Homeland Security: Further Actions Needed to Coordinate Federal Agencies' Facility Protection Efforts and Promote Key Practices
Published: 2004-11-30T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The war on terrorism has made physical security for federal facilities a governmentwide concern. The Interagency Security Committee (ISC), which is chaired by the Department of Homeland Security (DHS), is tasked with coordinating federal agencies' facility protection efforts, developing protection standards, and overseeing implementation. GAO's objectives were to (1) assess ISC's progress in fulfilling its responsibilities and (2) identify key practices in protecting federal facilities and any related implementation obstacles.
section_title: What GAO Found
paragraphs: ISC has made progress in coordinating the government's facility protection efforts. In recent years, ISC has taken several actions to develop policies and guidance for facility protection and to share related information. Although its actions to ensure compliance with security standards and oversee implementation have been limited, in July 2004, ISC became responsible for reviewing federal agencies' physical security plans for the administration. ISC, however, lacks an action plan that could be used to provide DHS and other stakeholders with information on, and a rationale for, its resource needs; garner and maintain the support of ISC member agencies, DHS management, Office of Management and Budget, and Congress; identify implementation goals and measures for gauging progress; and propose strategies for addressing various challenges it faces, such as resource constraints. Without an action plan, ISC's strategy and time line for implementing its responsibilities remain unclear. s ISC and agencies have paid greater attention to facility protection in recent years, several key practices have emerged that, collectively, could provide a framework for guiding agencies' efforts. These include allocating resources using risk management; leveraging security technology; coordinating protection efforts and sharing information; measuring program performance and testing security initiatives; realigning real property assets to mission, thereby reducing vulnerabilities; and, implementing strategic human capital management, to ensure that agencies are well equipped to recruit and retain high-performing security professionals. GAO also noted several obstacles to implementation, such as developing quality data for risk management and performance measurement, and ensuring that technology will perform as expected.

section_title: Letter
paragraphs: The war on terrorism has made physical security for federal facilities a  governmentwide concern. The federal government owns or leases  hundreds of thousands of facilities, with the vast majority concentrated in  the Departments of Defense (DOD), Veterans Affairs (VA), State (State),  Energy (DOE), and the Interior (Interior); the General Services  Administration (GSA); and the U.S. Postal Service (USPS). The makeup of  these facilities reflects the diversity of agencies’ missions and includes  office buildings, military installations, hospitals, embassies, border  stations, laboratories, and park visitor centers.
After the September 11, 2001, attacks, Congress passed the Homeland  Security Act of 2002, which created the Department of Homeland Security  (DHS). In creating DHS, the government’s efforts to prevent, protect  against, and respond to potential terrorism—including terrorism directed  at federal facilities—were centralized. As a result of the act, DHS assumed  responsibility for chairing the Interagency Security Committee (ISC). ISC,  which has representation from all the major property-holding agencies and  was established after the bombing of the Oklahoma City federal building,  has a range of governmentwide responsibilities related to protecting  nonmilitary facilities. These generally involve developing policies and  standards, ensuring compliance and overseeing implementation, and  sharing and maintaining information. Although ISC was established to  bring a central focus to the government’s efforts and provide a forum for  sharing key practices and lessons learned in protecting facilities, we  reported in September 2002 that ISC was having limited success in fulfilling  its responsibilities, because of the lack of consistent and aggressive  leadership by GSA, inadequate staff support and funding for ISC, and ISC’s  difficulty in making decisions.
Our objectives were to (1) assess ISC’s progress in fulfilling its  responsibilities and (2) identify key practices in protecting federal facilities  and any related implementation obstacles. To assess ISC’s progress in  fulfilling its responsibilities, we interviewed the Executive Director of ISC;  analyzed ISC publications and other documents; considered prior GAO  work; and reviewed various laws and policies, including the Homeland  Security Act of 2002. We also reviewed the executive order that established  ISC, a subsequent executive order that amended it in connection with the  transfer of ISC’s function to DHS, and relevant homeland security policy  directives. To identify key practices, we systematically analyzed 170 GAO  and Inspector General (IG) reports issued since 1995 that addressed  homeland security and terrorism issues and pertained to facility protection.  We also contracted with the National Academy of Sciences (NAS) to  convene a symposium of experts on key practices in facility protection.  Appendix II contains the symposium agenda and identifies the panelists.  We also interviewed officials and analyzed documents from DHS and the  major property-holding agencies, including DOD, VA, State, DOE, Interior,  GSA, and USPS. For the purpose of this review, we defined key practices as  those activities that, on the basis of our analysis, were recommended by  GAO and others, acknowledged by agencies, and validated by experts in  the area. More information on our scope and methodology appears in  appendix I. We did our work from November 2003 through October 2004 in  accordance with generally accepted government auditing standards.
subsections: section_title: Background
paragraphs: Terrorists have targeted federal facilities several times over the past 10  years. After the 1995 bombing of the Alfred P. Murrah Federal Building in  Oklahoma City, the Department of Justice created minimum-security  standards for federal facilities. In October 1995, the President signed  Executive Order 12977, which established ISC. ISC was expected to  enhance the quality and effectiveness of security in, and protection of,  facilities in the United States occupied by federal employees for  nonmilitary activities and to provide a permanent body to address  continuing governmentwide security issues for federal facilities. ISC is  expected to have representation from all the major federal departments  and agencies, as well as a number of key offices. ISC’s specific  responsibilities under the executive order generally relate to three areas:  developing policies and standards, ensuring compliance and overseeing  implementation, and sharing and maintaining information. Related to  policies and standards, the executive order specifically states that ISC is to  establish policies for security in and protection of federal facilities;   develop and evaluate security standards for federal facilities;   assess technology and information systems as a means of providing  cost-effective improvements to security in federal facilities;  develop long-term construction standards for those locations with  threat levels or missions that require blast-resistant structures or other  specialized security requirements; and  evaluate standards for the location of, and special security related to,  day care centers in federal facilities.
In the area of compliance and oversight, ISC is to develop a strategy for  ensuring compliance with facility security standards and oversee the  implementation of appropriate security measures in federal facilities. And,  related to sharing and maintaining information, ISC is to encourage  agencies with security responsibilities to share security related intelligence  in a timely and cooperative manner and assist with developing and  maintaining a centralized security database of all federal facilities.
Since September 11, the focus on protecting the nation’s critical  infrastructure has been heightened considerably. The Homeland Security  Act of 2002 and other administration policies assigned DHS specific duties  associated with coordinating the nation’s efforts to protect critical  infrastructure, and Homeland Security Presidential Directive Number 7  (HSPD-7) stated that DHS’s Secretary was responsible for coordinating the  overall national effort to identify, prioritize, and protect critical  infrastructure and key resources. Under the Homeland Security Act of  2002, the Federal Protective Service (FPS) was transferred from GSA to  DHS and, as a result of this transfer, DHS assumed responsibility for ISC in  March 2003.
In September 2002, we reported that ISC was having limited success in  fulfilling its responsibilities. Specifically, ISC had made little or no  progress in areas including developing and establishing policies for  security in and protection of federal facilities and developing a strategy for  ensuring compliance with security standards. In January 2003, we  designated federal property as a high-risk area, in part due to the threat of  terrorism against federal facilities. As the government’s security efforts  continue to intensify, and real property-holding agencies employ such  measures as searching vehicles that enter federal facilities, restricting  parking, and installing concrete bollards, important questions continue to  be raised regarding the level of security needed to adequately protect  federal facilities and how the security community should proceed. Figure 1  shows bollards installed at the Jacob Javits Federal Building in New York,  New York. Additionally, questions concerning the cost-effectiveness and  impact of various practices have emerged as the nation faces a protracted  war on terrorism.
section_title: ISC Has Made Progress but Faces Challenges in Fulfilling Some of Its Major Responsibilities
paragraphs: ISC has made progress in coordinating the government’s facility protection  efforts and has been given a prominent role in reviewing agencies’ physical  security plans for the administration since we last reported on this issue. In  September 2002, we reported that ISC, at that time, had made little or no  progress in key elements of its responsibilities, such as developing policies  and standards for security at federal facilities; ensuring compliance with  security standards and overseeing the implementation of appropriate  security in federal facilities; and related to information, developing a  centralized security database of all federal facilities. Agency  representatives identified several factors that they believe contributed to  ISC’s limited progress. These factors included (1) the lack of consistent and  aggressive leadership by GSA, (2) inadequate staff support and funding for  ISC, and (3) ISC’s difficulty in making decisions. Nonetheless, there were  areas where we observed some progress over its then 7-year existence. For  example, ISC had developed and issued security design criteria and  minimum standards for building access procedures; disseminated  information to member agencies on entry security technology for buildings  needing the highest security levels; and, through its meetings and working  groups, provided a forum for federal agencies to discuss security-related  issues and share information and ideas.
In commenting on the September 2002 report, GSA, which at the time had  responsibility for chairing ISC, agreed to take action to address the  shortcomings we identified. In March 2003, in accordance with the  Homeland Security Act of 2002, FPS was transferred from GSA to DHS. As  a result, DHS assumed responsibility for chairing ISC, and the executive  order establishing ISC was amended to reflect the transfer of this function  from GSA to DHS. Transferring responsibility for ISC to DHS reflected the  shift to having homeland security activities centralized under one cabinet- level department. Within DHS, the role of chairing ISC was subsequently  delegated to the Director of FPS in January 2004.
