Federal Protective Service: Protecting Federal Facilities Remains A Challenge
Published: 2014-05-21T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Recent incidents at federal facilities demonstrate their continued vulnerability to attacks or other acts of violence. As part of the Department of Homeland Security (DHS), FPS is responsible for protecting federal employees and visitors in approximately 9,600 federal facilities under the control and custody the General Services Administration (GSA). To help accomplish its mission, FPS conducts facility security assessments and has approximately 13,500 contract security guards deployed to federal facilities. FPS charges fees for its security services to federal tenant agencies.
This testimony discusses challenges FPS faces in (1) ensuring contract security guards deployed to federal facilities are properly trained and certified and (2) conducting risk assessments at federal facilities. It is based on GAO reports issued from 2009 through 2014 on FPS's contract guard and risk assessment programs. To perform this work, GAO reviewed FPS and guard company data and interviewed officials about oversight of guards. GAO compared FPS's and eight federal agencies' risk assessment methodologies to ISC standards that federal agencies must use. GAO selected these agencies based on their missions and types of facilities. GAO also interviewed agency officials and 4 risk management experts about risk assessments.
section_title: What GAO Found
paragraphs: The Federal Protective Service continues to face challenges ensuring that contract guards have been properly trained and certified before being deployed to federal facilities around the country. In September 2013, for example, GAO reported that providing training for active shooter scenarios and screening access to federal facilities poses a challenge for FPS. According to officials at five guard companies, their contract guards have not received training on how to respond during incidents involving an active shooter. Without ensuring that all guards receive training on how to respond to active-shooter incidents at federal facilities, FPS has limited assurance that its guards are prepared for this threat. Similarly, an official from one of FPS's contract guard companies stated that 133 (about 38 percent) of its approximately 350 guards have never received screener training. As a result, guards deployed to federal facilities may be using x-ray and magnetometer equipment that they are not qualified to use raising questions about their ability to fulfill a primary responsibility of screening access control points at federal facilities. GAO was unable to determine the extent to which FPS's guards have received active-shooter response and screener training, in part, because FPS lacks a comprehensive and reliable system for guard oversight. GAO also found that FPS continues to lack effective management controls to ensure its guards have met its training and certification requirements. For instance, although FPS agreed with GAO's 2012 recommendations that it develop a comprehensive and reliable system for managing information on guards' training, certifications, and qualifications, it still does not have such a system. Additionally, 23 percent of the 276 contract guard files GAO reviewed did not have required training and certification documentation. For example, some files were missing items such as documentation of screener training, CPR certifications, and firearms qualifications.
Assessing risk at federal facilities remains a challenge for FPS. GAO found in 2012 that federal agencies pay FPS millions of dollars to assess risk at their facilities, but FPS is not assessing risks in a manner consistent with federal standards. In March 2014, GAO found that this is still a challenge for FPS and several other agencies. The Interagency Security Committee's (ISC) Risk Management Process for Federal Facilities standard requires federal agencies to develop risk assessment methodologies that, among other things, assess the threat, vulnerability, and consequence to undesirable events. Risk assessments help decision-makers identify and evaluate security risks and implement protective measures. Instead of conducting risk assessments, FPS uses an interim vulnerability assessment tool, referred to as the Modified Infrastructure Survey Tool (MIST) to assess federal facilities until it develops a longer-term solution. However, MIST does not assess consequence (the level, duration, and nature of potential loss resulting from an undesirable event). Three of the four risk assessment experts GAO spoke with generally agreed that a tool that does not estimate consequences does not allow an agency to fully assess risks. Thus, FPS has limited knowledge of the risks facing about 9,600 federal facilities around the country. FPS officials stated that consequence information in MIST was not part of the original design, but they are exploring ways to incorporate it.
section_title: What GAO Recommends
paragraphs: Since fiscal year 2010, GAO has made 31 recommendations to improve FPS's contract guard and risk assessment processes, of which 6 were implemented, 10 are in process, and 15 have not been implemented.

