FEMA Did Not Always Secure Information Stored on Mobile Devices to Prevent Unauthorized Access

The Federal Emergency Management Agency (FEMA) did not always secure information stored on mobile devices. Specifically, FEMA did not document whether it removed all data from mobile devices that were disposed of, lost or stolen, or taken on international travel. This occurred because FEMA did not ensure employees followed Department of Homeland Security policy and because FEMA did not have supplemental guidance with specific requirements for sanitizing lost or stolen mobile devices.