Since our 2002 report, ISC has made clear progress in developing policies  and standards and maintaining and sharing information. Related to policies  and standards, ISC issued security standards for leased space in July 2003,  and OMB has approved them. These standards address security  requirements for leased facilities and, according to an ISC official, are  currently being used by ISC member agencies as a management tool. In  June 2003, ISC issued guidance on escape hoods for federal agencies and,  in October 2003, ISC issued an update to its May 2001 Security Design  Criteria for New Federal Office Buildings and Major Modernization  Projects. According to an FPS official, GSA is incorporating ISC’s Security  Design Criteria in the construction of new facilities. More recently, ISC  became involved with Homeland Security Presidential Directive Number 12  (HSPD-12), issued in August 2004, which seeks to standardize identification  for federal employees and contractors. According to the directive, wide  variations in the quality and security of forms of identification used to gain  access to federal facilities, where there is a potential for terrorist attacks,  need to be eliminated. ISC’s Executive Director informed us that he was  asked to be a member of the White House Homeland Security Council  Coordination Committee for HSPD-12. This ISC official would provide the  leadership role for this committee and ensure that physical security  requirements for the federal government, as they relate to the directive, are  included and coordinated with ISC members.
Related to its role in maintaining and sharing information, ISC has  developed a Web site for posting policies and guidance and is developing a  secure Web portal for member agencies to exchange security guidance and  other information. Also, according to the Executive Director of ISC,  standard operating procedures were approved by ISC members in June  2004 and were finalized in September 2004. These operating procedures are  intended to improve the quality of information sharing among member  agencies at its meetings by establishing standards for attendance and  participation at ISC meetings. For example, each ISC agency representative  is required to attend all meetings or delegate a person to attend to ensure  full participation. Finally, DHS is developing a governmentwide facilities  database that the ISC Executive Director believes will meet ISC’s  responsibility to assist with developing and maintaining a centralized  security database of all federal facilities. This database will list functions  and services that are mission critical, map federal assets and their critical  infrastructure, and identify key resources for both cyber and physical  security protection. According to ISC’s Executive Director, ISC members  are an integral part of this process and will ensure that the required support  from within their departments and agencies is provided.
subsections: section_title: New Role Could Provide Vehicle for Addressing Responsibilities Related to Ensuring Compliance and Overseeing Implementation
paragraphs: Despite progress in its other areas of responsibility, ISC has not developed,  as specified in its 1995 executive order, a strategy for ensuring compliance  with security standards among agencies and overseeing the  implementation of appropriate security measures in federal facilities.  However, in July 2004, the administration made ISC responsible for  annually reviewing and approving physical security plans that agencies are  required to develop under a presidential homeland security policy  directive. HSPD-7, issued in December 2003, establishes a national policy  for federal departments and agencies to identify and prioritize critical  infrastructure and key resources in the United States so that they can be  protected from terrorist attacks. The directive makes DHS responsible for  overseeing the implementation of the directive and outlines the roles and  responsibilities of individual agencies. Among the roles and responsibilities  delineated, HSPD-7 establishes an annual reporting cycle for agencies to  evaluate their critical infrastructure and key resources protection plans for  both cyber and physical security. ISC’s Executive Director informed us that  in July 2004, the administration designated ISC as the oversight body for  agencies’ physical security plans. According to ISC’s Executive Director,  ISC’s role will be to review, approve, or disapprove each department or  agency’s physical security plan.
If ISC were to successfully fulfill its new responsibilities under HSPD-7,  which would be done under the broader umbrella of the administration’s  central planning and coordination efforts for homeland security, it would  represent a major step toward meeting its responsibilities that relate to  oversight and compliance monitoring, as specified in the 1995 executive  order under which it was established. That is, the 1995 executive order that  established ISC specified that ISC should develop a strategy for ensuring  agencies’ compliance with governmentwide facility protection standards  and oversee the implementation of appropriate security measures in  federal facilities. By having a role in reviewing agencies’ physical security  plans in relation to HSPD-7, ISC would have a vehicle for carrying out its  existing responsibility related to compliance and oversight. Appendix III  identifies each of ISC’s major responsibilities under the executive order  and actions it has taken to date to fulfill them.
section_title: ISC Faces Challenges to Fulfilling Its Responsibilities
paragraphs: ISC’s Executive Director identified several challenges that relate to ISC’s  many roles and responsibilities in coordinating the government’s facility  protection efforts. These included the following:  reaching a consensus with agencies on a risk management process for  the government that is reasonable and obtaining funding for this  activity;  addressing the issue of leased government space and the impact that  new physical security standards for leased space will have on the real  estate market;  developing a compliance process for agencies that can also be used as a  self-assessment tool to measure the effectiveness of ISC;  educating senior level staff from across the government and gaining  their support for ISC activities; and overall,   integrating all physical security initiatives for the entire federal  government and implementing change.
We agree that ISC faces these challenges and, furthermore, that they will  have to be addressed in order for ISC to be successful. More specifically,  the sheer magnitude of integrating the government’s facility protection  initiatives, which ISC and FPS officials identified, is formidable because it  involves many different agencies and varying perspectives on security.  Furthermore, in discussing the challenges associated with leased property,  ISC’s Executive Director touched on one of several long-standing problems  in the federal real property area that have implications for facility  protection policy. As reported in GAO’s 2003 high-risk report on federal real  property, the government’s historical reliance on costly leased space— which achieves short-term budget savings but is more costly over the  longer term—is problematic. To the extent that private sector lessors are  required to enhance the security of their property for federal tenants, the  associated costs will likely be passed on to the government in the form of  higher rent.
Another long-standing problem that could affect ISC as it attempts to meet  its responsibilities is the historically unreliable nature of agency real  property data. Poor data could make it difficult for agency management to  implement and oversee comprehensive risk-based approaches to  protecting their facilities. As discussed later, risk management, as it  pertains to facility protection, relies heavily on accurate and timely data. At  the governmentwide level, inventory data maintained by GSA for the entire  government, and financial data on property reported in the government’s  financial statements, have also been historically unreliable.
Another challenge identified by ISC’s Executive Director—obtaining  adequate resources for its activities—is a particular concern. According to  the Executive Director of ISC, as the ISC’s only full-time staff person, his  ability to ensure that all of ISC’s responsibilities are fulfilled is limited. Also,  according to this official, ISC is dependent entirely on participation and  input from member agencies. ISC’s Executive Director said that, in the  past, getting buy-in and support from senior officials in member agencies  had been a challenge. It seems, however, that given ISC’s new role in the  administration’s homeland security efforts, it could make a persuasive case  for a sustained level of support from agencies. Also, it is important to note  that DHS has certain responsibilities under the executive order that  established ISC to ensure it has adequate resources. Specifically, the  executive order states that “to the extent permitted by law and subject to  the availability of appropriations, the Secretary of Homeland Security  should provide ISC with such administrative services, funds, facilities,  staff, and other support services as may be necessary for the performance  of its functions.” According to ISC’s Executive Director, current ISC  resources are not sufficient for ISC to meet all of its evolving  responsibilities. This official told us that additional funding for ISC will not  be available until fiscal year 2006. However, given the prominent role ISC  will be playing in the administration’s homeland security efforts, it will be  critical for DHS to help ISC undertake activities that will allow it to fulfill  its responsibilities, address other challenges it faces, and ultimately be  successful.
Given the challenges ISC faces, its new responsibility related to HSPD-7 for  reviewing agencies’ physical security plans, and the need to sustain  progress it has made in fulfilling its responsibilities, ISC would benefit from  having a clearly defined action plan for achieving results. Although ISC has  taken steps to address challenges, such as seeking additional resources for  fiscal year 2006, it lacks an action plan that could be used to (1) provide  DHS and other stakeholders with detailed information on, and a rationale  for, its resource needs; (2) garner and maintain the support of ISC member  agencies, DHS management, OMB, and Congress; (3) identify  implementation goals and measures for gauging progress in fulfilling all of  its responsibilities; and (4) propose strategies for addressing the challenges  ISC faces. Such a plan could incorporate the strategy for ensuring  compliance with facility protection standards that is required under ISC’s  executive order, but has not yet been developed. Without an overall action  plan for meeting this and other responsibilities, ISC’s strategy and time line  for these efforts remain unclear.
Having an effective ISC is critically important to the government’s overall  homeland security efforts as new threats emerge and agencies continue to  focus on improving facility protection. Prior to 1995, there were no  governmentwide standards for security at federal facilities and agencies’  efforts to coordinate and share information needed improvement. Without  standards and mechanisms for coordination, there were concerns about  the vulnerability of federal facilities to acts of terrorism. As recently as  August 2004, information from DHS showed that threats against high- profile facilities in the New York area and Washington, D.C., are still a  major concern.
section_title: Key Practices in Federal Facility Protection
paragraphs: As ISC and agencies have paid greater attention to facility protection in  recent years, several key practices have emerged that collectively could  provide a framework for guiding agencies’ efforts. As discussed in more  detail later, ISC could play a vital role in promoting key practices in relation  to its information sharing responsibilities. Key facility protection practices  that we identified include allocating security resources using risk  management, leveraging the use of security technology, coordinating  protection efforts and sharing information with other stakeholders, and  measuring program performance and testing security initiatives. In  addition, we determined that two other practices GAO has highlighted as  governmentwide issues also have implications for the facility protection  area. These include realigning real property assets to agencies’ missions,  thereby reducing vulnerabilities, and strategic human capital management,  to ensure that agencies are well equipped to recruit and retain high- performing security professionals. Our analysis—based on our work and  Inspector General (IG) reports, the views of the NAS symposium experts in  facility protection, and interviews with federal agencies—showed that  attention to these key practices could provide a framework for guiding  agencies’ efforts and achieving success in the facility protection area.  Figure 2 identifies each of these key practices.
subsections: section_title: Using Risk Management Prioritizes Limited Security Resources
paragraphs: Our discussions with the major property-holding agencies and analysis of  documents we obtained showed that each agency used some form of risk  management to protect its facilities. Some examples of how agencies  applied risk management are as follows:  According to officials with FPS, which protects federally owned or  occupied facilities held by GSA and DHS, security needs and related  countermeasures are prioritized based on the level of risk to a particular  facility. Risk is determined by evaluating the impact of loss and  vulnerability that each specific threat would have on a facility.  According to these officials, FPS inspectors are trained to make  educated decisions on applicable countermeasures to the identified  threats and vulnerabilities on a recurring basis.
