WASHINGTON — Acting Education Secretary John King Jr. said the agency has addressed ehtical missteps by its top technology official, including the use of agency employees for personal work and failing  to disclose outside income, while also working to correct lack of security of its data.

King told the House Oversight and Government Reform Committee that Chief Information Officer Danny Harris committed“significant lapses of judgment.” After a review by the Education’s Office of General Counsel, Harris received counseling to ensure he did not continue the actions.

Harris came under fire after an investigation by the department’s inspector general found that the department was “vulnerable to security threats.” In a November House hearing, the House committee identified that the department holds 139 million Social Security numbers, all of which could be compromised without proper security.

Harris was investigated for 12 potential violations of federal law and agency regulations, but was not prosecuted. The violations ranged from not reporting a car detail and audio installation business to using department employees to help him with those businesses.

Harris admitted to the committee that he had used poor judgment.

“I fully understand and take responsibility for how some of my actions could allow questions to arise about my judgment,” Harris said.

Committee Chairman Jason Chaffetz said that Harris is not alone in being investigated –10 department officials are currently under investigation.

“Borderline ethical conduct won’t be tolerated,” Chaffetz said.

King aid the department is making significant progress in improving security of data, following a failing grade in implementing the bipartisan Federal Information Technology Acquisition Reform Act. The Act, enacted in December 2014, gives chief information officers more power to manage IT systems.

In November, the Committee rated federal agencies for how they had done so far, and the Education Department received an F, the lowest grade of all agencies.

There is not a single metric, not one, that is positive,” Chaffetz said.