```

[House Hearing, 112 Congress]
[From the U.S. Government Publishing Office]

    SECURING FEDERAL FACILITIES: AN EXAMINATION OF FPS PROGRESS IN 
                 IMPROVING OVERSIGHT AND ASSESSING RISK

=======================================================================

                                HEARING

                               before the

                     SUBCOMMITTEE ON CYBERSECURITY,
                       INFRASTRUCTURE PROTECTION,
                       AND SECURITY TECHNOLOGIES

                                 of the

                     COMMITTEE ON HOMELAND SECURITY
                        HOUSE OF REPRESENTATIVES

                      ONE HUNDRED TWELFTH CONGRESS

                             SECOND SESSION

                               __________

                             JULY 24, 2012

                               __________

                           Serial No. 112-108

                               __________

       Printed for the use of the Committee on Homeland Security
                                     

[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

                                     

      Available via the World Wide Web: http://www.gpo.gov/fdsys/

                               __________

                                _____

                  U.S. GOVERNMENT PRINTING OFFICE

80-850 PDF                WASHINGTON : 2013
-----------------------------------------------------------------------
For sale by the Superintendent of Documents, U.S. Government Printing 
Office Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800; DC 
area (202) 512-1800 Fax: (202) 512-2104  Mail: Stop SSOP, Washington, DC 
20402-0001

                     COMMITTEE ON HOMELAND SECURITY

                   Peter T. King, New York, Chairman
Lamar Smith, Texas                   Bennie G. Thompson, Mississippi
Daniel E. Lungren, California        Loretta Sanchez, California
Mike Rogers, Alabama                 Sheila Jackson Lee, Texas
Michael T. McCaul, Texas             Henry Cuellar, Texas
Gus M. Bilirakis, Florida            Yvette D. Clarke, New York
Paul C. Broun, Georgia               Laura Richardson, California
Candice S. Miller, Michigan          Danny K. Davis, Illinois
Tim Walberg, Michigan                Brian Higgins, New York
Chip Cravaack, Minnesota             Cedric L. Richmond, Louisiana
Joe Walsh, Illinois                  Hansen Clarke, Michigan
Patrick Meehan, Pennsylvania         William R. Keating, Massachusetts
Ben Quayle, Arizona                  Kathleen C. Hochul, New York
Scott Rigell, Virginia               Janice Hahn, California
Billy Long, Missouri                 Ron Barber, Arizona
Jeff Duncan, South Carolina
Tom Marino, Pennsylvania
Blake Farenthold, Texas
Robert L. Turner, New York
            Michael J. Russell, Staff Director/Chief Counsel
               Kerry Ann Watkins, Senior Policy Director
                    Michael S. Twinchek, Chief Clerk
                I. Lanier Avant, Minority Staff Director

                                 ------                                

SUBCOMMITTEE ON CYBERSECURITY, INFRASTRUCTURE PROTECTION, AND SECURITY 
                              TECHNOLOGIES

                Daniel E. Lungren, California, Chairman
Michael T. McCaul, Texas             Yvette D. Clarke, New York
Tim Walberg, Michigan, Vice Chair    Laura Richardson, California
Patrick Meehan, Pennsylvania         Cedric L. Richmond, Louisiana
Billy Long, Missouri                 William R. Keating, Massachusetts
Tom Marino, Pennsylvania             Bennie G. Thompson, Mississippi 
Peter T. King, New York (Ex              (Ex Officio)
    Officio)
                    Coley C. O'Brien, Staff Director
                 Zachary D. Harris, Subcommittee Clerk
        Chris Schepis, Minority Senior Professional Staff Member

                            C O N T E N T S

                              ----------                              
                                                                   Page

                               Statements

The Honorable Daniel E. Lungren, a Representative in Congress 
  From the State of California, and Chairman, Subcommittee on 
  Cybersecurity, Infrastructure Protection, and Security 
  Technologies:
  Oral Statement.................................................     1
  Prepared Statement.............................................     3
The Honorable Yvette D. Clarke, a Representative in Congress From 
  the State of New York, and Ranking Member, Subcommittee on 
  Cybersecurity, Infrastructure Protection, and Security 
  Technologies:
  Oral Statement.................................................     4
  Prepared Statement.............................................     5

                               Witnesses

General L. Eric Patterson, Director, Federal Protective Service, 
  Department of Homeland Security:
  Oral Statement.................................................     7
  Prepared Statement.............................................     8
Mr. Mark L. Goldstein, Director, Physical Infrastructure Issues, 
  Government Accountability Office:
  Oral Statement.................................................    11
  Prepared Statement.............................................    12
Dr. James P. Peerenboom, Director, Infrastructure Assurance 
  Center, Associate Director, Decision and Information Sciences 
  Division, Argonne National Laboratory:
  Oral Statement.................................................    18
  Prepared Statement.............................................    19

                                Appendix

Questions From Chairman Daniel E. Lungren for L. Eric Patterson..    33
Questions From Ranking Member Yvette D. Clarke for L. Eric 
  Patterson......................................................    33
Questions From Ranking Member Yvette D. Clarke for Mark L. 
  Goldstein......................................................    34
Questions From Ranking Member Yvette D. Clarke for James P. 
  Peerenboom.....................................................    35

 
    SECURING FEDERAL FACILITIES: AN EXAMINATION OF FPS PROGRESS IN 
                 IMPROVING OVERSIGHT AND ASSESSING RISK

                              ----------                              

                         Tuesday, July 24, 2012

             U.S. House of Representatives,
                    Committee on Homeland Security,
 Subcommittee on Cybersecurity, Infrastructure Protection, 
                                 and Security Technologies,
                                                    Washington, DC.
    The subcommittee met, pursuant to call, at 10:09 a.m., in 
Room 311, Cannon House Office Building, Hon. Daniel E. Lungren 
[Chairman of the subcommittee] presiding.
    Present: Representatives Lungren, Walberg, Clarke, 
Richmond, and Keating.
    Mr. Lungren. The Committee on Homeland Security, 
Subcommittee on Cybersecurity, Infrastructure Protection, and 
Security Technologies will come to order. The subcommittee is 
meeting today to examine the Federal Protective Service and the 
possible need for reform.
    Ms. Clarke will be here shortly, and so I am just going to 
give my opening statement and when she arrives she will be able 
to give her opening statement.
    Thank you very much for being here, all three of our 
witnesses. This is an important hearing.
    The Federal Protective Service is a vital part of the 
Department of Homeland Security. It is the largest operational 
component within the National Protection and Programs 
Directorate.
    The FPS mission is to protect over 9,000 Government 
buildings and their 1.4 million occupants, which are essential 
to the day-to-day operations of the Federal Government. Recent 
incidents at Federal facilities such as the failed improvised 
explosive device, as well as the bombing of Oklahoma City's 
Murrah Federal Building in 1995, remind us the Federal 
facilities remain attractive terrorist targets.
    This subcommittee has conducted rigorous oversight over the 
Federal Protective Service this Congress. Last July we held a 
hearing which identified some of the perennial problems 
plaguing the FPS.
    In that hearing we discussed failures of contract guard 
oversight and their training program, including the egregious 
mishandling of an IED in Detroit. We also discussed the failed 
development of FPS's risk management program, known as RAMP, 
which cost the Federal Government $35 million over 4 years. I 
am hopeful and cautiously optimistic that these problems 
represent the low-water mark for FPS.
    Since 2008 GAO has made 32 recommendations to improve FPS 
security vulnerabilities and other operational problems, five 
of which have been implemented and 20 which are in the process 
of implementation.
    From the outset I do want to commend Director Patterson for 
his leadership. I believe the recent successes in implementing 
GAO recommendations are in part the result of improved dialogue 
and outreach with the private sector as well as the efforts of 
FPS's own workforce.
    I think this dialogue is extremely important as FPS works 
to address the remaining GAO recommendations, especially in its 
two core areas of responsibility: First, its ability to conduct 
risk assessments of Federal buildings; and second, to provide 
necessary oversight and training for its contract guard force.
    Regarding the first responsibility, FPS began operational 
testing this last spring for a new risk assessment tool, known 
as the modified infrastructure survey tool, or MIST, which was 
developed in partnership with the Argonne National Laboratory. 
MIST is intended to be an interim tool that FPS inspectors use 
to conduct vulnerability assessments in the aftermath of the 
RAMP failure.
    I understand, am informed that there is a disagreement 
between FPS and GAO with regard to the limitations and benefits 
of MIST and I look forward to hearing from our witnesses 
regarding these differences. I am aware of some of the 
limitations identified by GAO that MIST does not account for 
consequence information and therefore does not provide FPS the 
comprehensive ability to manage risk. I also understand GAO has 
concerns that MIST is neither compliant with the National 
infrastructure protection plan framework nor compliant with 
standards developed by the Interagency Security Committee.
    I think these are very legitimate questions raised by GAO 
and important standards FPS should meet when it develops a 
longer-term solution. Nonetheless, I do consider MIST 
development a step in the right direction for an agency that 
has taken a series of steps in the wrong direction over the 
last decade.
    FPS has always stated that MIST is intended to serve as an 
interim tool until a longer-term solution is developed. 
However, FPS has never stated what the longer-term solution 
will be. So I look forward to hearing from Director Patterson 
on his vision for MIST's future as a risk management tool.
    I also look forward to learning about what FPS is doing to 
address GAO's findings about unnecessary duplication of risk 
assessments by several FPS customers who in some instances have 
expressed dissatisfaction with FPS's assessments--for instance, 
the IRS, FEMA, and EPA.
    Providing oversight and training of the contract guard 
program is also a critical responsibility of FPS. At last 
summer's hearing Director Patterson stated that he was looking 
at different ways that FPS may be able to improve delivery of 
X-ray and magnetometer training.
    I look forward to hearing more about how these ideas have 
developed since last year. I also understand there has been 
outreach to the private sector regarding better training 
options and I commend you for those efforts.
    Finally, FPS has undergone significant transition since 
joining the Department of Homeland Security. After initially 
being placed under ICE, after the creation of DHS, FPS moved to 
NPPD in 2010, and last summer NPPD notified the committee that 
it was once again considering reorganizing the directorate. Is 
reorganization being contemplated, and if so, how will this 
impact FPS?
    I want to thank all of our witnesses for being here this 
morning, and I look forward to your testimony on the progress 
made by the FPS in securing our Nation's Federal facilities.
    [The statement of Chairman Lungren follows:]
                Statement of Chairman Daniel E. Lungren
                             July 24, 2012
    The Federal Protective Service (FPS) is a vital part of the 
Department of Homeland Security and is the largest operational 
component within the National Protection and Programs Directorate 
(NPPD). Its mission to protect some 9,000 Government buildings and its 
1.4 million occupants is essential for the Federal Government to 
continue day-to-day operations. Recent incidents at Federal facilities 
such as the failed IED attempt in Detroit, and the bombing of Oklahoma 
City's Murrah Federal Building in 1995, remind us that Federal 
facilities remain significant symbolic targets for terrorists.
    This subcommittee has conducted rigorous oversight over the Federal 
Protective Service this Congress. Last July we held a hearing which 
identified some of the perennial problems plaguing the FPS. In that 
hearing we discussed failures of contract guard oversight and training, 
including the egregious mishandling of an attempted Improvised 
Explosive Devise in Detroit, and the failed development of a risk 
management program known as RAMP, which after 5 years of development, 
cost the Federal Government somewhere between $35-57 million with 
little to show for. I am hopeful that these incidents represent the 
low-water mark for FPS, and I am cautiously optimistic about FPS's 
future.
    Last July the GAO had issued a total of 28 recommendations for FPS 
to address, yet at the time none were implemented. Today, I am 
encouraged to note that while GAO has recommended 32 recommendations, 
to date, 5 have been implemented and 20 are in the process of 
implementation. This represents significant progress.
    From the outset, I want to commend Director Patterson for his 
leadership and the agency's recent successes. These successes, I 
believe are in part the result of improved dialogue and substantial 
outreach with private-sector partners as well FPS's own workforce. I 
think this dialogue is extremely important as FPS works to address 
important recommendations made by the Government Accountability Office, 
especially as it works to improve two of its core areas of 
responsibility: (1) Its ability to conduct risk assessments of Federal 
buildings; and (2) provide necessary oversight and training for its 
Contract Guard Program.
    Regarding this first responsibility, FPS began operational testing 
this last spring for a new risk assessment tool, known as the Modified 
Infrastructure Survey Tool or MIST, which was developed in partnership 
with the Argonne National Laboratory. MIST is intended to be an interim 
tool FPS inspectors use to conduct facility security assessments, in 
the aftermath of RAMP's failure.
    I understand there is some pretty substantial disagreement between 
FPS and GAO with regard to the limitations and benefits of MIST and I 
look forward to hearing from our witnesses regarding these differences. 
I am aware of some of the limitations identified by GAO, such as that 
MIST does not account for ``consequence'' information, and therefore 
does not provide FPS the comprehensive ability to manage risk. I also 
understand GAO has concerns that MIST is neither compliant with the 
National Infrastructure Protection Plan framework nor compliant with 
standards developed by the Interagency Security Committee. I think 
these are very legitimate questions raised by GAO, and are important 
standards FPS should meet when it develops a longer-term solution.
    Nonetheless, I consider MIST's development a step in the right 
direction for an agency that has taken a series of steps in the wrong 
direction over the last decade. FPS has always stated that MIST is 
intended to serve as an interim tool until a longer-term solution is 
developed. However, FPS has never stated what the longer-term solution 
will be. I look forward to hearing from Director Patterson on his 
vision for MIST's future as a risk management tool. I also look forward 
to learning about what FPS is doing to address GAO's finding about 
unnecessary duplication of risk assessments by several FPS customers, 
who in some instances, are dissatisfied by assessments provided by FPS.
    Providing oversight and training of the contract guard program is 
also a critical responsibility of FPS. At last summer's hearing 
Director Patterson stated that he was looking at different ways FPS may 
be able to improve delivery of X-ray and magnetometer training. I look 
forward to hearing more about how these ideas have developed since last 
year. I understand there has been significant outreach with the private 
sector that may be able to better deliver training, and I commend you 
for putting an emphasis on training in your tenure at FPS.
