

Comments: In August 2019, EPA notified GAO that it expects to launch an electronic financial disclosure reporting system for special government employees in January 2021. Once financial disclosure forms for these individuals are available electronically, EPA's Ethics Office will be better positioned to audit or review the forms, according to EPA officials. In addition, the electronic filing system should minimize errors (e.g. failing to record the date that the form was received) made by filers and reviewers, according to EPA officials.

Recommendation: The Administrator of the Environmental Protection Agency (EPA) should finalize its draft policy for posting comments and their identity information, particularly for duplicate comments, and clearly communicate it to the public on the EPA website. (Recommendation 5)

Agency: Environmental Protection Agency
Status: Open

Comments: EPA concurred with the recommendation. In January 2020, EPA indicated that it will finalize its Docket Center's Document Processing Standard Operating Procedure as well as its website. This update will include information detailing when all duplicate comments are posted to Regulations.gov and when just one representative sample of a duplicate comment is posted. EPA officials estimate that this will be completed in February 2020. Until these items are completed, our recommendation to EPA remains open.

Recommendation: The Administrator of EPA should work with the Commissioner of FDA and Secretary of Agriculture to incorporate leading collaboration practices as they implement their interagency FLW reduction strategic plan, to include (1) agreeing on roles and responsibilities; (2) developing mechanisms to monitor, evaluate, and report on results; (3)clearly defining short- and long-term outcomes; (4) identifying how leadership commitment will be sustained; and (5) ensuring that the relevant stakeholders have been included in the collaborative effort.(Recommendation 1)

Agency: Environmental Protection Agency
Status: Open

Comments: The agency agreed with this recommendation. As of June 2020, EPA indicated that its proposed completion date is October 2020. EPA published joint and individual agency accomplishments in each of the six priority areas listed as contributing efforts on EPA's webpage (https://www.epa.gov/sustainable-management-food/winning-reducing-food-waste-federal-interagency-strategy). In addition, EPA indicated that it is coordinating with government and other stakeholders through: (1) monthly high-level check-in calls for senior USDA and FDA officials, in which the meeting chair rotates among agencies; (2) twice a month (or as needed) staff work group meetings, led by the recently appointed USDA food loss and waste liaison, to explore potential activities aligned with the six priority areas in the interagency strategy to reduce food loss and waste; and (3) participation in quarterly meetings with relevant stakeholders, such as ReFED, the Food Waste Reduction Alliance (FWRA), and Further with Food, to coordinate efforts and learn of opportunities to collaborate on reducing food loss and waste. We will continue to follow up with the agency. When we confirm what additional actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of the Environmental Protection Agency (EPA) should take action to meet the data center closure targets established under DCOI by OMB. (Recommendation 25)

Agency: Environmental Protection Agency
Status: Open

Comments: The Environmental Protection Agency (EPA) is taking action to implement our recommendation. After the Office of Management and Budget (OMB) released the updated Data Center Optimization Initiative policy in June 2019, the agency established a new data center closure target. EPA subsequently reported that it based its three planned closures for fiscal year 2019 on the data center definition applicable while developing its fiscal year 2019 DCOI strategic plan. However, when OMB updated its data center guidance it changed the definition of a data center, and as a result, the three facilities EPA planned to close no longer qualified as data centers. Further, EPA did not have plans to close any additional data centers. While EPA reported to us that it completed the planned closures, the three facilities did not represent what OMB now considers a data center, and so, EPA did not report the closures in its data center inventory update. However, we acknowledge that EPA closed the facilities identified in its April 2019 plan and did not plan to close any data centers that met OMB's new definition, meaning that the agency met its revised fiscal year 2019 goal of zero closures. However, given the short time to evaluate implementation efforts between when OMB released the updated policy in June 2019 and the end of fiscal year 2019, we will continue to monitor EPA's efforts to implement this recommendation through fiscal year 2020.

Recommendation: The Administrator of EPA should take action to meet the data center optimization metric targets established under DCOI by OMB. (Recommendation 26)

Agency: Environmental Protection Agency
Status: Open

Comments: The Environmental Protection Agency (EPA) is taking action to implement our recommendation. The agency established new data center optimization targets after the Office of Management and Budget (OMB) released the updated Data Center Optimization Initiative policy in June 2019. Subsequently, the agency reported meeting its targets for the advanced energy metering and server utilization metrics. However, the agency had not yet met its target for the virtualization metric. We will continue to monitor EPA's progress in implementing this recommendation.

Recommendation: The Administrator of the Environmental Protection Agency should develop a documented policy or clarify existing policy to implement the statutory requirement to consult with ANCs on the same basis as Indian tribes under Executive Order 13175. (Recommendation 2)

Agency: Environmental Protection Agency
Status: Open

Comments: In December 2019, EPA created a draft document, Guiding Principles for Consulting with Alaska Native Claims Settlement Act Corporations, and issued it for consultation with Alaska Native Corporations (ANCs). The draft guiding principles seek to clarify EPA's consultation and coordination practices with ANCs. Additionally, according to agency officials, an EPA working group is in the process of developing an internal, best practices implementation guide. As of April 2020, EPA expects to finalize these guidance documents in 2020

Recommendation: To complete the appropriate assignment of codes to their positions performing IT, cybersecurity, or cyber-related functions, in accordance with the requirements of the Federal Cybersecurity Workforce Assessment Act of 2015, the Administrator of the Environmental Protection Agency should complete the identification and coding of vacant positions in the agency performing IT, cybersecurity, or cyber-related functions. (Recommendation 19)

Agency: Environmental Protection Agency
Status: Open

Comments: The Environmental Protection Agency concurred with the recommendation but as of January 2020, it had not yet provided sufficient evidence that it had implemented the recommendation. We will continue to monitor the situation.

Recommendation: To complete the appropriate assignment of codes to their positions performing IT, cybersecurity, or cyber-related functions, in accordance with the requirements of the Federal Cybersecurity Workforce Assessment Act of 2015, the Administrator of the Environmental Protection Agency should take steps to review the assignment of the "000" code to any positions in the agency in the 2210 IT management occupational series, assign the appropriate NICE framework work role codes, and assess the accuracy of position descriptions. (Recommendation 20)

Agency: Environmental Protection Agency
Status: Open
Priority recommendation

Comments: The Environmental Protection Agency concurred with the recommendation and stated that it would complete a review of the assignment of the "000" code to its positions in the 2210 IT management occupational series, assign the appropriate NICE framework work role codes, and assess the accuracy of position descriptions. As of January 2020, EPA has not yet provided sufficient evidence to demonstrate that it has implemented this recommendation. To fully implement this recommendation, EPA will need to provide evidence that it has assigned appropriate NICE framework work role codes to its positions in the 2210 IT management occupational series and assessed the accuracy of position descriptions.

