AAAE Security Policy Alert: DHS OIG Issues Report on TSA’s Implementation of Airport Worker Vetting Requirements
November 9, 2026
The Department of Homeland Security (DHS) Office of Inspector General (OIG) issued a report entitled “Failures in TSA’s Vetting of Airport Workers Allowed Uncleared Individuals Access to Secure Areas.” The redacted report, dated November 4, 2026, is the result of an audit OIG conducted to determine the extent to which TSA and airport operators vet workers for access to airport secure areas. The audit was conducted at 8 airports between August 2024 and July 2026, using data dating from October 2018 to March 2025.
The report highlights three key findings:
- TSA did not ensure that airport operators provided complete and accurate information prior to conducting Security Threat Assessments;
- TSA did not ensure that airport operators refrained from issuing badges to applicants before the STA was complete, resulting in badges issued to individuals that then received a “Do Not Issue” STA result; and,
- TSA did not ensure that airport operators enrolled workers in the Rap Back program for recurrent vetting.
Based on these findings, DHS OIG made, and TSA concurred with, four recommendations.
To address the first recommendation regarding data element discrepancies between TSA and airport operators, TSA plans to implement a new data management system called the Vetting Credentialing System by September 30, 2027, that will include automated secure data capture to reduce human error, verify and validate an applicant’s identity within the system, and flag potential issues before airports and their Designated Aviation Channelers send data to TSA’s vetting system.
DHS OIG recommends TSA develop and implement controls to ensure individuals with a “Do Not Issue” STA status do not receive or possess an airport badge. DHS OIG also recommends that TSA better record findings and instances of non-compliance to ensure airport operators are penalized accordingly. TSA concurred, highlighting the new Vetting Credentialing System’s ability to track and verify airport operator compliance with “Do Not Issue” notifications, including the 1-business-day deadline to deny or revoke an airport badge. In its response, TSA stated that the agency will strengthen controls to require Transportation Security Inspectors (TSI) to document findings and instances of noncompliance while also highlighting its progressive enforcement framework for determining appropriate sanctions.
Finally, in response to the OIG recommendation that TSIs periodically verify that eligible badge holders are enrolled in the Rap Back program, TSA plans to conduct targeted oversight of Rap Back enrollment through its FY 2027 Security Operations Inspections Work Plan and a first-quarter Special Emphasis Inspection (SEI). TSA will use the SEI results to guide follow-up inspections, corrective actions, trend analysis, and enforcement decisions. TSA estimated completion by December 31, 2026.
As always, please do not hesitate to contact us if you have any questions or need any further information.