    Finally, FPS has undergone significant transition since joining the 
Department of Homeland Security. After initially being placed under ICE 
after the creation of DHS, FPS moved to NPPD in 2010. Last summer, NPPD 
notified the committee that it was once again considering reorganizing 
the agency which FPS was assigned. However, since last summer, the 
Department has been silent on its plans to reorganize NPPD, so I am 
very much looking forward to hearing from Director Patterson on his 
thoughts on reorganization, and if we can expect any more information 
on this soon.
    I want to thank all of our witnesses for being here this morning 
and look forward to their testimony on progress made by the FPS 
securing our Nation's Federal facilities. I now recognize the gentle 
lady from New York, the Ranking Member of this subcommittee, Ms. 
Clarke, for her opening statement.

    Mr. Lungren. I now have the pleasure of recognizing the 
gentle lady from New York, the Ranking Member of the 
subcommittee, Ms. Clarke, for her opening statement.
    Ms. Clarke. Thank you, Mr. Chairman, and thank you for 
holding this hearing today. Today's hearing will allow the 
subcommittee to hear from witnesses about the Federal 
Protective Service's progress in improving its ability to 
provide adequate protection to the Federal Government's more 
than 9,000 facilities.
    Given the numerous studies that FPS has undertaken by the 
Government Accountability Office and the multiple hearings held 
by this committee, the subcommittee is interested in learning 
about the actions FPS has taken to upgrade its ability to 
conduct facility security assessments, better manage its 
contract guard staff, and to enhance funding for its 
operations. We need a more clear explanation of the 
implementation and utility of the modern infrastructure survey 
tool, or MIST, and how it compares, hopefully surpasses, the 
failed risk assessment and management program, or RAMP.
    The subcommittee must be assured that after investing 
approximately $35 million RAMP without yielding any 
demonstrable outcomes FPS is indeed expending its resources 
effectively and scaling up MIST. We need assurances that MIST 
is working as an interim solution, and we need to know what 
FPS's long-term strategy to replace RAMP. Also, as the 
designated leader of the Federal Government facilities sector 
FPS has an important role to play in assuring that the Federal 
critical infrastructure both secure--that the--excuse me--the 
Federal critical infrastructure is both secure and resilient in 
the event of a catastrophic occurrence.
    In August GAO will issue a report at Ranking Member 
Thompson's request that evaluates the Department's activities 
regarding the Government facilities sector with a particular 
emphasis on FPS's role as the designated sector leader. I look 
forward to the release of that report and hope that we are able 
to revisit this subject at that time.
    Finally, Mr. Chairman, I am concerned that FPS is forced to 
bear the cost of developing and implementing a program capable 
of completing security assessments of Federal buildings. It 
seems to me that as the landlord for most Federal buildings, 
the General Services Administration benefits from these 
security assessments. I look forward to hearing from our 
witnesses today about the role of GSA in sharing the cost of 
the assessment program.
    Having said that, thank you, Mr. Chairman, and I yield 
back.
    [The statement of Ranking Member Clarke follows:]
              Statement of Ranking Member Yvette D. Clarke
                             July 26, 2012
    Mr. Chairman, thank you for holding this hearing to discuss 
developments in the Domestic Nuclear Detection Office Strategy, and the 
Global Nuclear Detection Architecture.
    It has been said before, the enormous devastation that would result 
if terrorists use a nuclear weapon or nuclear materials successfully, 
requires us to do all we can to prevent them from entering or moving 
through the United States.
    This subcommittee, in its oversight capacity, has held hearings 
starting in 2005, and continuing through 2012, regarding the 
development and implementation of the GNDA and in the decision-making 
process that involves costly investments in it.
    The overarching issues include the balance between investment in 
near-term and long-term solutions for architecture gaps, the degree and 
efficiency of Federal agency coordination, the mechanism for setting 
agency investment priorities in the architecture, and the efforts DNDO 
has undertaken to retain institutional knowledge regarding this 
sustained effort.
    In the policy and strategy documents of the GNDA, DNDO is 
responsible for developing the global strategy for nuclear detection, 
and each Federal agency that has a role in combating nuclear smuggling 
is responsible for implementing its own programs. DNDO identified 73 
Federal programs, which are primarily funded by DOD, DOE, and DRS that 
engage in radiological and nuclear detection activities.
    With the publication of an overall DNDO strategy document and the 
release of the Global Nuclear Detection Architecture and implementation 
plan, Congress will have a better idea of how to judge the DNDO's 
policy, strategy operations, tactics, and implementation.
    But we need to know more about their R&D activities, their resource 
requests, and their asset allocations. And I know that I might sound 
like a broken record before the day is through, but from the very start 
of the ASP program which was officially cancelled just 10 days ago, 
July 16, DNDO seemed to push for acquisition decisions well before the 
technology had demonstrated that it could live up to its promise.
    On July 14, 2006, Secretary of Homeland Security Michael Chertoff 
and the then-Director of DNDO, Mr. Oxford, one of our witnesses today, 
announced contract awards to three companies worth an estimated $1.2 
billion to develop ASPs, including the Raytheon Company from 
Massachusetts, the Thermo Electron Company from Santa Fe, New Mexico, 
and Canberra Industries from Connecticut. Both Secretary Chertoff and 
Oxford held a press conference to announce the billion-dollar contract 
awards just a few months after highly critical reviews of the ASPs' 
abilities by the GAO and the National Institute of Standards and 
Technology (NIST).
    I hope we don't see that kind of decision making again in DNDO.
    Within DNDO, policy and strategy have historically not been 
adequately translated into operations, tactics, and implementation. 
Overlapping missions, especially in the field of nuclear detection, 
worsen this.
    Since 2009, DNDO has made important changes under Secretary 
Napolitano, and made especially good progress in nuclear forensics. And 
I hope that our Congressional oversight has had an effect, a positive 
one, in bringing to light decisions that cost the taxpayers a lot of 
money, with little to show.
    In 2010, the Science and Technology (S&T) Directorate requested 
$109.000 million for the Transformational Research and Development 
Radiological and Nuclear Division. This research was to be transferred 
from DNDO to the S&T Directorate,\1\ and the Democratic committee 
Members supported the transition of radiological and nuclear research 
away from DNDO into S&T. The committee, under then-Chairman Thompson, 
worked to make this transition happen, and we believe that research and 
development, and operations and procurement, are best left to separate 
organizations in order to avoid the obvious conflict of interest.
---------------------------------------------------------------------------
    \1\ DHS Fiscal Year 2011 Budget in Brief, ICE 10-2647.000474. p. 
139.
---------------------------------------------------------------------------
    What I hope we are going to hear today is how DNDO's mission can be 
better-defined. Some claim there is still confusion as to whether it is 
an end-to-end RDT&E and procurement entity for all things nuclear/
radiological, a development entity, or an operational entity, and 
question whether there is an inherent conflict of interest when an 
agency is both an R&D workshop and a procurement platform.
    Let me finish with this thought, completely out of the policy 
arena. On the ground, and every day, our nuclear deterrence effort 
requires motivated and vigilant officers supplied with the best 
equipment and intelligence we can give them. Customs and Border Patrol 
officers working at our Nation's ports of entry have an extremely 
complex and difficult job.
    Thousands of decisions are made every day to clear a container or 
personal vehicle for transit into the United States, require further 
inspection, or even deny entry or interdict such a vehicle or person, 
and that is the hard, cold, every-day reality of our mission to prevent 
this kind of violent nuclear attack.
    We must do our best.
    I look forward to hearing from our witnesses today and with that, 
Mr. Chairman, I yield back.

    Mr. Lungren. I thank the gentlelady for her comments, and I 
think the panel can tell that we are on the same page at 
looking at what the progress has been since our last hearing.
    General L. Eric Patterson was appointed director of the 
Federal Protective Service, a subcomponent of the National 
Protective--Protection and Programs Directorate, in September 
2010. He previously served as the deputy director of the 
Defense Counterintelligence HUMINT Center at the Defense 
Intelligence Agency.
    Prior to joining DIA Mr. Patterson served as a principal 
with Booz Allen Hamilton where he supported two of the Defense 
Technical Information Center analysis centers, one focused on 
information assurance and the other on the survivability and 
vulnerability of defense systems. He is a retired United States 
Air Force brigadier general with 30 years of service.
    Mr. Mark Goldstein is the director of physical 
infrastructure issues at GAO. Mr. Goldstein is responsible for 
the agency's work in Federal property and telecommunications. A 
former award-winning journalist and author, his other public 
service work has included roles as chief of staff to the D.C. 
Financial Control Board and senior investigative staff to the 
Senate Committee on Governmental Affairs.
    Dr. James Peerenboom is the associate director of the 
decision and information sciences division at the Argonne 
National Laboratory, near Chicago, Illinois. In this role he is 
responsible for leading multidisciplinary teams of scientists 
and engineers in developing innovative solutions for 
infrastructure assurance, systems analysis, decision and risk 
analysis, and advanced modeling and simulation problems.
    For the past 15 years he has focused on critical 
infrastructure protection and resilience issues, providing 
technical support to the Departments of Energy and Homeland 
Security, the President's commission on critical infrastructure 
protection, and White House Office of Science and Technology 
Policy. He received his Ph.D in energy and environmental 
systems from the Institute of Environmental Studies and an M.S. 
and B.S. in nuclear engineering from the University of 
Wisconsin at Madison.
    Gentlemen, we ask you--well, we would first indicate that 
your written testimony will be made a part of the record and 
would ask that you summarize your testimony with any additions 
as you wish in 5 minutes, and then we will have a round of 
questioning.
    So the Chairman would recognize Director Patterson to 
begin.

 STATEMENT OF L. ERIC PATTERSON, DIRECTOR, FEDERAL PROTECTIVE 
            SERVICE, DEPARTMENT OF HOMELAND SECURITY

    General Patterson. Good morning. Thank you, Chairman 
Lungren, Ranking Member Clarke.
    My name is Eric Patterson and I am the director of the 
Federal Protective Service within the Department of Homeland 
Security's National Protection and Programs Directorate. I am 
honored to appear before you today to discuss FPS's progress in 
addressing some historically identified challenges.
    FPS's mission is to protect more than 9,000 Federal 
buildings throughout the United States and its territories and 
the 1.4 million Federal employees and visitors who occupy and 
conduct business in them every day. We execute this mission by 
providing proactive law enforcement, investigations, protective 
intelligence, incident response, security planning, and 
stakeholder engagement.
    Based upon my experience in the ever-changing threat 
environment, my belief is that risk assessment is a continuous 
process and not a static event. Our law enforcement and 
physical security professionals continually provide access risk 
and implement mitigation strategies through their daily 
activities.
    During fiscal year 2011 FPS investigated and mitigated more 
than 1,300 threats and assaults directed towards Federal 
facilities and their occupants, made close to 2,000 arrests, 
responded to 53,000 incidents, and prevented the entry of 
hundreds of thousands of prohibited items into Federal 
facilities. FPS also conducted 1,800 Operation Shield 
exercises, 150 Covert Test operations, over 80,000 post 
inspections, and also validated the training of thousands of 
protective security officers that we oversee.
    Over the past year FPS developed an important partnership 
with Argonne National Lab resulting in the completed 
development and current deployment of a new facility security 
assessment tool, called the modified infrastructure survey 
tool, or MIST. MIST will enable comprehensive and consistent 
FSAs that will allow Federal tenant agencies to make informed 
security and risk management decisions. The MIST tool is a 
welcome addition to FPS's portfolio of on-going facility 
assessment efforts and strategies.
    As GAO has indicated, FPS employed the best project 
management principles in the development of MIST. MIST 
requirements were developed leveraging the knowledge obtained 
from our long-standing relationships with the General Services 
Administration, the Facility Security Committee, and other 
customers.
    As we move to measure and assure the successful performance 
of MIST my plan is to build upon this foundation to improve 
FPS's management of other significant programs--for example, 
our protective security officer program. Just as technology is 
enhancing our risk assessment processes, I plan to better 
leverage technology to allow for more effective oversight of 
our contract PSOs.
    A key enabler of these actions will come from the good work 
of our collaboration with the Systems Engineering and Design 
Institute, SEDI, a Federally-funded research and development 
center. We have engaged the SEDI to produce a full mapping of 
FPS activities and to then align them with FPS's current fee 
structure. That work will be used to produce an activity-based 
cost model for FPS.
    These efforts are designed to result in a more efficient 
revenue structure for FPS and greater transparency on security 
costs for FPS stakeholders.
    I am also pleased to note that some of our recent progress 
includes an increased participation in the important work of 
the Interagency Security Committee to include chairing a new 
ISC working group which will look at the future of Federal 
workplace security and the newly reconstituted Training 
Subcommittee.
    FPS's program--progress in the past year and our path 
forward leveraging partnerships and technology is clearly in 
direct support of our long-term vision. It will continue to 
take time, deliberate planning, and the dedication of our 
employees and partners to fully realize our vision and I look 
forward to keeping you apprised of our progress.
    Again, thank you for the opportunity to discuss FPS with 
you today, and I would be happy to answer any questions you 
might have.
    [The prepared statement of Mr. Patterson follows:]
                Prepared Statement of L. Eric Patterson
                             July 24, 2012
    Thank you Chairman Lungren, Ranking Member Clarke, and the 
distinguished Members of the subcommittee. My name is Eric Patterson, 
and I am the Director of the Federal Protective Service (FPS) within 
the Department of Homeland Security's (DHS) National Protection and 
Programs Directorate (NPPD).
    I am honored to appear before you today to discuss NPPD/FPS's 
progress in utilizing key protection and risk management practices such 
as allocation of resources, leveraging technology, and enhancing 
information sharing and coordination.
    The GAO has raised several areas that have historically represented 
challenges for FPS including:
    1. Absence of a risk management program;
    2. Addressing key human capital issues through a strategic human 
        capital plan;
    3. Contract Guard workforce management and oversight; and
    4. Need for a review of FPS's fee design.
    Today's hearing is an opportunity to address the progress FPS has 
made during the past year in working to address these challenges, and 
to also provide information on the topics addressed in GAO's new report 
related to risk assessment and Protective Security Officer (PSO) 
program management and oversight.