Recommendation: The Director of EPA's Office of Superfund Remediation and Technology Innovation should develop a regular review process to ensure the quality of Superfund Enterprise Management System (SEMS) data identifying NPL sites on tribal property and revise automated reports used to check the accuracy of SEMS data to include on tribal property data. (Recommendation 1)

Agency: Environmental Protection Agency
Status: Open

Comments: EPA concurred with our recommendation. EPA stated that during the course of our work on this report, SEMS tribal data was reviewed for quality control and corrections were made to the existing data. In addition, EPA's Office of Superfund Remediation and Technology Innovation plans to create a schedule to review tribal data in SEMS and disseminate tribal data to Superfund regional coordinators annually for their quality assurance review starting in April 2019.

Recommendation: The Director of EPA's Office of Superfund Remediation and Technology Innovation should clarify agency guidance regarding tribal consultation for the Superfund program to clearly identify the circumstances under which the agency should consider consulting with tribes. (Recommendation 3)

Agency: Environmental Protection Agency
Status: Open

Comments: EPA concurred with our recommendation. EPA plans to issue a memo to regions that clarifies circumstances under which regions may consider tribal consultation for the Superfund program by March 2020.

Recommendation: The Assistant Administrator of EPA's Office of International and Tribal Affairs should develop or revise existing guidance to clearly direct regional officials to document all invitations to consult with tribes in the Tribal Consultation Opportunity Tracking System database and provide the guidance to those officials. (Recommendation 4)

Agency: Environmental Protection Agency
Status: Open

Comments: EPA concurred with our recommendation and planned four actions in response. According to EPA, it (1) issued a memorandum to all Assistant Administrators and Regional Administrators on the importance of tribal consultation in April 2019; (2) plans to issue monthly TCOTS report to Deputy Assistant Administrators and Regional Assistant Administrators on the status of consultations recorded in TCOTS; (3) developed training slides targeted to EPA's Regional Superfund staff on when and how to document consultation actions in TCOTS, presented during the annual 2019 National Association of Remedial Project Managers training in August 2019; and (4) revised a training module and draft TCOTS User Guide with particular emphasis on entering consultation information into TCOTS, with trainings scheduled in 2019.

Recommendation: The Administrator of the EPA should develop a program management plan that includes a schedule of the actions EPA will take and the resources and funding it needs to establish and implement the Columbia River Basin Restoration Program, including formation of the associated Columbia River Basin Restoration Working Group, and submit this plan to the appropriate congressional authorizing committees as part of the fiscal year 2020 budget process. (Recommendation 1).

Agency: Environmental Protection Agency
Status: Open

Comments: EPA reconvened the Columbia River Toxics Reduction Working Group. As of May 2019, EPA officials told us they are working on the development of a program management plan to identify the actions and timeline for implementing the Columbia River Basin Restoration Program. In July 2019, EPA released a status update entitled, "2019 Status Update: Columbia River Basin Toxics Reduction" that provides a summary of the working group's major accomplishments since 2010, as well as priority efforts for future work. In September 2019, EPA announced the availability of $900,000 in grants to reduce toxics throughout the Columbia River Basin for the Clean Water Act Section 123 Columbia River Basin Restoration Grant Program for fiscal year 2019 through fiscal year 2020. As of October 2020, we have not received additional information from EPA regarding this recommendation. We will update the recommendation's status when we do.

Recommendation: The Administrator of the Environmental Protection Agency should ensure that the agency's IT management policies address the role of the CIO for key responsibilities in the six areas we identified. (Recommendation 19)

Agency: Environmental Protection Agency
Status: Open

Comments: EPA neither agreed nor disagreed with our recommendation, but agreed that CIO authorities should be adequately documented in appropriate policies. EPA officials have stated that they continue to work to address this recommendation. When we confirm what actions the agency has taken to address the 20 responsibility gaps identified in the report, we will provide updated information.

Recommendation: The EPA Region 10 Administrator should work with the management conference on future updates to the CCMP to help prioritize among the indicators that currently lack measurable targets and ensure that such targets are developed for the highest priority indicators where possible. (Recommendation 1)

Agency: Environmental Protection Agency
Status: Open

Comments: EPA agreed with this recommendation, and in June 2019 EPA provided GAO with a written update on the status of actions being taken in response to the recommendation. EPA stated that the leader of the management conference, the Puget Sound Partnership, has initiated an effort to review and revise the Puget Sound recovery vital signs, including updating their associated indicators and targets. EPA estimated that this effort will be completed in fiscal year 2021 for use in the 2022 comprehensive conservation and management plan (CCMP) update. In December 2019, EPA stated that work is ongoing. We will continue to monitor the status of this effort and will assess the extent to which it addresses our recommendation.

Recommendation: The Director, working with the Study, should ensure that as the Study finalizes its reporting format, it fully incorporates leading practices of performance reporting. (Recommendation 1)

Agency: Environmental Protection Agency
Status: Open

Comments: In June 2020, the Long Island Sound Study (Study) stated that it has incorporated two leading practices into the reporting format for its progress reports. In addition, the Study website shows the progress toward ecosystem targets compared to the recovery plan, and for a preceding period of time when data are available. According to the Study, EPA hired a contractor to develop a report addressing our recommendations. The Study is using the contractor report to finalize its reporting format and plans to develop an online reporting and tracking system that fully incorporates leading practices of performance reporting. We will review the format of the online tracking system when it becomes available and provide updated information as appropriate.

Recommendation: The Director, working with the Study, should develop cost estimates that include analyses of uncertainties for each of the targets in the 2015 plan. (Recommendation 2)

Agency: Environmental Protection Agency
Status: Open

Comments: In June 2020, the Study reported that it had hired a contractor to develop a report including the range of costs, including uncertainty bounds, needed to attain each of the targets in the 2015 plan. The contractor has completed its study. Cost estimates for each ecosystem target were developed by adding up the existing cost ranges for each of the implementation actions in the 2015 plan. The report is posted and accessible to the public on the Long Island Sound Study website (https://longislandsoundstudy.net/2019/11/addressing-gaos-recommendations-liss-performance-reporting-and-cost-estimating/). The report contains recommendations for the Study to continue estimating costs in future reports. We are following up with EPA to determine whether the Study will do this.

