Aviation Security: TSA Has Made Progress Implementing Requirements in the Aviation Security Act of 2016
Published: 2017-09-07T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Recent incidents involving aviation workers conducting criminal activity in the nation's commercial airports have led to interest in the measures TSA and airport operators use to control access to secure areas of airports. The 2016 ASA required TSA to take several actions related to oversight of access control security at airports. The Act also contains a provision for GAO to report on progress made by TSA.
This report examines, among other issues, progress TSA has made in addressing the applicable requirements of the 2016 ASA. GAO compared information obtained from TSA policies, reports, and interviews with TSA officials to the requirements in the 2016 ASA. GAO also visited three airports to observe their use of access controls and interviewed TSA personnel. The non-generalizable group of airports was selected to reflect different types of access control measures and airport categories.
GAO is not making any recommendations. In its formal response, DHS stated that it continues to implement the 2016 ASA requirements.
section_title: What GAO Found
paragraphs: The Transportation Security Administration (TSA) has generally made progress addressing the 69 applicable requirements within the Aviation Security Act of 2016 (2016 ASA). As of June 2017, TSA had implemented 48 of the requirements; it plans no further action on these. For 18 requirements, TSA officials took initial actions and plans further action. TSA officials stated they have yet to take action on 2 requirements and plan to address them in the near future. TSA officials took no action on 1 requirement regarding access control rules because it plans to address this through mechanisms other than formal rulemaking, such as drafting a national amendment to airport operator security programs. Key examples of TSA's progress in implementing the requirements in the eight relevant sections of the Act are shown below:
Conduct a Threat Assessment : TSA conducted a threat assessment that analyzed vulnerabilities related to the insider threat—that is, the threat posed by aviation workers who exploit their access privileges to secure areas of an airport for personal gain or to inflict damage.
Enhance Oversight Activities : Among other things, TSA developed a list of measures for airport operators to perform, such as an airport rebadging if the percent of badges unaccounted for exceeds a certain threshold.
Update Airport Employee Credential Guidance : TSA issued guidance to airport operators to match the expiration date of a non-U.S. citizen aviation worker's identification badge to the individual's U.S. work authorization status.
Vet Airport Employees : In addition to making progress on updating employee vetting rules, TSA coordinated with the Federal Bureau of Investigation (FBI) to implement the FBI's Rap Back service for providing recurrent fingerprint-based criminal history record checks for aviation workers.
Develop and Implement Access Control Metrics: TSA developed and implemented a metric that determines the percentage of TSA secure area inspections found to be in compliance with the airport security program.
Develop a Tool for Unescorted Access Security: According to TSA officials , they developed a tool designed to ensure that aviation workers with unescorted access are randomly screened for prohibited items, such as firearms and explosives, and to check for proper identification.
Increase Covert Testing : TSA plans to increase the number of covert tests of access controls it will perform in 2017.
Review Security Directives : Security directives are issued by TSA when, for example, additional measures are required to respond to a threat. TSA officials stated they review all security directives annually to consider the need for revocation or revision, and brief Congress when new directives are to be issued.

section_title: Letter
paragraphs: The Transportation Security Administration (TSA) and the Federal Bureau  of Investigation (FBI) consider one of aviation security’s most pressing  concerns to be the insider threat—the threat of aviation workers who  exploit their access privileges to secure areas of an airport for personal  gain or to inflict damage. Recent incidents involving aviation workers  conducting criminal activity in the nation’s commercial airports have led to  congressional concern about access controls, the measures TSA and  commercial airport operators use to manage access to secure areas. For  example, in December 2014, a baggage handler at Atlanta, Georgia’s  Hartsfield-Jackson International Airport was arrested for allegedly using  his airport-issued identification badge to repeatedly smuggle loaded and  unloaded firearms into the passenger boarding area for hand-off to an  accomplice, who carried the firearms onto airplanes bound for New York.  In June 2015, a man pleaded guilty for a 2013 incident in which he  attempted to use his airport identification badge credentials to access the  tarmac at the Wichita, Kansas Mid-Continent Airport with the intent of  exploding a car bomb.