                             fps background
    FPS's mission is to protect more than 9,000 Federal buildings and 
the 1.4 million Federal employees and visitors who occupy them 
throughout the country every day by leveraging the intelligence and 
information resources of its network of public and private-sector 
partners. Specifically, FPS executes its mission by providing proactive 
law enforcement, investigation and protective intelligence and 
information sharing services, incident response, security planning, and 
stakeholder engagement. Prior to its transfer to NPPD in 2009, FPS was 
organized under Immigration and Customs Enforcement and prior to that, 
under the General Services Administration (GSA).
    Part of our core mission is to assess the threat picture for the 
Government Facilities Sector (GFS) and share that information with 
stakeholders as appropriate. For example, FPS leverages the Homeland 
Security Information Network (HSIN), a secure, trusted web-based portal 
to share information with our more than 900 Government and industry 
partners. One of the recent information-sharing initiatives FPS has 
implemented to assist in the protection of facilities and their 
occupants is the Federal Facility Threat Picture (FFTP), which is an 
unclassified assessment of the current known threats to the facilities 
FPS protects. Produced quarterly, the FFTP supports the threat 
component of a Federal Security Assessments (FSA) and informs our 
stakeholders of potential threats to Government facilities. The FFTP 
focuses on the threats posed by a variety of actors that may seek to 
attack or exploit elements of the GFS. The information used in the FFTP 
comes from intelligence and law enforcement community reporting.
    During fiscal year 2011, FPS:
   Investigated and mitigated more than 1,300 threats and 
        assaults directed towards Federal facilities and their 
        occupants;
   Disseminated 331 threat- and intelligence-based products to 
        our stakeholders, 142 of which were FPS-produced;
   Conducted 81,125 post inspections;
   Interdicted more than 680,000 weapons/prohibited items 
        including knives, brass knuckles, pepper spray, and other items 
        that could be used as weapons or are contraband such as illegal 
        drugs, at Federal facility entrances during routine checks;
   Made 1,975 arrests;
   Responded to 53,000 incidents involving people or property; 
        and
   Conducted more than 1,800 high-visibility operations under 
        Operation Shield and 150 risk-based Covert Test operations, 
        ensuring the protection of Federal buildings and 
        infrastructure.
              fps is developing a risk management program
    In terms of a risk management program, FPS's operational activities 
are organized by the National Infrastructure Protection Plan's (NIPP) 
Risk Management Framework, which calls for the following steps: Set 
Security Goals, Identify Assets and Functions, Assess Risks, 
Prioritize, Implement Protective Programs, and Measure Effectiveness. 
One area of recent significant progress related to risk assessment and 
the implementation of a risk management program is the on-going 
implementation of FPS's solution for conducting FSAs using an automated 
assessment tool. In May 2011, the decision was made to cease 
development of the legacy application known as the Risk Assessment and 
Management Program (RAMP) and to pursue a stand-alone assessment tool, 
in order to provide completed FSAs to customers. That decision has 
since been affirmed by the Department's Office of Inspector General 
(OIG).
    In the interim period, our employees have continued their daily 
interactions with tenant agencies and oversight of facility security. 
Our personnel have been completing Pre-Modified Infrastructure Survey 
Tool (MIST) worksheets to enable complete FSA reports, and are 
constantly assessing risks to Federal facilities. Specifically, the 
pre-MIST worksheet allows the inspector to collect key information that 
will be populated into MIST and used in generating a final FSA report. 
Such data includes facility information, vulnerability assessments, and 
existing protective measures.
    After consideration of several alternatives, FPS partnered with 
NPPD's Office of Infrastructure Protection (IP) to leverage a proven 
assessment methodology called the Infrastructure Survey Tool (IST). In 
October 2011, NPPD issued a task order to Argonne National Laboratory 
(ANL) through the Department of Energy to modify the existing Link 
Encrypted Network System (LENS) and IST for FPS use to conduct FSAs. 
Because this project leveraged existing tools and had limited resources 
and time constraints, the acquisition life cycle was tailored to meet 
delivery deadlines.
    I am pleased to note that in its draft report, GAO noted FPS's use 
of project management principles in the development of MIST. Throughout 
the project, the MIST Users Working Group has remained engaged to 
ensure user involvement in the process. User feedback from field 
testing was uniformly positive about MIST and the FPS Gateway, 
confirming suitability to support the FPS mission. The MIST and FPS 
Gateway development efforts were completed on schedule, with ANL 
delivering the system to the Government on March 30, 2012. In April 
2012, and the decision was made to proceed and deploy MIST. It is 
important to note that throughout the development and testing of MIST, 
field employees and our union were involved and actively participated 
as subject matter experts in the process.
    FPS developed and is currently implementing a distance learning-
based training program for each MIST user, as GAO commended in its 
draft report. Supervisors completed this training in April 2012 and 
Inspectors began their virtual training in May 2012, with completion of 
all training anticipated for late September 2012. This provides a 
hands-on learning environment for our Inspectors; they will receive 
virtual instruction as they use the tool in the learning environment. 
Once an Inspector completes the training and successfully briefs his or 
her supervisor on a completed FSA, that Inspector will be able to 
proceed with conducting FSAs and reporting the results to a Facility 
Security Committee.
    In leveraging existing technology in developing MIST, FPS was able 
to incorporate the ability to illustrate the impact of alternative 
countermeasures on a particular vulnerability. MIST will also show how 
a facility is or is not meeting the baseline level of protection for 
its Facility Security Level as set forth in the ISC's Physical Security 
Criteria for Federal Facilities standard and the ISC's Design Basis 
Threat report. This will lead to a more informed and better dialogue 
with tenants and Facility Security committees as FSA results are 
discussed and alternatives are explored. Additionally, FPS recently 
disseminated guidance Nation-wide on the commencement of the use of 
MIST to generate FSAs upon completion of inspector training. The 
anticipated results of the use of MIST are consistent assessment 
results Nation-wide and informed decision-making regarding security 
investments on the part of tenant agencies.
  fps is addressing key human capital issues through development of a 
                      strategic human capital plan
    In order to ensure that human resource requirements are aligned 
appropriately with FPS's overall mission, a Strategic Human Capital 
Plan is being developed in conjunction with NPPD's Human Capital 
Office. We are working to finalize the document; we intend to provide 
the plan and brief the committee when it is finalized.
 fps is working to improve its protective security officer management 
                             and oversight
    FPS is working to improve management and oversight of our over 
13,000 Protective Security Officer (PSO) force. We have reviewed our 
operations Nation-wide and have taken steps at the National program 
level to ensure that performances under contracts are advantageous to 
the Government. We are actively working to implement the 
recommendations resulting from GAO and OIG reviews across the 
organization. Additionally, an Integrated Project Team (IPT) conducted 
a comprehensive review of how FPS resources the PSO oversight function 
and our current oversight policy.
    FPS is also working with DHS's Science and Technology Directorate 
to develop a system for contract guard oversight and explore means of 
leveraging technology to ensure effective oversight of PSOs, such as 
automated tracking of guard post staff levels and PSO possession of the 
necessary credentials to stand post. Additionally, our training team is 
working closely with industry and Federal partners in developing a more 
effective training strategy for our PSOs.
   fps is examining its fee structure in order to review current fee 
                                 design
    FPS operates through fee-based funding revenue, which is calculated 
based on the Federal facility tenant's square footage of occupancy and 
on the collection of services associated with the provisioning of 
reimbursable protective countermeasures. This fee-based financial 
structure is unique among Federal law-enforcement agencies and requires 
a greater degree of understanding internal operations to ensure it is 
properly aligned with FPS's costs.
    To address this challenge, FPS is implementing a two-pronged 
strategy to better understand its activities and costs and recommend 
options for a new revenue structure. In January 2012, FPS collaborated 
with the Department's Systems Engineering and Design Institute (SEDI), 
a Federally Funded Research and Development Center managed by the DHS 
Science and Technology Directorate, to produce a full mapping of FPS 
activities and then align them with costs. That work will be used to 
produce Activity-Based Cost (ABC) models for FPS. Both of these efforts 
are designed to result in a more efficient revenue structure for FPS 
and greater transparency in security costs for FPS stakeholders.
                               conclusion
    Thank you again for the opportunity to provide you with an update 
on the progress FPS is making on a number of fronts. FPS aspires to be 
an exemplary law enforcement and strategic critical infrastructure 
protection organization. This is a vision uniformly shared by FPS 
leadership and operational staff, both at headquarters and in the 
field. I would be happy to answer any questions you might have.

    Mr. Lungren. Thank you very much, Director Patterson. You 
stayed within the time wonderfully. A new record here.
    Now, Mr. Goldstein, please.

      STATEMENT OF MARK L. GOLDSTEIN, DIRECTOR, PHYSICAL 
    INFRASTRUCTURE ISSUES, GOVERNMENT ACCOUNTABILITY OFFICE

    Mr. Goldstein. Thank you, Mr. Chairman and Ranking Member 
Clarke. We are pleased to be here this morning to testify on 
the Federal Protective Service and its efforts to improve its 
security of Federal property, employees, and citizens who use 
these facilities.
    FPS provides security and law enforcement services to over 
9,000 Federal facilities managed by GSA. GAO has reported that 
FPS faces challenges providing security services, particularly 
completing FSAs and managing its contract guard program.
    To address these challenges FPS spent about $35 million in 
4 years developing RAMP, essentially a risk assessment and 
guard oversight tool. However, RAMP ultimately could not be 
used to do either because of system problems.
    My testimony today is based on preliminary work for you, 
Mr. Chairman, and discusses the extent to which FPS is 
completing risk assessments, developing a tool to complete 
FSAs, and managing its contract guard workforce.
    Our preliminary results indicate that: No. 1, the 
Department of Homeland Security's DHS Federal Protective 
Service is not assessing risks at Federal facilities in a 
manner that is consistent with standards such as the National 
infrastructure protection plan's risk management framework as 
FPS originally planned. Instead of conducting risk assessments, 
since September 2011 FPS's inspectors have collected 
information such as location, purpose, agency contacts, and 
current countermeasures.
    This information notwithstanding, FPS has a backlog of 
Federal facilities that have not been assessed for several 
years. According to FPS's own data, more than 5,000 facilities 
were to be assessed in fiscal years 2010 through 2012.
    However, GAO was not able to determine the extent of FPS's 
facility security assessment backlog because the data was 
unreliable. Multiple agencies have expended resources to 
conduct risk assessments themselves even though they also 
already pay FPS for this service.
    Second, FPS has an interim vulnerability assessment tool, 
referred to as MIST, which it plans to use to assess Federal 
facilities until it develops a longer-term solution. In 
developing MIST, FPS generally followed project management best 
practices that GAO had developed, such as conducting user 
acceptance testing.
    However, our preliminary analysis indicates that MIST has 
some limitations. Most notably, MIST does not estimate the 
consequences of an undesirable event occurring at a facility.
    Several of the risk assessment experts GAO spoke with 
agreed that a tool that does not estimate consequences does not 
allow for an agency to fully assess risk. FPS officials stated 
that they did not include consequence information in MIST 
because it was not part of the original design and thus 
requires more time to validate.
    MIST also was not designed to compare risk across Federal 
facilities. Thus, FPS has a limited assurance if critical risks 
at Federal facilities are being prioritized and mitigated. We 
have made recommendations in this area in the past.
    Third, GAO's preliminary work indicates that FPS continues 
to face challenges in overseeing its contract guard program. 
FPS developed the risk assessment and management program, RAMP, 
to help it oversee its contract guard workforce by verifying 
that guards are trained and certified and for conducting guard 
post inspections.
    However, FPS faced challenges using RAMP for guard 
oversight, such as verifying guard training and certification 
information, and has recently determined that it would no 
longer use RAMP. Without a comprehensive system it is more 
difficult for FPS to oversee its contract guard workforce.
    FPS is verifying guard certification and training 
information by conducting monthly audits of guard training and 
certification information. However, FPS does not independently 
verify the contractors' information.
    Additionally, FPS recently decided to deploy a new interim 
method to record post inspections that replaced RAMP. We have 
not reviewed this system.
    This concludes my opening remarks, Mr. Chairman. I would be 
pleased to address any questions you or Members of the 
subcommittee have. Thank you.
    [The prepared statement of Mr. Goldstein follows:]
                Prepared Statement of Mark L. Goldstein
                             July 24, 2012
                             gao highlights
    Highlights of GAO-12-943T, testimony before the Subcommittee on 
Cybersecurity, Infrastructure Protection, and Security Technologies of 
the House Committee on Homeland Security.
Why GAO Did This Study
    FPS provides security and law enforcement services to over 9,000 
Federal facilities managed by the General Services Administration 
(GSA). GAO has reported that FPS faces challenges providing security 
services, particularly completing FSAs and managing its contract guard 
program. To address these challenges, FPS spent about $35 million and 4 
years developing RAMP--essentially a risk assessment and guard 
oversight tool. However, RAMP ultimately could not be used to do either 
because of system problems.
    This testimony is based on preliminary work for the Chairman and 
discusses the extent to which FPS is: (1) Completing risk assessments, 
(2) developing a tool to complete FSAs, and (3) managing its contract 
guard workforce. GAO reviewed FPS documents, conducted site visits at 3 
of FPS's 11 regions and interviewed officials from FPS, Argonne 
National Laboratory, GSA, Department of Veterans Affairs, the Federal 
Highway Administration, Immigration and Customs Enforcement, and guard 
companies; as well as 4 risk management experts.