Recommendation: The Director, working with the Study, should estimate the range of potential costs for all implementation actions and include the estimates in future supplements to the 2015 plan. (Recommendation 3)

Agency: Environmental Protection Agency
Status: Open

Comments: In June 2020, the Study said that as part of the Plan 2020-2024 implementation action update, it will include a range of costs for implementation actions. We will review the supplemental documents when they are available and provide updated information as appropriate.

Recommendation: The Administrator of EPA, in cooperation with other members of the tribal infrastructure task force, should review the 2011 task force report and identify and implement additional actions to help increase the task force's collaboration at the national level. (Recommendation 8)

Agency: Environmental Protection Agency
Status: Open

Comments: As of June 2020, EPA had discussed the 2011 task force report with the other member agencies to identify and implement additional actions to increase collaboration at the national level. EPA published a summary matrix of relevant funding sources on the task force website and compiled a draft document summarizing actions the task force member agencies have taken to implement recommendations from the 2011 report. We will continue to monitor EPA's actions in response to this recommendation.

Recommendation: The Administrator of the Environmental Protection Agency should take steps to consult with respective sector partner(s), such as the SCC, DHS and NIST, as appropriate, to develop methods for determining the level and type of framework adoption by entities across their respective sector. (Recommendation 4)

Agency: Environmental Protection Agency
Status: Open
Priority recommendation

Comments: In written comments, EPA did not explicitly state whether it agreed or disagreed with our recommendation, but said that several factors constrain the agency from implementing the recommendation. EPA also said it agrees that a comprehensive assessment of framework adoption within the water sector would assist with evaluating and tailoring efforts to promote its use. Further, the agency stated that it will continue to work with the Water Sector Coordinating Council and sector partners to promote and facilitate adoption of the cybersecurity framework. The agency also suggested options related to developing cross-sector metrics and survey methods and stated that it will collect available data that may be characterized as cybersecurity framework "awareness," such as downloads of guidance materials and participation in classroom trainings and webinars. However, as of February 2020, EPA had yet to develop methods to determine the level and type of framework adoption. Officials identified steps the department is taking to facilitate framework use. Specifically, EPA officials told us that the agency will coordinate with its Sector Coordinating Council to identify appropriate means to collect and report information, including a survey, to determine the level and type of framework adoption. They explained that, in the past, the water sector expressed concerns with sharing sensitive cybersecurity information and in developing metrics to evaluate cybersecurity practices. . However, EPA officials stated that they have conducted training, webcasts, and outreach related to cybersecurity, including using the framework and tailoring its efforts to sector needs. According to EPA officials, the agency's goal in doing so was to ensure that sector organizations understood the importance of the framework. While the agency has some ongoing initiatives, implementing our recommendation to gain a more comprehensive understanding of the framework's use by its critical infrastructure sector is essential to the success of protection efforts.

Recommendation: The Assistant Administrator for Water should direct EPA's Office of Water to amend its Safe Drinking Water Act and Clean Water Act inspection guidance documents to add questions on strategic workforce planning topics--such as the number of positions needed in the future, skills needed in the future, and any potential gaps in water operator positions. (Recommendation 1)

Agency: Environmental Protection Agency
Status: Open

Comments: In June 2020, EPA Office of Water said that it had revised guidance for conducting Sanitary Surveys for drinking water plants, adding questions related to workforce needs to the "utility management" section of the guidance manual (see Sanitary Survey Learner's Guide (https://www.epa.gov/sites/production/files/2019-08/documents/sanitary_survey_learners_guide_508_8.27.19.pdf), which includes questions on strategic workforce planning topics in section 14.7. As the recommendation applies to wastewater utilities, EPA did not provide an update. In August 2020, EPA officials stated that they plan to incorporate strategic planning questions into its existing guidance documents. According to EPA, it has taken other actions to support the water workforce by announcing a "Water Workforce Initiative," the goal of which is to provide federal leadership and increase public awareness of water sector careers. We will continue to follow-up with EPA Office of Water to determine what actions have been taken in the wastewater area to add questions on workforce issues in inspection guidance.

Recommendation: The Administrator of the Environmental Protection Agency (EPA) should ensure that the CIO of EPA establishes an agency-wide policy and process for the CIO's certification of major IT investments' adequate use of incremental development, in accordance with OMB's guidance on the implementation of FITARA, and confirm that it includes: a description of the CIO's role in the certification process; a description of how CIO certification will be documented; and a definition of incremental development and time frames for delivering functionality, consistent with OMB guidance. (Recommendation 11)

Agency: Environmental Protection Agency
Status: Open

Comments: The Environmental Protection Agency (EPA) concurred with our recommendation and stated that it planned to develop a policy to implement this recommendation and other FITARA issues. Specifically, EPA officials reported in July 2019 that the agency was continuing to work to address the recommendation but did not provided a time frame for when a policy would be finalized. We will continue to monitor EPA's progress on these efforts.

Recommendation: The Assistant Administrator for Water of EPA's Office of Water should require states to report available information about lead pipes to EPA's Safe Drinking Water Information System (SDWIS)/Fed (or a future redesign such as SDWIS Prime) database, in its upcoming revision of the LCR. (Recommendation 1)

Agency: Environmental Protection Agency
Status: Open
Priority recommendation

Comments: As of July 2020 there has been no change in the status of this recommendation. In July 2019, EPA said that the 2016 America's Water Infrastructure Act (AWIA) requires EPA to conduct an assessment of the costs to replace lead service lines and that EPA would conduct this assessment (a survey) in 2020. In a previous update, EPA said that it would consider GAO's recommendation to require states to report available information about lead pipes along with those of other stakeholders as part of the development of the revisions to the Lead and Copper Rule. EPA officials estimated that the agency would publish a proposal for the revisions in 2019.

Recommendation: The Assistant Administrator for Water of EPA's Office of Water should require states to report all 90th percentile sample results for small water systems to EPA's SDWIS/Fed (or a future redesign such as SDWIS Prime) database, in its upcoming revision of the LCR. (Recommendation 2)

Agency: Environmental Protection Agency
Status: Open
Priority recommendation

Comments: As of July 2020 there has been no change in the status of this recommendation. In July 2019, EPA said that it would consider GAO's recommendation to require states to report all 90th percentile sample results for small systems along with those of other stakeholders as part of the development of the revisions to the Lead and Copper Rule. EPA officials estimated that a proposal for the revisions would be published in 2019.