section_title: Letter
paragraphs: We are pleased to be here to discuss the efforts of the Department of  Homeland Security’s (DHS) Federal Protective Service (FPS) to protect  the nearly 9,600 federal facilities that are under the control and custody of  the General Services Administration (GSA), including the challenges  associated with FPS’s use of contract guards and risk assessments. The  2012 shooting at the Anderson Federal Building in Long Beach,  California, the results of our 2009 covert testing, and FPS’s ongoing  penetration testing demonstrate the continued vulnerability of federal  facilities. The challenge of protecting federal facilities is one of the major  reasons why we have designated federal real property management as a  high-risk area.
FPS is authorized to (1) protect the buildings, grounds, and property that  are under the control and custody of GSA, as well as the persons on the  property; (2) enforce federal laws and regulations aimed at protecting  such property and persons on the property; and (3) investigate offenses  against these buildings and persons. FPS conducts its mission by providing security services through two types of activities: physical security activities—conducting risk assessments and  recommending countermeasures aimed at preventing incidents—and  law enforcement activities—proactively patrolling facilities, responding  to incidents, conducting criminal investigations, and exercising arrest  authority. To accomplish its mission, FPS currently has almost 1,200  full-time employees and about 13,500 contract guards deployed at  federal facilities across the country. It expects to receive  approximately $1.2 billion in fees for fiscal year 2014.
Since 2008, we have reported on the challenges FPS faces with carrying  out its mission, including overseeing its contract guards and assessing  risk at federal facilities. FPS’s contract guard program is the most visible  component of the agency’s operations, and the agency relies on its  guards to be its “eyes and ears” while performing their duties. However,  we reported in 2010 and again in 2013 that FPS continues to experience  difficulty ensuring that its guards have the required training and  certifications. Before guards are assigned to a post (an area of  responsibility) at a federal facility, FPS requires that they all undergo  employee fitness determinations and complete approximately 120 hours  of training provided by the contractor and FPS, including basic training  and firearms training. Guards must also possess the necessary  certificates, licenses, and permits as required by the contract, such as  CPR and first-aid certifications. Among other duties, contract guards are  responsible for controlling access to facilities; conducting screening at  access points to prevent the introduction of prohibited items, such as  weapons and explosives; and responding to emergency situations  involving facility safety and security. FPS also faces challenges  assessing risks at the 9,600 facilities under the control and custody of  GSA. In 2012 and in 2014, we reported that FPS’s ability to protect and  secure federal facilities has been hampered by the absence of a risk  assessment program that is consistent with federal standards. To address  issues with overseeing contract guards and conducting risk assessments,  we made several recommendations which FPS agreed to implement.  These recommendations and their status are discussed later in this  statement.
This testimony discusses challenges FPS faces in (1) ensuring contract  security guards deployed to federal facilities are properly trained and  certified and (2) conducting risk assessments at federal facilities. It is  based on our reports and testimonies issued from 2009 through 2014 on  FPS’s contract guard and risk assessment programs. A complete list of  these related products appears at the end of my statement. As part of the  work for these products, we reviewed relevant statutes and federal  guidance, examined FPS contract guard and risk assessment processes  and procedures, reviewed a sample of contract guard files, conducted site  visits to FPS’s 11 regions where we interviewed FPS officials, and  conducted interviews with the 31 guard companies with which FPS has  contracted and 4 risk management experts. In addition, we reviewed  FPS’s and eight other selected federal agencies’ risk assessment  methodologies and compared it to the Risk Management Process for  Federal Facilities standard (RMP) that the Interagency Security  Committee (ISC) issued. The eight selected agencies include:  Department of Energy, Office of Health, Safety, and Security; Department  of Interior; Department of Justice, Justice Protective Service; Department  of State, Diplomatic Security; Department of Veterans Affairs; Federal  Emergency Management Agency; Nuclear Regulatory Commission; and  Office of Personnel Management. We selected these agencies to achieve  diversity with respect to the number and types of agencies’ facilities, as  well as the agencies’ missions.