What GAO Recommends
    GAO is not making any recommendations in this testimony. GAO plans 
to finalize its analysis and report to the Chairman in August 2012, 
including recommendations. GAO discussed the information in this 
statement with FPS and incorporated technical comments as appropriate.
 federal protective service.--preliminary results on efforts to assess 
               facility risks and oversee contract guards
What GAO Found
    GAO's preliminary results indicate that the Department of Homeland 
Security's (DHS) Federal Protective Service (FPS) is not assessing 
risks at Federal facilities in a manner consistent with standards such 
as the National Infrastructure Protection Plan's (NIPP) risk management 
framework, as FPS originally planned. Instead of conducting risk 
assessments, since September 2011, FPS's inspectors have collected 
information, such as the location, purpose, agency contacts, and 
current countermeasures (e.g., perimeter security, access controls, and 
closed-circuit television systems). This information notwithstanding, 
FPS has a backlog of Federal facilities that have not been assessed for 
several years. According to FPS's data, more than 5,000 facilities were 
to be assessed in fiscal years 2010 through 2012. However, GAO was not 
able to determine the extent of FPS's facility security assessment 
(FSA) backlog because the data were unreliable. Multiple agencies have 
expended resources to conduct risk assessments, even though they also 
already pay FPS for this service.
    FPS has an interim vulnerability assessment tool, referred to as 
the Modified Infrastructure Survey Tool (MIST), which it plans to use 
to assess Federal facilities until it develops a longer-term solution. 
In developing MIST, FPS generally followed GAO's project management 
best practices, such as conducting user acceptance testing. However, 
our preliminary analysis indicates that MIST has some limitations. Most 
notably, MIST does not estimate the consequences of an undesirable 
event occurring at a facility. Three of the four risk assessment 
experts GAO spoke with generally agreed that a tool that does not 
estimate consequences does not allow an agency to fully assess risks. 
FPS officials stated that they did not include consequence information 
in MIST because it was not part of the original design and thus 
requires more time to validate. MIST also was not designed to compare 
risks across Federal facilities. Thus, FPS has limited assurance that 
critical risks at Federal facilities are being prioritized and 
mitigated.
    GAO's preliminary work indicates that FPS continues to face 
challenges in overseeing its approximately 12,500 contract guards. FPS 
developed the Risk Assessment and Management Program (RAMP) to help it 
oversee its contract guard workforce by verifying that guards are 
trained and certified and for conducting guard post inspections. 
However, FPS faced challenges using RAMP for guard oversight, such as 
verifying guard training and certification information, and has 
recently determined that it would no longer use RAMP. Without a 
comprehensive system, it is more difficult for FPS to oversee its 
contract guard workforce. FPS is verifying guard certification and 
training information by conducting monthly audits of guard information 
maintained by guard contractors. However, FPS does not independently 
verify the contractor's information. Additionally, according to FPS 
officials, FPS recently decided to deploy a new interim method to 
record post inspections that replaces RAMP.
    Chairman Lungren, Ranking Member Clarke, and Members of the 
subcommittee: We are pleased to be here today to discuss the Department 
of Homeland Security's (DHS) Federal Protective Service's (FPS) efforts 
to complete risk assessments of the over 9,000 Federal facilities under 
the custody and control of the General Services Administration (GSA) 
and oversee its contract guards in the absence of its Risk Assessment 
and Management Program (RAMP), a web-enabled facility security 
assessment (FSA) and guard management system. As we reported in July 
2011, FPS had spent about $35 million and taken almost 4 years to 
develop RAMP--$14 million and 2 years more than planned--but still 
could not use RAMP to complete FSAs because of several factors, 
including that FPS did not verify the accuracy of the Federal facility 
data used.\1\ As a result, FPS's Director decided to stop using RAMP to 
conduct FSAs and instead pursue an interim tool to replace it. FPS also 
experienced difficulty using RAMP to ensure that its guards met 
training and certification requirements, primarily because of 
challenges in verifying guards' data.\2\ In June 2012, FPS also decided 
to stop using RAMP to help oversee its contract guard program.
---------------------------------------------------------------------------
    \1\ GAO, Federal Protective Service: Actions Needed to Resolve 
Delays and Inadequate Oversight Issues with FPS's Risk Assessment and 
Management Program, GAO-11-705R (Washington, DC: July 15, 2011).
    \2\ GAO-11-705R.
---------------------------------------------------------------------------
    For fiscal year 2012, FPS has a budget of $1.3 billion, with over 
1,200 full-time employees and about 12,500 contract security guards, to 
achieve its mission to protect Federal facilities. As part of the FSA 
process, FPS generally attempts to gather and review facility 
information; conduct and record interviews with tenant agencies; assess 
threats, vulnerabilities, and consequences to facilities, employees, 
and the public; and recommend countermeasures to Federal tenant 
agencies. FPS's contract guards are responsible for controlling access 
to Federal facilities, screening access areas to prevent the 
introduction of weapons and explosives, enforcing property rules and 
regulations, detecting and reporting criminal acts, and responding to 
emergency situations involving facility safety and security. FPS relies 
on the fees it charges Federal tenant agencies in GSA-controlled 
facilities to fund its security services.\3\
---------------------------------------------------------------------------
    \3\ 40 U.S.C.  586; 41 C.F.R.  102-85.35; Pub. L. No. 111-83, 123 
Stat. 2142, 2156-57 (2009).
---------------------------------------------------------------------------
    This testimony is based on preliminary results of work we conducted 
for a report that we plan to issue to the Chairman in August 2012. That 
report will contain our final evaluation and recommendations. 
Consistent with the report's objectives, this statement addresses the 
extent to which FPS is: (1) Completing risk assessments, (2) developing 
a tool to complete FSAs, and (3) managing its contract guard workforce. 
To examine the extent to which FPS is completing risk assessments and 
overseeing guards without RAMP, we reviewed, among other things, FPS's 
current FSA procedures and data on completed and planned FSAs for 
fiscal years 2010 to 2012. Specifically, we reviewed FPS's FSA data 
aggregated from its 11 regions to determine the extent of its FSA 
backlog. However, we could not determine the extent of the backlog 
because FPS's data contained a number of missing and incorrect values 
which made the data unreliable. We also visited 3 of FPS's 11 regions 
and interviewed internal and external stakeholders including, among 
others, FPS, GSA, Department of Veterans Affairs, the Federal Highway 
Administration, Immigration and Customs Enforcement, and guard 
companies. We selected these 3 regions based on the number of Federal 
facilities in the region and their security levels, the number of 
contract guards in the region, and geographic dispersion. Our work is 
not generalizable to all FPS regions. To determine the status of FPS's 
efforts to develop an FSA tool, we reviewed, among other things, 
relevant project documents and Federal physical security standards, 
such as DHS's National Infrastructure Protection Plan's (NIPP) risk 
management framework. We also interviewed FPS officials, 
representatives from Argonne National Laboratory, and four risk 
management experts. We selected our four risk assessment experts from a 
list of individuals who participated in the Comptroller General's 2007 
risk management forum.\4\ This work is being conducted in accordance 
with generally accepted Government auditing standards. Those standards 
require that we plan and perform the audit to obtain sufficient, 
appropriate evidence to provide a reasonable basis for our findings and 
conclusions based on our audit objectives. We believe that the evidence 
obtained provides a reasonable basis for our findings and conclusions 
based on our audit objectives.
---------------------------------------------------------------------------
    \4\ GAO, Highlights of a Forum: Strengthening the Use of Risk 
Management Principles in Homeland Security, GAO-08-627SP (Washington, 
DC: April 2008).
---------------------------------------------------------------------------
fps does not currently assess risks at federal facilities but multiple 
             agencies are conducting their own assessments
    Our preliminary results indicate that, in the absence of RAMP, FPS 
currently is not assessing risk at the over 9,000 Federal facilities 
under the custody and control of GSA in a manner consistent with 
Federal standards such as NIPP's risk management framework, as FPS 
originally planned. According to this framework, to be considered 
credible a risk assessment must specifically address the three 
components of risk: Threat, vulnerability, and consequence. As a 
result, FPS has accumulated a backlog of Federal facilities that have 
not been assessed for several years. According to FPS data, more than 
5,000 facilities were to be assessed in fiscal years 2010 through 2012. 
However, we were not able to determine the extent of the FSA backlog 
because we found FPS's FSA data to be unreliable. Specifically, our 
analysis of FPS's December 2011 assessment data showed nearly 800 (9 
percent) of the approximately 9,000 Federal facilities did not have a 
date for when the last FSA was completed. We have reported that timely 
and comprehensive risk assessments play a critical role in protecting 
Federal facilities by helping decision makers identify and evaluate 
potential threats so that countermeasures can be implemented to help 
prevent or mitigate the facilities' vulnerabilities.\5\
---------------------------------------------------------------------------
    \5\ GAO, Homeland Security: Greater Attention to Key Practices 
Would Improve the Federal Protective Service's Approach to Facility 
Protection, GAO-10-142 (Washington, DC: Oct. 23, 2009).
---------------------------------------------------------------------------
    Although FPS is not currently assessing risk at Federal facilities, 
FPS officials stated that the agency is taking steps to ensure Federal 
facilities are safe. According to FPS officials, its inspectors (also 
referred to as law enforcement security officers) monitor the security 
posture of Federal facilities by responding to incidents, testing 
countermeasures, and conducting guard post inspections. In addition, 
since September 2011, FPS's inspectors have collected information--such 
as location, purpose, agency contacts, and current countermeasures 
(e.g., perimeter security, access controls, and closed-circuit 
television systems) at over 1,400 facilities--which will be used as a 
starting point to complete FPS's fiscal year 2012 assessments. However, 
FPS officials acknowledged that this approach is not consistent with 
NIPP's risk management framework. Moreover, several FPS inspectors told 
us that they received minimal training or guidance on how to collect 
this information, and expressed concern that the facility information 
collected could become outdated by the time it is used to complete an 
FSA.
Multiple Federal Agencies Are Conducting Their Own Risk Assessments
    We reported in February 2012 that multiple Federal agencies have 
been expending additional resources to conduct their own risk 
assessments, in part because they have not been satisfied with FPS's 
past assessments.\6\ These assessments are taking place even though, 
according to FPS's Chief Financial Officer, FPS received $236 million 
in basic security fees from Federal agencies to conduct FSAs and other 
security services in fiscal year 2011.\7\ For example, officials we 
spoke with at the Internal Revenue Service, Federal Emergency 
Management Agency, Environmental Protection Agency, and the U.S. Army 
Corps of Engineers stated that they conduct their own risk assessments. 
GSA is also expending additional resources to assess risk. We reported 
in October 2010 that GSA officials did not always receive timely FPS 
risk assessments for facilities GSA considered leasing.\8\ GSA seeks to 
have these assessments completed before it takes possession of a 
property and leases it to tenant agencies. However, our preliminary 
work indicates that as of June 2012, FPS has not coordinated with GSA 
and other Federal agencies to reduce or prevent duplication of its 
assessments.
---------------------------------------------------------------------------
    \6\ GAO, 2012 Annual Report: Opportunities to Reduce Duplication, 
Overlap, and Fragmentation, Achieve Savings, and Enhance Revenue, GAO-
12-342SP (Washington, DC: February 2012).
    \7\ FPS currently charges tenant agencies in properties under GSA 
control a basic security fee of $0.74 per square foot per year for its 
security services including physical security and law enforcement 
activities as per 41 C.F.R.  102-85.35.
    \8\ GAO-10-142.
---------------------------------------------------------------------------
    fps efforts to develop a risk assessment tool are evolving, but 
                           challenges remain
    In September 2011, FPS signed an interagency agreement with Argonne 
National Laboratory for about $875,000 to develop an interim tool for 
conducting vulnerability assessments by June 30, 2012.\9\ According to 
FPS officials, on March 30, 2012, Argonne National Laboratory delivered 
this tool, called the Modified Infrastructure Survey Tool (MIST), to 
FPS on time and within budget. MIST is an interim vulnerability 
assessment tool that FPS plans to use until it can develop a permanent 
solution to replace RAMP. According to MIST project documents and FPS 
officials, among other things, MIST will:
---------------------------------------------------------------------------
    \9\ As of March 2012, FPS's total life cycle cost for MIST was 
estimated at $5 million.
---------------------------------------------------------------------------
   allow FPS's inspectors to review and document a facility's 
        security posture, current level of protection, and recommend 
        countermeasures;
   provide FPS's inspectors with a standardized way for 
        gathering and recording facility data; and
   allow FPS to compare a facility's existing countermeasures 
        against the Interagency Security Committee's (ISC) 
        countermeasure standards based on the ISC's predefined threats 
        to Federal facilities (e.g., blast-resistant windows for a 
        facility designed to counter the threat of an explosive device) 
        to create the facility's vulnerability report.\10\
---------------------------------------------------------------------------
    \10\ The ISC is comprised of representatives from more than 50 
Federal agencies and departments, establishes standards and best 
practices for Federal security professionals responsible for protecting 
non-military Federal facilities in the United States. FPS is a member 
agency of the Interagency Security Committee in the Department of 
Homeland Security, along with other Federal agencies such as the 
General Services Administration, the Federal Aviation Administration, 
the Environmental Protection Agency, and other components within the 
Department of Homeland Security. The ISC has defined 31 different 
threats to Federal facilities including vehicle-borne improvised 
explosive devices, workplace violence, and theft.
---------------------------------------------------------------------------
    According to FPS officials, MIST will provide several potential 
improvements over FPS's prior assessment tools, such as using a 
standard way of collecting facility information and allowing edits to 
GSA's facility data when FPS inspectors find it is inaccurate. In 
addition, according to FPS officials, after completing a MIST 
vulnerability assessment, inspectors will use additional threat 
information gathered outside of MIST by FPS's Threat Management 
Division as well as local crime statistics to identify any additional 
threats and generate a threat assessment report. FPS plans to provide 
the facility's threat and vulnerability reports along with any 
countermeasure recommendations to the Federal tenant agencies.
    In May 2012, FPS began training inspectors on MIST and how to use 
the threat information obtained outside MIST and expects to complete 
the training by the end of September 2012. According to FPS officials, 
inspectors will be able to use MIST once they have completed training 
and a supervisor has determined, based on professional judgment, that 
the inspector is capable of using MIST. At that time, an inspector will 
be able to use MIST to assess level I or II facilities.\11\ According 
to FPS officials, once these assessments are approved, FPS will 
subsequently determine which level III and IV facilities the inspector 
may assess with MIST.