Recommendation: The Assistant Administrator for Water of EPA's Office of Water and the Assistant Administrator of EPA's Office of Enforcement and Compliance Assurance should develop a statistical analysis that incorporates multiple factors--including those currently in SDWIS/Fed and others such as the presence of lead pipes and the use of corrosion control--to identify water systems that might pose a higher likelihood for violating the LCR once complete violations data are obtained, such as through SDWIS Prime. (Recommendation 3)

Agency: Environmental Protection Agency
Status: Open
Priority recommendation

Comments: As of July 2020 there has been no change in the status of this recommendation. In July 2019, EPA stated that the agency developed a Lead and Cooper Rule (LCR) violation reporting tool that is updated and distributed to the EPA regional offices on a quarterly basis. This tool, according to EPA, enhances national oversight by fostering closer engagement with the regional offices to continuously assess any new water systems violating the LCR. EPA has stated that the agency has also developed, and shared with its regional offices, an internal resource to make ad hoc assessments of water systems, nationwide, that would benefit most from assistance with lead service line replacements or (for water systems without lead service lines) corrosion control treatment installation/re-optimization. According to EPA, this internal resource takes a multi-factor approach that considers historical action level exceedance occurrences and information on additional factors (for which information is already available through regulatory development efforts for the LCR long-term revisions or internet search engine queries). These additional factors include the number of lead service lines known to be present in a given water system; the proportion of a system's service connections that are served by lead service lines; and potential technical, managerial, and financial capacity challenges experienced by that system. Although EPA has made progress in addressing the recommendation, GAO will leave this recommendation open until SDWIS Prime is implemented.

Recommendation: The Secretaries of Agriculture, Commerce, Defense, Homeland Security, Energy, HHS, Interior, Labor, State, Transportation, Treasury, and VA; the Attorney General of the United States; the Administrators of EPA, GSA, and SBA; the Director of OPM; and the Chairman of NRC should take action to, within existing OMB reporting mechanisms, complete plans describing how the agency will achieve OMB's requirement to implement automated monitoring tools at all agency-owned data centers by the end of fiscal year 2018.

Agency: Environmental Protection Agency
Status: Open

Comments: The Environmental Protection Agency (EPA) described planned actions to address our recommendation. Specifically, the agency detailed plans to address OMB's requirements, such as leveraging EPA's current investment in a network monitoring tool and the intent to procure and deploy a data center infrastructure management tool by the end of fiscal year 2018. However, in December 2018, EPA determined it will leverage its current network monitoring tool for server utilization monitoring. The agency expects to have most data center servers monitored by the end of CY 2019. Once servers are monitored, the agency said that it will follow the most current OMB guidance to report required metrics. In November 2019, EPA reported that it had four agency-owned data centers that the agency planned to keep open. However, of those four data centers, one had implemented the advanced monitoring tools. As of January 2020, we have not received a more recent update from the agency about how it will meet the Data Center Optimization Initiative requirement to implement monitoring tools at the remaining three agency-owned data centers. We will continue to monitor the status of this recommendation.

Recommendation: To improve federal agencies' efforts to rationalize their portfolio of applications, the heads of the Departments of Agriculture, Commerce, Education, Energy, Health and Human Services, Housing and Urban Development, the Interior, Labor, State, Transportation, the Treasury, and Veterans Affairs; and heads of the Environmental Protection Agency; National Aeronautics and Space Administration; National Science Foundation; Nuclear Regulatory Commission; Office of Personnel Management; Small Business Administration; Social Security Administration; and U.S. Agency for International Development should direct their Chief Information Officers (CIOs) and other responsible officials to improve their inventories by taking steps to fully address the practices we identified as being partially met or not met.

Agency: Environmental Protection Agency
Status: Open

Comments: We reported that the Environmental Protection Agency had fully met three of the four practices to establish a complete application inventory, and partially met one. Specifically, the agency partially met the practice for including application attributes in the inventory, as although EPA did not identify the business function for every application. In December 2019, Environmental Protection Agency officials stated that the inventory now requires the business function to be included, and provided inventory update instructions that show the business function is to be included. In addition, agency officials provided instructions for senior information managers to update the inventory in fiscal year 2019. However, as of January 2020, agency officials had not provided an updated inventory, and thus we were not able to verify that the business function was added for all applications. We will follow up with the agency to obtain the updated inventory.

Recommendation: The EPA Administrator should direct the Office of Grants and Debarment (OGD) and program and regional offices, as appropriate, as part of EPA's ongoing streamlining initiatives and the development of a grantee portal, to incorporate expanded search capability features, such as keyword searches, into its proposed web-based portal for collecting and accessing performance reports to improve their accessibility.

Agency: Environmental Protection Agency
Status: Open

Comments: In correspondence to GAO, EPA reiterated its agreement with this recommendation. EPA also stated that its vision for grants management includes having grant recipients submit performance reports and other information to the agency through a web-based portal. The portal would incorporate capabilities such as key word searches to allow for easier access to performance report information. EPA expected this recommendation to be addressed by its new grants management system (GrantsSolutions). However, in January 2020, EPA officials told us that EPA had ceased its migration to GrantSolutions after determining the long-term costs were unsustainable and that the system lacked fundamental functionality necessary for core grant operations and to maintain appropriate internal controls. EPA is now migrating towards a modernized grants administration and management cloud solution. EPA expects this recommendation to be addressed when the new grants management system is fully implemented. EPA anticipates deployment of the new cloud solution in December 2020.

Recommendation: The EPA Administrator should direct OGD and program and regional offices, as appropriate, as part of EPA's ongoing streamlining initiatives and the development of a grantee portal, once EPA's new performance system is in place, to ensure that the Office of Water adopts software tools, as appropriate, to electronically transfer relevant data on program results from program-specific databases to EPA's national performance system.

Agency: Environmental Protection Agency
Status: Open

Comments: In correspondence to GAO, EPA reiterated its general agreement with this recommendation and stated that it will apply it, where appropriate and cost effective, to program-specific databases, not only the Office of Water databases. EPA noted that not all data from program-specific databases may be appropriate for direct electronic transfer to the national performance system; some individual grant data may need to be analyzed before being rolled up into national data. As of December 2018, EPA officials said that continued work on this recommendation is dependent upon EPA's Office of the Chief Financial Officer's deployment of a new performance tracking system and individual program funds for developing systems that interact with it. As of April 2020, GAO is following up with EPA on the status of this recommendation.

