Background

The National Mall in Washington, D.C., is one of the most recognizable  landscapes in the United States and serves as both the public setting for  our nation’s Capital as well as home to some of the most visited  museums in the world. Along the National Mall are numerous monuments  and memorials to our nation’s history and heritage. According to the Park  Service, approximately 24-million people visit the National Mall each year.
Various federal entities are responsible for the physical security of the  National Mall which includes conducting risk assessments of the National  Mall’s assets and implementing measures to protect those assets,  employees, and the visiting public. The open spaces of the National Mall,  along with the Washington Monument and the Jefferson and Lincoln  Memorials, are administered and maintained by Interior’s Park Service  and patrolled by the Park Police. The Park Police is responsible for  protecting the three icons as well as the other monuments and  memorials, and Park Police officers have law enforcement jurisdiction on  the National Mall and its environs. One of the Park Police’s specialized  units is its Icon Protection Unit, which is comprised of personnel who  possess specialized training and knowledge of the icons. Among Interior’s  other offices, OLES (located within the Office of the Secretary) oversees  Interior’s security efforts across the department.

		The Smithsonian and the National Gallery

The Smithsonian and the National Gallery also have a number of  museums and galleries on the National Mall, and each is responsible for  the physical security of its respective facilities.
The Smithsonian was created by an act of Congress in 1846 and is  considered the world’s largest museum and research complex. It  consists of 19 museums and galleries, 12 of which are on the National  Mall; the National Zoological Park; and 9 research facilities. The  Smithsonian’s Office of Protection Services oversees security at the  Smithsonian, which includes policing its assets and grounds;  screening individuals who enter its facilities; responding to  undesirable events; and assessing its physical security risks and  implementing countermeasures to minimize, monitor, and control the  probability that an undesirable event might occur. In 2016, the  Smithsonian’s 12 museums and galleries on the National Mall had  almost 23-million visits, and the Smithsonian employed about 5,800  employees, volunteers, fellows, and researchers on the National Mall  as of December 31, 2016.
Conceived of by financier Andrew W. Mellon, the National Gallery was  created by a joint resolution of Congress in 1937, and it maintains  two facilities on the National Mall—known as the East and West  Buildings—and a 6-acre outdoor sculpture garden. As with the  Smithsonian, the National Gallery also has an Office of Protection  Services that serves as its primary security and risk-management  office responsible for protecting the National Gallery’s assets,  employees, and the visiting public. The National Gallery’s East and  West buildings had almost 3 million visits during 2016, and it  employed about 1,400 employees and volunteers at the end of 2016.

		Risk Management

Risk management is a continuous process of managing—through a  series of mitigating actions—the likelihood of an undesirable event and its  negative impact. Our past work has shown that risk management  approaches generally involve identifying potential threats, assessing  vulnerabilities, identifying the assets that are most critical to protect in  terms of mission and significance, and evaluating mitigation alternatives  to assess their effectiveness. With this information, federal entities can  then decide how to allocate their resources to address risks. Risk  management principles acknowledge that while risk cannot always be  eliminated, steps can be taken to reduce it.
ISC, an interagency organization chaired by DHS, has developed  physical security standards for nonmilitary federal facilities in the United  States. One of the primary ISC standards is known as the RMP, and it  defines the criteria and process federal entities should follow to assess  risks to their facilities and determine which countermeasures—such as  blast resistant windows and intrusion detection systems—should be in  place to reduce risk to an acceptable level. The RMP was not written  with the application to the Washington Monument and the Jefferson and  Lincoln Memorials in mind. However, ISC has noted that the risk  management methodology upon which the RMP is based can be used for  such structures. In addition, while only executive branch departments and  agencies are required to cooperate and comply with ISC policies and  recommendations, ISC has noted that the RMP is intended to be applied  to all buildings in the United States occupied by federal employees for  nonmilitary activities.
As shown in figure 2, the risk management process that ISC has set forth  for federal facilities begins with determining the Facility Security Level  (FSL), which is a categorization that ranges from Level I (lowest risk) to  Level V (highest risk) based on the analysis of security-related factors,  such as symbolism, population (e.g., employees and visitors), and size.  That categorization serves as the basis for identifying security  enhancements or countermeasures that should be implemented at  federal facilities to reduce the level of risk to an acceptable level.
Because risk assessments play a key role in the risk management  process, ISC has developed standards for these assessments. For  example, ISC requires that risk assessments consider the likelihood of  certain undesirable events (which range from theft to active shooter), and  the RMP provides entities with an integrated, single source of information  on physical security enhancements that entities should implement to  effectively minimize risk and meet baseline levels of protection. To  determine whether a facility meets recommended baseline levels of  protection, the RMP includes criteria, which vary by FSL, in the following  categories:
Site: facility perimeter, exterior areas and assets, and parking.
Structure: structural hardening, façade, windows, and building  systems.
Facility entrance: employee and visitor entrances and exits, loading  docks, and other openings in the building envelope.
Interior: space planning and security of specific interior spaces.
Security systems: intrusion-detection, access control, and closed- circuit television (CCTV) camera systems.
Security operations and administration: management and decision- making and the handling and receiving of mail.
The RMP also notes that performance measurement data are essential to  appropriate decision-making and provides guidance on implementing a  comprehensive performance measurement and testing program.  According to ISC, performance measures should be based on an entity’s  goals and objectives. Examples of performance measures for physical  security programs include the number and types of security incidents, the  time it takes to respond to security incidents, and the percentage of  countermeasures deployed within a given time frame. In addition, the  RMP notes that testing can be useful in assessing how well  countermeasures are performing. Testing can include operational efforts,  such as determining whether equipment is calibrated properly,  determining if security guards are knowledgeable about procedures, and  determining if intrusion detection systems are activating properly. Testing  can also include procedures to test emergency response or planned  exercises to breach security to ensure that existing countermeasures are  capable of securing a facility.