---------------------------------------------------------------------------
    \11\ FPS uses the ISC's Facility Security Level Determination for 
Federal Facilities to determine the facility security level (FSL). The 
ISC recommends that level I and II facilities be assessed every 5 years 
and level III and IV facilities every 3 years. According to the ISC's 
criteria, a level I facility may be 10,000 or fewer square feet, have 
fewer than 100 employees, provide administrative or direct service 
activities, and have little to no public contact; a level II facility 
may be 100,000 or fewer square feet, have 250 or fewer employees, be 
readily identifiable as a Federal facility, and provide district or 
State-wide services; a level III facility may be 250,000 or fewer 
square feet, have 750 or fewer employees, be an agency's headquarters, 
and be located in an area of moderate crime; and a level IV facility 
may exceed 250,000 square feet, have more than 750 employees, house 
National leadership, and be located in or near a popular tourist 
destination.
---------------------------------------------------------------------------
FPS Increased Its Use of Project Management Best Practices in 
        Developing MIST
    Our preliminary analysis indicates that in developing MIST, FPS 
increased its use of GAO's project management best practices, including 
alternatives analysis, managing requirements, and conducting user 
acceptance testing.\12\ For example, FPS completed, although it did not 
document, an alternatives analysis prior to selecting MIST as an 
interim tool to replace RAMP. It appears that FPS also better managed 
MIST's requirements. Specifically, FPS's Director required that MIST be 
an FSA-exclusive tool and thus helped avoid changes in requirements 
that could have resulted in cost or schedule increases during 
development. In March 2012, FPS completed user acceptance testing of 
MIST with some inspectors and supervisors, as we recommended in 
2011.\13\ According to FPS officials, user feedback on MIST was 
positive from the user acceptance test, and MIST produced the necessary 
output for FPS's FSA process. However, FPS did not obtain GSA or 
Federal tenant agencies' input in developing MIST's requirements. 
Without this input, FPS's customers may not receive the information 
they need to make well-informed countermeasure decisions.
---------------------------------------------------------------------------
    \12\ GAO-11-705R.
    \13\ GAO-11-705R.
---------------------------------------------------------------------------
MIST Has Limitations as an Assessment Tool
    FPS has yet to decide what tool, if any, will replace MIST, which 
is intended to be an interim vulnerability assessment tool. According 
to FPS officials, the agency plans to use MIST for at least the next 18 
months. Consequently, until FPS decides what tool, if any, will replace 
MIST and RAMP, it will still not be able to assess risk at Federal 
facilities in a manner consistent with NIPP, as we previously 
mentioned. Our preliminary work suggests that MIST has several 
limitations:
   Assessing Consequence.--FPS did not design MIST to estimate 
        consequence, a critical component of a risk assessment. 
        Assessing consequence is important because it combines 
        vulnerability and threat information to evaluate the potential 
        effects of an adverse event on a Federal facility. Three of the 
        four risk assessment experts we spoke with generally agreed 
        that a tool that does not estimate consequences does not allow 
        an agency to fully assess the risks to a Federal facility. 
        However, FPS officials stated that incorporating consequence 
        information into an assessment tool is a complex task. FPS 
        officials stated that they did not include consequence 
        assessment in MIST's design because it would have required 
        additional time to develop, validate, and test MIST. As a 
        result, while FPS may be able to identify a facility's 
        vulnerabilities to different threats using MIST, without 
        consequence information, Federal tenant agencies may not be 
        able to make fully-informed decisions about how to allocate 
        resources to best protect Federal facilities. FPS officials do 
        not know if this capability can be developed in the future, but 
        they said that they are working with the ISC and DHS's Science 
        and Technology Directorate to explore the possibility.
   Comparing Risk Across Federal Facilities.--FPS did not 
        design MIST to present comparisons of risk assessment results 
        across Federal facilities. Consequently, FPS cannot take a 
        comprehensive approach to managing risk across its portfolio of 
        9,000 facilities to prioritize recommended countermeasures to 
        Federal tenant agencies. Instead, FPS takes a facility-by-
        facility approach to risk management where all facilities with 
        the same security level are assumed to have the same security 
        risk, regardless of their location.\14\ We reported in 2010 
        that FPS's approach to risk management provides limited 
        assurance that the most critical risks at Federal facilities 
        across the country are being prioritized and mitigated.\15\ FPS 
        recognized the importance of having such a comprehensive 
        approach to its FSA program when it developed RAMP and FPS 
        officials stated that they may develop this capability for the 
        next version of MIST.
---------------------------------------------------------------------------
    \14\ GAO-10-142.
    \15\ GAO, Homeland Security: Addressing Weaknesses with Facility 
Security Committees Would Enhance Protection of Federal Facilities, 
GAO-10-901 (Washington, DC: August 5, 2010).
---------------------------------------------------------------------------
   Measuring Performance.--FPS has not developed metrics to 
        measure MIST's performance, such as feedback surveys from 
        tenant agencies. Measuring performance allows organizations to 
        track progress toward their goals and, gives managers critical 
        information on which to base decisions for improving their 
        programs. This is a necessary component of effective 
        management, and should provide agency managers with timely, 
        action-oriented information.\16\ Without such metrics, FPS's 
        ability to improve MIST will be hampered. FPS officials stated 
        that they are planning to develop performance measures for 
        MIST, but did not give a time frame for when they will do so.
---------------------------------------------------------------------------
    \16\ GAO, Homeland Security: The Federal Protective Service Faces 
Several Challenges That Hamper its Ability to Protect Federal 
Facilities, GAO-08-683 (Washington, DC: June 11, 2008).
---------------------------------------------------------------------------
         fps faces challenges in overseeing its contract guards
    Our work to date indicates that FPS does not have a comprehensive 
and reliable system to oversee its approximately 12,500 contract 
guards. In addition to conducting FSAs, FPS developed RAMP as a 
comprehensive system to help oversee two aspects of its contract guard 
program: (1) Verifying that guards are trained and certified to be on 
post in Federal facilities; and (2) conducting and documenting guard 
post inspections.\17\ However, FPS experienced difficulty with RAMP 
because the contract guard training and certification information in 
RAMP was not reliable. Additionally, FPS faced challenges using RAMP to 
conduct and document post inspections.\18\ For example, FPS inspectors 
we interviewed reported they had difficulty connecting to RAMP's 
servers in remote areas and that recorded post inspections disappeared 
from RAMP's database without explanation. Although we reported some of 
these challenges in 2011, FPS did not stop using RAMP for guard 
oversight until June 2012 when the RAMP operations and maintenance 
contract was due to expire.
---------------------------------------------------------------------------
    \17\ A post is a guard's area of responsibility in a Federal 
facility.
    \18\ FPS's inspection requirement for level I and II facilities is 
two annual inspections of all posts, all shifts. The inspection 
requirement for level III facilities is biweekly inspections of two 
posts, any shift, and for level IV, weekly inspections of two posts, 
any shift.
---------------------------------------------------------------------------
    In the absence of RAMP, in June 2012, FPS decided to deploy an 
interim method to enable inspectors to record post inspections. FPS 
officials said this capability is separate from MIST, will not allow 
FPS to generate post inspection reports, and does not include a way for 
FPS inspectors to check guard training and certification data during a 
post inspection. FPS officials acknowledged that this method is not a 
comprehensive system for guard oversight. Consequently, it is now more 
difficult for FPS to verify that guards on post are trained and 
certified and that inspectors are conducting guard post inspections as 
required.
    Although FPS collects guard training and certification information 
from the companies that provide contract guards, it appears that FPS 
does not independently verify that information. FPS currently requires 
its guard contractors to maintain their own files containing guard 
training and certification information and began requiring them to 
submit a monthly report with this information to FPS's regions in July 
2011.\19\ To verify the guard companies' reports, FPS conducts monthly 
audits. As part of its monthly audit process, FPS's regional staff 
visits the contractor's office to select 10 percent of the contractor's 
guard files and check them against the reports guard companies send FPS 
each month. In addition, in October 2011, FPS undertook a month-long 
audit of every guard file to verify that guards had up-to-date training 
and certification information for its 110 contracts across its 11 
regions. FPS provided preliminary October 2011 data showing that 1,152 
(9 percent) of the 12,274 guard files FPS reviewed at that time were 
deficient, meaning that they were missing one or more of the required 
certification document(s). However, FPS does not have a final report on 
the results of the Nation-wide audit that includes an explanation of 
why the files were deficient and whether deficiencies were resolved.
---------------------------------------------------------------------------
    \19\ For example, guard training and certifications include 
firearms qualification, cardiopulmonary resuscitation, first aid, baton 
certification, and X-ray and magnetometer training.
---------------------------------------------------------------------------
    FPS's monthly audits of contractor data provide limited assurance 
that qualified guards are standing post, as FPS is verifying that the 
contractor-provided information matches the information in the 
contractor's files. We reported in 2010 that FPS's reliance on 
contractors to self-report guard training and certification information 
without a reliable tracking system of its own may have contributed to a 
situation in which a contractor allegedly falsified training 
information for its guards.\20\ In addition, officials at one FPS 
region told us they maintain a list of the files that have been audited 
previously to avoid reviewing the same files, but FPS has no way of 
ensuring that the same guard files are not repeatedly reviewed during 
the monthly audits, while others are never reviewed. In the place of 
RAMP, FPS plans to continue using its administrative audit process and 
the monthly contractor-provided information to verify that qualified 
contract guards are standing post in Federal facilities.
---------------------------------------------------------------------------
    \20\ GAO, Homeland Security: Federal Protective Service's Contract 
Guard Program Requires More Oversight and Reassessment of Use of 
Contract Guards, GAO-10-341 (Washington, DC: April 13, 2010).
---------------------------------------------------------------------------
    We plan to finalize our analysis and report to the Chairman in 
August 2012, including recommendations. We discussed the information in 
this statement with FPS and incorporated technical comments as 
appropriate. Chairman Lungren, Ranking Member Clarke, and Members of 
the subcommittee, this completes my prepared statement. I would be 
happy to respond to any questions you may have at this time.

    Mr. Lungren. Thank you very much, Mr. Goldstein.
    The Chairman now recognizes Dr. Peerenboom to testify.

  STATEMENT OF JAMES P. PEERENBOOM, DIRECTOR, INFRASTRUCTURE 
ASSURANCE CENTER, ASSOCIATE DIRECTOR, DECISION AND INFORMATION 
         SCIENCES DIVISION, ARGONNE NATIONAL LABORATORY

    Mr. Peerenboom. Good morning. Thank you, Chairman Lungren, 
Representative Clarke, and the Members of the subcommittee for 
your invitation to testify here today.
    In early October 2011 the Federal Protective Service 
engaged Argonne by funding the development of a software 
application called a Modified Infrastructure Survey Tool, or 
MIST, to be used by FPS on an interim basis to conduct facility 
security assessments. MIST uses a tailored set of questions 
that helps FPS establish a security baseline and allows for 
comparisons of facilities being surveyed against security 
standards. The MIST provides a standardized way of collecting 
and reporting facility information to inform decisions about 
security measures.
    Argonne's work involved five tasks: Working with FPS to 
develop the MIST methodology; implementing the methodology as a 
release called MIST Release 1.0; developing a host site for 
MIST Release, called the FPS Gateway; assisting FPS, as 
requested, in training functions; and finally, providing help 
desk support to MIST operation.
    By working closely with FPS inspectors, contract management 
staff, and leadership throughout the period of performance 
Argonne was able to meet all the defined requirements in the 
statement of work. MIST Release 1.0 and the FPS Gateway were 
delivered to FPS on March 30, 2012, 6 months after the program 
began. The products were delivered on time and within the 
defined budget.
    Argonne greatly appreciates the opportunity to work with 
FPS in a collaborative manner to develop the MIST as a useful 
and usable interim tool for FPS personnel. Knowledgeable FPS 
leadership and staff were actively involved in all tasks and 
feedback was provided by FPS personnel in a timely manner to 
guide development activities. In addition, regular meetings 
were held with FPS director, Director Patterson, and his staff 
to review schedules and deliverables and to ensure that any 
problems encountered were identified and quickly resolved.
    Finally, Argonne also wishes to thank the DHS Office of 
Infrastructure Protection, part of NPPD, their Protective 
Security Coordination Division in particular, for their 
collaboration with FPS, willingness to share methodologies, 
technology, and experience.
    I appreciate this opportunity to summarize the MIST 
development activities at Argonne and I look forward to your 
questions. Thank you.
    [The prepared statement of Mr. Peerenboom follows:]
               Prepared Statement of James P. Peerenboom
                             July 24, 2012
    Thank you Chairman Lungren, Representative Clarke, and the 
distinguished Members of the subcommittee for your invitation to 
testify here today.
    My name is James Peerenboom, and I am the Director of the 
Infrastructure Assurance Center and the Associate Director of the 
Decision and Information Sciences Division at Argonne National 
Laboratory. Argonne is located just outside of Chicago and is one of 
the U.S. Department of Energy's largest National laboratories for 
scientific and engineering research. Argonne has been providing 
technical support to the U.S. Department of Homeland Security (DHS) 
since the Department was established in March 2003.
                               background
    In late March 2011, the Federal Protective Service (FPS) requested 
a meeting with Argonne to discuss the potential for leveraging 
technical work that had been underway at the laboratory since 2007. The 
work that FPS was seeking to leverage was funded by the DHS National 
Protection and Programs Directorate's Office of Infrastructure 
Protection (NPPD/IP). Specifically, FPS was interested in exploring the 
option to modify an existing survey tool that Argonne had developed for 
NPPD/IP called the Infrastructure Survey Tool (IST). This security 
survey has been successfully deployed and used by DHS and its 
Protective Security Advisors (PSAs) to identify security measures at 
various critical infrastructure assets across the Nation. Argonne first 
met with FPS representatives in April 2011 to demonstrate IST 
functionality; discuss the purpose, scope, and limitations of the tool; 
and discuss FPS assessment needs. A series of subsequent discussions 
and meetings with FPS took place from April through September 2011.
                           description of ist
    The IST is a survey tool that employs a tailored set of questions 
to identify for infrastructure owners and operators some of the 
potential security weaknesses at a given facility, establish an index 
value of protective measures at the facility, and provide comparisons 
with similar facilities. It is not a vulnerability or risk assessment 
tool. Rather, as a survey tool, the IST provides a consistent, 
transparent, and integrated assessment of a facility's current security 
posture. It was designed for application to many types of critical 
infrastructure assets--from refineries, railroad lines, and power 
plants to financial centers--to enable owners and operators to see how 
the security measures at their facilities stack up against those at 
facilities like theirs. While the IST is not intended to compare a 
facility's security to specific standards, it does provide a 
comparative measure to similar facilities.