We have reported that, for many years, DOE has employed risk-based  security practices. To manage potential risks, DOE uses a classified  document referred to as a “design basis threat” (DBT). The DBT  identifies the potential size and capabilities of terrorist forces and is  based on information DOE gathers from the intelligence community.  DOE requires contractors operating its sites to provide sufficient  protective forces and equipment to defend against the threat contained  in the DBT. DOE updated its 1999 DBT in May 2003 to better reflect  current and projected terrorist threats in the aftermath of September 11.
VA conducts physical security assessments and prioritizes its protection  efforts for critical infrastructure, according to VA officials. The phases  of the assessment include defining the criticality of VA facilities,  identifying and analyzing vulnerabilities of VA’s critical facilities, and  identifying appropriate countermeasures. According to VA documents,  VA determines vulnerability by factors such as facility population,  number of floors in the facility, and the presence or absence of armed  officers. This assessment also includes a procedure for scoring and  prioritizing identified vulnerabilities at each assessed site.
We have reported that DOD requires its installations to assess, identify,  and evaluate potential threats to the installation; identify weaknesses  and countermeasures to address the installation’s vulnerabilities; and  evaluate and rank criticality of the installation’s assets to achieving  mission goals. These three assessments serve as the foundation of  each DOD installation’s antiterrorism plan. The results of the  assessments are used to balance threats and vulnerabilities and to  define and prioritize related resource and operational requirements.
Interior’s Office of Law Enforcement and Security (OLES) has identified  16 Interior assets as needing special consideration because they are  critical to the nation’s infrastructure or are national icons that could be  targets for symbolic reasons. Having a rationale such as this, for  focusing on certain assets, represents Interior’s approach to risk  management at the departmentwide level.
According to USPS officials, USPS’s physical security program  incorporates a risk assessment methodology and a layered approach to  facility security. This effort involves annual security surveys of facilities  conducted by facility security control officers and periodic  comprehensive reviews at larger core postal facilities by the Postal  Inspection Service, which is the investigative branch of USPS.
In commenting on this report, State noted that another example of an  agency’s use of risk management is State’s Long-Range Overseas  Buildings Plan (LROBP). LROBP is a 6-year plan, updated yearly, that  identifies embassy and consulate facilities most in need of replacement  due to unacceptable security, safety, and/or operational conditions.  State also said that the plan identifies State’s facilities’ program  objectives and prioritizes competing facility requirements with input  from the Bureaus of Overseas Buildings Operations (OBO) and  Diplomatic Security (DS), State’s Regional Bureaus, and other overseas  agencies. State indicated that the LROBP provides a road map for  addressing long-term facility needs under the Capital Security  Construction Program, Regular Capital Construction Program, as well  as major rehabilitation, compound security, and other programs.  According to State’s comments, to prepare the plan, each year OBO and  DS meet with the regional bureaus to discuss which posts should move  into the “top 80” list, which contains the 80 primary posts requiring  replacement for security reasons, and for which, by law, the department  can spend security capital construction appropriations. Furthermore,  with respect to the original full list of facilities that need replacement,  the department, working with intelligence agencies, prioritizes these  facilities.
At the NAS symposium, a private sector security expert discussed a risk  management methodology in use by FPS at GSA and Internal Revenue  Service facilities. We did not review the usefulness or effectiveness of this  methodology. Nonetheless, the methodology is an example of one risk  management process that is in use. The process, called Federal Security  Risk Management, or FSRM, is a risk matrix that compares credible threats  with assets and assesses the impact of loss and vulnerability. According to  the panelist, agencies use the risk matrix to apply security upgrades to the  risks deemed unacceptable and reevaluate the countermeasures until a  desired level of risk reduction is achieved. The agencies then develop  design or retrofit specifications and criteria. This risk assessment cycle  generally spans a 2-to-4 year time period. According to the panelist, once  unacceptable risks are addressed through countermeasures, agencies need  to reevaluate risks and vulnerabilities on an ongoing basis.
section_title: Leveraging Security Technologies Can Enhance Facility Protection
paragraphs: By efficiently using technology to supplement and reinforce other security  measures, vulnerabilities that are identified by the risk management  process can be more effectively addressed with appropriate  countermeasures. Our work showed broad concurrence among GAO, IGs,  facility security experts, and agency experts that making efficient use of  security technology to protect federal facilities is a key practice, but that  the type of technology to use should be carefully analyzed. For example, in  reporting on border security and information security issues in 2003, we  found that prior to significant investment in a project, a detailed analysis  should be conducted to determine that benefits of a technology outweigh  costs, as well as to determine the effects of the technology on areas such as  privacy and convenience. In the facility access control area, we also  reported that agencies should decide how technology will be used and  whether to use technology at all to address vulnerabilities before  implementation. According to our 2003 testimony on using technologies  to secure federal facilities, technology implementation costs can be high,  particularly if significant infrastructure modifications are necessary.
Another consideration is that lesser technological solutions sometimes  may be more effective and less costly than more advanced technologies.  For example, as we reported in 2002, trained dogs are an effective and time- proven tool for detecting concealed explosives. By using the risk  management process and balancing costs, benefits, and other concerns,  agencies can efficiently leverage technologies to enhance facility  protection.
Among the advanced technologies that were identified during our review  were smart cards—which use integrated circuit chips to store information  on individuals—and biometrics—which analyze human physical and  behavioral characteristics—to verify the identity of employees.  Furthermore, sophisticated detection and surveillance systems such as  closed circuit television (CCTV) have also aided in securing facility  perimeters and monitoring activity in the building. Such technologies  expand surveillance capabilities and can free up security staff for other  duties. Several GAO and IG reports indicated that agencies currently have a  wide array of security technologies available for protecting facilities,  including smart cards, biometrics, X-ray scanners, and CCTV. As we  reported in 2002, technologies identified as countermeasures through the  risk management process support the following three integral concepts for  security:   Protection—Provides countermeasures such as policies, procedures,  and technical controls to defend assets against attacks.
Detection—Monitors for potential breakdowns in protective  mechanisms that could result in security breaches.
Reaction—Responds to detected breaches to thwart attacks before  damage can be done.
In GAO’s April 2002 testimony on security technologies, we categorized the  security technologies by which security concept they supported. Figure 3  lists the technologies and provides descriptions of each.
Several of the major property-holding agencies we contacted use various  security technologies to protect their facilities. For example, to control  access to its embassies, State employs alarm systems, arrest barriers to  stop vehicles, audio/video monitoring equipment, explosive detection  devices and metal detectors, and X-ray machines. Officials at USPS  indicated that various detection technologies are used to secure its  facilities against biological and radiological agents. For example, as we  reported in 2002, USPS installed high-efficiency particulate air (HEPA)  filtration systems at some facilities to protect them from biohazards.  HEPA filtering technology is designed to remove particulate biohazards  and other particles.
Currently, GSA is conducting a smart card pilot program for two federal  buildings in New York City. Although the first cards went into use in  October 2003, planning for the pilot program began before the September  11 terrorist attacks. One of the federal buildings participating in the  program is the Jacob Javits Federal Building, which houses approximately  35 agencies and more than 7,000 federal employees. All of the employees  participating in the program use smart cards to enter the building. In  addition to a person’s name, title, and picture, the smart card contains  multiple layers of data substantiating the card’s authenticity and personal  biometric data of the cardholder. Employees use the smart cards at access  portals near the building’s entrances (see fig. 4). After the portal has read  the smart card and validated the user, glass doors swing apart to allow  entry. If the threat level is raised under the homeland security advisory  system, the building access technology requires additional security  procedures (e.g., entering a personal identification number (PIN), matching  a stored biometric record). Although agencies’ use of smart cards in the  building has been optional, all of the agencies in the Javits building are  currently participating in the pilot program, including the Federal Bureau  of Investigation, the Small Business Administration, and the Department of  Housing and Urban Development.
Overall, it was evident during our review that agencies are already using or  experimenting with a range of technologies in their facility protection  efforts. In terms of key practices, it is important to note that focusing on  obtaining and implementing the latest technology is not necessarily a key  practice by itself. Instead, having an approach that allows for cost- effectively leveraging technology to supplement and reinforce other  measures would represent an advanced security approach in this area.  Also, linking the chosen technology to countermeasures identified as part  of the risk management process provides assurance that factors such as  purpose, cost, and expected performance were addressed.
section_title: Information Sharing and Coordination among Federal Agencies and the Private Sector Can Help Agencies Better Protect Their Assets
paragraphs: Information sharing and coordination among organizations is crucial to  producing comprehensive and practical approaches and solutions to  address terrorist threats directed at federal facilities. Our work showed a  broad consensus—on the basis of prior GAO and IG work and information  from agencies and the private sector—that by having a process in place to  obtain and share information on potential threats to federal facilities,  agencies can better understand the risk they face and more effectively  determine what preventive measures should be implemented. In  considering the implications that information sharing and coordination  have for facility protection efforts, it is useful to look at how this practice is  being approached governmentwide, at the agency level, and at the  individual facility level.
