EPA has implemented a number of activities to promote the security of drinking water systems. However, strategic planning and internal controls for the water security program need to be strengthened to allow the Agency to measure the program's performance and progress in drinking water systems' preparedness, prevention, response, and recovery capabilities. EPA's strategic planning in this area is hampered by its limited authority over water security, the voluntary nature of its water security activities, and concerns related to protecting information. These impediments could be overcome by the water security program utilizing available data; using alternative methods to gather data; and seeking additional authority from Congress to collect, protect, and utilize information from water systems. EPA should also expand its internal controls to meet Federal Managers' Financial Integrity Act requirements. EPA has made progress improving water security by taking corrective actions based on the recommendations and suggestions from prior evaluations. However, the Agency has not fully addressed three Office of Inspector General (OIG) suggestions to establish a baseline and measure improvements, despite agreeing with OIG's assessment. Additional work remains for EPA, as the lead federal agency for the water sector, to enhance its efforts to manage the water security program and help reduce risks to drinking water systems and the public.