    The DHS customers for IST survey data are infrastructure owners and 
operators. The survey data, presented in an interactive dashboard, 
allows them to visualize how certain security-related changes, such as 
adding security cameras or installing fencing, alters the protective 
measures index value and may contribute to improved security. On the 
basis of feedback from the PSA community, the interactive dashboard in 
use by NPPD/IP has been well received by infrastructure owners and 
operators. In addition to providing insight and valuable feedback to 
owners and operators, the IST data are also used by DHS to benchmark 
security measures, identify protective measure gaps, and develop 
infrastructure protection strategies.
                             fps work scope
    In early October 2011, FPS engaged Argonne by funding the 
development of a software application, called the Modified 
Infrastructure Survey Tool (MIST), to be used by FPS on an interim 
basis to conduct facility security assessments. As the name implies, 
the MIST is a modification of the existing IST developed by Argonne and 
deployed by NPPD/IP. The MIST uses a tailored set of questions that 
helps FPS establish a security baseline and allows for comparison of 
the facility being surveyed against security standards. MIST's 
methodology involves the gathering of data via an assessment question 
set, processing the data through an algorithm to convert the data to 
vulnerability measures, and the generation of outputs such as a report 
of those measures. Although the MIST was not designed to be an 
Interagency Security Committee (ISC)-compliant tool, it adheres to the 
ISC process and guidance as much as possible and captures elements of 
ISC standards. The MIST provides a standardized way of collecting and 
reporting facility information to inform decisions about security 
measures.
    Argonne's work was funded through an existing Interagency Agreement 
(IAA) with NPPD/IP that encompassed IST-related tasks. Funds were 
committed under the IAA to develop, test, deliver, and support MIST 
Release 1.0. More than half of the funds were used for hardware and 
software to establish a web portal, called the FPS Gateway, that allows 
for sharing of information products and knowledge in real time. The FPS 
Gateway leverages the architecture and hardware/software technology of 
the Linking Encrypted Network System (LENS), a similar portal that 
Argonne developed for NPPD/IP.
    Argonne's statement of work under the IAA with FPS included five 
tasks, all of which involved leveraging the experience, expertise, and 
technology used in developing the IST:
   Working with FPS to develop the MIST methodology;
   Implementing the methodology as MIST Release 1.0 (software 
        development);
   Developing a host site for MIST Release 1.0 (i.e., the FPS 
        Gateway);
   Assisting FPS, as requested, in training functions; and
   Providing ``help desk'' support for MIST operation.
                            project results
    By working closely with FPS inspectors, contract management staff, 
and leadership throughout the period of performance, Argonne was able 
to meet all defined requirements in the statement of work. MIST Release 
1.0 and the FPS Gateway were delivered to FPS on March 30, 2012. The 
products were delivered on time and within the defined budget. Argonne 
continues to provide help desk support to FPS. Feedback from FPS about 
the MIST as an interim survey tool has been very positive.
                            acknowledgments
    Argonne appreciates the opportunity to work with FPS in a 
collaborative manner to develop the MIST as a useful and usable interim 
tool for FPS personnel. Knowledgeable FPS leadership and staff were 
actively engaged in all tasks, and feedback was provided by FPS 
personnel in a timely manner to guide development. In addition, regular 
meetings with the FPS Director also were held to review schedules and 
deliverables and to ensure that any problems encountered were 
identified and quickly resolved. Argonne also wishes to thank the NPPD/
IP Protective Security Coordination Division staff for their 
collaboration with FPS, willingness to explain and share methodologies 
and technology, and thorough IAA oversight.

    Mr. Lungren. Thank you very much.
    I think we may have set a record for brevity of the three 
panelists, and we appreciate that. I am sure all my colleagues 
have questions. We will start of round of questioning, and I 
will start with the first 5 minutes.
    General Patterson, in your previous jobs, precision, 
accuracy, attention to detail has been extremely important. We 
have had concerns prior to the time you got there with the lack 
of those things in some of the functions that you are supposed 
to--that your operation is supposed to carry out.
    Last July when you testified you indicated your, I think, 
frustration at where FPS was at that time. So how would you 
assess FPS's progress to address deficiencies in the ability to 
conduct facility security assessments and conduct oversight and 
training of the contract guard program?
    As I am sure you heard Mr. Goldstein, you have seen the 
testimony that he gave. There seems to be some concern that he 
expresses there. How would you judge where you are versus where 
you think you need to be and where you want to be in those 
areas?
    General Patterson. Thank you, sir.
    Well, to begin, we are at the beginning. RAMP unfortunately 
did not produce results that the agency had hoped that it 
would. So after careful review, as you are aware, I made the 
decision that we were no longer going to follow that path and 
develop a new path.
    I spent quite a bit of time with our sister activity 
component within Homeland Security, I.P., to talk about how 
they look at threats, how they look at vulnerability within the 
private and commercial sector, and how we could leverage what 
they do and bring that about as quickly as we can to look how 
we might do that in the Federal sector.
    Once I was able to look across the--at what they were doing 
and some of the things that some of our other partners might--
were doing at the time, because we also looked at systems 
within S&T, and I think GSA also had a system that we were 
evaluating. But at the time I believe that I.P. offered us the 
best product, if you will, for us to move forward. That was 
when I was introduced to Argonne Labs and the work that they 
were doing for I.P. to support I.P.
    I spent quite a bit of time with I.P. and Argonne Labs to 
assess whether or not that would be the right direction for us. 
In fact, that was the right--I believe that it is the right 
direction for us.
    Now, to get to the point of our folks within the GAO 
assessment, it is correct that our MIST tool does not look at 
consequence. However, what we do is we look at vulnerability 
and we look at threat. We do that in a couple of ways.
    In the vulnerability, we collect a lot of data to assess 
and to determine how vulnerable these--our facilities are to 
the threats that are being posed by--in a number of areas, 
whether it be natural disaster, whether it be criminal threat, 
or whether it be from the threat of terrorism.
    I have also developed a very robust activity within FPS 
that looks at the threat picture every day. We have folks who 
are working with the ODNI, the Office of Director of National 
Intelligence, who are working with I&A at DHS, who are working 
with the FBI. I have several folks across the country who are 
working at the JTTFs as well as the fusion centers across the 
country to help us better understand the threat picture as we 
move forward pulling vulnerability and threat together.
    Relative to the consequence piece, each one of the Federal 
agencies has a--what we call a COOP plan. It is a plan as to 
when there is a problem--a disaster or something the must 
respond to--how they will reorganize, how they will 
reconstitute once that event has happened. They also have 
something called an occupational emergency plan that we work 
with them--that they can leverage, and that plan is developed 
when an agency is either--when they have stood up--or when they 
occupy a facility, or as we go in to perform our assessments.
    So we have what we believe to be a fairly robust scenario, 
if you will, of bringing vulnerability, threat, and 
consequences together not necessarily in a single document, but 
in a process, in a plan. So when an assessment is done my MIST 
tool brings me the vulnerability piece; my intelligence folks--
my RIAs, is what we call them, regional intelligence folks, 
bring forth the threat piece, and combine that with the COOP 
plan and the emergency occupant plan to, I think, to bring 
together a fairly robust product and assessment of 
vulnerabilities and threats to our Federal facilities.
    Mr. Lungren. Mr. Goldstein, would you have any comments on 
that?
    Mr. Goldstein. Thank you, Mr. Chairman.
    You know, we were very pleased that FPS has made progress. 
Don't get me wrong, we feel that they have made some progress. 
The development of MIST is certainly a way forward out of the 
past, whether it was from the original tools of FSRS, or 
whether it was through the more recent tools, where they use an 
Excel spreadsheet and then they had the whole RAMP program. 
This is a way forward, and we do believe that by finally having 
a program the inspectors can use where they are not 
subjectively determining vulnerability on their own is 
important. We discussed it in our report.
    But we do think that being able to include consequence 
information, as the National infrastructure program requires, 
is really important. In my opinion----
    Mr. Lungren. Mr. Patterson suggests that COOP, I believe it 
is, or these other elements that their clients have fulfills 
that role. You have a disagreement with that?
    Mr. Goldstein. What I would tell you is I think that you 
can't have a robust program without consequence information 
because what you are doing is essentially telling people that 
you have set the dinner table without telling them what the 
food is going to be----
    Mr. Lungren. No, I understand. I mean, I have always looked 
at risk, you know, that simple equation of threat, 
vulnerability, and consequence. What I was trying to get at is 
Mr. Patterson has suggested, or stated, that he believes that 
you reach that with this other component of information that he 
receives from what I refer to as the clients--you might use 
another term. Is that something you would still quarrel with at 
this point?
    Mr. Goldstein. I don't think it provides agencies and their 
clients the kind of information they need to make robust 
decisions about which countermeasures they are going to adopt 
and which they aren't, which have more priority than others.
    Mr. Lungren. Okay.
    Ms. Clarke.
    Ms. Clarke. Thank you, Mr. Chairman.
    Director Patterson, FPS chose to modify the current Office 
of Infrastructure Protection's infrastructure survey tool for 
its new interim risk assessment tool. What other tools did FPS 
consider and why weren't they selected?
    General Patterson. Yes, ma'am. I don't have the specific 
names of the other tools but there were a couple other tools. I 
know one specifically that was being developed by the Office of 
Science and Technology. The challenge with that particular tool 
was that it was still in the development phase and it was being 
beta tested.
    One of the challenges that I believe that we were going to 
have was that we were not involved in setting the requirements 
for the tool. So therefore, we would had to have started from 
the very beginning to figure out, you know, whether or not our 
requirements were going to be met, and then if they weren't, 
how we were going to incorporate that.
    I felt that I needed to deliver something. We had spent 
time, a bit of time, on RAMP. I felt that we needed to do, to 
move forth quickly to try to do something to ensure that we 
were providing our customers, our clients, an assessment 
product--okay, not just an assessment, but an assessment 
product--and I thought MIST would be the best way to do that.
    Ms. Clarke. How does FPS plan to address the limitations 
that GAO identified for MIST?
    General Patterson. Yes, ma'am. For me, this is about being 
a marathon and not a sprint. We are going to work aggressively 
with the ISC, the Interagency Security Committee, to look at 
how we productively and efficiently and effectively incorporate 
all those things that the GAO has recommended and we agree that 
should be considered to be in the tool.
    Part of the challenge that we have is that we need to look 
at this very, if you will, judiciously. When we evaluate or 
assess a facility sometimes there are 10 tenants in that 
facility, okay, so we have to be--we have to ensure that when 
we produce a report that the consequence piece of that, if you 
will, is going to have relevance to all of the folks in that 
particular facility.
    So I am not exactly sure that trying to put a consequence 
piece into every assessment is the right avenue. So we are 
going to work with the ISC to see how we might develop that and 
work forward and move in that direction.
    Ms. Clarke. How was the decision made to award Argonne 
National Laboratory the contract to develop MIST? Were there 
other entities considered as well?
    General Patterson. Yes. We were required to--the 
acquisition process required us to consider other avenues for 
that, and they were--the decision was to go with Argonne.
    Ms. Clarke. Okay.
    Mr. Goldstein, when do you estimate that FPS will have a 
more robust guard oversight tool in place that can track guard 
certification information and offer FPS management with greater 
insight as to whether all of the post inspections that need to 
be conducted are, in fact, occurring?
    Mr. Goldstein. I would judicially say that that is a work 
in progress. I think the Federal Protective Service has 
recognized that there are some vulnerabilities in their 
process.
    They recently stopped, as of June 2012, any use of RAMP for 
that process; it was the last part of RAMP that was being used 
and they notified offices not to be using that anymore. Much of 
the information in that system had never been revalidated from 
the old cert system so there were many problems with it.
    I think it is going to take some time. We have some on-
going work for this committee, taking a look at guard programs, 
and this will be something that we evaluate how others do it 
and try to bring some of that information back to you and to 
FPS to help them as they go forward. It is not a short-term 
project.
    Ms. Clarke. So would you say--yes, I mean, I recognize 
that. But would you say they are just at the advent of----
    Mr. Goldstein. I think they are at the beginning of trying 
to determine what they need and how to independently verify 
certification as well as post inspection, yes, ma'am.
    Ms. Clarke. Okay. How does FPS now track the implementation 
of security countermeasures that are recommended for inclusion 
in the facility security assessments?
    General Patterson. I am sorry, ma'am. Can you repeat that, 
please?
    Ms. Clarke. Yes, sure. How does FPS now track the 
implementation of security countermeasures that are recommended 
for inclusion in the facility security assessments?
    General Patterson. Yes, ma'am. Currently we don't have a 
tracking tool. It is all done manually, if you will, paper. As 
our inspectors go out and interface with the committees, the 
security committees, the facility security committees to 
discuss--or the agencies to discuss what countermeasures might 
be necessary or what--that we might recommend, at that point we 
work with the FSCs to implement those requirements and it is 
documented, but it is documented on paper at this point because 
don't have a digital system, if you will, to account for that.
    Ms. Clarke. Thank you, Mr. Chairman. I yield back.
    Mr. Lungren. Gentlelady yields back.
    Mr. Walberg is recognized for 5 minutes.
    Mr. Walberg. Thank you, Mr. Chairman.
    Thanks to the panel for being here.
    Mr. Goldstein, you have noted that MIST, as an interim 
tool, falls short of providing FPS the ability to do many of 
the things that RAMP was intended to provide. You also noted 
that MIST is neither compliant with DHS's own National 
infrastructure protection plan and the framework that it has 
nor standards developed by the Interagency Security Committee.
    So the question I would initially ask is, why are these 
standards so important?
    Mr. Goldstein. I think the standards are important 
principally because they will create a baseline, but they will 
also allow that baseline to be examined across the host of the 
Government's portfolio. FPS does not have the ability today to 
look at the portfolio of Government properties that it 
protects--some 9,000 GSA buildings--and to determine at various 
levels which of those facilities require the most resources.