At the governmentwide level, DHS is expected to play a critical role in  information sharing and coordination in most homeland security areas,  including facility protection. In September 2003, we reported that  information sharing was critical for DHS to meet its mission of preventing  terrorist attacks in the United States, reducing vulnerability to terrorist  attacks, and minimizing damage and assisting with recovery if attacks do  occur. In 2003, we also reported that to accomplish its mission, DHS  needed to access, receive, and analyze law enforcement information,  intelligence information, and other threat, incident, and vulnerability  information from federal and nonfederal sources and analyze this  information to identify and assess the nature and scope of terrorist threats.  Furthermore, we reported that DHS should share information both  internally and externally with agencies, law enforcement, and first  responders. As we testified in September 2003, we have made numerous  recommendations to DHS to improve information sharing and coordination  to accomplish its homeland security responsibilities. These  recommendations involved, for example,  incorporating existing information-sharing guidance contained in  various national strategies and the information-sharing procedures  required by the Homeland Security Act of 2002;  establishing a clearinghouse to coordinate the various information- sharing initiatives to eliminate possible confusion and duplication of  effort;   fully integrating states and cities into a national policy-making process  for information sharing and taking steps to provide greater assurance  that actions at all levels of government are mutually reinforcing;   identifying and addressing perceived barriers to federal information-  using survey methods or related data collection approaches to  determine, over time, the needs of private and public organizations for  information related to homeland security and to measure progress in  improving information sharing at all levels of government.
In addition to those recommendations, we identified a need for a  comprehensive plan to facilitate information sharing and coordination to  protect critical infrastructure in our August 2004 testimony on  strengthening information sharing for homeland security. We reported  that such a plan could encourage improved information sharing by clearly  delineating roles and responsibilities of federal and nonfederal entities,  defining interim objectives and milestones, setting time frames for  achieving objectives, and establishing performance measures. DHS has  concurred with the above recommendations to improve information  sharing and coordination and is in various stages of implementing them.  These recommendations clearly have implications for the facility  protection area, by, for example, increasing coordination among facility  stakeholders that would reduce duplicative efforts and reinforce protection  strategies.
The emphasis on information sharing and coordination is also evident in  the National Strategy for Homeland Security and its related strategies to  protect critical infrastructure, including federal facilities. According to the  national strategy, successfully protecting facilities will rely on effective  information sharing and coordination among multiple entities as part of the  nation’s broader homeland security efforts. In the related National  Strategy for the Physical Protection of Critical Infrastructure and Key  Assets, information sharing is a common theme. This strategy calls for the  federal government to work with various stakeholders to, among other  things, develop processes for visitor screening, assess vulnerabilities,  develop construction standards, and implement security technology. With  regard to national icon protection, the strategy recommends that Interior  work with other agencies, the public, and the private sector to define  criticality criteria, assess vulnerabilities, conduct security awareness  programs, and collaborate to protect national icons outside the purview of  the federal government. Related to dams, the strategy recommends that  DHS work with other agencies, dam owners, and local and state officials to  assess risks and institute a national dam security program.
At the agency level, the agencies we contacted provided several examples  of their activities related to information sharing and coordination. These  activities are described in table 1.
In addition to agencywide efforts, coordination and information sharing is  important at the individual facility level. As we have previously reported,  protecting federal facilities requires facility security managers to involve  multiple organizations to effectively coordinate and share information to  prevent, detect, and respond to terrorist attacks. Security managers  typically are not aware of potential threats to their facilities and depend on  intelligence from other organizations to prevent and/or deter attacks. For  example, according to officials from VA, due to limited resources and its  lack of an intelligence gathering capability, VA must rely on other agencies  to gain threat information. Additionally, security managers have to  coordinate and share information with state and local governments to  respond to terrorist attacks and do not have direct access to the range of  emergency resources required to respond to terrorist attacks. They rely on  state and local governments to provide first-responder services such as  firefighting, medical personnel, and other emergency services. They also  rely on local police and the judicial process to enforce and prosecute  violators of the laws and regulations governing the protection of federal  facilities. As such, at the individual facility level, security managers are less  equipped to make informed decisions about security without effective  information sharing and coordination.
One way managers at the individual facility level may become better  informed is if they take advantage of emerging efforts by the government to  disseminate targeted threat information. For example, one recent DHS  effort to increase information sharing and coordination among security  stakeholders is its Homeland Security Information Network. According to  DHS’s Web site, this unclassified network consists of Internet, phone, fax,  and pager communications systems that provides DHS with constant  access to real-time threat information from public and private industries  and agencies. DHS can also use the network to send targeted alert  notifications and other threat information to states, cities, and others,  which can then collect and disseminate this information among those other  entities involved in combating terrorism. A base of locally knowledgeable  experts governs and administers the network with the support of DHS  regional coordinators.
section_title: Performance Measurement Can Ensure Accountability for Achieving Broad Program Goals and Improved Security
paragraphs: Performance measurement can help achieve broad program goals and  improve security at the individual facility level. Our analysis showed a  consensus among various stakeholders that performance measurement is a  key practice that agencies should follow. Although using performance  measurement for facility protection is a practice that—based on our  analysis—is in the early stages of development, several initiatives at three  levels—governmentwide policy, agency, and facility-specific—demonstrate  how performance measurement is being approached in the facility  protection area.
At the governmentwide policy level, the National Strategy for Homeland  Security addresses the threat of terrorism in the United States by  organizing the domestic efforts of federal, state, local and private  organizations. It aligns and focuses homeland security functions into six  mission critical areas, set forth as (1) intelligence and warning, (2) border  and transportation security, (3) domestic counterterrorism, (4) protecting  critical infrastructures and key assets, (5) defending against catastrophic  terrorism, and (6) emergency preparedness and response. As mentioned  before in relation to information sharing and coordination, the National  Strategy for the Physical Protection of Critical Infrastructures and Key  Assets incorporates facility protection efforts and identifies a set of  national goals and objectives. The strategy outlines the guiding principles  that will underpin the government’s efforts to secure the infrastructures  and assets vital to national security, governance, public health and safety,  the economy, and public confidence. It also provides a unifying  organizational structure and identifies specific initiatives to drive the  government’s near-term national protection priorities and inform the  resource allocation process. According to the strategy, the strategic  objectives that underpin our national critical infrastructure and key asset  protection effort include the following:  identifying and assuring the protection of those infrastructures and  assets that are deemed most critical in terms of national-level public  health and safety, governance, economic and national security, and  public confidence consequences;  providing timely warning and assuring the protection of those  infrastructures and assets that face a specific, imminent threat; and  assuring the protection of other infrastructures and assets that may  become terrorist targets over time by pursuing specific initiatives and  enabling a collaborative environment in which federal, state, and local  governments and the private sector can better protect the  infrastructures and assets they control.
These strategies are national in scope, cutting across all levels of  government, and involve a large number of organizations and entities  including federal, state, local, and private sectors. We have testified that  these national strategies are the starting point for federal agencies and that  the ultimate measure of this and other strategies’ value will be the extent  they are useful as guidance for policy and decision makers in allocating  resources. Related to facility protection, the strategic objectives are  useful in providing a context and a broader framework for agencies, as they  develop agencywide and facility-specific goals and measures to determine  if their specific facility protection efforts are achieving desired results.
subsections: section_title: Security Goals Can Be Tied to Broader Agency Mission Goals
paragraphs: At the agency level, we have reported that tying security goals to broader  agency mission goals can help federal agencies measure the effectiveness  and ensure accountability of their security programs. One tool that  agencies can use is the Government Performance and Results Act of 1993  (GPRA). Under GPRA, agencies are to prepare 5-year strategic plans that  set the general direction for their efforts. These plans are to include  comprehensive mission statements, general and outcome-related goals,  descriptions of how those goals will be achieved, identification of external  factors that could affect progress, and a description of how performance  will be evaluated. Agencies are to then prepare annual performance plans  that establish connections between the long-term goals in the strategic  plans with the day-to-day activities of program managers and staff. These  plans are to include measurable goals and objectives to be achieved by a  program activity, descriptions of the resources needed to meet these goals,  and a description of the methods used to verify and validate measured  values. Finally, GPRA requires that the agency report annually on the  extent to which it is meeting its goals and the actions needed to achieve or  modify those goals that were not met.
GPRA provides a framework under which agencies can identify  implementation time lines for facility protection initiatives and adherence  to related budgets. We did not assess the extent to which agencies were  using GPRA to develop agencywide facility protection or security-related  goals. However, we noted one agency that ties its strategic security goals to  GPRA is the Defense Threat Reduction Agency (DTRA) at DOD. DTRA’s  2003 strategic plan contains most of the elements in a strategic plan  developed using GPRA standards. DTRA plays a key role in addressing  the threats posed by weapons of mass destruction (WMD), and its  specialized capabilities and services are used to support civilian agencies’  efforts to address WMD threats, particularly the efforts of DOE and DHS.  DTRA also provides training for emergency personnel responding to WMD  incidents and assesses the vulnerability of personnel and facilities to WMD  threats.
DTRA’s strategic plan lays out the agency’s five goals, which serve as the  basis of its individual units’ annual performance plans: (1) deter the use  and reduce the impact of WMD, (2) reduce the present threat, (3) prepare  for future threats, (4) conduct the right programs in the best manner, and  (5) develop people and enable them to succeed. These long-term goals are  further broken down into four or five objectives, each with a number of  measurable tasks under each objective. These tasks have projected  completion dates and identify the DTRA unit responsible for the specific  task. For example, under the goal “deter the use and reduce the impact of  WMD” is the objective “support the nuclear force.” A measurable task  under this objective is to work with DOE to develop support plans for  potential resumption of underground nuclear weapons effects testing. The  technology development unit in DTRA was expected to complete this task  by the fourth quarter of fiscal year 2004.
section_title: At the Individual Facility Level, Active Testing and Drills Can Help Gauge the Adequacy of Facility Protection
paragraphs: Our work showed examples where federal agencies were testing security  measures by conducting inspections and assessments to ensure that  adequate levels of protection are employed. For example, officials at  Interior said that after September 11, one of its bureaus began conducting  full-risk assessments at all of its facilities, in order of importance. As part of  one of its regularly scheduled assessments at one location, Interior  received assistance from DTRA, which performed an assessment of  vulnerabilities. According to Interior officials, DTRA officials looked at  whether the resulting effect from various types of attack would affect the  mission capabilities of the location. After the assessment, DTRA made  recommendations to Interior officials for strengthening security.  Consequently, Interior officials took actions to improve security and  scheduled plans for follow-up.