Recommendation: The EPA Administrator should direct OGD and program and regional offices, as appropriate, as part of EPA's ongoing streamlining initiatives and the development of a grantee portal, to clarify the factors project officers should consider when determining whether performance reports are consistent with EPA's environmental results directive.

Agency: Environmental Protection Agency
Status: Open

Comments: In correspondence to GAO, EPA reiterated its agreement with this recommendation and stated that it will make conforming changes to the implementation guidance for the Environmental Results Order (directive). In December 2018, EPA stated that its existing environmental results directive may be superseded or incorporated into a different policy as part of the agency's migration to a new grants management system (GrantsSolutions). EPA stated that it would incorporate the recommendation into its new policy. However, in January 2020, EPA officials told us that EPA had ceased its migration to GrantSolutions after determining the long-term costs were unsustainable and that the system lacked fundamental functionality necessary for core grant operations and to maintain appropriate internal controls. EPA is now migrating towards a modernized grants administration and management cloud solution. EPA expects this recommendation to be addressed when the new grants management system is fully implemented. EPA anticipates deployment of the new cloud solution in December 2020.

Recommendation: The EPA Administrator should direct OGD and program and regional offices, as appropriate, as part of EPA's ongoing streamlining initiatives and the development of a grantee portal, to expand aspects of EPA's policy for certain categorical grants, specifically, the call for an explicit reference to the planned results in grantees' work plans and their projected time frames for completion, to all grants.

Agency: Environmental Protection Agency
Status: Open

Comments: In correspondence to GAO, EPA reiterated its agreement with this recommendation and stated that it will make conforming changes to existing policy. In December 2018, EPA stated that its existing policies may be superseded or incorporated into different policies as part of the agency's migration to a new grants management system (GrantsSolutions). EPA stated that it would incorporate the recommendation into its new policy. However, in January 2020, EPA officials told us that EPA had ceased its migration to GrantSolutions after determining the long-term costs were unsustainable and that the system lacked fundamental functionality necessary for core grant operations and to maintain appropriate internal controls. EPA is now migrating towards a modernized grants administration and management cloud solution. EPA expects this recommendation to be addressed when the new grants management system is fully implemented. EPA anticipates deployment of the new cloud solution in December 2020.

Recommendation: The EPA Administrator should direct OGD and program and regional offices, as appropriate, as part of EPA's ongoing streamlining initiatives and the development of a grantee portal, to incorporate built-in data quality controls for performance reports into the planned web-based portal based on EPA's environmental results directive.

Agency: Environmental Protection Agency
Status: Open

Comments: In correspondence to GAO, EPA reiterated its general agreement with this recommendation. However, EPA emphasized that identifying and deploying appropriate data quality controls is a long-term effort subject to budgetary considerations, completion of its new grants management system, and extensive collaboration with internal and external stakeholders. EPA officials said that the agency expected this recommendation to be addressed by its new grants management system (GrantsSolutions). However, in January 2020, EPA officials told us that EPA had ceased its migration to GrantSolutions after determining the long-term costs were unsustainable and that the system lacked fundamental functionality necessary for core grant operations and to maintain appropriate internal controls. EPA is now migrating towards a modernized grants administration and management cloud solution. EPA expects this recommendation to be addressed when the new grants management system is fully implemented. EPA anticipates deployment of the new cloud solution in December 2020.

Recommendation: To better monitor and provide a basis for improving the effectiveness of cybersecurity risk mitigation activities, informed by the sectors' updated plans and in collaboration with sector stakeholders, the Administrator of the Environmental Protection Agency should direct responsible officials to develop performance metrics to provide data and determine how to overcome challenges to monitoring the water and wastewater systems sector's cybersecurity progress.

Agency: Environmental Protection Agency
Status: Open

Comments: The Environmental Protection Agency (EPA) continues to develop and implement activities in support of the water and wastewater sector's cybersecurity such as a cyber-attack risk assessment tool and cybersecurity training for sector partners. The 2015 water and wastewater sector-specific plan calls for assessing performance and reporting on sector cybersecurity progress; however, the plan does not state specific measures. In 2017, agency officials stated that the development of performance metrics in collaboration with sector partners was underway; however, EPA has not provided evidence of the metrics or any tracking effort. As EPA continues to carry out its sector-specific agency role, we will continue to monitor its efforts and associated performance metrics to be developed to demonstrate the effectiveness of these activities.

Recommendation: To improve the agency's IT savings reinvestment plans, the Administrator of the Environmental Protection Agency should direct the CIO to ensure that the agency's integrated data collection submission to OMB includes, for all reported initiatives, complete plans to reinvest any resulting cost savings and avoidances from OMB-directed IT reform-related efforts.

Agency: Environmental Protection Agency
Status: Open

Comments: The Environmental Protection Agency agreed with our recommendation, but has not yet taken steps to implement it. Specifically, as of May 2020, the agency's quarterly integrated data collection submission to the Office of Management and Budget did not include reinvestment plans for any of the 12 reported cost savings and avoidance initiatives. For example, the agency reported about $34.0 million in cost savings and avoidances in 2019 related to data center, commodity IT, and software licensing initiatives, but did not provide information regarding how it plans to reinvest these savings and avoidances. The agency expects to provide an update in June 2020. We will continue to evaluate the agency's progress in implementing this recommendation.

Recommendation: The EPA Administrator should direct OGD to develop a timetable with milestones and identify and allocate resources for adopting electronic records management for all 10 regional offices.

Agency: Environmental Protection Agency
Status: Open

Comments: According to EPA officials, the Office of Grants and Debarment (OGD) established an agency-wide electronic grants record workgroup in fiscal year 2016. The workgroup identified the contents of the electronic grant file, technical options, and evaluation criteria. OGD completed its alternatives analysis for scope, general approach, and requirements in fiscal year 2017 and EPA expected this recommendation to be addressed by its new grants management system (GrantsSolutions). However, in January 2020, EPA officials told us that EPA had ceased its migration to GrantSolutions after determining the long-term costs were unsustainable and that the system lacked fundamental functionality necessary for core grant operations and to maintain appropriate internal controls. EPA is now migrating towards a modernized grants administration and management cloud solution. EPA expects this recommendation to be addressed when the new grants management system is fully implemented. EPA anticipates deployment of the new cloud solution in December 2020.