	Federal Entities Are Assessing Security Risks to the Icons, Museums, and Galleries on the National Mall

Interior, the Smithsonian, and the National Gallery are assessing the  physical security risks to the icons, museums, and galleries on the  National Mall. Conducting risk assessments is a key component of a risk  management approach, and over the years we have advocated the use of  a risk management approach as an analytical tool to help address various  national security and terrorism issues. Our prior work has shown that  taking a risk management approach provides federal entities with useful  information to make security-related decisions and direct resources to  address any unmitigated risk. By assessing the risk to the National  Mall’s assets, Interior, the Smithsonian, and the National Gallery are  demonstrating that they are taking a risk management approach to meet  the demands of a complex security environment.

		Interior’s Risk Assessments Reflect Strategic Security Requirements for National Critical Infrastructure

Interior assesses the physical security risks to the icons on the National  Mall using a departmental policy that reflects government-wide homeland- security objectives for critical infrastructure. As discussed above, the  RMP was not written with application to the Washington Monument and  the Jefferson and Lincoln Memorials in mind; accordingly, Interior does  not follow the RMP when assessing the physical security risks to the  icons. Rather, Interior’s offices and bureaus are to follow requirements  specified in a departmental policy related to the security of national critical  infrastructure and other key resources. Interior issued this policy in 2006  in response to The National Strategy for the Physical Protection of Critical  Infrastructure and Key Assets and Homeland Security Presidential  Directive 7, which provided federal agencies with guidance on  assessing risks to critical infrastructure. Among other things, Interior’s policy establishes minimum security requirements for safeguarding critical  infrastructure such as the icons and includes requirements for the  following:
Security personnel: assignments, coverage, locations, and available  equipment, such as having an armed security force on site 24 hours a  day.
Perimeter security: physical barriers and CCTV monitoring, such as  having a physical perimeter with barriers to prevent unauthorized  vehicular access.
Access control security: the entry of persons, mail, packages, and  vehicles, such as using high security locks and securing door hinges.
Interior security: prevention of criminal or terrorist activity, such as  securing utility areas and having back-up power for critical systems  such as alarms.
Security planning: security planning and coordination, such as  reviewing construction projects for security enhancements.
To ensure the department’s minimum security requirements for critical  infrastructure are met, Interior requires OLES to conduct periodic  compliance assessments. For the icons on the National Mall, OLES and  the Park Police jointly conduct these assessments, which involve  interviews with security personnel and onsite inspections of physical  security systems and operational procedures.

