Homeland Security: FPS and GSA Should Strengthen Collaboration to Enhance Facility Security
Published: 2015-12-16T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: GAO designated federal real-property management as a high-risk area in part because of physical security challenges at federal facilities. FPS and GSA have joint responsibility for protecting federal facilities held or leased by GSA. FPS has primary responsibility for the security and protection of buildings and their occupants, whereas GSA has primary responsibility for security fixtures, maintenance, and building access.
In light of these challenges, GAO was asked to review (1) how the agencies' collaboration reflects key practices to ensure facility security and (2) the impact of their collaboration practices on day-to-day operations at the regional and facility level. GAO analyzed pertinent laws and documents, compared FPS's and GSA's collaboration efforts against GAO's selected key-collaboration practices, and interviewed agency officials at the headquarters and regional levels selected based on various factors. While the results from regions cannot be generalized, they provided illustrative examples.
section_title: What GAO Found
paragraphs: The Federal Protective Service (FPS), within the Department of Homeland Security (DHS), and the General Services Administration (GSA) have taken some steps to improve collaboration, such as drafting a joint strategy. While each agency has some individual policies for collaboration, the two agencies have made limited progress in agreeing on several key practices as described below. Reaching agreement on these practices will help to enhance the agencies' ability to protect federal facilities and to improve day-to-day operations at the regional level.
As a result of not having key practices in place, regional officials said they were not aware of agreed upon collaborative policies and procedures to conduct day-to-day operations. GAO found that this created inefficiencies and security risks. For example, FPS officials told GAO that GSA did not coordinate with them on new construction intended for law enforcement tenants, and as a result, it was not suitable for law enforcement use. GSA officials told GAO that they did not have sufficient information from FPS about security plans for upcoming events and, therefore, were not able to inform tenants of necessary security measures.
section_title: What GAO Recommends
paragraphs: GAO recommends that FPS and GSA take actions to improve their collaboration in several areas, including defining common outcomes, agreeing on roles and responsibilities, and communicating compatible policies and procedures. DHS specifically concurred with GAO's recommendations, and GSA agreed to work with FPS to address the findings.

section_title: Letter
paragraphs: Over one-million employees and a wide range of visitors seeking services  depend on the government to provide security and protection at  approximately 8,900 facilities held or leased by the General Services  Administration (GSA). Two federal agencies—the Federal Protective  Service (FPS), an agency within the Department of Homeland Security  (DHS), and GSA— are critical to ensuring security. The Homeland  Security Act of 2002 vested both the Secretary of DHS and the  Administrator of GSA with responsibilities for the protection of these  facilities. FPS is the component within DHS that has responsibility for  security and protection of the facilities, their occupants, and visitors. GSA  also has responsibility for protecting federal facilities and their grounds  and is also responsible for taking steps to improve efficiency while  managing the government’s real property portfolio and the physical  structure of facilities. FPS and GSA are very different agencies with  different cultures, approaches to staff training, and perspectives on their  missions. Nevertheless, their related missions regarding facility protection  require them to collaborate at all levels—agency headquarters, regional,  and facility levels. We designated federal real property management as a  high-risk area in part because of physical security challenges at federal  facilities. In particular, we and others have identified physical security of  federal facilities as an area facing on-going challenges specifically with  regard to collaboration between FPS and GSA. For example, we have  reported on FPS’s and GSA’s difficulty collaborating in areas including  sharing information and clearly defining roles and responsibilities. To the  extent that collaboration affects these agencies’ ability to adequately  protect facilities, security may be compromised.
In light of these challenges, you asked us to review progress in how FPS  and GSA work together to ensure that federal facilities are adequately  protected. We assessed (1) how the agencies’ collaboration reflects key  practices to ensure facility security and (2) the impact of their  collaboration practices on day-to-day operations at the regional and  facility levels.
To examine these topics, we conducted a review of pertinent laws and  DHS, FPS, and GSA regulations, policy documents, and strategic plans.  We also reviewed our prior reports related to FPS and facility security  issues published between 2005 and 2015 to identify prior findings and  recommendations related to FPS and GSA collaboration that had not  been addressed. Additionally, we reviewed our prior work on collaboration  among federal agencies. The review identified practices that can help  enhance and sustain collaboration as well as implementation  approaches. For this review, we selected six of the eight practices most  relevant to issues we have found in our prior work on facility security and  our outstanding recommendations to FPS and GSA. These practices are  described later in this report. In addition, we interviewed DHS, FPS, and  GSA headquarters officials about how they work together. Finally, we  selected four FPS and GSA regions for review of their collaborative  efforts: Region 3 (Mid-Atlantic); Region 5 (Great Lakes); Region 7  (Greater Southwest); and Region 10 (Northwest/Arctic). These four  regions comprise about one-third of all GSA leased and held facilities, are  geographically dispersed, include a mix of urban and rural federal  facilities, and a range of facility security levels (FSL). We collected  operational documents and plans, and interviewed regional managers  and directors, FPS inspectors, and GSA facility managers. We also  toured four federal facilities in the Chicago and Dallas Regions, and we  judgmentally selected these facilities based on the size and tenant  agency composition. The information obtained during the site visits and  interviews is not generalizable and cannot be used to represent the  opinions of all agency officials. We used the information from these site  visits and interviews to provide illustrative examples throughout our  report. See appendix I for more details on our scope and methodology.