Recommendation: The EPA Administrator should direct OGD to implement plans for adopting an up-to-date and comprehensive IT system by 2017 that will provide accurate and timely data on agencywide compliance with grants management directives.

Agency: Environmental Protection Agency
Status: Open

Comments: Implementation efforts are ongoing. According to EPA officials, OGD is conducting a multi-modular project to upgrade the agency's grants management IT system. EPA expected this recommendation to be addressed by its new grants management system (GrantsSolutions), which had been targeted for deployment in March 2020. However, in January 2020, EPA officials told us that EPA had ceased its migration to GrantSolutions after determining the long-term costs were unsustainable and that the system lacked fundamental functionality necessary for core grant operations and to maintain appropriate internal controls. EPA is now migrating towards a modernized grants administration and management cloud solution. EPA expects this recommendation to be addressed when the new grants management system is fully implemented. EPA anticipates deployment of the new cloud solution in December 2020.

Recommendation: To ensure the effective management of software licenses, the Adminitrator of the Environmental Protection Agency should develop an agency-wide comprehensive policy for the management of software licenses that addresses the weaknesses we identified.

Agency: Environmental Protection Agency
Status: Open

Comments: In April 2018, the Environment Protection Agency reported that it is currently taking steps to develop a comprehensive policy that will address a centralized management program of licenses, an analysis to inform decision making, education and training goals and overall management throughout the lifecycle. In addition, The Agency stated that it is still leveraging the efforts of the Continuous Diagnostics and Mitigation project as well as its Office of Acquisition Management's consolidation of its Microsoft suite. We will follow up with the agency to obtain supporting documents and continue to monitor its progress in implementing this recommendation.

Recommendation: To ensure the effective management of software licenses, the Adminitrator of the Environmental Protection Agency should employ a centralized software license management approach that is coordinated and integrated with key personnel for the majority of agency software license spending and/or enterprise-wide licenses.

Agency: Environmental Protection Agency
Status: Open

Comments: In April 2018, the Environment Protection Agency reported that it is currently taking steps to develop a comprehensive policy that will address a centralized management program of licenses. In addition, the agency stated that it is still leveraging the efforts of the Continuous Diagnostics and Mitigation project as well as leveraging its Office of Acquisition Management's consolidation of enterprise licenses. We will follow up with the agency to obtain supporting documents and continue to monitor its progress in implementing this recommendation.

Recommendation: To strengthen federal oversight of facilities with ammonium nitrate, the Secretary of Labor and the Administrator of EPA should direct OSHA and EPA, respectively, to consider revising their related regulations to cover ammonium nitrate and jointly develop a plan to require high risk facilities with ammonium nitrate to assess the risks and implement safeguards to prevent accidents involving this chemical.

Agency: Environmental Protection Agency
Status: Open

Comments: In January 2017, EPA issued a final rule to modify its Risk Management Program (RMP) regulations. The agency decided not to propose any revisions to the list of regulated substances and therefore, did not address ammonium nitrate in the revised regulations.

Recommendation: To improve the agency's implementation of PortfolioStat, the Administrator of the Environmental Protection Agency should direct the CIO to develop a complete commodity IT baseline.

Agency: Environmental Protection Agency
Status: Open

Comments: In September 2016, we reported that the Environmental Protection Agency's (EPA) Registry of Environmental Protection Agency Applications, Models and Databases (READ) system had a complete inventory of enterprise IT and business systems-two of three categories of IT assets that make up a commodity IT baseline-and that the agency had processes in place to regularly update this inventory to ensure its completeness (see GAO-16-511). We have been following up with EPA to obtain its inventory of IT infrastructure systems-the third commodity IT category--and determine the agency's process to ensure the completeness of this inventory. In a December 2019 update, EPA told us that it was working on a response to the recommendation.

Recommendation: To improve the agency's implementation of PortfolioStat, in future reporting to OMB, the Administrator of the Environmental Protection Agency should direct the CIO to fully describe the following PortfolioStat action plan elements: (1) consolidate commodity IT spending under the agency CIO; (2) establish targets for commodity IT spending reductions and deadlines for meeting those targets; and (3) establish criteria for identifying wasteful, low-value, or duplicative investments.

Agency: Environmental Protection Agency
Status: Open

Comments: In November 2016, the Environmental Protection Agency (EPA) reported making progress in addressing the three action plan elements through implementation of the Federal Information Technology Acquisition Reform Act (FITARA) and efforts to assess applications in its inventory. In June 2019, the agency provided supporting documentation. We are reviewing the documentation to determine whether it fully addresses the recommendation.

Recommendation: To improve the agency's implementation of PortfolioStat, the Administrator of the Environmental Protection Agency should direct the CIO to report on the agency's progress in consolidating the managed print services and strategic sourcing of end user computing to shared services as part of the OMB integrated data collection quarterly reporting until completed.

Agency: Environmental Protection Agency
Status: Open

Comments: Between July and December 2016, the Environmental Protection Agency (EPA) reported that it had implemented a managed print service contract for headquarters in 2014 and was preparing to award a new contract to also cover its regions. The agency also reported that it plans to use one of the government-wide contracts identified in OMB's policy on improving the acquisition and management of common IT for its end user computing needs. EPA, however, did not provide documentation supporting these efforts. In a December 2019 update, EPA told us that it was working on a response to the recommendation.

Recommendation: To improve EPA's management of the conditional registration process, the Administrator of EPA should direct the Director of the Office of Pesticide Programs to complete plans to automate data related to conditional registrations to more readily track the status of these registrations and related registrant and agency actions and identify potential problems requiring management attention.

Agency: Environmental Protection Agency
Status: Open

Comments: As of August 2020, EPA's Office of Pesticide Programs is providing status information on conditional registrations issued from 2000 through 2020 on the web at https://www.epa.gov/pesticide-registration/conditional-pesticide-registration. However, because plans are not yet complete for automating data related to conditional registrations to more readily track their status and related information, this recommendation remains open. According to EPA, due to the government shutdown and delays in the award of its mission support IT contract, IT modernization efforts enabling the Office of Pesticide Programs to track conditionally registered products electronically are now targeted for completion in 2021 rather than 2020.

