Review of Physical Security of Information Technology Equipment at the Columbia, South Carolina, VA Regional Office

The VA Office of Inspector General (OIG) assessed a hotline complaint alleging that hundreds of IT devices at the Veterans Benefits Administration (VBA) regional office in Columbia, South Carolina, were stored in unsecured areas. Storing IT equipment in a location that is not secure is contrary to VA policy.

The OIG substantiated the allegation. Additionally, the Columbia Office of Information and Technology (OIT) did not effectively manage IT equipment in storage, resulting in unused equipment that was nearing or beyond the end of its useful life expectancy. Specifically, Columbia OIT staff should have distributed 241 unused IT devices, worth $178,223, before new equipment was purchased. Also, another 82 devices in storage, worth $127,384, had not been used and were past their life expectancy.

The team found that the OIT manager did not use the most complete IT inventory data when making decisions about using equipment. This occurred because the OIT manager did not integrate federal and VA requirements for physical security and IT equipment management into local inventory procedures. As a result, Columbia OIT staff did not implement sufficient physical security controls to protect IT devices in a temporary staging area. For the OIG, these findings led to concerns about waste and abuse of taxpayer dollars as well as potential tampering, loss, and theft of equipment.

The OIG made two recommendations to further improve the effectiveness of IT storage and equipment management in the Columbia VA Health Care System. The healthcare system’s acting executive director concurred with both recommendations. The OIG will close the recommendations when officials provide sufficient evidence that they have addressed the risks identified in the report.