We conducted our work in accordance with generally accepted  government auditing standards. These standards require that we plan  and perform the audit to obtain sufficient, appropriate evidence to provide  a reasonable basis for our findings and conclusions based on our audit  objectives. We believe that the evidence obtained provides a reasonable  basis for our findings and conclusions based on our audit objectives.  Additional details about the scope and methodology can be found in each  of these related reports.
subsections: section_title: FPS Faces Challenges Ensuring Contract Guards Have Been Properly Trained and Certified before Being Deployed to Federal Facilities
subsections: section_title: Some FPS Contract Guards Have Not Received Required Training on Responding to Active-Shooter Scenarios
paragraphs: According to FPS officials, the agency has required its guards to receive  training on how to respond to an active-shooter scenario since 2010.  However, as our 2013 report shows, FPS faces challenges providing  active-shooter response training to all of its guards. We were unable to  determine the extent to which FPS’s guards have received active-shooter  response training, in part, because FPS lacks a comprehensive and  reliable system for guard oversight (as discussed below). When we asked  officials from 16 of the 31 contract guard companies we contacted if their  guards had received training on how to respond during active-shooter  incidents, responses varied.companies we interviewed about this topic:   For example, of the 16 contract guard officials from eight guard companies stated that their guards had  received active-shooter scenario training during FPS orientation; officials from five guard companies stated that FPS had not provided  active-shooter scenario training to their guards during the FPS- provided orientation training; and officials from three guard companies stated that FPS had not provided  active-shooter scenario training to their guards during the FPS- provided orientation training, but that the topic was covered at some  other time.
Without ensuring that all guards receive training on how to respond to  active-shooter incidents, FPS has limited assurance that its guards  are prepared for this threat. According to FPS officials, the agency  provides guards with information on how they should respond during  an active-shooter incident as part of the 8-hour FPS-provided  orientation training. FPS officials were not able to specify how much  time is devoted to this training, but said that it is a small portion of the  2-hour special situations training. According to FPS’s training  documents, this training includes instructions on how to notify law  enforcement personnel, secure the guard’s area of responsibility, and  direct building occupants according to emergency plans as well as the  appropriate use of force.
section_title: Some FPS Contract Guards Have Not Received Required Screener Training
paragraphs: As part of their 120 hours of FPS-required training, guards must receive 8  hours of screener training from FPS on how to use x-ray and  magnetometer equipment. However, in our September 2013 report, we  found that FPS has not provided required screener training to all guards.  Screener training is important because many guards control access  points at federal facilities and thus must be able to properly operate x-ray  and magnetometer machines and understand their results. In 2009 and  2010, we reported that FPS had not provided screener training to 1,500  contract guards in one FPS region. In response to those reports, FPS  stated that it planned to implement a program to train its inspectors to  provide screener training to all its contract guards by September 2015.
Information from guard companies we contacted indicate that guards who  have never received this screener training continue to be deployed to  federal facilities.
An official at one contract guard company stated that 133 of its  approximately 350 guards (about 38 percent) on three separate FPS  contracts (awarded in 2009) have never received their initial x-ray and  magnetometer training from FPS. The official stated that some of  these guards are working at screening posts.
Officials at another contract guard company in a different FPS region  stated that, according to their records, 78 of 295 (about 26 percent)  guards deployed under their contract have never received FPS’s x-ray  and magnetometer training. These officials stated that FPS’s regional  officials were informed of the problem, but allowed guards to continue  to work under this contract, despite not having completed required  training. Because FPS is responsible for this training, according to  guard company officials, no action was taken against the company.
Consequently, some guards deployed to federal facilities may be using x- ray and magnetometer equipment that they are not qualified to use─thus  raising questions about the ability of some guards to execute a primary  responsibility to properly screen access control points at federal facilities.
section_title: FPS Lacks Effective Management Controls to Ensure Contract Guards Have Met Training and Certification Requirements
paragraphs: In our September 2013 report, we found that FPS continues to lack  effective management controls to ensure that guards have met training  and certification requirements. For example, although FPS agreed with  our 2012 recommendations to develop a comprehensive and reliable  system to oversee contract guards, it still has not established such a  system. Without a comprehensive guard management system, FPS has  no independent means of ensuring that its contract guard companies  have met contract requirements, such as providing qualified guards to  federal facilities. Instead, FPS requires its guard companies to maintain  files containing guard-training and certification information. The  companies are then required to provide FPS with this information each  month.