		The Smithsonian Follows Government-Wide Standards for Physical Security at Federal Facilities

The Smithsonian assesses security risks to its museums and galleries by  following the RMP as well as its own internal security-design standards.  Executive Order 12977 applies only to executive branch departments and  agencies. For the purposes of Executive Order 12977, the Smithsonian is  not treated as an executive branch department or agency required to  follow the RMP. However, Smithsonian officials told us they view the  RMP as a best practice and voluntarily follow the RMP when assessing  the physical security risks to their facilities on the National Mall.
To conduct these assessments, officials with the Smithsonian’s Office of  Protection Services review past security-incident reports, crime statistics,  and each facility’s site and floor plans. Officials also conduct on-site  inspections and interview security personnel and facility managers to  identify their security concerns. These assessments are conducted in  conjunction with an internal assessment that the Office of Protection  Services performs to assess each facility’s compliance with its own  internal security-design standards—an assessment that provides an  additional layer of guidance on mitigating risks associated with cultural  property protection, common crime, terrorist attacks, and other threats.  Information from both of these assessments is captured in a database  that allows the Smithsonian to document its risk management decisions  and analyze data across its facilities on the National Mall and elsewhere.  For example, using this database, Smithsonian’s Office of Protection  Services is able to document any security deficiencies it discovers and  then to analyze, aggregate, and prioritize future projects to address those  deficiencies.
Regarding the National Museum of African American History and Culture  (which opened in September 2016), the Smithsonian took steps to identify  potential risks to the site—which is located at the southwest corner of  Constitution Avenue and 14th Street, west of the National Museum of  American History and across from the Washington Monument—and  address those risks during the facility’s design and construction.  Specifically, when the museum was in the initial stages of design, a  contractor conducted a risk assessment of the site which included  determining its FSL and providing recommendations based on the  requirements included in the RMP. According to the Smithsonian’s Office  of Protection Services, the findings and recommendations from this  assessment were the primary resource they drew from in addressing the  National Museum of African American History and Culture’s physical  security needs as it was constructed.

		The National Gallery Is Assessing its Security Risks but Lacks Documentation of Its Risk Management Decisions

Like the Smithsonian, the National Gallery also assesses security risks to  its galleries by voluntarily following the RMP. Prior to 2016, the National  Gallery engaged a security contractor to assess its compliance with the  RMP. However, during the course of our review, and, in response to our  inquiries, the National Gallery sent staff to receive training on ISC’s risk  management process, thereby enabling the National Gallery to conduct  its own assessments.
While the National Gallery is taking steps to assess its security risks, we  found that it does not have complete documentation of its risk  management decisions. Documenting risk management decisions is  important for several reasons. The RMP states that the threat to federal  facilities is significant and that decisions to accept risk could have serious  consequences. To that end, the RMP requires that risk management  decisions be documented. In addition, we have previously reported that  risk management, as it pertains to facility protection, relies heavily on  having accurate and timely information. Documentation is also a  necessary part of an effective internal control system, and federal internal  control standards state that federal entities should complete and  document corrective actions to remediate internal control deficiencies on  a timely basis. Without documentation, decision makers may not  effectively understand the rationale behind decisions—or, in the case of  risk management—make important security-related decisions and direct  resources to address unmitigated risks.
During the initial inquiries of our work conducting the sensitive aspects of  this review, officials told us that due to a lack of complete documentation  they had limited institutional knowledge of the National Gallery’s risk  management decisions as they relate to physical security. Because of a  lack of documentation, we received inconsistent or incomplete information  throughout that review. While National Gallery officials agreed to address  concerns we raised to them, we believe there is an opportunity for the  National Gallery to address gaps in its institutional knowledge and help  ensure more informed decision-making—specifically, by developing a  process to document its risk management decisions.

	National Mall Entities Vary in Their Use of Goals, Performance Measures, and Testing to Assess Their Security Programs

		Federal Entities Have Identified Goals and Related Performance Measures to Varying Degrees