As the federal agency with primary responsibility for securing the nation’s  civil aviation system, TSA, within the Department of Homeland Security  (DHS), is responsible for establishing minimum security measures and  regulating the implementation of those measures by airport operators and  other regulated entities to improve access control security. As part of this  responsibility, TSA conducts inspections and covert testing to maintain  and improve access controls that reduce security risks posed by aviation  workers. Among other things, TSA may issue security directives setting  forth requirements when it determines that additional security measures  are necessary to respond to a threat assessment or a specific threat  against civil aviation.
In 2016, we reported that TSA had made progress since 2009 in  assessing the risk to airport perimeter and access control security by  developing its Comprehensive Risk Assessment of Perimeter and Access  Control Security in May 2013. However, we also reported that TSA had  not updated this assessment to reflect changes in the airport security risk  environment, including risks from insider threats. We recommended that  TSA update this assessment to reflect these changes, and take other  actions related to airport security. DHS concurred with the  recommendation and in June 2017 TSA officials stated that actions were  underway to implement the recommendation. The Department of  Homeland Security’s Office of Inspector General has also recently  reported on TSA’s challenges in managing access control security,  including the need for additional oversight over identification badges.
Enacted on July 15, 2016, Subtitle D of the Aviation Security Act of 2016   (ASA) requires TSA to take specific actions in eight categories related to  aviation worker screening and access control security: (1) conduct a  threat assessment, (2) enhance oversight activities, (3) update airport  employee credential guidance, (4) vet airport employees, (5) develop and  implement access control metrics, (6) develop a tool for unescorted access security, (7) increase covert testing, and (8) review security  directives. The Act also contains a provision for GAO to report on  progress made by TSA and the effect on aviation security of  implementing the applicable 2016 ASA requirements. This report  examines (1) progress TSA has made in addressing the applicable  requirements of the 2016 ASA and (2) the potential effects on aviation  security TSA has identified in implementing these requirements.
To determine the progress TSA has made in addressing the applicable  requirements of the 2016 ASA, we examined relevant TSA policies and  procedures, including applicable regulations and security directives, and  reports that TSA was required to submit to the appropriate congressional  committees in accordance with applicable provisions of the 2016 ASA— including those in draft form—and compared them to the applicable 2016  ASA requirements. We interviewed TSA officials responsible for  implementing each of the applicable 2016 ASA requirements, including  officials from the Office of Security Policy and Industry Engagement, the  Office of Chief Counsel, the Office of Intelligence and Analysis, and the  Office of Security Operations to determine what actions they had taken,  and plan to take, in response to the applicable 2016 ASA requirements.  For the purposes of this report, we define progress as TSA having taken  action on a requirement or having a commitment for planned actions.
To determine the potential effects on aviation security TSA has identified  in implementing these requirements, we interviewed TSA officials  responsible for implementing the 2016 ASA requirements to gain their  insight on which requirements they believed may have an impact on  aviation security, and subsequently reviewed relevant documents,  including those in draft form. Because many of TSA’s actions taken in  response to the 2016 ASA were recently implemented or are still ongoing  and not fully implemented, we did not assess the effectiveness of the  actions taken by TSA.
We conducted site visits to Dulles International Airport, Virginia, and  Dallas Fort Worth International Airport and Dallas Love Field, Texas.  During these visits, we observed these airports’ use of access controls— such as aviation worker use of identification badges to gain access to the  secure areas—in their operations and discussed these controls with  airport officials and TSA federal security directors or their representatives.  We selected these airports for site visits and interviews based on the  variation in the types of access controls these airports implemented and  the different airport categories. Because we did not select a  generalizable sample of airports, the results of these site visits and  interviews cannot be projected to all of the approximately 440 commercial  airports in the United States. However, these site visits and interviews  provided us with the perspectives of TSA personnel and airport officials  on how actions taken by TSA to implement the applicable requirements of  the 2016 ASA may affect aviation security.