In our September 2013 report, we found that 23 percent of the 276 guard  files we reviewed (maintained by 11 of the 31 guard companies we  interviewed) lacked required training and certification documentation. As  shown in table 1, some guard files lacked documentation of basic training,  semi-annual firearms qualifications, screener training, the 40-hour  refresher training (required every 3 years), and CPR certification.
FPS has also identified guard files that did not contain required  documentation. FPS’s primary tool for ensuring that guard companies  comply with contractual requirements for guards’ training, certifications,  and qualifications is to review guard companies’ guard files each month.  From March 2012 through March 2013, FPS reviewed more than 23,000  guard files. It found that a majority of the guard files had the required  documentation but more than 800 (about 3 percent) did not. FPS’s file  reviews for that period showed files missing, for example, documentation  for screener training, initial weapons training, CPR certification, and  firearms qualifications.
As our September 2013 report explains, however, FPS’s process for  conducting monthly file reviews does not include requirements for  reviewing and verifying the results, and we identified instances in which  FPS’s monthly review results did not accurately reflect the contents of  guard files. For instance, FPS’s review indicated that required  documentation was present for some guard files, but for some of those  files we were not able to find (for example) documentation of training and  certification, such as initial weapons training, DHS orientation, and pre- employment drug screenings. As a result of the lack of management  controls, FPS is not able to provide reasonable assurance that guards  have met training and certification requirements.
section_title: FPS Continues to Face Challenges with Assessing Risk at Federal Facilities
paragraphs: We found in 2012 that FPS did not assess risks at the 9,600 facilities  under the control and custody of GSA in a manner consistent with federal  standards, although federal agencies paid FPS millions of dollars to  assess risk at their facilities. Our March 2014 report examining risk  assessments at federal facilities found that this is still a challenge for FPS  and several other federal agencies. Federal standards such as the  National Infrastructure Protection Plan’s (NIPP) risk management  framework and ISC’s RMP call for a risk assessment to include a threat,  vulnerability, and consequence assessment. Risk assessments help  decision-makers identify and evaluate security risk and implement  protective measures to mitigate risk. Moreover, risk assessments play a  critical role in helping agencies tailor protective measures to reflect their  facilities’ unique circumstances and enable them to allocate security  resources effectively.
Instead of conducting risk assessments, FPS uses an interim vulnerability  assessment tool, referred to as the Modified Infrastructure Survey Tool  (MIST), with which it assesses federal facilities until it develops a longer- term solution. According to FPS, MIST allows it to resume assessing  federal facilities’ vulnerabilities and recommend countermeasures— something FPS has not done consistently for several years.
MIST has some limitations. Most notably, it does not assess  consequence (the level, duration, and nature of potential loss resulting  from an undesirable event). Three of the four risk assessment experts we  spoke with generally agreed that a tool that does not estimate  consequences does not allow an agency to fully assess risks. FPS  officials stated that it intends to eventually incorporate consequence into  its risk assessment methodology and is exploring ways to do so. MIST  was also not designed to compare risks across federal facilities.  Consequently, FPS does not have the ability to comprehensively manage  risk across its portfolio of 9,600 facilities and recommend  countermeasures to federal tenant agencies.
As of April 2014, according to an FPS official, FPS had used MIST to  complete vulnerability assessments of approximately 1,200 federal  facilities in fiscal year 2014 and have presented approximately 985 of  them to the facility security committees. The remaining 215  assessments were under review by FPS.
section_title: FPS Has Begun Some Initiatives, but Most GAO Recommendations Have Not Been Fully Implemented
paragraphs: FPS has begun several initiatives that, once fully implemented, should  enhance its ability to protect the more than 1 million federal employees  and members of the public who visit federal facilities each year. Since  fiscal year 2010, we have made 31 recommendations to help FPS  address its challenges with risk management, oversight of its contract  guard workforce, and its fee-based funding structure. DHS and FPS have  generally agreed with these recommendations. As of May 2014, as  shown in table 2, FPS had implemented 6 recommendations, and was in  the process of addressing 10 others, although none of the 10 have been  fully implemented. The remaining 15 have not been implemented.  According to FPS officials, the agency has faced difficulty in implementing  many of our recommendations because of changes in its leadership,  organization, funding, and staffing levels.