Recommendation: To ensure that EPA maximizes its limited resources and addresses the statutory, regulatory, and programmatic needs of EPA program offices and regions when IRIS toxicity assessments are not available, and once demand for the IRIS Program is determined, the EPA Administrator should direct the Deputy Administrator, in coordination with EPA's Science Advisor, to develop an agencywide strategy to address the unmet needs of EPA program offices and regions that includes, at a minimum: (1) coordination across EPA offices and with other federal research agencies to help identify and fill data gaps that preclude the agency from conducting IRIS toxicity assessments, and (2) guidance that describes alternative sources of toxicity information and when it would be appropriate to use them when IRIS values are not available, applicable, or current.

Agency: Environmental Protection Agency
Status: Open
Priority recommendation

Comments: As of February 2020, IRIS program officials indicated that they are building capacity for applying systematic review in chemical assessments. We reported in March 2019 that staff from the IRIS program were communicating more frequently with EPA program and regional offices about program and regional office needs and the IRIS program's ability to meet those needs. While ORD's newly-implemented survey process helps identify a limited number of the highest priority needs for program and regional offices, we also reported in March 2019 that program and regional officials told us that they still need far more chemical assessments than the IRIS program currently produces, and they do not have EPA-wide guidance on what sources to use when IRIS assessments are not available. One program office has developed its own prioritized list of sources for chemical assessments when IRIS assessments are not available, and other offices follow similar guidelines, though none officially. EPA leadership needs to provide documentation showing an agency-wide strategy that includes identifying data gaps and guidance on alternative sources of toxicity information when IRIS values are not available, applicable, or current.

Recommendation: To better position EPA to collect chemical toxicity and exposure-related data and ensure chemical safety under existing TSCA authority, while balancing its workload, and to better position EPA to ensure chemical safety under existing TSCA authority, the Administrator of EPA should direct the appropriate offices to develop strategies for addressing challenges that impede the agency's ability to meet its goal of ensuring chemical safety. At a minimum, the strategies should address challenges associated with: (1) obtaining toxicity and exposure data needed to conduct ongoing and future TSCA Work Plan risk assessments, (2) gaining access to toxicity and exposure data provided to the European Chemicals Agency, (3) working with processors and processor associations to obtain exposure-related data, (4) banning or limiting the use of chemicals under section 6 of TSCA and planned actions for overcoming these challenges--including a description of other actions the agency plans to pursue in lieu of banning or limiting the use of chemicals, and (5) identifying the resources needed to conduct risk assessments and implement risk management decisions in order to meet its goal of ensuring chemical safety.

Agency: Environmental Protection Agency
Status: Open
Priority recommendation

Comments: As of March 2020, several sections of this recommendation have been superseded by the Frank R. Lautenberg Chemical Safety for the 21st Century of 2016. However, questions remain about whether the Office of Chemical Safety and Pollution Prevention, which oversees implementation of this legislation, has identified the resources necessary to conduct risk assessments and implement risk management decisions.

Recommendation: To enhance federal agencies' ability to realize enterprise architecture benefits, the Secretaries of the Departments of Agriculture, the Air Force, the Army, Commerce, Defense, Education, Energy, Homeland Security, the Interior, Labor, the Navy, State, Transportation, the Treasury, and Veterans Affairs; the Attorney General; the Administrators of the Environmental Protection Agency, General Services Administration, National Aeronautics and Space Administration, and Small Business Administration; the Commissioners of the Nuclear Regulatory Commission and Social Security Administration; and the Directors of the National Science Foundation and the Office of Personnel Management should fully establish an approach for measuring enterprise architecture outcomes, including a documented method (i.e., steps to be followed) and metrics that are measurable, meaningful, repeatable, consistent, actionable, and aligned with the agency's enterprise architecture's strategic goals and intended purpose.

Agency: Environmental Protection Agency
Status: Open

Comments: The Environmental Protection Agency has not implemented this recommendation. In December 2019, the agency stated that its chief architect and technical architecture staff were working to reformulate the enterprise architecture program and described several goals and activities that were underway. The agency also stated that the program was examining industry best practices on architecture metrics to determine which would be best for EPA's enterprise architecture program. As metrics are adopted to assess the value of the architecture program, the program will work them into the agency-wide process for performance metrics. We will continue to monitor the agency's efforts to implement the recommendation.

Recommendation: To enhance federal agencies' ability to realize enterprise architecture benefits, the Secretaries of the Departments of Agriculture, the Air Force, the Army, Commerce, Defense, Education, Energy, Homeland Security, the Interior, Labor, the Navy, State, Transportation, the Treasury, and Veterans Affairs; the Attorney General; the Administrators of the Environmental Protection Agency, General Services Administration, National Aeronautics and Space Administration, and Small Business Administration; the Commissioners of the Nuclear Regulatory Commission and Social Security Administration; and the Directors of the National Science Foundation and the Office of Personnel Management should periodically measure and report enterprise architecture outcomes and benefits to top agency officials (i.e., executives with authority to commit resources or make changes to the program) and to OMB.

Agency: Environmental Protection Agency
Status: Open

Comments: The Environmental Protection Agency has not implemented this recommendation. In December 2019, the agency stated that its chief architect and technical architecture staff were working to reformulate the enterprise architecture program and described several goals and activities that were underway. The agency also stated that the program was examining industry best practices on architecture metrics to determine which would be best for EPA's enterprise architecture program. As metrics are adopted to assess the value of the architecture program, the program will work them into the agency-wide process for performance metrics. We will continue to monitor the agency's efforts to implement the recommendation.

Recommendation: To better ensure the credibility of IRIS assessments by enhancing their timeliness and certainty, the EPA Administrator should require the Office of Research and Development, should different time frames be necessary, to establish a written policy that clearly describes the applicability of the time frames for each type of IRIS assessment and ensures that the time frames are realistic and provide greater predictability to stakeholders.

Agency: Environmental Protection Agency
Status: Open
Priority recommendation

Comments: As of March 2020, we have not seen a formal written memo from the IRIS program laying out this information - in detail - publicly, or how timelines for assessments are influenced by various criteria. While IRIS program staff have discussed this issue, no written guidance has been created. Such communication from the IRIS Program, as well as more frequent updates of the timelines for chemicals currently in assessment and projected starting dates for every chemical listed as "under assessment" is needed.

Recommendation: To ensure that current and accurate information on chemicals that EPA plans to assess through IRIS is available to IRIS users--including stakeholders such as EPA program and regional offices, other federal agencies, and the public--the EPA Administrator should direct the Office of Research and Development to annually publish the IRIS agenda in the Federal Register each fiscal year.