We conducted this performance audit from February 2017 to September  2017 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: TSA inspects airports, air carriers, and other regulated entities to ensure  that they are in compliance with federal aviation security regulations,  TSA-approved airport security programs, and other requirements,  including requirements related to controlling airport employee access to  secure areas of an airport. Airport operators have direct responsibility  for implementing security requirements in accordance with their TSA- approved airport security programs. In general, secure areas of an airport  are specified in the airport operator’s security programs and include the  sterile area, which is the area of an airport that provides passengers  access to boarding aircraft and to which access is generally controlled by  TSA or a private screening entity under TSA oversight, and the security  identification display area (SIDA), which is a portion of an airport in which  security measures are carried out and where appropriate identification  must be worn by aviation workers. For example, aviation workers that  require access to the aircraft movement and parking areas for the  purposes of their employment duties must display appropriate  identification to access these areas.
Airport operators are to perform background checks on individuals prior to  granting them unescorted access to secure areas of an airport and TSA  relies on airport operators to collect and verify applicant data, such as  name, place of birth, and country of citizenship, for individuals seeking  credentials. Background checks for individuals applying for credentials  to allow unescorted access to secure areas of commercial airports  include (1) a security threat assessment from TSA, including a terrorism  check; (2) a fingerprint-based criminal history records check; and (3)  evidence that the applicant is authorized to work in the United States. The  criminal history records check also determines whether the applicant has  committed a disqualifying criminal offense in the previous ten years.
TSA and airport operators have oversight responsibilities for the  identification badges that are issued. For example, airport operators must  account for all badges through control procedures, such as audits,  specified in TSA’s security directives and in an airport’s security  program. TSA assesses airports’ compliance with its security directives  and federal regulations through inspections conducted in alternating  years of, among other things, the airport operator’s documents related to  issuing and controlling identification badges and by randomly screening  aviation workers.
section_title: TSA Generally Made Progress in Addressing the Applicable Requirements of the Aviation Security Act of 2016
paragraphs: The Transportation Security Administration (TSA) has generally made  progress addressing the 69 applicable requirements within the Aviation  Security Act of 2016 (2016 ASA). As of June 2017, TSA officials stated it  had implemented 48 of the requirements; it plans no further action on  these. For 18 requirements, TSA officials took initial actions and plans  further action. TSA officials stated they have yet to take action on 2  requirements and plan to address them in the near future. TSA officials  took no action on 1 requirement regarding access control rules because it  plans to address this through mechanisms other than formal rulemaking,  such as drafting a national amendment to airport operator security  programs. Appendix I presents the details of each requirement, the  progress made by TSA, and the status of TSA’s plans for further actions.  A summary of TSA’s progress in implementing the requirements in each  section of the Act is presented below.
Conduct a Threat Assessment (Section 3402)
TSA made progress on the 11 requirements in Section 3402 of the 2016  ASA. TSA plans no further action for 9 requirements and plans further  action for 2 requirements, as shown in appendix I. For example, section  3402(a) requires TSA to conduct a threat assessment that considers the  seven factors stated in the law and 3402(b) requires TSA to submit a  report to the appropriate congressional committees on the results of the  assessment. Consistent with these sections, TSA conducted a threat  assessment on the level of risk individuals with unescorted access to the  secure area of an airport pose to the domestic air transportation system  and submitted a report on it to the appropriate congressional committees  in May 2017. In conducting the threat assessment, TSA also considered  all seven required factors. For example, TSA considered recent security  breaches at domestic and foreign airports by analyzing access-control  related incidents from December 2013 through February 2017. TSA also  considered the vulnerabilities associated with unescorted access  authority granted to foreign airport operators and air carriers, and their  workers, by reviewing the vulnerability of incoming flights to the United  States for four international regions. The threat assessment noted several  recommendations under consideration, such as enhancing relationships  with the FBI and U.S. Drug Enforcement Administration, among other law  enforcement entities, to ensure TSA is more fully aware of insider threats  within the domestic transportation system. TSA officials stated they plan  to use the threat assessment to, among other things, expand the use of  vulnerability assessments and insider threat-related inspections at all  commercial airports. Thus, TSA plans no further action for the 9  requirements related to the threat assessment.