Interior, the Smithsonian, and the National Gallery each collect  information on various aspects of the performance of their physical  security programs; however, each is at a different stage of developing  goals and linking performance measures to these goals. While measuring  the performance of physical security programs can be challenging, we  have reported that monitoring and evaluating actions taken against  strategic objectives and performance measures is part of the “loop” of risk  management and helps ensure that an entity’s objectives are being  accomplished. A key part of performance measurement is setting  meaningful goals and measuring progress toward those goals, according  to our prior work. Establishing goals helps an entity focus on what it is  trying to achieve. Accordingly, goals should be objective, measurable,  and quantifiable. Once an entity has defined its goals, we have reported  that developing performance measures that are linked to those goals can  help it assess progress.
In addition, the RMP, which the Smithsonian and National Gallery  voluntarily follow, states that federal entities should use performance  measurement to assess and document the effectiveness of their physical  security programs, and it notes that performance measures should be  linked to goals. According to the RMP, an example of a goal could be to  ensure that facilities are compliant with the RMP within a given time  period, and examples of performance measures for monitoring progress  toward that goal could be the number of completed risk assessments and  the number of countermeasures implemented. As discussed above,  documenting activities is also part of an effective internal control system  and helps to ensure that goals are met.
Interior, the Smithsonian, and the National Gallery have taken steps to  incorporate aspects of performance measurement into their physical  security programs, and each plans to improve how it measures  performance, specifically:
The Park Police uses information it collects to manage its physical  security program and has identified goals and performance measures  to assess the effectiveness of its efforts; however, its efforts align with  a strategic plan that has not been updated in more than 10 years and  does not specifically document how performance measures are linked  to goals. According to officials, the Park Police’s goals are defined in a  strategic plan that covers fiscal years 2006-2009. This plan contains  several goals and action steps needed to implement these goals;  however, it has not been updated since 2006. One of the goals  included in this plan is to ensure that the icons and visitors are  protected from harm, and the plan includes steps that should be taken  to implement that goal, such as maintaining sustainable and effective  patrol coverage and enhancing equipment and training of security  guards assigned to the icons. In addition, the Park Police monitors a  variety of performance measures on a monthly basis. While officials  described to us how some of these performance measures were  connected to a goal about protecting the icons—such as the number  of security incidents that pose a threat to the icons and the  percentage of security patrols that pass inspection—the connection  between their performance measures and goals are not documented  as part of their strategic plan. As a result, it is not clear how all of  these performance measures link to the Park Police’s goals. Further,  officials told us that both their goals and performance measures need  to be updated. The Park Police intends to develop a new strategic  plan this summer. According to Park Police officials, that plan will  include updated goals and performance measures linked to those  goals.
The Smithsonian uses performance measures to monitor various  aspects of its physical security program, and while it plans to link  these performance measures to overall program goals, it has not yet  identified these goals. For example, the Smithsonian has analyzed its  security staffing levels to identify the numbers and types of staff  needed to secure its facilities and collections, and it conducts ongoing  monitoring of its staffing levels. The Smithsonian has a variety of  performance measures and has defined performance targets for some  of them—such as compliance rates with the RMP and its own security  design criteria, security staffing levels, the frequency with which risk  assessments are conducted, and actions taken in response to  security alarms—but it has not identified overall goals for its physical  security program. Smithsonian officials told us that they have focused  on other priorities for their security program in the past, such as  managing day-to-day concerns and addressing needed upgrades.  However, these officials told us they recognize the importance of  establishing program-wide goals and plan to address this need as part  of an effort they are currently undertaking to develop a strategic plan  for security. Smithsonian officials noted that they are in the early  stages of this effort and do not know when it will be completed and  that efforts to develop their strategic plan for security have been  delayed in the past due to other priorities. Smithsonian officials told us  they also intend to link their performance measures to program goals  but noted that this effort would be separate from the strategic plan,  and they have not identified where they would document this linkage.
The National Gallery uses information to monitor its physical security  program and is starting to link performance measures and goals as  part of several ongoing efforts. National Gallery officials told us that  their past priorities have been fire-safety upgrades and projects in  their Master Facilities Plan, but they have recognized the need to link  performance measures and goals. As part of a new National Gallery- wide risk-management process, officials have identified two goals  related to security—protecting the landmark buildings and ensuring  the safety of the staff and the visiting public. Further, the National  Gallery has documented plans to develop goals and performance  measures. Officials anticipate that the National Gallery’s leadership  will approve the goals, and they plan to submit performance measures  for approval to the National Gallery’s leadership by September 2017.  In a parallel effort, the National Gallery is also developing a master  security plan, and as part of this plan officials intend to develop goals  and performance measures. However, this plan is still in draft form  and time frames for implementation are unclear because the plan  would need leadership approval and some steps outlined in the plan  will require approval for additional funding.
The Park Police, the Smithsonian, and the National Gallery have  opportunities to take a more strategic approach to performance  measurement—specifically, by developing goals where they are needed  and linking their performance measures to these goals, so that they can  better assess the effectiveness of their physical security programs. Each  of these entities has recognized the value of a more strategic approach  and is currently taking steps to incorporate goals and related performance  measures into the physical security programs. However, the three  entities’ plans are all at an early stage, so they have not yet determined  how they will document this linkage or identified time frames for  completing their plans. Thus, it is too early to tell if the results of their  efforts will include these linkages.
Linking performance measures and goals could help these entities  monitor and evaluate their efforts, which is an essential part of risk  management. The information the entities can gain from performance  measures that are aligned with goals could also provide these entities  with a clearer view of the effectiveness of their physical security programs  and better position them to prioritize security needs.