We conducted this performance audit from January 2015 to December  2015 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
subsections: section_title: FPS and GSA Organization and Responsibilities
paragraphs: FPS and GSA share responsibility for protecting federal facilities. FPS is  primarily responsible for protecting federal employees and visitors in  federal facilities held or leased by GSA. Specifically, FPS’s law  enforcement and protective security services authority include: (1)  protecting federal employees and visitors in approximately 8,900 federal  facilities under the control and custody of GSA; (2) enforcing federal laws  and regulations aimed at protecting such property and persons (including  proactively patrolling facilities, responding to incidents, and exercising  arrest authority); and (3) investigating criminal offenses against these  facilities and persons. To fund its operations, FPS collects security fees  from the agencies it protects and does not receive a separate  appropriation. FPS conducts its mission by providing security services  through two types of activities: physical security activities such as conducting facility risk  assessments and recommending countermeasures—such as security  cameras, bollards, barriers, physical access control systems,  magnetometers, and x-ray machines—aimed at preventing  incidents.   law enforcement activities such as proactively patrolling facilities,  responding to incidents, conducting criminal investigations, and  exercising arrest authority.
GSA serves as the federal government’s landlord and designs, builds,  and manages facilities to support the needs of other federal agencies.  GSA funds security fixtures based on facility security level requirements  on a prioritized, funds available basis. GSA, or the entity that leases the  facility, provides project execution, maintenance, and repair of the  security fixtures. GSA also has primary responsibility for providing  facilities maintenance, space for communications equipment, and building  plans, among other services.
Both agencies conduct policy making and high-level planning at the  headquarters level. At the regional level, FPS and GSA officials serve as  the liaisons from headquarters to the facility level and have responsibility  for implementing policies and managing communications. At the facility  level, FPS recommends the execution of security countermeasures,  provides incident response, and supports emergency plans, whereas  GSA manages the government properties. There have been a number of  changes over the past decade in structure and authority of government  security for federal facility security, especially for FPS. For example, FPS  was a component of GSA until 2003, when it transferred to DHS.  FPS  is currently located within DHS’s National Protection and Programs  Directorate (NPPD). See figure 1 for an overview of key FPS and GSA  security and protection roles, responsibilities, and operational  relationships as outlined in a 2006 memorandum of agreement (MOA)  concerning the security of GSA-controlled space.
section_title: Facility Security Challenges
paragraphs: The areas in which our prior work has found facility security challenges  that FPS faces in carrying out its mission, and between FPS and GSA,  focus on operational issues, such as conducting entrance screenings and  assessing risk at federal facilities; overseeing FPS’s protective security  officers; and collaborating with federal, state, and local entities.  Further, between FPS and GSA, we have previously found problems with  the quality of data exchanged between GSA and FPS on facilities and  their locations. As such, we have made previous recommendations to  FPS and GSA related to improving their collaboration. For example, in  March 2012, we recommended that GSA ensure that efforts to identify the  jurisdictions of all GSA facilities are completed and that the data are  provided to FPS so that FPS is better equipped to manage jurisdictional  roles and responsibilities at GSA facilities. At the time of our 2012 report,  FPS lacked complete data from GSA on the jurisdiction of about one-third  of the facilities it protects. Since that time, GSA has made progress with  identifying facility jurisdictions. Furthermore, in August 2012, we  recommended that FPS coordinate with GSA and other federal tenant  agencies to reduce any unnecessary duplication in security assessments  of facilities held or leased by GSA. According to ISC guidance, as the  security organization for such facilities, FPS is required to conduct risk  assessments on a scheduled and recurring basis. FPS has reported  progress regarding this issue; however, as of November 2015, the  agency has not yet provided us with documentation of its efforts to  address the recommendation. Therefore, this recommendation remains  open. In light of these previously identified operational challenges, in this  report, we focused on how FPS’s and GSA’s working relationship reflects  key collaboration practices.