Enhance Oversight Activities (Section 3403)
TSA generally made progress in addressing the 10 requirements in  Section 3403 of the 2016 ASA. Of the 10 requirements, TSA plans no  further action for 4 requirements. TSA plans further action for 5  requirements, but has yet to begin implementing 1 of these 5  requirements. In addition, TSA took no action on one requirement  because they plan to address this requirement through other means, as  shown in appendix I. Section 3403(a) requires TSA to update rules on  access controls, and as part of this update, to consider, among other  things best practices for airport operators that report missing more than  three percent of credentials for unescorted access to the SIDA of any  airport. In accordance with this requirement, TSA developed a list of  measures for airport operators to perform—such as an airport rebadging  if the percent of unaccounted for badges exceeds a certain threshold— and published them on DHS’s Homeland Security Information Network  (HSIN) for airport operators to access. In addition, TSA officials stated  they developed a fine structure for non-category X airport operators that  have more than five percent and for category X airports that have more  than three percent of credentials missing for unescorted access to the  SIDA of an airport. TSA plans to take additional action to address this and  other requirements related to updating the rules on access controls. For  example, it plans to propose a national amendment to airport operator  security programs for airport operators to report to TSA when an airport  exceeds a specified threshold for unaccounted identification badges.
TSA plans no further action under section 3403(a)(2)(F) to consider a  method of termination by the employer of any airport worker who fails to  report in a timely manner missing credentials for unescorted access to  any SIDA of an airport. TSA officials stated they considered developing  such a method; however, they plan no further action because TSA does  not have authority over employment determinations made by airport  operators or other employers. Further, section 3403(b) stated that TSA  may encourage the issuance of temporary credentials by airports and  aircraft operators of free one-time, 24-hour temporary credentials for  aviation workers who report their credentials as missing but not  permanently lost. Officials stated they plan no further action on this  requirement because temporary credentials conflict with a current federal  regulation that requires airport operators to ensure that only one  identification badge is issued to an individual at one time.
TSA has yet to take action on one requirement and took no action on  another requirement in section 3403(a) of the 2016 ASA. First, TSA  stated they plan to consider section 3403(a)(2)(E) to increase fines and  direct enforcement action for airport workers and their employers who fail  to timely report missing credentials, but have yet to do so. In addition,  TSA took no action to update the rules on access controls. TSA officials  stated that that they are taking other actions, such as drafting a proposed  national amendment to airport security programs, to address this  requirement.
Update Airport Employee Credential Guidance (Section 3404)
TSA generally made progress in addressing the 4 requirements in  Section 3404 of the 2016 ASA. Of the 4 requirements, TSA took action  and plans no further action for 2 requirements, plans further actions for 1  requirement, and has yet to take action on 1 requirement. For example,  section 3404(a) requires TSA to issue guidance to airport operators  regarding the placement of an expiration date on airport identification  badges issued to non-U.S. citizens that is not longer than the period of  time during which such non-U.S. citizens are lawfully authorized to work  in the United States. In accordance with this requirement, TSA issued  guidance that states that airport operators should match an identification  badge’s expiration date to an individual’s immigration status, published  this guidance to airport operators in fiscal year 2016 on the HSIN, and  plans to issue a security directive to further address this requirement.  TSA has no plans for further action to address section 3404(b)(1), which  requires TSA to issue guidance for its inspectors to annually review the  procedures of airport operators and carriers for individuals seeking  unescorted access to the SIDA and to make information on identifying  suspicious or fraudulent identification materials available to airport  operators and air carriers. For example, TSA officials stated that  Transportation Security Inspector guidance is updated yearly to  incorporate additional inspection guidelines, as is TSA’s Compliance  Manual, which includes updated methods for inspections and additional  airport access control measures to be tested. The update for fiscal year  2017 changed the number of required tests related to insider threats and  has new inspection techniques related to individuals seeking unescorted  access to the SIDA. Additionally, officials stated that TSA made  information available on the HSIN on identifying fraudulent  documentation.