		National Mall Entities Vary in Their Use of Security Testing and Could Benefit from Seeking Assistance to Enhance Efforts

Interior, the Smithsonian, and the National Gallery each test aspects of  their physical security programs, and although they have reached out to  other entities to help improve their overall programs, they have not made  testing a focus of their outreach efforts. Testing—both covert and  planned—can help determine whether security staff and equipment are  adequate under real and simulated conditions, and the results of testing  can provide insight into the effectiveness of efforts to mitigate potential  vulnerabilities. We have found in past work that testing is a key practice  for physical security programs and integral to performance measurement.  The RMP states that nonmilitary federal entities should use testing to  assess and document the effectiveness of their physical security  programs, but it does not prescribe how this testing must be done, noting  that its guidance is meant to assist federal entities and recognizing that  the implementation of testing will differ depending on the entity.
Conducting testing at the icons and facilities on the National Mall presents  unique challenges, due to the open settings of the icons and the large  numbers of people who visit the museums and galleries. Despite these  challenges, Interior, the Smithsonian, and the National Gallery have each  taken steps to incorporate testing into their physical security programs,  more specifically:
The Park Police currently conducts operational checks to ensure that  security guards are following procedures, conducts daily security  inspections of the icons to verify that guards are at their assigned  locations and attending to their duties, and uses security managers  from outside sources to perform covert operational checks on a  random basis.
The Smithsonian currently conducts periodic operational tests of its  security systems and its access controls, with more frequent tests for  higher risk areas such as perimeter doors and exhibition space,  according to Smithsonian officials. In addition, an official told us that  they began to review security screening at the entrances to their  facilities in February 2017, in response to our questions about this  topic. As part of these tests, Smithsonian assesses how well security  guards follow prescribed guidelines.
The National Gallery currently tests aspects of its physical security  program and plans to expand its testing practices. Specifically, the  National Gallery conducts periodic covert testing of access controls  and uses the results of these tests to address failures and measure  improvement. The National Gallery also tests whether its command  center appropriately directs responses to alarm situations and plans to  test its baggage-screening procedures.
As Interior, the Smithsonian, and the National Gallery proceed with these  efforts, there may be opportunities to draw on the expertise of others with  knowledge in testing physical security initiatives. In our prior work we  have identified information sharing and coordinating with other federal  entities as a key practice for physical security. We have also found that  federal agencies can enhance their collaborative efforts by identifying  opportunities to leverage resources. ISC officials told us that ISC  provides an interagency forum with multiple mechanisms for information  sharing and that ISC members could share best practices for conducting  testing. We have also reported that DHS’s Federal Protective Service  (FPS) and the Department of Justice’s U.S. Marshals Service (Marshals  Service), which has primary responsibility for the security of federal  courthouses, have years of experience in testing security-screening  efforts in federal buildings—places where balancing public access and  security is an important factor. For example, in order to assess  screening effectiveness, we have reported that FPS conducts covert tests  of security screening at federal buildings and that the Marshals Service  conducts intrusion tests that consist of attempts to circumvent the public-  screening process and access federal courthouses with a prohibited item  such as a weapon. A senior FPS official also told us that FPS could meet  with entities to understand their existing program and share applicable  lessons learned, and Marshals Service officials told us they would be  willing to share their expertise in planning and conducting testing with  entities on the National Mall.
Interior, the Smithsonian, and the National Gallery have reached out to  other federal entities to improve their physical security programs, but we  found they have not made testing a focus of their outreach efforts,  specifically:
Park Police officials told us they have sought to enhance their  physical security program by coordinating with internal and external  partners. This coordination includes, for example, sharing information  about best practices, emerging threats, and new technology through a  variety of venues, such as by visiting other sites, such as the Statute  of Liberty National Monument; and by participating in a variety of  working groups, such as the Mall Security Working Group. While  these efforts are valuable, testing has not been the primary focus.  According to Park Police officials, they have considered implementing  additional covert testing but found they lacked the capability to  implement and sustain such efforts.
Smithsonian officials said that additional testing would help them to  assess the effectiveness of their physical security program but that  they lacked the resources to conduct additional testing activities.  According to these officials, they participate in the Mall Security  Working Group and have collaborated with other entities to share  practices for implementing testing. Apart from these efforts, officials  said they have not reached out to other entities regarding testing  because they have devoted time and resources to other efforts, such  as conducting operational tests and managing day-to-day security  concerns.
National Gallery officials told us they have a collaborative relationship  with other entities through the Mall Security Working Group and that  they reach out to this group to discuss a variety of security initiatives  and emerging issues. A senior official told us the National Gallery has  reached out to this group to discuss testing of its screening  procedures, which is a useful first step. However, a senior National  Gallery official also noted that other aspects of the physical security  program could benefit from the same kind of knowledge sharing.
Moving forward, drawing on the knowledge and practices of others could  help Interior, the Smithsonian, and the National Gallery enhance their  respective testing programs, a process that could provide them with more  information about what security procedures and investments are working  and where improvements are needed. By not making testing a focus of  outreach efforts, National Mall entities may be missing opportunities to  leverage the knowledge of other entities that have experience in this area.