section_title: Practices That Can Enhance and Strengthen Collaboration
paragraphs: In our prior work, we have identified eight key collaboration practices that  we have used to assess collaboration at a range of federal agencies.  These practices can help agencies to implement actions to operate  across boundaries, including developing compatible policies and  procedures and fostering open lines of communication. We also found  that positive working relationships among participants from different  agencies bridge organizational cultures, and these relationships can build  trust and foster communication, which facilitates collaboration. Given  many federal agencies’ long-standing challenges working across  organizational lines, following these practices could help agencies to  enhance and sustain collaboration at all organizational levels. For this  review, to assess FPS and GSA collaboration, we focused on six of eight  practices identified in our prior work that are particularly relevant to  collaboration between FPS and GSA (see fig. 2). These collaboration  practices focus on outcomes and strategies, roles and responsibilities,  and policies and procedures to facilitate working across agency  boundaries. See appendix II for a detailed overview of all eight  collaboration practices.
section_title: FPS and GSA Collaborate to Some Extent, but Could Strengthen Efforts in Several Areas
subsections: section_title: FPS and GSA Have Not Fully Defined or Articulated a Common Outcome or Established Mutually Reinforcing or Joint Strategies
paragraphs: While FPS and GSA officials have drafted a joint strategy, the agencies  have not defined and articulated a common outcome or fully established  mutually reinforcing or joint strategies because they have not agreed on  how they will work together to achieve their respective missions. In our  prior work, we have found that the collaborative effort requires agency  staff working across agency lines to define and articulate the common  federal outcome or purpose they are seeking to achieve. We also found  that collaborating agencies need to establish strategies that work in  concert with those of their partners. In 2012, FPS and GSA drafted, and  subsequently received comments on, a joint strategy that includes a  common outcome. The document defines an overarching strategic goal of  having a federal facility critical infrastructure that balances public access,  security, and resiliency to enable continuity of operations and rapid  recovery from all hazards. The document also includes objectives that  focus on priority activities and describes some of the challenges that exist  in securing federal facilities. The draft joint strategy establishes priorities  for enhancing the security and resilience of federal facilities. The two  agencies had not agreed on how to proceed with negotiations on the draft  joint strategy until the completion of our audit work in October 2015. At  that time, FPS officials told us that before finalizing the joint strategy, they  plan to complete the following documents: (1) an updated MOA (which  will be discussed in the next section); (2) the Control Systems  Cybersecurity Strategy for Federal Facilities; and (3) the Government  Facilities Sector Specific Plan. As of October 2015, they have no  timeline for completing these other efforts or the joint strategy. Joint  strategies help in aligning the partner agencies’ activities, core processes,  and resources to accomplish a common outcome, and the continuing  lack of agreement on common security outcomes and strategies could  limit FPS’s and GSA’s ability to fully protect federal facilities and their  tenants and visitors.
section_title: FPS and GSA Have Not Fully Agreed on Roles and Responsibilities
paragraphs: FPS and GSA officials told us that they have not fully agreed on roles and  responsibilities for their related missions regarding facility protection  because they have not completed discussions on how they will work  together based on changes in the facility security environment since  2006. However, as of August 2015, after being stalled for several years,  FPS and GSA resumed negotiations on roles and responsibilities. Our  prior work supports the value of agencies working together to define and  agree on their respective roles and responsibilities. FPS’s and GSA’s  facility security roles and responsibilities are documented in regulation,  statutes, and policies, some of which are outdated or incomplete (See  app. III for more details on these requirements). Among these documents  is the 2006 MOA between the two agencies, which has a stated purpose  to address roles, responsibilities, and operational relationships between  FPS and GSA concerning the security of GSA-controlled space. The  MOA lists services provided by FPS and GSA, outlines law- enforcement and physical-security responsibilities, and identifies the need  for the two agencies to share information and jointly address security  concerns in specific areas, such as new construction and repair and  alteration projects. The MOA remains in effect; however, as a result of  policy and organization changes affecting roles and responsibilities not  reflected in the 2006 MOA, some information is outdated and incorrect.   Figure 3 describes policy and organizational changes affecting roles and  responsibilities not reflected in the 2006 MOA. We have previously  reported that written agreements are most effective when they are  regularly updated and monitored.
In our prior work, we have reported on delays in updating the MOA, and  in 2012, we recommended that the Administrator of GSA ensure that the  agency identifies the jurisdictions of all GSA buildings and that these data  are provided to FPS officials to better equip them to manage roles and  responsibilities at GSA buildings, and an updated MOA would help GSA  implement the needed changes to address this issue.
