- TSA concurred with all five DHS OIG recommendations to improve its IT access controls
- Auditors cited gaps in privileged account approvals, annual reviews and separated employee access
- TSA launched a ServiceNow process in July 2026 to disable separated employees’ accounts
The Transportation Security Administration is tightening oversight of privileged accounts and employee offboarding to reduce the risk of unauthorized access after a Department of Homeland Security Office of Inspector General audit flagged information technology gaps. TSA concurred with all five audit recommendations.
The DHS inspector general’s latest audit of TSA brings access controls into focus across the department. Join DHS leaders, CISA officials and industry experts at the Potomac Officers Club’s 2026 Homeland Security Summit on Nov. 10 in McLean, Virginia, to explore how the department is building a federated data and identity fabric to secure its components. Sign up now!
What Did the OIG Find About TSA Privileged and Service Accounts?
In a report published Tuesday, the OIG said TSA gave elevated permissions to privileged accounts that lacked authorization and created service accounts for a critical system without completing the required privileged access request forms.
Auditors said compromised accounts of this kind could let an attacker pivot between sensitive systems and escalate privileges. The agency also did not review every privileged and service account on two critical systems, including what it called “infrastructure core services,” in fiscal years 2023 and 2024, as DHS and TSA policies require.
TSA officials attributed the missed reviews to a manual, spreadsheet-based process covering thousands of accounts across 79 systems. They also said TSA has lacked dedicated staff and time for full reviews since a contractor team’s work wrapped up in 2019.
What Delayed Account Disablement for Separated TSA Employees?
Auditors tested a sample of 362 of the 6,179 employees who left TSA in fiscal 2024. They found the agency did not consistently disable accounts within three days of separation. Under TSA rules, accounts of workers fired for cause should be deactivated no more than 30 minutes after notification, but the agency exceeded that window on average.
The watchdog traced the delays to Office of Human Capital policies that allow extended time before staff alert the Office of Information Technology. As a result, TSA relied mostly on an automated control that shuts off accounts after a set period without logins.
How Did TSA Perform on Vulnerability Patching and Security Configurations?
Auditors determined TSA largely applied mandated system configurations and vulnerability fixes on two platforms that support access management. An April 2025 assessment of each system found no unpatched vulnerabilities at or above the reporting threshold. Configuration scans also measured server compliance with Defense Information Systems Agency Security technical implementation guides, which TSA applies under DHS requirements.
Susan Tashiro, acting executive assistant administrator for technology and systems at TSA, said agency leadership was pleased the OIG recognized its vulnerability management practices.
What Steps Has TSA Taken to Address the OIG Recommendations?
TSA’s Operations and Engineering Division reviewed permissions on the flagged privileged accounts and completed remediation. The Information Assurance and Cybersecurity Division set up monthly “Getting to Green” compliance meetings to review all privileged accounts.
On July 24, the agency launched a ServiceNow Service Request process: human capital representatives alert IT points of contact to separations, and those contacts submit account-disable requests that route automatically to an accounts team. TSA expects to finish updating related notification policies by Dec. 31.
The audit marks the OIG’s fifth access controls review of DHS components and follows a separate audit of U.S. Customs and Border Protection that produced 12 recommendations.
In July, the Government Accountability Office urged TSA to update its Cybersecurity Roadmap to define roles and responsibilities.