In another example, the Interior IG reported in August 2003 on its security  assessment of National Park Service (NPS) parks. During the review,  Interior IG officials identified some serious deficiencies with the overall  security program and made recommendations to remedy these problems.  For example, the IG’s assessment revealed that necessary security  enhancements were delayed or wholly disregarded, that management  officials lacked situational awareness, and that other officials lacked the  expertise and resources to effectively assess, determine, and prioritize  necessary security actions. This type of active testing is useful in exposing  vulnerabilities and developing countermeasures.
According to DOE officials, DOE’s Performance Assurance Program  requires that performance testing determine the effectiveness of facility  protection systems and programs. DOE conducts inspections to ensure  that proper levels of protection are consistent with standards it has  established. Assessments are made of the sites’ ability to prevent  unacceptable, adverse impact on national security or on the health and  safety of DOE and contract employees, the public, or the environment. The  adequacy of safeguards and security measures are then validated through  various means such as surveys, periodic facility self-assessments, program  reviews and inspections, and assessments.
In addition to testing facility access control through inspections and site  surveys, we found examples of security programs that tested the  effectiveness of physical security measures such as structural  enhancements, physical barriers, and blast-resistant windows. Blast- resistance in buildings is generally provided by passive features such as  additional reinforcement and connections in the structural frame for  increased malleability, composite fiber wraps to prevent shattering of  columns and slabs, and high-performance glazing materials that resist blast  pressures. In both field tests and experience (for example, the attack on the  Pentagon), these measures have been quite effective in reducing the  devastating effects of deliberate explosions and, consequently, reducing  casualties as well.
In March 2004, a panelist from DOD at the NAS symposium indicated that  blast testing is also important in the prevention of injuries resulting from  progressive collapse of buildings and flying debris. He reported that 87  percent of the deaths occurred in the collapsed portion of the Alfred P.  Murrah Federal Building in Oklahoma City, and only 5 percent of the deaths  occurred in the uncollapsed portion of the building. Furthermore, another  panelist noted that 70 of the over 2,000 publicly reported terrorist incidents  worldwide, since 1970, were directed at buildings. Most of these have  involved large vehicle bombs, incendiary bombs, or rocket-propelled  grenades.
Training exercises and drills are also useful in assessing preparedness. We  have reported that effective security also entails having a well-trained staff  that follows and enforces policies and procedures. In these reports, we  found breaches in security resulting from human error are more likely to  occur if personnel do not understand the technologies, risks, and the  policies that are put in place to mitigate them. Furthermore, good training  and practice are essential to successfully implementing policies by  ensuring that personnel exercise good judgment in following security  procedures. Presidential Decision Directive (PDD) 39 requires key federal  agencies to maintain well-exercised capabilities for combating terrorism.  Exercises test and validate policies and procedures, test the effectiveness  of response capabilities, increase the confidence and skill levels of  personnel, and identify strengths and weaknesses in responses before they  arise in actual incidents. Counterterrorism exercises also include activities  where agency officials discuss scenarios around a table or other similar  setting, and field exercises, where agency leadership and operational units  actually deploy to practice their skills and coordination in a realistic field  setting. Overall, training, as it relates to facility protection, provides  decision makers with data on performance in various scenarios. Training is  also discussed later in this report in relation to strategic human capital  management.
section_title: Aligning Assets to Mission Can Reduce Security Vulnerabilities
paragraphs: Excess and underutilized real property at federal agencies is a long- standing and pervasive problem that has implications for the facility  protection area. Along with the need to secure facilities against the threat  of terrorism, excess property and the need to realign the federal real  property inventory were among the reasons GAO designated federal real  property as a high-risk area in January 2003. To the extent that agencies  are expending resources to maintain and protect facilities that are not  needed, funds available to protect critical assets may be lessened. Our past  work showed examples where funds spent to maintain and protect excess  property were significant. For example, we reported in January 2003 that  DOD estimates it is spending $3 billion to $4 billion each year maintaining  facilities that are not needed. In another example, costs associated with  excess DOE facilities, primarily for security and maintenance, were  estimated by the DOE IG in April 2002 to exceed $70 million annually. One  building that illustrates this problem is the former Chicago main post  office. In October 2003, we testified that this building, a massive 2.5 million  square foot structure located near the Sears Tower, is vacant and costing  USPS $2 million annually in holding costs. It is likely that other agencies  that continue to hold excess or underutilized property are also incurring  significant holding costs for services including security and maintenance.
Given the need to realign the federal real property inventory so that it  better reflects agencies’ missions, agencies that can overcome this problem  may reap benefits in the facility protection area. That is, funds no longer  spent securing and maintaining excess property could be put to other uses,  such as enhancing protection at critical assets that are tied to agencies’  missions. VA’s Capital Asset Realignment for Enhanced Services (CARES)  initiative, which VA started in October 2000, is an example where a  realignment effort is under way. In the mid-1990s, VA began shifting its role  from being a traditional hospital-based provider of medical services to an  integrated delivery system that emphasizes a full continuum of care with a  significant shift from inpatient to outpatient services. Subsequently, VA  began the CARES initiative so that it could reduce its large inventory of  buildings, many of which are underutilized or vacant.
section_title: “Rightsizing” the Overseas Presence
paragraphs: The administration’s effort to “rightsize” the nation’s overseas presence  demonstrates how giving consideration to security, people, and facilities  could be approached as part of an asset realignment framework. During  2000, an interagency effort led by the Department of State began to assess  staffing of U.S. embassies and consulates to determine whether there were  opportunities to improve mission effectiveness and reduce security  vulnerabilities and costs by relocating staff. This process, referred to as  rightsizing, was initiated in response to the November 1999  recommendations of the Overseas Presence Advisory Panel (OPAP). In  the aftermath of the August 1998 bombings of U.S. embassies in Africa,  OPAP determined that overseas staffing levels had not been adjusted to  reflect the changing missions and requirements; thus, some embassies and  consulates were overstaffed, and some were understaffed. The framework  provides a systematic approach for assessing workforce size and  identifying options for rightsizing, both at the embassy level and for making  related decisions worldwide. It links staffing levels to three critical  elements of overseas diplomatic operations: (1) physical/technical security  of facilities and employees, (2) mission priorities and requirements, and (3)  cost of operations.
The first element includes analyzing the security of embassy buildings, the  use of existing secure space, and the vulnerabilities of staff to terrorist  attack. The second element focuses on assessing embassy priorities and  the staff’s workload requirements. The third element involves developing  and consolidating cost information from all agencies at a particular  embassy to permit cost-based decision making. Unlike an analysis that  considers the elements in isolation, the rightsizing framework encourages  consideration of a full range of options, along with the security, mission,  and cost trade-offs. With this information, decision makers would then be  in a position to, for example, determine whether rightsizing actions are  needed either to add staff, reduce staff, or change the staff mix at an  embassy. Options for reducing staff could include outsourcing functions or  relocating functions to the United States or to regional centers. In May  2002, we testified that the use of this approach for the U.S. embassy in Paris  was successful in identifying security concerns and finding alternative  locations for staff, such as in the United States or other cities in Europe.  In April 2003, we reported that the rightsizing framework could be applied  at U.S. embassies in developing countries. We later testified in April 2003  that OMB should expand the use of the rightsizing framework and that  State adopt additional measures to ensure that U.S. agencies take a  systematic approach to assessing workforce size that considers security,  mission, and cost factors. GAO also recommended that State develop  guidance on a systematic approach for developing and vetting staffing  projections for new diplomatic compounds. State and OMB agreed with  our recommendations. Figure 5 illustrates the rightsizing process, which  integrates security, people, and mission considerations in determining how  facilities are used.
section_title: Strategic Management of Human Capital Can Enhance Agency Facility Protection Efforts
paragraphs: The strategic management of human capital is a key practice that can  maximize the government’s performance and ensure the accountability of  its efforts related to homeland security. People define an organization’s  culture, drive its performance, and embody its knowledge base. They are  the source of all knowledge, process improvement, and technological  advancements. As the government’s homeland security efforts evolve,  federal agencies involved with the intelligence community and other  homeland security organizations will need the most effective human capital  systems to reach projected security goals. For facility protection, as with  other areas related to homeland security, it is especially critical for  agencies to recognize the “people” element and implement strategies to  help individuals maximize their full potential. Also, it is important for  agencies to be well equipped to recruit and retain high-performing security  and law enforcement professionals. Training is also essential to  successfully implementing policies by ensuring that personnel are well  exercised and exhibit good judgment in following security procedures.
As we have reported, high-performing organizations align human capital  approaches with missions and goals, and human capital strategies are  designed, implemented, and assessed based on their ability to achieve  results and contribute to an organization’s mission. This includes aligning  their strategic planning and key institutional performance with unit and  individual performance management, as well as implementing reward  systems. We reported in March 2003 that federal agencies can develop  effective performance management systems by implementing a selected,  generally consistent, set of key practices. These key practices helped  public sector organizations both in the United States and abroad create a  clear linkage or “line of sight” between individual performance and  organizational success and, thus, transform their cultures to be more  results-oriented, customer-focused, and collaborative in nature. These key  practices, which have applicability to agencies’ management of facility  protection employers and contractors, include the following:  Align individual performance expectations with organizational goals.