    They protect everyone, everything essentially at each level 
in the same way, regardless of where it is and what its 
function is. So therefore we have a very static approach, 
building by building, to protecting our Federal infrastructure 
when resources are obviously very tight, and you can't leverage 
the resources and priorities effectively that way.
    Mr. Walberg. I mean, that being the suggestion then, I 
guess, Mr. Patterson, does FPS believe ISC or NIPP standards 
are important criteria to meet?
    General Patterson. Oh, absolutely, sir. They are important. 
We are baselining those criteria.
    The challenge that we have is right now, is developing, if 
you will, a tool that will bring all that into play----
    Mr. Walberg. But the present tool isn't compliant with any 
of those standards, is it?
    General Patterson. It is not ISC-compliant because it does 
not take into consideration the consequence piece of the 
assessment, okay? However, the tool isn't compliant but our 
process is compliant, okay, and the process----
    Mr. Walberg. Explain that a little further.
    General Patterson. Yes, sir. I will. The tool is no more 
than a product that we provide to our customer. It is a 
snapshot in time of what we believe to be the vulnerability, 
the threat, and in this case, the consequence at a particular 
facility, okay? We discuss each one of those elements at the 
out-brief when we have completed an assessment.
    All right, now, that MIST tool--that MIST product--will not 
cover all three, but that doesn't mean that we haven't covered 
that with our customers, all right? So what we are trying to do 
is we are trying to work with the ISC to develop a product, a 
tool, a product that we can deliver at the end of the day, at 
the end of the assessment that allows them to capture all of 
that into one document. We can't do that today.
    Mr. Walberg. What is the time period you are expecting this 
tool to be developed and then fully implemented?
    General Patterson. In my discussions with the ISC, to their 
knowledge there is no one out there today that has a tool that 
will do that, that has been proven to do that. I understand 
that there might be a few folks out there who think they may 
have a tool to do that, but no one at this point has 
demonstrated that they have an effective tool that brings into 
play vulnerability, threat, and consequence into one document, 
or into a process that will bring all that together and you can 
provide that to our clients.
    So we are working aggressively with GSA, with the ISC, and 
others to look at how we might do that and how the community--
how we can work together with the community to make that 
happen.
    Mr. Walberg. Mr. Goldstein, would you concur with that, 
that there is not a tool capable at this time, or----
    Mr. Goldstein. We haven't looked at that specifically, sir. 
We are doing some work for this committee--just beginning that 
work--taking a look at assessment tools across the Federal 
Government and out in the broader community, and we will 
hopefully be able to report back on that on the near future.
    Mr. Walberg. Okay.
    Mr. Patterson, I understand that MIST was developed as an 
interim tool to replace RAMP. What is FPS's long-term plan to 
replace RAMP and what is the time line for that implementation?
    General Patterson. Yes, sir. The long-term plan is to 
create a tool that is ISC-compliant. I currently don't have a--
I don't have a time line for that.
    Again, we are going to--we are actively working with the 
ISC and collaborating with the ISC. We are actively 
collaborating with GSA to begin to look at how we will do that: 
What is the next step? Because we want to build upon what we 
have at MIST, what we have created with MIST, so that we are 
not recreating every time we decide to develop a new tool or a 
new process. We don't want to recreate that every time.
    So the bottom line is is that we are going to work with the 
ISC and the community to look at how we move forward. I wish I 
could give you a better answer but I don't have a better answer 
at this point until we can collaboratively come together and 
begin to figure out the path forward.
    Mr. Walberg. Well, I see my time has expired.
    Mr. Lungren. Mr. Richmond----
    Mr. Walberg. Thank you, Mr. Chairman.
    Mr. Lungren [continuing]. Is recognized for 5 minutes.
    Mr. Richmond. Mr. Patterson, I guess I need you to make a 
connection for me and monitor the conversation with my 
colleague, and you said that MIST, or whatever you are using 
now, the program does not have consequence in it but your 
process has consequence in it. Did I hear that right?
    General Patterson. Yes.
    Mr. Richmond. I guess I am falling short that if the 
process has consequence in it why can't we develop a tool that 
puts vulnerability, threat, and consequence into one thing? I 
guess I am lost on that. Can you----
    General Patterson. Sure.
    Mr. Richmond. Can you help me on that?
    General Patterson. I am not debating that we can. I am just 
saying that I haven't found a way to do that today.
    My work to this point--our research to this point--has 
taken us through vulnerability and threat, but incorporating 
the consequence piece, as we would have it within the Federal 
sector, is very different than you incorporate consequence 
necessarily into the private sector. So what we are trying to 
do is when we do that we want to make sure that we develop a 
tool that is usable, that has got credibility, and we just 
haven't reached that point yet.
    So when I talk about the consequence piece in the process, 
the process is is that when we sit down and talk with our 
customers and with our clients we talk about their ability to 
reconstitute, their ability to perform if there is an event, 
okay, and there are certain things that they have already done.
    For instance, IRS has a COOP plan. If there is an IRS--if 
there is an event--for instance, the airplane that flew into 
the IRS facility in Austin, Texas a few years ago, well the IRS 
had a way to reconstitute. They knew exactly what they needed 
to do in order to move those functions from that facility to 
another facility, okay?
    So for them it wasn't about us bringing something to them, 
all right? They knew exactly what they wanted to do. They had a 
plan. They have a plan.
    Most Federal agencies have a plan if there is a problem, if 
there is an event that happens that takes them away from their 
facility.
    Mr. Richmond. You said most of them do. Do----
    General Patterson. That is an assumption. I would hope all 
do.
    Mr. Richmond. Okay. I guess that was going to be my next 
question: Do we have a good take on who has and who does not 
have----
    General Patterson. No. We work with every agency--every 
facility, every agency that we do an assessment, we work with 
them on what they call the occupant emergency plan, and that is 
a plan to do just what we are talking about. If there is a 
problem--if it is a natural disaster, if it is a criminal event 
or a terrorism event, what will you do? We go through a myriad 
of scenarios with them as to what they would do. Through every 
assessment we work with every tenant in the facility on that 
plan.
    Mr. Richmond. I remember from the last hearing we talked 
about that there was the inability, or we were not in a 
position to verify the--that the guards that were on post were 
trained and certified. Have we developed something to better 
assess whether they are trained, certified, and present on 
our--in our Federal buildings?
    General Patterson. Yes. What we are doing now--we don't--
clearly we need a better process. Right now it is a pen-and-
paper process for us.
    We were hoping--the agency was hoping that RAMP was going 
to resolve this or help us get a little closer to a better 
solution. When that didn't evolve, when that didn't work, what 
I had directed all of my regions to do is revert back to a 
paper process, if you will, working with--as our PSOs are 
brought on for their time to do work, or when a client--not a 
client, but when our contractors, if you will, when they hire a 
PSO to work there is a package of certifications that each of 
our PSOs must have. That package--those certifications are 
maintained by the contractor.
    However, that information that is contained in those 
certification packages are then forwarded--is then forwarded to 
every one of my regions. So we have on file in our regions, if 
you will, that information.
    Now, the challenge is how often we can get through there 
and continue to recertify that their certifications are up-to-
date. We have 13 certifications in those files that must be 
certified every year, or recertified every year. So it is a 
huge administrative task for us to go through that and we are 
looking for ways that we can digitize that, we can use 
technology to help us with that; we are just not there yet.
    Mr. Richmond. I see that my time has expired so I yield 
back. Thank you, Mr. Chairman.
    Mr. Lungren. Thank you.
    We might have time for a quick second round if anybody is 
interested.
    Let me just recognized myself in the first instance, and 
that is, Mr. Goldstein, you heard Mr. Patterson's response to 
the question about consequence. Here is my concern--I will have 
Mr. Patterson answer after I ask your thoughts--when Mr. 
Patterson described it he talked about some of the clients, 
such as IRS, having an ability to reconstitute themselves. That 
is what they have. That is their part of this consequence.
    But I thought this tool that we were trying to develop, or 
tools, to do threat assessment was for the purpose of 
establishing, by FPS, what the levels of security would be so 
that you would have them more in line with what the overall 
risk assessment was. In that regard, a consequence piece would 
help Mr. Patterson and his organization decide the level of 
security as opposed to, as you suggested, I thought, in your 
testimony, that it is kind of an across-the-board, everybody is 
treated the same.
    Am I correct in what you said and the reason why the lack 
of consequence would affect their ability to make those 
decisions?
    Mr. Goldstein. Yes, sir. Mr. Patterson's discussion of COOP 
is an important element of, obviously, responding to any 
disaster or any attack but it isn't directly related, I would 
submit, to what we are talking about, in that the need to have 
consequence information as part of this program, which he 
agrees they will eventually develop and we are simply bringing 
that point out, is so that agencies working with the Federal 
Protective Service will have guidance on how to prioritize 
protecting facilities themselves over a period of time.
    Mr. Lungren. Mr. Patterson, that is what I have found is a 
disconnect in what you are saying. I understand--I am happy 
that IRS knew how to reconstitute itself, but in terms of your 
assessment of your operation's ability to manage your resources 
in tough budget times, to decide where you need to put your 
emphasis, where you need to have more, where you need to have 
less, that that assessment tool or tools are to allow you to do 
that as opposed to you determining exactly what IRS ought to do 
at this place or one of your other clients.
    General Patterson. Yes, sir. Again, it is--from our 
perspective it is a huge challenge as to how we incorporate 
consequence into any tool.
    For instance, as I stated before, every facility is 
different. Some facilities, they are just stand-alone agencies; 
and other facilities, much like the Reagan Building, there 
might be literally 10 to 20 different agencies with different 
requirements--having different requirements, and having much 
more, if you will, at risk than some of the other agencies in 
there.
    So as we look across the spectrum of facilities that we 
have to assess what I am trying to get away from is a one-size-
fits-all kind of a tool.
    Mr. Lungren. I don't want you to do that. That is why I am 
trying to figure out----
    General Patterson. Yes, sir.
    Mr. Lungren [continuing]. Why consequence couldn't be 
incorporated into the tool that you use, or you have some 
integration at some point in time of two tools so that you have 
those three things together in making your risk assessment to 
aid you in a determination of the level of security and the 
prioritizing of your resources. That is all I am trying to 
figure out.
    General Patterson. Yes, sir. Again, it is our intent to 
incorporate consequence; we are just trying to figure out, how 
do we do that?
    Mr. Lungren. Okay. Ms. Clarke.
    Ms. Clarke. Thank you, Mr. Chairman.
    This question is for Director Patterson and Mr. Goldstein: 
How does FPS track the effectiveness and performance of the 
security countermeasures that it has recommended? How do you 
actually----
    General Patterson. We have our inspectors who visit our 
sites routinely, who visit Federal facilities routinely to 
assess the effectiveness of our PSOs. When we do post 
inspections that is an assessment of our contract guard force.
    We also visit our camera facilities to look at whether or 
not they are operating, and when they are not to look, and 
working with the FSC to get them repaired. So this is on an on-
going and continual basis, looking at all of our 
countermeasures on a routine basis to ensure that they are 
operating efficiently and effectively.
    Ms. Clarke. Would you say it is a cyclical type of regimen 
that your inspectors are engaged in? Because I would imagine 
when you look at various facilities the landscape around those 
facilities may change from time to time with infrastructure 
changes, with----
    General Patterson. Right. I mean, you know, we can--we--
from time to time we will have different tenants who move in 
who have different requirements, or they, like, as you just 
stated, ma'am, where there are facilities that may come up next 
to or where we have to assess whether or not--what that impact 
might be on a bus station, let's say, moving in next to one of 
our facilities. So absolutely.
    But that is a continuing process for us. We don't wait for 
the assessment period to do that. If, in fact, we know that the 
city is building--has new construction going up to one of our 
GSA facilities we engage immediately with GSA and the tenant to 
find out what--and the city--to find out what is going up and 
what the impact might be, and what we may need to do to answer 
the--to see if there is going to be an additional security 
standard that we may have to set out as a result of that.
    Ms. Clarke. Is there, baked into the MIST system, a way of 
keeping track of that information?
    General Patterson. I am sorry. Let me--is there going to be 
a way----
    Ms. Clarke. Yes, of, you know--over time you are going to 
maybe have overlays----
    General Patterson. Yes. Yes. Our MIST system, yes, as MIST 
is rolled out and as we are incorporating all that information, 
yes, ma'am, that all will be digitized into MIST so we can go 
back immediately and determine, you know, what systems are 
there and then how we need to correct, or adjust, or whatever 
we need to do to those systems, yes.
    Ms. Clarke. Dr. Peerenboom, what capabilities, if any, 
would a more permanent tool have over FPS's interim MIST tool?
    Mr. Peerenboom. Well, as stated by Director Patterson and 
Mr. Goldstein, MIST is not a risk tool. It focuses on 
vulnerabilities. But it was based on work done for the Office 
of Infrastructure Protection at DHS, the infrastructure survey 
tool. That provides a platform or basis by which one could 
expand.
    In fact, within I.P. they are looking at single assessment 
methodologies to pull together tools and capabilities that 
address risk in a holistic fashion to inform decisions about 
security investments. The customers of Office of Infrastructure 
Protection are slightly different; they are the owners and 
operators. The IST tool that we developed and modified for FPS 
is applicable to all 18 critical infrastructures, so it has a 
broader base.
    But the subset of questions and things that apply to 
Federal facilities is what was done for MIST.
    Ms. Clarke. What makes these capabilities necessary?
    Mr. Peerenboom. The Office of Infrastructure Protection has 
a mission to provide protection and risk analysis for critical 
infrastructure, and so their sets of tools are designed to 
encompass that broad spectrum. The IST that we developed MIST 
from addresses part of the equation, and there are efforts 
underway to expand that base within Office of Infrastructure 
Protection. It provides a point of leverage for FPS should they 
decide to use that.
    Ms. Clarke. So when the risk or the vulnerabilities seem to 
be evolving, how do--how effective is the MIST tool, in terms 
of indicating for FPS what new measures need to be taken? Is it 
dynamic, in other words?
