Five recommendations remain open
The Department of Homeland Security inspector general issued five recommendations after finding that the Transportation Security Administration did not consistently secure access to its information systems. Oversight.gov lists all five as open.
Three recommendations address privileged or service-account controls; two address employee access reviews and timely disabling after separation. That makes the remedial plan 60% account-governance and 40% workforce-access control by recommendation count.
| Control area | Recommendations | Share |
|---|---|---|
| Privileged/service accounts | 3 | 60% |
| Employee review/separation | 2 | 40% |
| Total open | 5 | 100% |
The public version deliberately withholds scale
The audit says TSA granted inappropriate privileged capability, created service accounts without proper approval and did not always disable former employees’ access promptly. Sensitive Security Information redactions remove several counts and system details.
Those redactions are a material limitation, not a blank to fill with estimates. The public record establishes deficient controls and potential for serious harm, but it cannot support a public failure rate or a count of exposed systems.
Risk language is not proof of an intrusion
DHS OIG says the weaknesses increased the risk of unauthorized access and could permit serious or catastrophic operational harm. The report does not say such an attack occurred.
That distinction matters: an access-control audit evaluates whether safeguards prevent misuse. It does not by itself establish that data were stolen, operations were disrupted or an identified employee acted maliciously.
Method and limits
This newsroom reviewed the redacted report summary and recommendation list, classified each recommendation by its stated control target and checked open status on Oversight.gov. No concealed count was reconstructed.
Recommendation counts do not measure severity, cost or implementation effort. The public version reports no questioned costs and does not expose the technical details necessary for independent penetration testing.