TSA officials have yet to take action on section 3404(b)(2), which requires  that the guidance to airport operators regarding the placement of an  expiration date on airport identification badges issued to non-U.S. citizens  include a comprehensive review background checks and employment  authorization documents issues by the United States Citizenship and  Immigration Services. Officials stated that it plans to request clarification  from the appropriate congressional committees to determine the actions  needed to implement this requirement.
Vet Airport Employees (Section 3405)
TSA made progress on the 12 requirements in Section 3405 of the 2016  ASA. TSA plans no further action for 5 requirements, and plans further  action for 7 requirements, as shown in appendix I. For example, section  3405(a) requires TSA to revise certain regulations related to the eligibility  requirements and disqualifying criminal offenses for individuals seeking  unescorted access to any SIDA of an airport. In accordance with this  requirement, TSA is drafting a Notice of Proposed Rulemaking to update  rules related to vetting of employees seeking unescorted access to the  SIDA of an airport; however, TSA officials reported two challenges in  implementation. First, TSA officials stated they cannot update the  employee eligibility requirements and disqualifying criminal offense  regulations within the required 180 days specified in the statute because  the required process for promulgating regulations generally takes longer  than 180 days. Second, per Executive Order 13771, federal agencies  must identify two existing regulations to be repealed for every new  regulation issued during fiscal year 2017, and the order further provides  that for each new regulation, the head of the agency is required to identify  offsetting regulations and provide the agency’s best approximation of the  total costs or savings associated with each new regulation or repealed  regulation. Despite these challenges, TSA officials stated they plan  further actions to update rules related to employee vetting in accordance  with this section; however, officials could not provide a timeframe for  completing this requirement.
In addition, TSA officials stated they plan no further action with respect to  section 3405(b)(1), which requires TSA and the FBI to implement the Rap  Back Service for recurrent vetting of aviation workers. In response to  this requirement, TSA coordinated with the FBI to implement the FBI’s  Rap Back Service, which uses the FBI fingerprint-based criminal records  repository to provide recurrent fingerprint-based criminal history record  checks for aviation workers who have been initially vetted and already  received airport-issued identification badge credentials. TSA officials  stated the Rap Back program is available to all commercial airport  operators; however, for airport operators to participate in the Rap Back  program, the airport operator must, among other things, sign a  memorandum of understanding with TSA that documents its participation  in the program. As of June 2017, TSA had executed over 100  memoranda of understanding with airport operators, including 17  category X airports and plans to enroll additional airports in fiscal year  2017.
Develop and Implement Access Control Metrics (Section 3406)
TSA made progress by taking action on the 6 requirements in Section  3406 of the 2016 ASA. Of the 6 requirements, TSA officials stated they  plan no further action to implement the requirements of this section, as  shown in appendix I. For example, section 3406 requires TSA to develop  and implement performance metrics to measure the effectiveness of  security for the SIDAs of airports and, in developing these metrics, TSA  may consider 5 factors stated in the Act. In accordance with this  requirement, TSA developed and implemented a metric that determines  the percentage of TSA SIDA inspections that were found to be in  compliance with the airport security program. TSA officials stated they  plan to use the metric to inform decision makers on the SIDA compliance  for individual airports and nationwide. For example, if TSA determines an  individual airport has a low compliance rate, TSA leadership may conduct  additional special emphasis inspections to address the issue, according  to TSA officials.
Develop a Tool for Unescorted Access Security (Section 3407)
TSA made progress on the 18 requirements in Section 3407 of the 2016  ASA. Of the 18 requirements, TSA plans no further action on 17  requirements, and further action for 1 requirement, as shown in appendix  I. For example, section 3407(a) requires TSA to develop a model and  best practices for unescorted access security that includes 5  requirements as stated in the Act. In accordance with this requirement,  TSA officials stated they utilized a tool for unescorted access security  called the Advanced Threat Local Allocation Strategy (ATLAS) tool, which  was developed in 2015 and is designed to randomly screen aviation  workers who have unescorted access to restricted areas of an airport.  The tool incorporates the required elements listed in section 3407(a) such  as using intelligence, scientific algorithms and other risk-based factors,  according to TSA officials. For example, TSA officials stated the algorithm  in the tool provides a scientific way to randomize the locations, times, and  types of screening an aviation worker might receive. It allows TSA to limit  an individual’s ability to circumvent screening by deploying resources in a  way that an individual who enters an access point will not know if, or what  type of screening will take place, according to officials. While officials  stated they plan no further actions to implement the requirements in  section 3407(a) to develop a model, officials stated they had conducted  pilot assessments of the ATLAS tool in fiscal year 2015 at three airports,  at one airport in fiscal year 2016, and plan to pilot the tool in additional  airports before expanding its use in phases to all airports by fiscal year  2018, according to TSA officials.