FPS and GSA officials at the headquarters level have not been able to  agree on the level of detail about roles and responsibilities or the services  that should be included in the MOA. After resuming negotiations in  August 2015, according to GSA, the issues needing further negotiation  include: more detailed information on FPS’s billing to GSA for security  costs and timely completion of facility security assessments (FSA).  According to FPS, the issues needing further negotiations include: more  clearly defining roles and responsibilities to improve FPS and GSA  collaboration on security matters and clarifying language that may have  previously been subject to misinterpretation by parties in the field. As of  October 2015, FPS and GSA officials told us that they plan to address the  responsibilities for the condition of countermeasures—such as security  cameras, magnetometers and x-ray machines—and fixtures—such as  bollards, guard booths, and blast-resistant windows—at facilities in  updating the MOA. They also told us that GSA plans to add Public  Buildings Service (PBS) as a negotiating partner because: (1) FPS  normally works with PBS on implementing countermeasures; (2) PBS has  engineering expertise; and (3) PBS creates and manages the building  system in regard to an agency’s portion of the bill. However, FPS and  GSA officials also told us that they have not developed a timeframe for  completing negotiations on the MOA.
At the regional level, FPS and GSA officials at the four regions we  interviewed told us that an updated MOA would be helpful. Generally,  officials told us that they often rely on established working relationships  and informal means of communicating and that an updated MOA could  clarify roles and responsibilities, particularly in the areas that have  changed since the 2006 MOA was established. For example, according to  these officials, security systems are now more integrated than when the  MOA was written. As a result, it is not always clear where the  responsibility lies for the purchase and maintenance of certain security  countermeasures. GSA owns facility access control systems and,  according to FPS officials, has objected to FPS connecting intrusion  detection systems to these access control systems. As such, officials told  us that some facility access control systems have been inoperable while  GSA and FPS determine which agency will do what. In November 2015,  GSA headquarters officials told us that GSA is in the process of updating  failing physical access control systems and legacy systems nationwide.  As security technology advances, lack of clarity on roles and  responsibilities for these systems could result in security gaps potentially  leaving the tenants, the public, and the facilities at risk. At the completion  of our audit work in October 2015, FPS and GSA headquarters officials  told us that they plan to work together to integrate countermeasures  within facilities as existing technology reaches the end of its lifecycle.
section_title: FPS and GSA Have Not Fully Collaborated in Communicating Existing Policies and Procedures
paragraphs: We have previously found that as agencies bring diverse cultures to the  collaborative effort, it is important to address these differences to enable  a cohesive working relationship and to create the mutual trust required to  enhance and sustain their working relationship. To facilitate collaboration  among agencies with different cultures, agencies need to address the  compatibility of policies and procedures that will be used in this effort.  However, in this review, we found that the FPS and GSA regional officials  we spoke to were not always aware of policies and procedures to operate  across agencies and regions because FPS and GSA have not fully  collaborated in communicating established policies and procedures. As a  result, the regions rely on informal communication between the agencies  for day-to-day operations. Our prior collaboration work has found that  agencies that articulate their agreements in formal documents can  strengthen their commitment to working collaboratively. Once formal  agreements are documented, agencies must also have a process in place  for implementing such agreements at all organizational levels and across  agency boundaries. For example, our work has shown that, by having a  process in place to obtain and share information on potential threats to  federal facilities, agencies can better understand the risks they face and  more effectively determine what preventive measures should be  implemented. Without policies and procedures that are well understood  at all levels—headquarters, regions, and facilities—it is more difficult to  share information and coordinate consistently and effectively.
During our review, we found that, in some cases, FPS and GSA have  their own policies and procedures for collaboration with other agencies,  such as in the case of FPS’s Regional Information Sharing Plan. FPS  developed this plan in 2009, and it provides policies and procedures for  the collection, review, analysis, and dissemination of criminal or national  security information within FPS and to stakeholders, and it also requires  dissemination to the GSA Regional Officer of Security. However, in the  regions we reviewed, several officials said they did not know of formal  policies and procedures related to collaborating on facility protection  issues. For example, GSA officials at one region told us that their role, as  compared with FPS’s role, in the protection of federal facilities is not  clearly defined and said that they were unaware of formal security  standards, policies, and procedures for GSA. The officials told us it  makes it difficult to do their jobs without the ability to link security activities  to joint security management procedures. A GSA official at another region  we interviewed noted a lack of planning and guidance related to facility  security, a lack that could lead to duplicative efforts, confusion regarding  roles and responsibilities, and an inability to monitor whether FPS and  GSA meet their security requirements. GSA officials from these two  regions said that in their previous experience at other agencies, they had  more specific policies and procedures that help guide their efforts.