An explicit alignment helps individuals see the connection between  their daily activities and organizational goals.
Connect performance expectations to crosscutting goals. Placing an  emphasis on collaboration, interaction, and teamwork across  organizational boundaries helps strengthen accountability for results.
Provide and routinely use performance information to track  organizational priorities. Individuals use performance information to  manage during the year, identify performance gaps, and pinpoint  improvement opportunities.
Require follow-up actions to address organizational priorities. By  requiring and tracking follow-up actions on performance gaps,  organizations underscore the importance of holding individuals  accountable for making progress on their priorities.
Use competencies to provide a fuller assessment of performance.
Competencies define the skills and supporting behaviors that  individuals need to effectively contribute to organizational results.
Link pay to individual and organizational performance. Pay,  incentive, and reward systems that link employee knowledge, skills, and  contributions to organizational results are based on valid, reliable, and  transparent performance management systems with adequate  safeguards.
Make meaningful distinctions in performance. Effective performance  management systems strive to provide candid and constructive  feedback and the necessary objective information and documentation to  reward top performers and deal with poor performers.
Involve employees and stakeholders to gain ownership of performance  management systems. Early and direct involvement helps increase  employees’ and stakeholders’ understanding and ownership of the  system and belief in its fairness.
Maintain continuity during transitions. Because cultural  transformations take time, performance management systems reinforce  accountability for change management and other organizational goals.
Our analysis showed that several GAO and IG reports discuss the  importance of strategic management of human capital in relation to  homeland security functions, including facility protection. For example, in  June 2004 we recommended that DHS develop a transformation strategy  for FPS to resolve challenges related to, among other things, the change in  organizational culture and responsibilities FPS faces since it was  transferred from GSA to DHS. DHS concurred with our  recommendations. Furthermore, we testified on the importance of making  changes to human capital management related to improving intelligence  gathering at the CIA for security purposes. Also, the DOE IG  recommended that DOE standardize annual, refresher training  requirements for security forces and conduct reviews of safeguards and  security training programs departmentwide to ensure compliance with the  agency training plan. The Director, Office of Safeguards and Security at  DOE, agreed with the recommendation.
Successfully training employees on using emerging security technologies is  also an important element in facility protection (see fig. 6). Installing the  latest security technology alone cannot guarantee effective facility  protection if security personnel have not been adequately trained to use the  technologies properly. Training is particularly essential if the technology  requires personnel to master certain knowledge and skills to operate it,  such as detecting concealed objects in generated X-ray images. Without  adequate training in understanding how technology works, the security  system will likely be less effective. This is especially important in assessing  risks and vulnerabilities in facility protection. According to DHS officials,  FPS inspectors are trained to conduct risk assessments and to evaluate the  effectiveness of previously installed facility countermeasures. Trained FPS  inspectors articulate their findings to a building security committee for  approval and funding, after which FPS implements the necessary  countermeasures. At the NAS symposium, a security consultant from the  private sector said that the effectiveness of a risk management approach  depends on the involvement of experienced and professional security  personnel and that there is an increased chance that personnel could omit  major steps in the risk management process if they are not well trained in  applying risk management.
As the emphasis on protecting people, property, and information has  increased, it has made the demand for professional security practitioners  become even more important. It is widely recognized that there is a need  for competent professionals who can effectively manage complex security  programs that are designed to reduce threats to people and the assets of  corporations, governments, and public and private institutions. To meet  these needs, we noted an effort by one organization to provide standard  certifications for security professionals. ASIS International is an  international organization for professionals responsible for security,  including managers and directors of security. According to the ASIS  International Web site, the organization is dedicated to increasing the  effectiveness and productivity of security practices by developing  educational programs and materials that address broad security concerns.  ASIS International has put together a training curriculum where security  professionals, upon completing requirements, can receive certifications to  become Certified Protection Professionals, Professional Certified  Investigators, or Physical Security Professionals (PSP). The PSP  designation is the certification for those whose primary responsibility is to  conduct threat surveys; design integrated security systems that include  equipment, procedures and people; or install, operate and maintain those  systems. We did not assess the training and certifications offered by ASIS  International. Nonetheless, seeking certifications for security staff may  allow agencies to better ensure that they are adequately trained and allows  for comparisons with other organizations and the security industry.
section_title: Agencies Face Obstacles in Implementing Key Practices in Facility Protection
paragraphs: During our review, we noted that agencies face obstacles in implementing  the six key practices that we have identified. For example, determining  which assets to protect by establishing and sustaining a comprehensive  risk management approach is a significant undertaking for federal  agencies. The quality of information needed for the risk management  process is often difficult to obtain and analyze. Another obstacle is keeping  risk assessments up-to-date as threat levels change, and resources for this  activity are stretched. As we pointed out earlier in relation to ISC’s  challenges, in our January 2003 high-risk report on federal real property, we  highlighted that some major real property-holding agencies face obstacles  in developing quality management data on their real property assets. Also,  in April 2002, we reported that GSA’s worldwide inventory of property  contained data that were unreliable and of limited usefulness. This  inventory is the only central source of descriptive data on the makeup of  the federal real property inventory.
In addition to data reliability problems, we have reported that some  agencies face obstacles in implementing and leveraging security  investments. As we testified in 2002, the capabilities of technology can be  overestimated.We found that by overestimating technology’s capabilities,  security officials risk falling into a false sense of security and relaxing their  vigilance. Furthermore, technology cannot compensate for human failure.  Instead, technology and people need to work together as part of an overall  security process where security personnel are properly trained to use the  technology.
The federal government also faces systemic obstacles regarding  information sharing and coordination. We testified in August 2004 that  there is a need for a comprehensive plan to facilitate information sharing  and coordination in the protection of critical infrastructure. However,  DHS has not yet developed a plan that describes how it will carry out its  overall information sharing responsibilities and relationships. In  commenting on this report, DHS indicated in its technical comments that  such an information plan is being developed. Another obstacle is  developing productive information sharing relationships among federal,  state, and local governments and the private sector. Improving the federal  government’s capabilities to analyze incident, threat, and vulnerability  information from numerous sources could assist in more effectively  disseminating information to federal, state, local, and private entities. Not  sharing information on threats and on actual incidents experienced by  others can hinder the ability of agencies’ to identify new trends, better  understand risks, and determine what preventive measures to implement.  As we reported in August 2003, information sharing initiatives implemented  by states and cities were neither effectively coordinated with those of  federal agencies, nor were they coordinated within and between federal  entities.
At the agencywide level, we have reported that agencies face obstacles in  developing meaningful, outcome-oriented performance goals and  collecting performance data that can be used to assess the true impact of  facility security. Performance measurement under GPRA typically focuses  on regularly collected data on the level and type of program activities, the  direct products and services delivered by the program, and the results of  those activities. For programs that have readily observable results or  outcomes, performance measurement may provide sufficient information  to demonstrate program results. In some programs, such as facility  security, however, outcomes are not quickly achieved or readily observed,  or their relationship to the program is often not clearly defined. In such  cases, more in-depth program evaluations may be needed, in addition to  performance measurement, to examine the extent to which a program is  achieving its objectives. This approach is more challenging and represents  a more advanced level of performance measurement.
Significant long-standing obstacles also hinder agencies’ ability to realign  their asset portfolios. As we have reported, the complex legal and  budgetary environment in which real property managers operate has a  significant impact on real property decisionmaking and often does not lead  to businesslike outcomes. Resource limitations—including those related  to facility protection—in general, often prevent agencies from addressing  real property needs from a strategic portfolio perspective. When available  funds for capital investment are limited, Congress must weigh the need for  new, modern facilities with the need for renovation, maintenance, and  disposal of existing facilities, the latter of which often gets deferred.  Facility protection often falls within this latter category. Until these  competing factors are mitigated, agencies face budgetary and legal  disincentives when trying to realign their assets. State’s experience to date  with rightsizing its overseas presence demonstrated some of the challenges  in realigning real property assets. We reported in November 2003 that  State’s efforts to replace facilities at risk of terrorist or other attacks have  experienced project delays due to changes in project design and security  requirements, difficulties hiring appropriate American and local labor with  the necessary clearances and skills, differing site conditions, and  unforeseen events such as civil unrest.
Finally, we have reported that agencies continue to face obstacles in  implementing and maintaining a strategic approach to human capital.  Specifically, agencies continue to face challenges in promoting (1)  leadership; (2) strategic human capital planning; (3) acquiring, developing,  and retaining talent; and (4) results-oriented organizational cultures in an  effort to strategically manage human capital. Although some progress has  been made since we designated human capital management as high-risk in  2001, today’s federal human capital strategies are not appropriately  constituted to meet current and emerging challenges, especially in light of  the new security challenges facing the government. Human capital  challenges are relevant to the facility protection area because security is a  people-intensive activity involving active management and response, and  there is a high dependency on law enforcement and security officers, as  well as contract guards.