Increase Covert Testing (Section 3408)
TSA made progress on the 2 requirements in Section 3408 of the 2016  ASA. Of the 2 requirements, TSA plans no further action for 1  requirement, and plans to take further action for 1 requirement, as shown  in appendix I. For example, TSA plans further actions to increase the use  of covert testing in fiscal year 2017 in accordance with section 3408(a),  which requires TSA to increase the use of red-team, covert testing of  access controls to any secure areas. Specifically, TSA conducted one  access control covert project in fiscal year 2016 and plans to increase the  number of projects to three in fiscal year 2017. Additionally, TSA  submitted a report on access control covert testing to the appropriate  congressional committees as required by section 3408(c)(1) of the 2016  ASA, describing the steps TSA plans to take to expand the use of access  control covert testing, and TSA plans no further action to address this  reporting requirement.
Review Security Directives (Section 3409)
TSA made progress on the 6 requirements in Section 3409 of the 2016  ASA. Of the 6 requirements, TSA plans no further action on 4  requirements, and plans further action on 2 requirements, as shown in  appendix I. Section 3409(a) requires TSA to conduct a comprehensive  review of every current security directive addressed to any regulated  entity. Section 3409(b) requires TSA to submit notice to the appropriate  congressional committees for each new security directive TSA issues.  TSA officials stated they have a process in place to review current  security directives. For example, officials stated that they review all  current security directives on at least an annual basis, through working  groups of TSA and industry association officials. TSA stated these  working groups consider, among other things, security directives within  airport security programs and the need for revocation or revision of  current security directives and TSA plans no further action to address this  requirement. With respect to the issuance of new security directives, TSA  officials stated they provide briefings for relevant congressional  committees as requested regarding the issuance of a new security  directive and the rationale for issuing it. According to officials, further  action is planned to address these requirements for new security  directives.
section_title: TSA Identified Two 2016 ASA Requirements that May Specifically Reduce Access Control Vulnerabilities
paragraphs: While TSA officials stated that it is too early to measure the effectiveness  of the applicable requirements of the 2016 ASA, they stated that  implementing these requirements would broadly have an effect on  improving aviation security and identified two requirements that, when  implemented, may specifically reduce access control vulnerabilities. First,  in accordance with section 3404(a) of the Act, TSA plans to issue a  security directive to require airport operators to match the expiration date  of an identification badge of an aviation worker that possesses a  temporary immigration status with the individual’s U.S. work authorization  expiration date. TSA officials stated that this measure may help prevent  workers who are no longer authorized to work in the United States from  inappropriately gaining access to airport SIDAs because an expired  identification badge will prevent entry into the SIDA.
Second, in accordance with section 3405(b) of the Act, TSA coordinated  with the FBI to implement the Rap Back Service for airport operators to  recurrently vet aviation workers in October 2016. The Rap Back service  uses the FBI fingerprint-based criminal records repository to provide  recurrent fingerprint-based criminal history record checks for aviation  workers who have been initially vetted and already received airport- issued identification badge credentials. As of June 2017, TSA executed  memorandums of understanding with 105 airport operators, including 17  category X airports, and 1 airline, to complete the Rap Back enrollment  process. TSA officials stated that implementing the requirement to  recurrently vet aviation workers may also reduce vulnerabilities  associated with the insider threat. For example, they stated that  continuous vetting would increase the potential for TSA and airport  operators to be aware of aviation workers who had engaged in potentially  disqualifying criminal activity yet continued to hold active identification  badges granting access to airport SIDAs.
section_title: Agency Comments
paragraphs: We provided a draft of this product to the Secretary of Homeland Security  for comment. In its formal comments, which are reproduced in full in  Appendix II, DHS stated that TSA continues to implement the 2016 ASA  requirements. TSA provided technical comments on a draft of this report  which we incorporated as appropriate.
