Select ED Collectors Will Face Data Security Audit

The U.S. Office of the Inspector General this year will turn its microscope for the first time on private collection agencies contracted with the U.S. Department of Education, conducting audits of data security standards at the contractors, ED officials told the agencies Wednesday in Washington, D.C.

The Inspector General will select at random for security audits “a few” of the 17 contractors that work for ED, Dwight Vigna, the director of ED’s Federal Student Aid division, told the agencies during the Private Collection Agency Business Meeting. The FSA manages the collection program.

The audits will be a part of ED’s formal review by the Inspector General under the Federal Information Security Management Act of 2002 (FISMA), Vigna said. The Act was passed to bolster computer and network security within the federal government and affiliated parties — such as government contractors — by mandating yearly audits of information security systems.

“This is ED’s FISMA audit,” Vigna told insideARM, “they’re just going to be auditing our collection contractors for the first time.”

The agencies are already subject to off-site and on-site reviews by ED staff, and Vigna’s announcement met a mixed response.

“It’s a little scary, frankly,” said an executive with an agency, requesting anonymity. “We’ve never had to deal with this level of scrutiny.”

“Nobody really wants an OIG audit,” said Don Taylor, president of ED contractor Account Control Technology.

But executives were quick to comment that they have nothing to fear in the audits, reasoning that ED already demands rigorous data security standards, so their firms should meet FISMA requirements.

Vigna echoed that view, and said that the FISMA requirements mean ED itself is undergoing an audit. “The audits will be reviewing security performance against the requirements of the current contract. The ED security standards placed into the contract will also be under review as much as a contractor’s compliance with them,” said Vigna.

Yesterday’s meeting is a regularly-scheduled event to discuss issues current agencies are facing on the collection contract. It followed ED’s pre-solicitation conference in Washington on Tuesday.