	Conclusions

Ensuring the physical security of the icons, museums, and galleries on  the National Mall—as well as the federal employees who work there and  the visiting public—is a complex and difficult task. Federal entities  contend with a variety of challenges on the National Mall that can limit  what they can do to enhance security. Interior, the Smithsonian, and the  National Gallery recognize these limitations and are taking steps to  assess physical-security risks. However, more could be done to better  manage physical security risks on the National Mall. Because the  National Gallery lacks complete documentation of its risk management  decisions, there is an opportunity to enhance its risk management  decision-making as it relates to physical security. Furthermore, Interior,  the Smithsonian, and the National Gallery have opportunities to take a  more strategic approach to performance measurement by developing  goals for their programs and linking performance measures to those  goals. Without taking a more strategic approach, these entities may have  difficulty effectively assessing their progress. Lastly, although federal  entities on the National Mall have reached out to others to improve their  physical security programs, they have not made testing a focus of their  outreach efforts. Drawing on the knowledge and practices of other federal  entities could help Interior, the Smithsonian, and the National Gallery  enhance their testing programs.

	Recommendations for Executive Action

We recommend that the Secretary of the Interior direct the Director of the  National Park Service to take the following two actions: direct the U.S. Park Police to ensure that performance measures  linked to program goals are included as part of its updated strategic  plan and direct it to develop a timeline for completion of this plan, and direct the U.S. Park Police to seek additional input from federal  entities with expertise regarding ways to enhance testing of its  physical security program.
We recommend that the Secretary of the Smithsonian Institution direct  the Office of Protection Services to take the following two actions: develop program goals and ensure that performance measures linked  to those goals are included as part of the strategic plan for security  and develop a timeline for completion of this plan, and  seek additional input from federal entities with expertise regarding  ways to enhance testing of the physical security program.
We recommend that the Director of the National Gallery of Art direct the  Office of Protection Services to take the following three actions: develop a process for documenting risk management decisions; ensure that program goals and performance measures linked to those  goals are included as part of the master security plan and develop a  timeline for completion of this plan; and  seek additional input from federal entities with expertise regarding  ways to enhance testing of the physical security program.

	Agency Comments

We provided a draft of the sensitive version of this report to DHS, Interior,  the Smithsonian, and the National Gallery for review and comment. In an  email, DHS’s liaison stated that DHS had no comments on the report.  Interior and the National Gallery provided written comments, reproduced  in appendixes I and II, respectively, stating that they agreed with our  recommendations and will take steps to address them. We also received  an e-mail from the Smithsonian’s Office of Government Relations stating  that the Smithsonian was not providing written comments, but that it  agreed with our recommendations and will take steps to address them. In  addition, DHS and Interior provided technical comments, which we  incorporated as appropriate.
We are sending copies of this report to the Secretaries of Homeland  Security, the Interior, and the Smithsonian Institution, and to the Director  of the National Gallery of Art. In addition, the report will be available at no  charge on the GAO website at http://www.gao.gov.
If you or your staff have any questions about this report, please contact  me at (202) 512-2834 or rectanusl@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix III.