FPS and GSA officials in all four regions we visited told us that policies  and procedures related to facility protection are not always clear, in part,  because the MOA has not been updated for changes in security  practices. An updated MOA would drive needed changes in policies and  procedures. The lack of collaboration in communicating compatible  policies and procedures makes it difficult for the agencies to effectively  implement their security mission and can negatively affect day-to-day  operations. For example, we reported in 2009 that in the absence of  comprehensive plans, many aspects of homeland-security information  sharing can be ineffective and fragmented—a situation that could result in  greater vulnerability to security threats.
section_title: FPS and GSA Have Not Jointly Developed Mechanisms to Monitor, Evaluate, and Report on Results or Reinforce Accountability for Collaboration through Agency Plans and Reports
paragraphs: FPS and GSA officials have not jointly developed mechanisms to monitor,  evaluate, and report on the results of their shared responsibilities or ways  to reinforce accountability for collaborative efforts through agency plans  and reports. FPS and GSA officials have not yet focused on these areas  of collaboration. The officials told us that updating the MOA will provide  them an opportunity to develop ways to address these practices. Our  prior work has found that when agencies monitor, evaluate, and report on  the results of collaboration, they can better identify areas for  improvement. Further, agencies contributing to the same or similar results  should collaborate to ensure that goals are consistent. The agencies’  plans and reports can reinforce accountability by aligning goals and  strategies with the collaborative effort, and, in turn, public reporting can  reinforce accountability for results. In this review, we found that FPS  and GSA individually monitor specific areas of facility security—FPS  completes facility security assessments (FSA), and GSA conducts an  annual tenant survey on satisfaction with facilities, which includes three  questions about security. However, the two agencies have not developed  the mechanisms to monitor their shared responsibilities. For example,  while the 2006 MOA calls for FPS to provide data to GSA on specific  actions, such as completed countermeasures and copies of executive  summaries of FSAs, it does not require the two agencies to monitor,  evaluate, or report on the results of these efforts.
Further, FPS’s and GSA’s security-related performance measures, which  allow agencies to track progress in achieving their goals, and to assist in  monitoring and evaluating results, are limited. For example, NPPD’s  strategic plan does include two performance measures for FPS; GSA’s  strategic plan does not include any security-related performance  measures. Specifically, NPPD tracks the percentage of tenants satisfied  with the level of security provided at federal facilities and the percentage  of evaluations conducted at high-risk facilities that found no deficiencies  related to countermeasures. FPS has many other security-related  responsibilities, as described above, which contribute to the agency’s  performance. Performance measures that align with agency-wide goals  and missions can facilitate developing better mechanisms to monitor and  evaluate results. Further, because FPS and GSA have not developed  mechanisms to monitor and evaluate their collaboration for facility  protection, the agencies do not have the means in place to systemically  identify areas for improvement. It may be more challenging for the  agencies to develop mechanisms to monitor, evaluate, and report on  results, and to incorporate collaborative goals into their respective plans  and reports, without having first defined and articulated a common  outcome—the first of the key practices we assessed in this review.
With regard to plans and reports, at a high level, both agencies’ strategic  plans mention the importance of collaboration with other agencies in  general and, therefore, can function as a tool to drive collaboration with  relevant agencies and partners. However, the plans do not align goals  and strategies to the agencies’ collaborative efforts. As such, the plans do  not serve to facilitate reinforcing agency accountability to ensure that FPS  and GSA’s related missions are accomplished.
section_title: FPS’s and GSA’s Incomplete Collaboration Creates Inefficiencies and Security Risks at the Regional Level
paragraphs: FPS’s and GSA’s incomplete collaboration, particularly with regard to  three key collaboration practices—the lack of agreement on roles and  responsibilities, communicating compatible policies and procedures, and  mechanisms to monitor, evaluate, and report on results—essential  elements to organizing joint efforts and facilitating decision making across  agency boundaries—makes day-to-day operations more challenging and  creates inefficiencies and security risks at the regional level, as discussed  below.
In our prior work and in this review, we found cases in which the MOA laid  out roles and responsibilities that FPS or GSA did not consistently follow.  For example, in 2009, we reported that FPS was not following a  requirement of the MOA that it share the results of FSAs with GSA. FPS  believed that the FSA executive summary contained sufficient information  for GSA to make decisions about purchasing and implementing FPS’s  recommended countermeasures. However, GSA officials at all levels said  that the FSA executive summary did not contain enough information on  threats and vulnerabilities. Moreover, GSA security officials told us that  FPS does not consistently share FSA executive summaries across all  regions. This lack of information sharing highlights the need for additional  policies and procedures. We recommended that the Director of FPS  reach consensus with GSA and tenant agencies on what information GSA  needs to fulfill its facility security responsibilities. In February 2014, FPS  implemented our recommendation by issuing a policy directive on the  implementation of FSAs that outlines a policy for sharing FSAs with GSA  and ensuring that sensitive information is safeguarded.