Given these obstacles, and the need to overcome them, agencies would  benefit from having a set of key practices to guide their facility protection  efforts. GAO has advocated the use of guiding principles in other areas,  including human capital management, information technology, and capital  investment. ISC, in serving as the central coordinator for agencies’ efforts,  is uniquely positioned to promote key practices in facility protection and  could use our work as a starting point. In fact, ISC views one of its primary  roles as being the nucleus of communication on key practices and lessons  learned for the facility protection community in the federal government  and has embraced this responsibility.
section_title: Conclusions
paragraphs: After having limited success prior to the September 11 terrorist attacks,  ISC has made progress in recent years related to its responsibilities to  develop policies and standards, as well as those related to information  sharing. Although this progress is encouraging, more work remains to fulfill  ISC’s major responsibilities related to ensuring agency compliance and  overseeing the implementation of various policies and standards. Fulfilling  its new role in reviewing and approving agencies’ physical security plans  for the administration represents a major step toward meeting its  compliance and oversight responsibilities. Furthermore, because DHS now  has responsibility for ISC, the department also has a responsibility, in  keeping with the executive order under which ISC was established, to  ensure that ISC has adequate resources to accomplish its mission. Given  the challenges ISC faces, its new responsibility related to HSPD-7 for  reviewing agencies’ physical security plans, and the need to sustain  progress it has made in fulfilling its responsibilities, ISC would benefit from  having a clearly defined action plan for achieving results. Such a plan,  which ISC lacks, could be used to (1) provide DHS and other stakeholders  with detailed information on, and a rationale for, its resource needs; (2)  garner and maintain the support of ISC member agencies, DHS  management, OMB, and Congress; (3) identify implementation goals and  measures for gauging progress in fulfilling all of its responsibilities; and (4)  propose strategies for addressing the challenges ISC faces. Such a plan  could incorporate the strategy for ensuring compliance with facility  protection standards that is required under ISC’s executive order but has  not yet been developed. Without an overall action plan for meeting this and  other responsibilities, ISC’s strategy and time line for these efforts remain  unclear.
Since September 11, the focus on protecting the nation’s critical  infrastructure has been heightened considerably. At the individual building  level, agencies have improved perimeter security by, for example, installing  concrete bollards and are routinely screening vehicles and people entering  federal property. In looking at facility protection issues more broadly,  several key practices have emerged that include allocating resources using  risk management, leveraging security technology, sharing information and  coordinating protection efforts with other stakeholders, and measuring  program performance and testing security initiatives. In addition, other key  practices that have clear implications for the facility protection area  include realigning real property assets and strategically managing human  capital. Because agencies face various obstacles and would benefit from  evaluating their actions, it would be useful for them to have a framework of  key practices in the facility protection area that could guide their efforts,  and ISC is well positioned to lead this initiative as the government’s central  forum for exchanging information and guidance on facility protection.
section_title: Recommendations for Executive Action
paragraphs: We are making two recommendations—one to the Secretary of Homeland  Security and one to the Chair of ISC. Specifically, we recommend that the  Secretary of Homeland Security direct the Chair of ISC to develop an action  plan that identifies resource needs, implementation goals, and time frames  for meeting ISC’s ongoing and yet-unfulfilled responsibilities. The action  plan should also be used to propose strategies for addressing the range of  challenges ISC faces. Such an action plan would provide a road map for  DHS to use in developing resource priorities and for ISC to use in  communicating its planned actions to agencies and other stakeholders,  including Congress.
Furthermore, we recommend that the Chair of ISC, with input from ISC  member agencies, consider using our work as a starting point for  establishing a framework of key practices that could guide agencies’ efforts  in the facility protection area. This initiative could subsequently be used by  agencies to evaluate their actions, identify lessons learned, and develop  strategies for overcoming obstacles.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to DHS, State, GSA, DOE, Interior, DOD,  VA, and USPS for their official review and comment. DHS concurred with  the report’s overall conclusions and said it would implement the  recommendations. In its comments, DHS provided information on ongoing  initiatives related to information sharing and coordination. DHS’s  comments can be found in appendix V. DHS also provided separate  technical comments, which we incorporated where appropriate. State  provided additional information on its activities as they relate to the key  practices, which we incorporated into the final report where appropriate.  State’s comments can be found in appendix VI. GSA, DOE, and Interior  concurred with the report’s findings and recommendations. Comments  from GSA, Interior, and DOE can be found in appendixes VII, VIII, and IX,  respectively. DOD, VA, and USPS notified us that they had no comments on  this report.
As agreed with your office, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies of this report to other  interested Congressional Committees and the Secretaries of Defense,  Energy, the Interior, Homeland Security, State, Veterans Affairs; the  Administrator of GSA; and the Postmaster General of the U.S. Postal  Service. We will also make copies available to others upon request. In  addition, the report will be available at no charge on the GAO Web site at  http://www.gao.gov.
If you have any questions regarding this report, please contact me on (202)  512-2834 or at goldsteinm@gao.gov or David Sausville, Assistant Director,  on (202) 512-5403 or at sausvilled@gao.gov. Other contributors to this  report were Matt Cail, Roshni Dave, Joyce Evans, Brandon Haller, Anne  Izod, Susan Michal-Smith, and Cynthia Taylor.
section_title: Objectives, Scope, and Methodology
paragraphs: Our objectives were to (1) assess the Interagency Security Committee’s  (ISC) progress in fulfilling its responsibilities and (2) identify key practices  in protecting federal facilities and any related implementation obstacles. To  assess ISC’s progress in fulfilling its responsibilities, we interviewed the  Executive Director of ISC; analyzed ISC publications and other documents;  considered prior GAO work; and reviewed various laws and policies,  including the Homeland Security Act of 2002. We also reviewed the  executive order that established ISC, a subsequent executive order that  amended it in connection with the transfer of ISC’s function to DHS, and  relevant homeland security policy directives. We also reviewed minutes  from ISC meetings. We also considered prior GAO work on ISC. As part of  our interviews with ISC’s Executive Director, we focused on the challenges  ISC faces in meeting its major responsibilities.
To identify key practices for facility protection and any related  implementation obstacles, we conducted a comprehensive literature  review of GAO and Inspector General (IG) reports, interviewed officials  from the major property-holding agencies, and validated our results using  an expert symposium on facility protection. For the analysis of GAO and IG  reports, we systematically analyzed reports issued between January 1,  1995, and March 1, 2004. We chose 1995 as a starting point to coincide with  the year of the terrorist attack on the Alfred P. Murrah Federal Building in  Oklahoma City, Oklahoma, and the publishing of the Justice Department’s  minimum-security standards.
We identified reports by searching GAO and IG online databases and  consulting with GAO and IG contacts using several search terms such as  facility security, terrorism, and homeland security. From this initial  selection, we identified over 450 reports related to homeland security,  which we subsequently reduced to 170 reports that were related to facility  protection. Thirty-six of the reports were from IG offices at the seven  agencies that control over 85 percent of federal facilities in terms of  building square footage. These agencies included the Departments of  Defense (DOD), Energy (DOE), the Interior (Interior), Veterans Affairs  (VA) and State (State); the U.S. Postal Service (USPS); and the General  Services Administration (GSA). We systematically reviewed these reports  using a data collection instrument we designed to identify and group key  practices according to theme or type of activity. In doing our work, we also  gave consideration to other GAO reports on governmentwide management  issues that, in our judgment, had implications for the facility protection  area. We also considered new GAO reports that were issued after the  selection time period that were relevant. For the purposes of this review,  we did not assess the extent to which agencies were using GPRA to  develop agencywide facility protection or security-related goals. Also, for  the purpose of this review, we did not assess the training and certifications  offered by ASIS International.
We also interviewed officials at the major property-holding agencies,  including DOD, DOE, Interior, VA, State, USPS, and GSA to obtain updated  information on their facility protection activities and their use of key  practices. We then contracted with the National Academy of Sciences  (NAS) to convene a symposium with 21 security experts from the private  sector, government, academia, and foreign countries to validate the  practices and gain further insights. Using their judgment, NAS officials  selected security experts based on their broad expertise and backgrounds  in building security programs. Appendix II contains the symposium agenda  and identifies the experts. As a result, for the purpose of this review, we  defined key practices as those activities that, on the basis of our analysis,  were recommended by GAO and others, acknowledged by agencies, and  validated by experts in the area.
It is important to note that the key practices identified in this report may  not be an exclusive list and may not necessarily represent all key practices  for the protection of federal facilities. In addition, new reports and other  information may have become available since we completed the analysis.  Also, ISC has identified GAO as an associate member, which includes the  ability to serve on ISC subcommittees. While associate members of ISC  have this ability, no GAO staff member serves on any subcommittee.  Furthermore, no GAO staff member actively participates in ISC meetings or  contributes to decisions. Rather, GAO’s role on ISC is only to observe  proceedings and obtain ISC information distributed to the other ISC  members. Because of GAO’s observational role, our independence in  making recommendations involving ISC and in completing this engagement  was maintained.
ISC, agency officials, and other experts provided much of the data and  other information used in this report. We noted cases where these officials  provided testimonial evidence, and we were not always able to obtain  documentation that would substantiate the testimonial evidence they  provided. In cases where officials provided their views and opinions on  various issues within the context of speaking for the organization, we  corroborated the information with other officials. Overall, we found no  discrepancies with these data and, therefore, determined that they were  sufficiently reliable for the purpose of this report. We requested official  comments on this report from DHS, State, GSA, Interior, DOE, DOD, VA,  and USPS. Appendixes V through IX contain comments we received from  DHS, State, GSA, Interior, and DOE, respectively. We received State’s  comments on November 12, 2004. DOD, VA, and USPS had no comments.
section_title: National Academy of Sciences Symposium Agenda
section_title: ISC Actions Related to Its Major Responsibilities under Executive Order 12977, as of September 2004
paragraphs: Responsibilities Related to Developing Policies and Standards Establish policies for security in and protection of federal facilities. Develop and evaluate security standards for federal facilities. Assess technology and information systems as a means of providing cost-effective improvements to security in federal facilities. Develop long-term construction standards for those locations with threat levels or missions that require blast-resistant structures or other  specialized security requirements. Evaluate standards for the location of, and special security related to, day care centers in federal facilities.