We are sending copies of this report to the appropriate congressional  committees, the Secretary of Homeland Security, and other interested  parties. In addition, the report is available at no charge on the GAO  website at http://www.gao.gov.
If you or your staff have any questions about this report, please contact  Jennifer Grover at (202) 512-7141 or GroverJ@gao.gov. Contact points  for our Offices of Congressional Relations and Public Affairs may be  found on the last page of this report. Key contributors to this report are  found in Appendix III.
section_title: Appendix I: TSA’s Progress in Implementing the Aviation Security Act of 2016
paragraphs: Subtitle D of the Aviation Security Act of 2016 (ASA), enacted on July  15, 2016, requires the Transportation Security Administration (TSA) to  take actions in eight categories that have a total of 69 applicable  requirements. The Transportation Security Administration (TSA) has  generally made progress addressing the 69 applicable requirements  within the 2016 ASA. As of June 2017, TSA officials stated it had  implemented 48 of the requirements and plans no further action on  these. For 18 requirements, TSA officials took initial actions and plans  further action. TSA officials stated they have yet to take action on 2  requirements and plan to address them in the near future. TSA officials  took no action on 1 requirement regarding access control rules because it  plans to address this through mechanisms other than formal rulemaking,  such as drafting a national amendment to airport operator security  programs. Because many of TSA’s actions taken in response to the 2016  ASA were recently implemented or are still ongoing and not fully  implemented, we did not assess the effectiveness of the actions taken by  TSA. The tables below present the details of each requirement, the  progress made by TSA, and the status of TSA’s plans for further action.
Section 3402 of the 2016 ASA requires TSA to, among other things,  conduct a threat assessment and submit a report regarding the threat  assessment to the appropriate congressional committees. TSA made  progress in implementing these requirements and has plans for further  action, as shown in table 1.
Section 3403 of the 2016 ASA required TSA to take actions related to  enhancing its oversight activities of aviation workers. TSA made progress  in implementing the requirements and has further actions planned, as  shown in table 2.
Section 3404 of the 2016 ASA requires TSA to take action on actions  related to updating employee credential guidance. TSA made progress in  implementing the requirements in this section and plans further actions,  as shown in table 3.
Section 3405 of the 2016 ASA required TSA to take action on  requirements related to vetting aviation workers. TSA made progress in  implementing these requirements and plans further action on certain  requirements, as shown in table 4.
Section 3406 of the 2016 ASA required TSA to, among other things,  develop and implement performance metrics to measure the  effectiveness of security for Security Identification Display Areas of  airports. TSA made progress in implementing these requirements and  plans no further action on all requirements, as shown in table 5.
Section 3407 of the 2016 ASA requires TSA to, among other things,  develop a model and best practices for unescorted access security. TSA  made progress in implementing these requirements and plans further  action on certain requirements, as shown in table 6.
Section 3408 of the 2016 ASA requires TSA to, among other things,  increase the use of red-team covert testing of access controls to any  secure areas of an airport. TSA made progress in implementing these  requirements and plans further action on certain requirements, as shown  in table 7.
Section 3409 of the 2016 ASA requires TSA to, among other things,  review all security directives to determine if they remain relevant, and  report to Congress on security directives. TSA made progress in  implementing these requirements and plans further action on certain  requirements, as shown in table 8.
section_title: Appendix II: Comments from the Department of Homeland Security
section_title: Appendix III: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Acknowledgments
paragraphs: In addition to the contact named above, Kevin Heinz (Assistant Director),  Brandon Jones (Analyst-in-Charge), Michele Fejfar, Tyler Kent, Thomas  Lombardi, Heidi Nielson, and Claire Peachey made significant  contributions to the report.