Although developing this directive is a positive step toward improving  collaboration, in this review, we found that FPS still inconsistently shares  FSAs with GSA at the four regions we reviewed. For example, GSA  officials at one region told us that although FSAs had not always been  shared in the past, FPS now shares the information and provides the  assessments. Conversely, GSA officials from another region we visited  said that FPS does not always share FSAs. For instance, the GSA  officials said that FPS sometimes does not provide facility managers with  the appropriate FSA information and that the facility manager first  becomes aware of the FSA during the facility security committee (FSC)  meeting. Similar to what we found in 2009, GSA officials from this  region expressed a need for an updated MOA to help clarify information  sharing issues. In October 2015, FPS officials told us that they have  addressed GSA’s concerns involving sharing FSAs. For example, FPS  officials said, as a result of changing their assessment tool, the FSC now  receives complete copies of the FSAs. We previously reported that  information sharing and coordination among organizations is crucial to  producing comprehensive and practical approaches and solutions to  address security threats directed at federal facilities. As discussed  above, we previously found that written agreements are most effective  when they are regularly updated and monitored. In that same work, we  found a case in which the ineffective implementation of a written  agreement between two federal government agencies likely led to  sporadic and limited collaboration among the two agencies. Similarly,  without properly implementing written agreements such as the 2006  MOA, FPS and GSA may experience some of these same challenges,  and according to one of the key collaboration practices we have  identified, the lack of mechanisms to monitor, evaluate, and report on  results makes it difficult to identify and remedy cases of inconsistent  implementation at the regional level.
During our review, we found that FPS and GSA communicate informally  at the regional level in the absence of formal policies and procedures.  GSA officials from two of the four regions we interviewed told us that they  rely on working relationships to keep things running smoothly because  they are not aware of compatible policies and procedures. For example,  GSA officials in one region told us that FPS regional officials brief them  on security threats quarterly. GSA officials added that FPS and GSA  regional officials also meet to discuss security incidents, changes in ISC  standards, and new GSA space requirements. The GSA regional officials  told us that they are working with their FPS counterparts to create a joint  regional-information-sharing strategy. FPS officials in another region told  us that they hold quarterly meetings with GSA regional officials to discuss  security issues, including upcoming events, such as protests, that could  affect facility security, as well as how and when to inform tenant agencies  about actions they need to take, such as expanded telework, during the  events.
Informal communication is part of a collaborative relationship and may  enable the agencies to conduct day-to-day operations, but it may also  result in inefficiencies and less than optimal use of resources, as well as  security risks. Regional officials provided us with examples of  construction and alteration projects, personnel redeployment, security  incidents, and threat-based reporting that could have benefitted from  policies and procedures and more formal communication to ensure  security. We found that these regional examples most closely relate to  three of the six collaboration practices we included in our review: (1)  agreeing on roles and responsibilities; (2) establishing compatible policies  and procedures; and (3) developing mechanisms to monitor, evaluate,  and report on results. See table 3 for examples of some of these  inefficiencies and security risks and the effect at the regional level.
FPS’s and GSA’s reliance on informal communication at the regional level  and resulting inefficiencies from a lack of information sharing, echo  findings from our prior work on FPS’s facility protection. We have  previously found that in the post-September 11 era, it is crucial that  federal agencies work together to share information to advance homeland  security and critical infrastructure-protection efforts. The ability to share  security-related information can unify the efforts of federal agencies in  preventing or minimizing terrorist attacks. However, we found that many  aspects of homeland-security information sharing can be ineffective and  fragmented. FPS officials are sometimes reluctant to share information  that they consider law enforcement sensitive, and this reluctance can  have an impact on GSA’s ability to manage its facilities and on  collaboration between the two agencies to ensure security.  As we  previously found, GSA has raised strong arguments for having this  information, and FPS could do more to resolve this situation. We  concluded that FPS and GSA should share information in a timely  manner to support homeland security and critical infrastructure-protection  efforts and that, without a greater focus on defining the consistency,  frequency, and content of communication between the agencies, FPS  would be ill-equipped to sufficiently mange facility security as new threats  emerge.
In October 2015, FPS and GSA officials acknowledged that  communication among the agencies at the regional level can be  improved. The officials told us that they will begin monthly meetings  between key FPS and GSA officials to develop a strategy for improving  communication at the regional level.
The incomplete implementation of key collaboration practices— particularly with regard to agreement on roles and responsibilities,  compatible policies and procedures, and mechanisms to monitor,  evaluate, and report on results—leaves day-to-day operational decisions  to the regional and facility levels, a situation that may result in  inconsistent management practices among regions across the country.  As noted in the cases above, this practice could lead to FPS and GSA not  making the best use of limited resources to build and renovate facilities,  and may increase security lapses, putting facilities, tenants and the public  at greater risk.