Agency: Environmental Protection Agency
Status: Open

Comments: As of March 2020, EPA's Integrated Risk Information System (IRIS) Program has established the priority chemicals it is working on, and has published some timelines via the IRIS Program Outlook document. However, this information has not been published as an agenda in the Federal Register.

Recommendation: To improve EPA's ability to oversee the states' implementation of the Safe Drinking Water Act and provide Congress and the public with more complete and accurate information on compliance, the Administrator of EPA should resume data verification audits to routinely evaluate the quality of selected drinking water data on health-based and monitoring violations that the states provide to EPA. These audits should also evaluate the quality of data on the enforcement actions that states and other primacy agencies have taken to correct violations.

Agency: Environmental Protection Agency
Status: Open
Priority recommendation

Comments: As of July 2020 there has been no change in the status of this recommendation. EPA, as of September 2019, had not resumed data verification audits to routinely evaluate the quality of the data states provide to the agency. The Safe Drinking Water Information System (SDWIS) Prime and the Compliance Monitoring Data Portal (CMDP) will replace the data verification audits in the future. EPA has made SDWIS Prime available through incremental interim releases to state drinking water agencies for exploring and testing but does not expect to fully release it until mid-2020. However, as of August 2019, SDWIS Prime was unavailable while EPA awaited progress on the SDWIS Modernization Project plan. According to EPA, the CMDP will enable utilities and laboratories to report data electronically to primacy agencies with fewer errors and in a more efficient manner; but it is not clear when it will be fully operational. According to data provided by EPA in September 2019, 10 states were using CMDP to varying degrees. EPA information identified another 6 states that plan to transition to CMDP between September and December 2019, 2 states that plan to transition in 2020, and 12 others that may transition in the future. In the meantime, EPA indicated that the agency will complete nine file reviews in 2019 to verify data in agencies that do not currently use CMDP. EPA's actions may improve its ability to oversee states' implementation of the act and provide more complete and accurate information on compliance, but because EPA's systems to replace data verification audits are not yet fully in place, we are keeping this recommendation open.

Recommendation: To improve EPA's ability to oversee the states' implementation of the Safe Drinking Water Act and provide Congress and the public with more complete and accurate information on compliance, the Administrator of EPA should work with the states to establish a goal, or goals, for the completeness and accuracy of data on monitoring violations. In setting these goals, EPA may want to consider whether certain types of monitoring violations merit specific targets. For example, the agency may decide that a goal for the states to completely and accurately report when required monitoring was not done should differ from a goal for reporting when monitoring was done but not reported on time.

Agency: Environmental Protection Agency
Status: Open

Comments: As of July 2020 there has been no change in the status of this recommendation. EPA is developing the Safe Drinking Water Information System (SDWIS) Prime, with several efforts underway as of September 2019 as we noted under recommendation 1, but until it is fully operational, EPA will not be able to work with states to establish a national goal for the quality of monitoring violations. EPA noted in 2017 that it expected SDWIS Prime to enable the agency and primacy agencies to better understand the nature of system violations and consider developing goals for monitoring and reporting violations. However, according to EPA, SDWIS Prime will not be released until mid-2020. EPA indicated plans to modify the Annual Public Water System Supervision (PWSS) Program Review requirements but the agency states that it is dependent on approval by the Office of the Inspector General. Despite the ongoing delays to address the call in the recommendation for establishing new goals, we are keeping this recommendation open while EPA continues its efforts to implement SDWIS Prime.

Recommendation: To develop timely chemical risk information that EPA needs to effectively conduct its mission, the Administrator, EPA, should require the Office of Research and Development to re-evaluate its draft proposed changes to the IRIS assessment process in light of the issues raised in this report and ensure that any revised process periodically assesses the level of resources that should be dedicated to this significant program to meet user needs and maintain a viable IRIS database.

Agency: Environmental Protection Agency
Status: Open
Priority recommendation

Comments: As of February 2020, EPA officials indicated that the IRIS Program had almost completed internal review of a "Handbook for Developing IRIS Assessments," intended to guide staff through the sequential stages of the IRIS assessment process and ensure consistency across assessments. The Handbook, when finalized and used by staff, codifies the agency's effort to reevaluate their assessment process, but doesn't address the resources that should be dedicated to the IRIS Program. A workforce plan that includes both staff and budget resources consistent with user needs is necessary. As we reported in March 2019, the program has made strides utilizing project management software and project management techniques that enable the IRIS Program to better plan assessment schedules and utilize staff. However, we also reported in March 2019 that the President's budget requests since fiscal year 2018 have repeatedly cut the budget by as much as 40 percent for the Health and Environmental Risk Assessment (HERA) area, of which IRIS is a part. While these cuts were not enacted by Congress, the President's fiscal year 2021 budget request again cuts the HERA program by 34 percent, or approximately $12.7 million dollars. These cuts could have an impact on the IRIS program's ability to meet EPA program and regional office needs, if enacted by Congress.

Recommendation: The Administrator, EPA, should take a number of steps to further protect the American public from elevated lead levels in drinking water. Specifically, to improve EPA's ability to oversee implementation of the lead rule and assess compliance and enforcement activities, EPA should ensure that data on water systems' test results, corrective action milestones, and violations are current, accurate, and complete.

Agency: Environmental Protection Agency
Status: Open

Comments: As of July 2020 there has been no change on the status of this recommendation. In June 2019, EPA reported to GAO that its tools for improving data about water systems compliance are not complete, though some states and laboratories have been exploring and testing incremental versions of them. EPA reported in a previous update that the agency had been working with states through face-to-face trainings and webinars on the reporting of milestone data. GAO will continue to monitor these efforts and reevaluate whether water systems' test results, corrective action milestones and violations are current, accurate and complete subsequent to the completion of the Compliance Monitoring Data Portal and the Safe Drinking Water Information System (SDWIS) Prime, described briefly below. However, until these new tools are complete, the status of this recommendation remains open. According to EPA, as of June 2018, SDWIS Prime has been available for exploring and testing, following incremental interim releases, since early 2018. In addition, EPA stated that SDWIS Prime will continue to be available for exploring and testing until the first production release anticipated for mid-2020.The agency has also focused on promoting electronic reporting of drinking water data through the development of the Compliance Monitoring Data Portal (CMDP). In June 2019, EPA stated that as of May 31, 2019, 10 states and more than 200 laboratories were using CMDP. According to EPA, as a result of using CMDP, these states reported a 30-70 percent reduction in staff time for data processing and a 90-99 percent reduction in errors for data.