{"id":20271,"date":"2017-10-11T19:08:57","date_gmt":"2017-10-11T19:08:57","guid":{"rendered":"https:\/\/one.sightlinemg.com\/federaltimes\/uncategorized\/2017\/10\/11\/nist-fails-physical-security-test\/"},"modified":"2026-08-08T04:47:46","modified_gmt":"2026-08-08T04:47:46","slug":"nist-fails-physical-security-test","status":"publish","type":"post","link":"https:\/\/one.sightlinemg.com\/federaltimes\/federal-oversight\/2017\/10\/11\/nist-fails-physical-security-test\/","title":{"rendered":"NIST fails physical security test"},"content":{"rendered":"\n

The National Institute of Standards and Technology\u2019s physical security repeatedly failed to keep undercover agents out of restricted areas of NIST campuses, according to an assessment by the Government Accountability Office.<\/p>\n\n\n\n

\u201cGAO, as I understand it, remains concerned that the police services group and the security structure within NIST has not received proper scrutiny,\u201d said Rep. Lamar Smith, R-Texas, at an Oct. 11 hearing on the report. \u201cA concern that is bolstered by the revelation that GAO agents successfully penetrated NIST campuses in 15 out of 15 attempts during their covert vulnerability testing.\u201d<\/p>\n\n\n\n

According to the report, GAO undercover agents attempted to access restricted areas of NIST campuses in Gaithersburg, Maryland, and Boulder, Colorado, and provided video evidence of their efforts. Those videos were designated law enforcement sensitive and are not available to the public.<\/p>\n\n\n\n

\u201cThese videos, captured as part of GAO\u2019s covert vulnerability testing, reveal NIST employees adhere to established physical security policies,\u201d said Rep. Darin LaHood, R-Ill. \u201cOne video in particular shows an undercover GAO agent subverting detection by security personnel by employing very basic espionage techniques.\u201d<\/p>\n\n\n\n

The GAO investigation was initially undertaken after physical security incidents occurred at both NIST campuses. In July 2015, a NIST security officer caused an explosion in a little used lab in Gaithersburg, Maryland, after attempting to create methamphetamine in the lab. In April 2015, an unauthorized person was found wandering around a restricted area of the Boulder, Colorado, campus.<\/p>\n\n\n\n

These events resulted in NIST undertaking efforts to improve security, as well as a Congressional call for GAO to conduct the now-complete security assessment.<\/p>\n\n\n\n

\u201cRecent security incidents at NIST\u2019s Gaithersburg and Boulder campuses highlighted vulnerabilities and raised questions about the agency\u2019s physical security program, and our work shows that such questions persist,\u201d the GAO report said. \u201cTo its credit, NIST has acknowledged its security issues, and leadership has taken steps to transform NIST\u2019s physical security program, in part by beginning to address the organizational culture, policies, and risk management at its campuses.\u201d<\/p>\n\n\n\n

A GAO survey included in the report found that 75 percent of surveyed NIST employees said that their leadership placed a great or very great emphasis on security, but staff awareness about that security varied due to a failure in communication initiatives.<\/p>\n\n\n\n

\u201cIt is particularly troubling that GAO\u2019s efforts were successful even after NIST had taken efforts to improve security,\u201d said Rep. Eddie Johnson, D-Texas.<\/p>\n\n\n\n

According to NIST acting Director Kent Rochford, a resolution to many of these problems will likely come down to long-term training efforts and a culture change within the agency. In particular, Rochford characterized the onboarding training sessions for new employees as \u201csimplistic\u201d and said that this problem is currently being remedied.<\/p>\n\n\n\n

\u201cTo have a security culture, you have to train your people to take it seriously,\u201d said Seto Bagdoyan, director of audit services in the Forensic Audits & Investigative Service at GAO.<\/p>\n\n\n\n

The report also found that the division of security responsibilities between NIST and the Department of Commerce could be causing security problems on the NIST campuses.<\/p>\n\n\n\n

\u201cManagement of NIST\u2019s physical security program is fragmented between the Department of Commerce (Commerce) and NIST,\u201d the report said. \u201cThis is inconsistent with the federal Interagency Security Committee\u2019s (ISC) physical security best practices, which encourage agencies to centrally manage physical security. Commerce is responsible for overseeing security personnel who implement physical security policies, while NIST manages physical security countermeasures such as access control technology, leading to fragmentation in responsibilities. Before implementing the current organizational structure in October 2015, neither Commerce nor NIST assessed whether it was the most appropriate way to fulfill NIST\u2019s physical security responsibilities.\u201d<\/p>\n\n\n\n

\u201cIf they don\u2019t talk with each other, they end up doing separate risk assessments, and so forth. That is definitely counterproductive,\u201d said Bagdoyan.<\/p>\n\n\n\n

The report made four recommendations for improving security:<\/p>\n\n\n\n