    Mr. Peerenboom. Well, that is really--I should let Director 
Patterson speak to that issue, but MIST provides a basis for 
looking at the vulnerabilities to the facility and the 
inspectors can add in their recommendations and their 
understanding of the consequences of protective measures that 
would--not consequences, excuse me--the countermeasures that 
would be applicable to that facility.
    The MIST tool is partly compliant with the ISC standards 
but it is not an ISC-compliant tool. But we certainly took that 
into account, and over time, should FPS decide to do that, 
technically it is possible to address those standards.
    Ms. Clarke. All right. Thank you.
    Mr. Lungren. Mr. Walberg.
    Mr. Walberg. Thank you, Mr. Chairman.
    Drilling down in the same board again, Mr. Peerenboom, can 
MIST be developed to capture consequence? Is it capable?
    Mr. Peerenboom. Technically the answer is yes.
    Mr. Walberg. Go a little further on why you would say 
technically the answer is yes.
    Mr. Peerenboom. Well, there are capabilities, as I 
indicated earlier, that are being developed within the Office 
of Infrastructure Protection, to enhance the capabilities of 
the infrastructure survey tool that provides the basis that 
MIST was developed on, and we have the capabilities to 
incorporate elements of consequence, but that is a decision 
that obviously is not ours. But technically it is feasible.
    Mr. Walberg. It is feasible, but would you say it is not 
the best tool?
    Mr. Peerenboom. It depends on requirements. No, I didn't 
say that.
    Mr. Walberg. Okay. Okay. Thank you.
    Mr. Patterson, I would applaud you and commend you for 
putting an emphasis on training in your tenure at FPS, and I 
agree that training is a key for your force's morale and 
effectiveness in the process.
    Last summer you stated that you were looking at different 
ways FPS may be able to deliver X-ray and magnetometer and 
weapons training. I understand there has been significant 
dialogue and outreach between FPS and the private sector, which 
may be able to better deliver the training.
    Could you enlighten us at this point in time on the on-
going dialogue with industry to improve guard training?
    General Patterson. Yes, sir. Well, first of all, one of the 
things that I needed to do was hire a senior deputy director 
for training to--who could focus in on this full-time and not 
be a part-time duty. So I have done that. So now I have someone 
who is looking across the board at all the training within FPS 
full-time.
    Now, as we look at training for our PSO force, we are 
actively working with NASCO, the National Association of 
Security Companies, to work with them and look at how we can 
proliferate training across 13,000 PSOs that support FPS and 
all of our Federal partners. It is a huge task, because when 
you are talking about providing services in 50 States that all 
have different, if you will, training requirements, okay, we 
have to ensure that we are doing it in such a way that we are 
getting the best bang for our buck.
    One of the things in the National Weapons Detection 
Program, in magnetometers and X-ray machines, that I knew that 
we needed to do was to ensure that our inspectors were 
adequately trained, and we have done that--we are doing it. We 
are just about completed all of our training for our inspectors 
for the magnetometers and X-ray machines----
    Mr. Walberg. The additional 8 hours of training that you 
were----
    General Patterson. Yes.
    Mr. Walberg [continuing]. Proposing?
    General Patterson. That is going to be cascaded by our 
inspectors, by a team of our inspectors to the--to our PSO 
force. Working with the--kind of in a deal where we do kind-of 
a trained-to-trainer kind-of a thing as well so that we can 
also work with our--within the contractor force, within the 
contractor structure to, in such, certify our contractors so 
that they can provide some of the training, as well.
    Mr. Walberg. You feel that FPS is capable of delivering 
consistent training across, as you say, the 50 States and the 
uniqueness of each of those?
    General Patterson. Yes, sir. Absolutely.
    Mr. Walberg. Mr. Goldstein, would you concur with that?
    Mr. Goldstein. We remain concerned, sir, because the 
problem that brought on the need for the additional training is 
now more than 3 years old when GAO was able to bring bomb-
making materials into 10 Federal facilities without anyone 
knowing and building those bombs. It has been 3 years, and the 
contract guards who are there to prevent things like that from 
happening haven't had that additional training in all of that 
time.
    I understand that the agency is resource-constrained, but 
it would seem to me that this would have been a matter of the 
highest priority, sir.
    Mr. Walberg. Within 3 years?
    Mr. Goldstein. Yes, sir.
    Mr. Walberg. Thank you.
    Mr. Lungren. Thank you very much.
    I thank all the Members for their participation.
    I want to thank the witnesses for your valuable testimony. 
The Members of the committee may have some additional questions 
for our witnesses, and so we would ask you to respond to those 
in writing. The hearing record will be held open for 10 days, 
and this subcommittee stands adjourned.
    [Whereupon, at 11:09 a.m., the subcommittee was adjourned.]

                            A P P E N D I X

                              ----------                              

    Questions From Chairman Daniel E. Lungren for L. Eric Patterson
    Question 1. In testimony before the House Committee on Homeland 
Security in November 2009, NPPD Under Secretary Rand Beers testified 
that NPPD was conducting a workforce needs analysis for FPS, at the 
request of Secretary Napolitano, to ensure that FPS has ``the right 
resources and staffing levels to match the missions FPS currently 
has.'' Under Secretary Beers further stated that when the results of 
the study were complete, Congress would be notified.
    What were the results of the analysis?
    Answer. The Federal Protective Service (FPS) conducted a workforce 
needs analysis between 2009 and 2010 and the results were used 
internally within the Department of Homeland Security. The results were 
a first step but did not fully meet the needs of the Service. FPS 
currently has a Federally Funded Research and Development Center on 
contract to conduct an activities analysis to refresh the past 
assumptions and requirements so that FPS may evaluate staffing levels 
in future years. FPS will brief the committee on the completion of the 
updated analysis.
    Question 2a. While FPS is taking positive steps to improve the 
standardization and consistency of FPS, there are still concerns that 
FPS operates differently from region to region and lacks consistent 
standards.
    Is consistency throughout the regions a concern of yours?
    Question 2b. What steps are being taken to improve consistency of 
FPS from region to region?
    Question 2c. Is headquarters assignment a prerequisite for 
promotion at FPS, and if not, do you think that would improve 
standardization and consistency of FPS policies?
    Answer. The Federal Protective Service (FPS) is performing an 
activities analysis to understand and document where it should 
introduce or modify policies to increase operational effectiveness and 
reduce risk. Several variables, including geography, law, threat, and a 
specific customer, could warrant differences in operational activities 
across regions. Through FPS's current detailed review of functions and 
activities, it is identifying commonalities and best practices to 
inform uniform National policies where it makes sense to do so. FPS 
would be pleased to provide a detailed briefing on this effort and 
highlight policy and process improvements that are being implemented 
Nation-wide.
    In addition, FPS has taken steps to realign its workforce to 
effectively map personnel resources to program functions. The result of 
this effort was the creation of an Area Management Concept, which 
compartmentalizes reporting for 11 regional-level offices into three 
Field Operations. Each Field Operation, led by a Senior Executive 
Service-level Assistant Director, provides oversight for multiple 
regional offices to help ensure standardization and consistency across 
the service. This area concept is a geographic-based structure that 
streamlines operational reporting through consolidation of information 
channels.
    An assignment to headquarters is not a prerequisite for promotion 
at FPS. The creation of the Area Management Concept, led by three 
Senior Executive Service-level and field-based Assistant Directors, is 
providing standardization and consistency across the service.
  Questions From Ranking Member Yvette D. Clarke for L. Eric Patterson
    Question 1. According to GAO, FPS spent $795 million on its 
contract guards in fiscal year 2011 which represented 90% of the 
agency's procurement budget. How much is FPS obligated to spend on its 
contract guards in fiscal year 2012, and what are the projected 
expenditures for fiscal year 2013?
    Answer. The Federal Protective Service (FPS) obligated $755.6 
million on its guard contracts in fiscal year 2011, which represented 
approximately 91 percent of its total contract obligations. FPS 
projects that it will obligate approximately $764.6 million in this 
program in fiscal year 2012. This projection is based on the known 
fiscal year 2012 obligations to date ($750.9 million as of August, 10, 
2012), plus additional expected obligations through September 30, 2012, 
totaling $13.7 million for recurring guard services and pending 
modifications and/or equitable adjustments under existing contracts. 
FPS projects that it will obligate approximately $784.4 million in 
fiscal year 2013. This projection is based on the estimated escalation 
of the fiscal year 2012 obligation by 2.6 percent, which accounts for 
estimated inflationary factors such as Service Contract Act wage 
adjustments. However, FPS may obligate additional amounts in fiscal 
year 2013 as necessary to account for emerging requirements for 
existing and new customers and any changes that may arise concerning 
guard requirements.
    Question 2. Why is it that as of June 2012, a total of $652,000 was 
spent on MIST, which appears to be useful so far, while RAMP has 
yielded no tangible results after four years and $35 million or more in 
expenditures?
    Answer. The Risk Assessment and Management Program (RAMP) 
experienced significant programmatic and technical issues, primarily 
related to insufficient user involvement in the requirements definition 
and testing of the application, as well as the lack of an approved 
program baseline to control and measure program progress.
    The efforts to develop and field the Modified Infrastructure Survey 
Tool (MIST) have been more successful because the program benefited 
from leveraging an existing software application already in service 
with the Office of Infrastructure Protection. MIST and its development 
addressed the shortcomings experienced within RAMP by instituting 
program management best practices to provide adequate controls on the 
development effort, and ensuring user involvement in the development 
and testing of MIST.
    Question 3. Given that FPS had a June 2012 deadline to decide what 
to do with the data remaining within RAMP, what decision has been made? 
If a decision has yet to be made, what are the next steps?
    Answer. The June 2012 deadline was tied to the expiration of the 
sustainment support contract for the legacy Risk Assessment and 
Management Program (RAMP) application. The expiration of that contract 
does not equate to a loss of data, as the Government owns the rights to 
the software and RAMP is currently installed within the Department of 
Homeland Security (DHS) Data Center 1 production environment.
    The Federal Protective Service (FPS) has examined the data within 
RAMP and identified three major data sets that needed to be retained: 
The RAMP repository, which is a library of historical assessments and 
policy documents; Protective Security Officer (contract guard) 
contracting information; and guard post inspection reports. Data from 
all other modules within RAMP is either resident elsewhere within FPS 
or lacks value due to problems with RAMP functionality.
    FPS has decommissioned RAMP as of July 12, 2012. With user access 
no longer available, the final data set was copied to FPS servers to 
ensure retention of the data. FPS will continue to work to dispose of 
the RAMP application during the fourth quarter of fiscal year 2012 and 
remove the application and all data from the DHS Data Center 1.
  Questions From Ranking Member Yvette D. Clarke for Mark L. Goldstein
    Question 1. How will the security of Federal facilities be affected 
if FPS inspectors and law enforcement security officers are not 
adequately trained to use MIST?
    Answer. The protection of Federal facilities may be significantly 
hampered if FPS's law enforcement security officers do not receive 
training on the Modified Infrastructure Survey Tool (MIST). As we 
reported in August 2012, FPS is not assessing risk at Federal 
facilities but plans to resume assessing Federal facilities 
vulnerabilities with MIST. However, if FPS's law enforcement security 
officers do not receive MIST training and no other alternative 
assessment tool is used, the backlog of facilities not assessed will 
increase significantly. According to FPS data, more than 5,000 
facilities were to be assessed in fiscal years 2010 through 2012.
    Question 2. What tools or options would be available to FPS in the 
event that MIST training is not completed?
    Answer. FPS may be able to use other tools if it cannot use MIST to 
assess Federal facilities. For example, one tool is the Federal 
Security Risk Manager (FSRM), which FPS used from 2000 to 2009. 
However, FPS has experienced problems using FSRM. Another potential 
tool is the Integrated Rapid Visual Screening developed by DHS's 
Science and Technology Directorate (S&T). The IRVS is a risk assessment 
tool that assesses risk using threat, vulnerability, and consequence. 
According to an S&T official, the IRVS is available to FPS at no cost.
    Question 3. Will the implementation of MIST and other FPS 
activities allow for enhanced compliance with the Interagency Security 
Committee standards?
    Answer. FPS has taken some steps to better align MIST with the 
Interagency Security Committee (ISC) standards. For example, MIST uses 
the ISC recommended countermeasures for defined threat scenarios for 
each facility security level.
 Questions From Ranking Member Yvette D. Clarke for James P. Peerenboom
    Question 1. What are the costs associated with developing and 
implementing MIST as the interim replacement for RAMP?
    Answer. Argonne developed the Modified Infrastructure Survey Tool 
(MIST) under an existing Interagency Agreement (IAA) with the U.S. 
Department of Homeland Security National Protection and Programs 
Directorate's Office of Infrastructure Protection (NPPD/IP). Similar 
methodologies and technologies developed by Argonne for NPPD/IP, such 
as the Infrastructure Survey Tool (IST), were leveraged to reduce MIST 
development time, cost, and risk. A total of $850,000 was committed 
under the IAA to build on the foundation established for the IST to 
develop, test, and deliver MIST Release 1.0. More than half of the 
funds were used for hardware and software to establish a web portal, 
called the FPS Gateway, that allows for sharing of information products 
and knowledge in real time. The FPS Gateway leverages the architecture 
and hardware/software technology of the Linking Encrypted Network 
System (LENS), a similar platform that Argonne also developed for NPPD/
IP. Work on the project was initiated on October 3, 2011. Argonne 
delivered MIST Release 1.0 and the FPS Gateway to FPS on March 30, 
2012.
    Question 2. Are there any features within RAMP that can be adapted 
for use with MIST?
    Answer. Argonne was not tasked to evaluate RAMP and its features.
    Question 3. What are the projected costs and time table for the 
completion of MIST?
    Answer. The scope of work for MIST development was completed, and 
MIST Release 1.0 and the FPS Gateway were delivered to FPS, on March 
30, 2012. The products were delivered on time and within the defined 
budget. Future enhancements to MIST, if any, and Argonne's potential 
role in completing such enhancements are unknown.
    Question 4. Do you anticipate any cost overruns with regard to 
MIST?
    Answer. No cost overruns were associated with Argonne's development 
and delivery of MIST Release 1.0 and the FPS Gateway.

                                 

```