section_title: Contact Information
paragraphs: For further information on this testimony, please contact Mark Goldstein  at (202) 512-2834 or by email at GoldsteinM@gao.gov. Individuals  making key contributions to this testimony include Tammy Conquest,  Assistant Director; Geoff Hamilton; Jennifer DuBord; and SaraAnn  Moessbauer.
section_title: Related GAO Products
paragraphs: Federal Facility Security: Additional Actions Needed to Help Agencies  Comply with Risk Assessment Methodology Standards. GAO-14-86.  Washington, D.C.: March 5, 2014.
Homeland Security: Federal Protective Service Continues to Face  Challenges with Contract Guards and Risk Assessments at Federal  Facilities. GAO-14-235T. Washington, D.C.: December 17, 2013.
Homeland Security: Challenges Associated with Federal Protective  Service’s Contract Guards and Risk Assessments at Federal Facilities.  GAO-14-128T. Washington, D.C.: October 30, 2013.
Federal Protective Service: Challenges with Oversight of Contract Guard  Program Still Exist, and Additional Management Controls Are Needed.  GAO-13-694. Washington, D.C.: September 17, 2013.
Facility Security: Greater Outreach by DHS on Standards and  Management Practices Could Benefit Federal Agencies. GAO-13-222.  Washington, D.C.: January 24, 2013.
Federal Protective Service: Actions Needed to Assess Risk and Better  Manage Contract Guards at Federal Facilities. GAO-12-739. Washington,  D.C.: August 10, 2012.
Federal Protective Service: Actions Needed to Resolve Delays and  Inadequate Oversight Issues with FPS’s Risk Assessment and  Management Program. GAO-11-705R. Washington, D.C.: July 15, 2011.
Federal Protective Service: Progress Made but Improved Schedule and  Cost Estimate Needed to Complete Transition. GAO-11-554. Washington,  D.C.: July 15, 2011.
Homeland Security: Protecting Federal Facilities Remains a Challenge for  the Department of Homeland Security’s Federal Protective Service.  GAO-11-813T. Washington, D.C.: July 13, 2011.
Federal Facility Security: Staffing Approaches Used by Selected  Agencies. GAO-11-601. Washington, D.C.: June 30, 2011.
Budget Issues: Better Fee Design Would Improve Federal Protective  Service’s and Federal Agencies’ Planning and Budgeting for Security,  GAO-11-492. Washington, D.C.: May 20, 2011.
Homeland Security: Addressing Weaknesses with Facility Security  Committees Would Enhance Protection of Federal Facilities,  GAO-10-901. Washington, D.C.: August 5, 2010.
Homeland Security: Preliminary Observations on the Federal Protective  Service’s Workforce Analysis and Planning Efforts. GAO-10-802R.  Washington, D.C.: June 14, 2010.
Homeland Security: Federal Protective Service’s Use of Contract Guards  Requires Reassessment and More Oversight. GAO-10-614T.  Washington, D.C.: April 14, 2010.
Homeland Security: Federal Protective Service’s Contract Guard Program  Requires More Oversight and Reassessment of Use of Contract Guards.  GAO-10-341. Washington, D.C.: April 13, 2010.
Homeland Security: Ongoing Challenges Impact the Federal Protective  Service’s Ability to Protect Federal Facilities. GAO-10-506T. Washington,  D.C.: March 16, 2010.
Homeland Security: Greater Attention to Key Practices Would Improve  the Federal Protective Service’s Approach to Facility Protection.  GAO-10-142. Washington, D.C.: October 23, 2009.
Homeland Security: Preliminary Results Show Federal Protective  Service’s Ability to Protect Federal Facilities Is Hampered by  Weaknesses in Its Contract Security Guard Program, GAO-09-859T.  Washington, D.C.: July 8, 2009.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.