section_title: Conclusion
paragraphs: The nature of FPS’s and GSA’s related missions for federal facility  security and protection and the presence of potential threats to these  facilities require effective collaboration. At the same time, the agencies  have different cultures, training, and ways of operating, which can present  additional challenges to working well together. To meet these challenges,  FPS and GSA have taken some steps to improve collaboration over the  past year, and as of October 2015, FPS and GSA officials stated that they  plan to address several of these issues. For example, drafting a joint  strategy and, in August 2015, resuming negotiations to update the 2006  MOA that outlines FPS’s and GSA’s facility security roles and  responsibilities represent positive efforts. Agreeing on and articulation of  a common outcome that is consistent with the two agencies’ related  agency goals and missions and finalizing a joint strategy to align their  efforts, could help FPS and GSA to improve their working relationship.  Reaching agreement in these key areas will help to enhance the  agencies’ ability to protect federal facilities and has become more  pressing given how much has changed in the security environment since  the original MOA was put in place nearly 10 years ago. Communicating  existing policies and procedures, within both agencies, for operating  across agency boundaries could help to improve the inconsistency in day- to-day communication and operations across the regions. Further,  establishing mechanisms to monitor, evaluate, and report on the results  of the agencies’ efforts to accomplish their mission, or a means to ensure  agency accountability for collaboration through agency plans and reports  can help ensure that agencies achieve intended results. Without working  to strengthen these key collaboration practices, FPS and GSA risk their  ability to meet their mission to adequately identify and address serious  security risks.
section_title: Recommendations for Executive Action
paragraphs: Given the collaboration challenges that FPS and GSA face in protecting  federal facilities, we are making four recommendations to the Secretary of  Homeland Security and the Administrator of the General Services  Administration. Specifically, we recommend that the DHS Secretary direct  FPS to take and that the GSA Administrator take the following actions:      1.  FPS and GSA headquarters officials should establish a plan with  timeframes for reaching agreement on a joint strategy and finalizing it  in order to define and articulate a common understanding of expected  outcomes and align the two agencies’ activities and core processes to  achieve their related missions.  2.  FPS and GSA headquarters officials should establish a plan with  timeframes for reaching agreement on the two agencies’ respective  roles and responsibilities for federal facility security, and update and  finalize the two agencies’ MOA accordingly.   3.  FPS and GSA headquarters officials should develop a process to  ensure that compatible policies and procedures, including those for  information sharing, are communicated at the regional level so that  regional officials at both agencies have common information on how  to operationalize the two agencies’ collaborative efforts.  4.  FPS and GSA headquarters officials should develop mechanisms to  monitor, evaluate, and report on their collaborative efforts to protect  federal facilities in order to identify possible areas for improvement  and to reinforce accountability.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to DHS and GSA for their review and  comment, and both agencies provided written comments in response.  DHS concurred with our recommendations and provided actions and  timeframes for completion. DHS’s official written response is reprinted in  appendix IV. GSA agreed with our findings and agreed to work with FPS  to address them. GSA’s official written response is reprinted in appendix  V. DHS’s and GSA’s responses are a positive step toward addressing our  recommendations, and we look forward to updates on the agencies’  progress as these efforts move forward. DHS and GSA also provided  technical comments, which we incorporated as appropriate.
DHS officials stated that they are working to update their respective roles  and responsibilities and to define a joint strategy and outcome for federal  facility protection. Specifically, DHS stated that the MOA will include roles  and responsibilities for each organization where there are clear  dependencies. DHS also stated that in collaboration with GSA, FPS will  document how field personnel can better execute their responsibilities.  Furthermore, DHS stated that FPS and GSA headquarters personnel  have agreed to meet monthly to review and address identified areas for  improvement, and the officials expect to further define mechanisms to  monitor, evaluate, and report on their collaborative efforts to protect  federal facilities during these monthly meetings.
As agreed with your office, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies to the appropriate  congressional committees, the Secretary of Homeland Security, the  Administrator of the General Services Administration, and other interested  parties. In addition, the report is available at no charge on the GAO web  site at http://www.gao.gov.  If you or your staff have any questions about  this report, please contact me at (202) 512-2834 or rectanusl@gao.gov.  Contact points for our Offices of Congressional Relations and Public  Affairs may be found on the last page of this report. GAO staff who made  major contributions to this report are listed in appendix VI.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: The objectives of our report were to assess (1) how the agencies’  collaboration reflects key practices to ensure facility security and (2) the  impact of their collaboration practices on day-to-day operations at the  regional and facility levels. To obtain contextual information and establish  criteria for our work, we reviewed our prior reports and other reports and  literature related to FPS, collaboration between agencies, and facility  security and protection issues published between 2005 and 2015 to  identify issues, prior findings, and recommendations related to FPS and  GSA collaboration that had not been addressed. We identified eight  practices described in our previous work that can help enhance and  sustain collaboration as well as implementation approaches. We  selected six of the eight practices most relevant to issues we identified in  our prior work on facility security and collaboration to assess the status of  FPS and GSA collaborative efforts and how they affect the agencies’  operations. We selected the following six practices: define and articulate a common outcome, establish mutually reinforcing or joint strategies, agree on roles and responsibilities, establish compatible policies, procedures, and other means to operate develop mechanisms to monitor, evaluate, and report on results, and reinforce agency accountability for collaborative efforts through  agency plans and reports.
