The Personal Identity Verification (PIV) card is the foundation of the Department of Transportation’s (DOT) process for securely identifying every employee and contractor who seeks access to DOT’s valuable and sensitive resources. When a contract ends or a contractor no longer needs a PIV card for any reason, DOT contracting officials are to “promptly” collect contractor employee PIV card(s), removing the ability to access secure DOT facilities and information systems. In fiscal years 2020 and 2021, just over 1,000 DOT service contracts, with a total value of $1.5 billion, came to an end.
Given that most of these contracts ended during the Coronavirus Disease 2019 pandemic—when DOT was in a state of maximum telework—there is an elevated risk that prompt and appropriate PIV card collection and deactivation did not occur. Accordingly, we are initiating this audit of the Department—with the exception of the Federal Aviation Administration. Our objective will be to assess DOT’s oversight of contractor employee PIV cards issued in connection with performance of agency contracts.