Appendix I: Comments from the Department of the Interior

Appendix II: Comments from the National Gallery of Art

Appendix III: GAO Contact and Staff Acknowledgments

	GAO Contact

	Staff Acknowledgments

In addition to the contact above, key contributors to this report included  David Sausville (Assistant Director); Luqman Abdullah; Patricia Donahue;  Geoffrey Hamilton; Wesley A. Johnson; Kate Perl; Malika Rice; Jerry  Sandau; Henry Smart, III; and Michelle Weathers.

Summary:
Why GAO Did This Study

The National Mall is one of the most recognizable landscapes in the United States. It is home to memorials to our nation's history and some of the most visited museums in the world. Threats to these assets—whether acts of terrorism, violence, or vandalism or theft of artifacts or art—could result not only in the loss of life but also the loss of iconic monuments or irreplaceable items from the Smithsonian's or National Gallery's collections.
GAO was asked to review the steps Interior, the Smithsonian, and the National Gallery are taking to protect U.S. assets, employees, and the visiting public. This report examines: (1) the extent to which these entities assess physical security risks and (2) the extent to which the entities use goals, measures, and testing to assess their physical security programs. This is a public version of a sensitive report that GAO issued in May 2017.
GAO reviewed applicable federal requirements; Interior-, Smithsonian-, and National Gallery-specific policies and related documents; and interviewed officials.

What GAO Found

Federal entities on the National Mall are assessing the physical security risks to their respective U.S. assets. In doing so, they are demonstrating that they are taking a risk management approach to meet the demands of a complex security environment, specifically:
To assess the risks to the icons—the Washington Monument and the Jefferson and Lincoln Memorials—the Department of the Interior (Interior) follows a departmental policy that reflects government-wide homeland security objectives for critical infrastructure. Among other things, Interior's policy establishes minimum security requirements for safeguarding critical infrastructure such as the icons.
To assess the risks to the museums and galleries on the National Mall, the Smithsonian Institution (Smithsonian) and the National Gallery of Art (National Gallery) voluntarily follow government-wide standards set forth by the Interagency Security Committee (ISC)—an interagency organization chaired by the Department of Homeland Security (DHS). These standards are designed to minimize risk to federal facilities and help nonmilitary federal entities meet recommended levels of protection. Interior's, the Smithsonian's, and the National Gallery's adherence to these policies and standards, and the related steps that the entities follow, shows the considerable extent to which these entities use risk assessments as an analytical tool in their physical security programs. Nonetheless, the threat to federal facilities is significant, and ISC standards require the documentation of risk management decisions—such as decisions to defer actions to mitigate risk due to cost or other factors. Documenting risk management decisions is also a necessary part of an effective internal-control system and important in order to retain institutional knowledge and inform decision-making. GAO found that the National Gallery, which follows ISC standards voluntarily, lacked such documentation.
Interior, the Smithsonian, and the National Gallery collect information on various aspects of the performance of their physical security programs and are making efforts to use goals, measures, and testing to assess the performance of their physical security programs; however, each could benefit from taking additional steps. ISC and GAO have reported that it is necessary to establish goals and link performance measures to those goals to assess progress. While Interior, the Smithsonian, and the National Gallery intend to link performance measures to goals, they have not done so yet or established firm time frames for completing these efforts. Ensuring that plans include both goals and performance measures linked to those goals, as well as developing timelines for completion, could help these entities develop a more strategic view of their physical security programs and better position them to prioritize their needs. These entities also test aspects of their physical security programs, such as to ensure that security systems are operational and that guards are attending to their duties. While the entities have reached out to others to improve their overall programs, they did not focus on testing as part of that outreach. Seeking input from others with expertise is consistent with key practices GAO has identified for physical security and could help these entities target where their testing efforts need improvement.

What GAO Recommends

In the sensitive report, GAO recommended that (1) the National Gallery document its risk management decisions and that (2) Interior, the Smithsonian, and the National Gallery link performance measures with security goals and seek input to enhance their testing programs. Interior, the Smithsonian, and the National Gallery agreed with GAO's recommendations and indicated they will begin taking steps to address them.