Additional interagency collaboration practices we did not select for our  review include: (1) identify and address needs by leveraging resources  and (2) reinforce individual accountability for collaborative efforts through  performance management systems. We did not select these two  practices because they were less relevant to FPS and GSA collaboration  issues we have previously identified. See Appendix II for a detailed  overview of all eight collaboration practices.
To assess the status of FPS and GSA efforts to collaborate for their  related missions of facility security and protection, we reviewed  Department of Homeland Security (DHS), NPPD, FPS, and GSA  regulations, policy documents, and strategic plans. We also reviewed the  2006 Memorandum of Agreement between DHS and GSA that defines  the security responsibilities of FPS and GSA at federal facilities, as well  as a draft FPS and GSA joint strategic plan for protection of federal  facilities. In addition, we reviewed Presidential Policy Directive 21, which  refined and clarified roles and responsibilities for critical infrastructure and  emphasized overall collaboration among agencies. We also reviewed  pertinent laws and presidential executive orders, the Homeland Security  Act of 2002, Titles 6, 40, and 41 of the United States Code, and  Presidential Executive Orders 12977 and 13286, which describe FPS and  GSA protection authorities. In addition, we reviewed the Government  Performance and Results Act (GPRA) of 1993, the GPRA Modernization  Act of 2010, and Office of Management and Budget Circular A11, which  define federal agencies’ responsibilities for creating strategic plans, goals,  and measures. We interviewed DHS, FPS, and GSA headquarters  officials about their regulations, policies, plans, agreements, regional and  facility level operations, and ongoing efforts to improve federal facility  security collaboration through implementation of our six selected  collaboration practices. We also interviewed Interagency Security  Committee officials about their efforts to improve federal facility security  collaboration.
To assess how FPS and GSA collaboration affects day-to-day operations  at the regional and facility levels, we selected four FPS and GSA regions  for review: Region 3 (Mid-Atlantic); Region 5 (Great Lakes); Region 7  (Greater Southwest); and Region 10 (Northwest/Arctic). We selected  these four regions because they comprise about  41 percent of all GSA  leased and owned facilities, are geographically dispersed, and include a  mix of urban and rural federal facilities and a range of FSLs. During our  reviews of these four regions, we collected FPS and GSA operational  documents, plans, policies, and procedures. We interviewed FPS and  GSA regional managers and directors about their respective facility  security collaborative efforts and how the status of FPS and GSA  collaboration and implementation of our six selected collaboration  practices affect their operations. During our visits to the Chicago and  Dallas Regions, we judgmentally selected two facilities to tour in each  region based on the size and tenant agency composition. During our  tours of these four facilities, we observed how FPS and GSA collaborate  at the facility level to provide security, and interviewed FPS security  officers and GSA facility managers about their collaborative efforts to  provide facility security and about how the status of FPS and GSA  collaboration and implementation of our six selected collaboration  practices affect their operations. We also reviewed Facility Security  Committee (FSC) meeting minutes for the four regions we reviewed. We  requested the most recent FSC meeting minutes for five facilities at each  of the four regions we reviewed based on interviews with FPS and GSA  regional officials, facilities we visited, and the tenant make-up and size of  a facility. In reporting on how FPS and GSA collaboration affects day-to- day operations at the regional and facility levels, we focus on three of the  six practices that most closely related to the issues we found in the  regions we visited, including: (1) agreeing on roles and responsibilities;  (2) establishing compatible policies, procedures, and other means to  operate across agency boundaries; and (3) developing mechanisms to  monitor, evaluate, and report on results. The information we obtained  during our site visits and interviews is not generalizable and cannot be  used to represent the opinions of all agency officials. We used the  information from these site visits and interviews to provide illustrative  examples throughout our report.
We conducted this performance audit from January 2015 to December  2015 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
section_title: Appendix II: Key Collaboration Practices
paragraphs: In our prior work, we have identified eight key collaboration practices that  we have used to assess collaboration at a range of federal agencies.  Agencies can enhance and sustain their collaborative efforts by engaging  in these eight practices. Running throughout these practices are a  number of factors such as leadership, trust, and organizational culture  that are necessary elements for a collaborative working relationship. See  table 3 below for a detailed overview of all eight collaboration practices.
section_title: Appendix III: Established Federal Protective Service’s (FPS) and General Services Administration’s (GSA) Roles and Responsibilities
section_title: Appendix IV: Comments from the Department of Homeland Security
section_title: Appendix V: Comments from the General Services Administration
section_title: Appendix VI: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Amelia Shachoy (Assistant  Director), Geoffrey Hamilton, Raymond Griffith, Judy Guilliams-Tapia,  Matthew Latour, Michael Mgebroff, Amy Rosewarne, Kelly Rubin, John  Sheehan, and Sarah Veale made significant contributions to this report.