May 2001: Issued Security Design Criteria for New Federal Office Buildings and Major Modernization Projects (Security Design   July 2001: Issued Minimum Standards for Federal Building Access Procedures.  June 2003: Issued ISC Information Document on Escape Hoods.  October 2003: Issued update of ISC Security Design Criteria.   Currently developing physical security requirements for HSPD-12 and the federal credentialing program.  In 1997, ISC disseminated guidance on entry security technology for member agencies’ buildings with high security designations.  Provided input in smart card development process for federal government.  Integrated expert opinions from engineering and architectural disciplines and included technology expert advice on blasting and  biochemical threats in the most recent update of ISC Security Design Criteria for 2004.
July 2003: Issued Security Standards for Leased Space.  In its review of the latest ISC security design criteria update, the ISC long-term construction team will look into security needs at child  care centers (no actions implemented to date).
Responsibilities Related to Ensuring Compliance and Overseeing Implementation of Policies and Standards Develop a strategy for ensuring compliance with standards. Oversee the implementation of appropriate security measures in federal facilities.
According to ISC’s Executive Director, ISC does not have the necessary resources to develop a compliance process—ISC has  requested additional funding and resources for the fiscal year 2006 budget (no actions implemented to date).
As reviewer of agency physical security plans under HSPD-7, ISC has not been able to develop a scoring process to review the plans.  Furthermore, ISC will not meet the November 2004 deadline for completing agency reviews and is working with OMB and DHS on this  issue.
Responsibilities Related to Encouraging Information Sharing   Encourage agencies with security responsibilities to share security-related intelligence in a timely and cooperative manner. Assist in developing and maintaining a centralized security database of all federal facilities.
April 2003: Appointed a full-time Executive Director.   Since September 11, 2001, ISC has expanded its membership and outreach efforts by adding associate member agencies that can  provide input but are not listed in Executive Order 12977.
In recent years, GAO has consistently advocated the use of a risk  management approach as an iterative analytical tool to help implement and  assess responses to various national security and terrorism issues.  Although applying risk management principles to facility protection can  take on various forms, our past work showed that most risk management  approaches generally involve identifying potential threats, assessing  vulnerabilities, identifying the assets that are most critical to protect in  terms of mission and significance, and evaluating mitigation alternatives  for their likely effect on risk and their cost. We have concluded that without  a risk management approach, there is little assurance that programs to  combat terrorism are prioritized and properly focused. Risk management  principles acknowledge that while risk cannot be eliminated, enhancing  protection from known or potential threats can help reduce it. Drawing on  this precedent, we compiled a risk management framework—outlined  below—to help assess the U.S. government’s response to homeland  security and terrorism risk. This framework, which we have used to assess  the Department of Homeland Security’s programs to target oceangoing  cargo containers for inspection, also has applicability to protecting federal  facilities. For purposes of the risk management framework, we used the  following definitions:  Risk—an event that has a potentially negative impact, and the possibility  that such an event will occur and adversely affect an entity’s assets and  activities and operations, as well as the achievement of its mission and  strategic objectives. As applied to the homeland security context, risk is  most prominently manifested as “catastrophic” or “extreme” events  related to terrorism, i.e., those involving more that $1 billion in damage  or loss and/or more than 500 casualties.
Risk management—a continuous process of managing, through a series  of mitigating actions that permeate an entity’s activities, the likelihood  of an adverse event happening and having a negative impact. In general,  risk is managed as a portfolio, addressing entity-wide risk within the  entire scope of activities. Risk management addresses “inherent,” or  pre-action, risk (i.e., risk that would exist absent any mitigating action)  as well as “residual,” or post-action, risk (i.e., the risk that remains even  after mitigating actions have been taken).
The risk management framework—which is based on the proposition that a  threat to a vulnerable asset results in risk—consists of the following  components:  Internal (or implementing) environment—the internal environment is  the institutional “driver” of risk management, serving as the foundation  of all elements of the risk management process. The internal  environment includes an entity’s organizational and management  structure and processes that provide the framework to plan, execute,  and control and monitor an entity’s activities, including risk  management. Within the organizational and management structure, an  operational unit that is independent of all other operational (business)  units is responsible for implementing the entity’s risk management  function. This unit is supported by and directly accountable to an  entity’s senior management. For its part, senior management (1) defines  the entity’s risk tolerance (i.e., how much risk is an entity willing to  assume in order to accomplish its mission and related objectives) and  (2) establishes the entity’s risk management philosophy and culture (i.e.,  how an entity’s values and attitudes view risk and how its activities and  practices are managed to deal with risk). The operational unit (1)  designs and implements the entity’s risk management process and (2)  coordinates internal and external evaluation of the process and helps  implement any corrective action.
Threat (event) assessment—threat is defined as a potential intent to  cause harm or damage to an asset (e.g., natural environment, people,  manmade infrastructures, and activities and operations). Threat  assessments consist of the identification of adverse events that can  affect an entity. Threats might be present at the global, national, or local  level, and their sources include terrorists and criminal enterprises.  Threat information emanates from “open” sources and intelligence  (both strategic and tactical). Intelligence information is characterized as  “reported” (or raw) and “finished” (fully fused and analyzed).
Criticality assessment—criticality is defined as an asset’s relative  importance. Criticality assessments identify and evaluate an entity’s  assets based on a variety of factors, including the importance of its  mission or function, the extent to which people are at risk, or the  significance of a structure or system in terms of, for example, national  security, economic activity, or public safety. Criticality assessments are  important because they provide, in combination with the framework’s  other assessments, the basis for prioritizing which assets require greater  or special protection relative to finite resources.
Vulnerability assessment—vulnerability is defined as the inherent state  (either physical, technical, or operational) of an asset that can be  exploited by an adversary to cause harm or damage. Vulnerability  assessments identify these inherent states and the extent of their  susceptibility to exploitation, relative to the existence of any  countermeasures.
Risk assessment—risk assessment is a qualitative and/or quantitative  determination of the likelihood (probability) of occurrence of an  adverse event and the severity, or impact, of its consequences. Risk  assessments include scenarios under which two or more risks interact  creating greater or lesser impacts.
Risk characterization—risk characterization involves designating risk  as, for example, low, medium, or high (other scales, such as numeric,  are also be used). Risk characterization is a function of the probability  of an adverse event occurring and the severity of its consequences. Risk  characterization is the crucial link between assessments of risk and the  implementation of mitigation actions, given that not all risks can be  addressed because resources are inherently scarce; accordingly, risk  characterization forms the basis for deciding which actions are best  suited to mitigate the assessed risk.
Mitigation evaluation—Mitigation evaluation is the identification of  mitigation alternatives to assess the effectiveness of the alternatives.  The alternatives should be evaluated for their likely effect on risk and  their cost.
Mitigation selection—Mitigation selection involves a management  decision on which mitigation alternatives should be implemented  among alternatives, taking into account risk, costs, and the effectiveness  of mitigation alternatives. Selection among mitigation alternatives  should be based upon preconsidered criteria. There are as of yet no  clearly preferred selection criteria, although potential factors might  include risk reduction, net benefits, equality of treatment, or other  stated values. Mitigation selection does not necessarily involve  prioritizing all resources to the highest-risk area, but in attempting to  balance overall risk and available resources.
Risk mitigation—Risk mitigation is the implementation of mitigation  actions, in priority order and commensurate with assessed risk;  depending on its risk tolerance, an entity may choose not to take any  action to mitigate risk (this is characterized as risk acceptance). If the  entity does choose to take action, such action falls into three categories:  (1) risk avoidance (exiting activities that expose the entity to risk), (2)  risk reduction (implementing actions that reduce likelihood or impact of  risk), and (3) risk sharing (implementing actions that reduce likelihood  or impact by transferring or sharing risk). In each category, the entity  implements actions as part of an integrated “systems” approach, with  built-in redundancy to help address residual risk (the risk that remains  after actions have been implemented). The systems approach consists  of taking actions in personnel (e.g., training, deployment), processes  (e.g., operational procedures), technology (e.g., software or hardware),  infrastructure (e.g., institutional or operational—such as port  configurations), and governance (e.g., management and internal control  and assurance). In selecting actions, the entity assesses their costs and  benefits, where the amount of risk reduction is weighed against the cost  involved and identifies potential financing options for the actions  chosen.
Monitoring and evaluation of risk mitigation—Monitoring and  evaluation of risk mitigation entails the assessment of the functioning of  actions against strategic objectives and performance measures to make  necessary changes. Monitoring and evaluation includes, where and  when appropriate, peer review and testing and validation; and an  evaluation of the impact of the actions on future options; and  identification of unintended consequences that, in turn, would need to  be mitigated. Monitoring and evaluation helps ensure that the entire risk  management process remains current and relevant, and reflects changes  in (1) the effectiveness of the actions and (2) the risk environment in  which the entity operates—risk is dynamic and threats are adaptive. The  risk management process should be repeated periodically, restarting the  “loop” of assessment, mitigation, and monitoring and evaluation.
section_title: Comments from the Department of Homeland Security
section_title: Comments from the Department of State
section_title: Comments from the General Services Administration
paragraphs: HOMELAND SECURITY: Further Actions Needed to Coordinate  Federal Agencies’ Facility Protection Efforts and Promote Key  GSA Public Buildings Service (PBS) Response The PBS agrees with the findings of the Government Accountability Office (GAO) relating  security issues facing the federal government.  PBS also supports the recommendations to the  Secretary of Department of Homeland Security and the Chair of Interagency Security Committee  (ISC).  As a member agency, of the ISC, GSA will support the initiatives and efforts proposed by  the committee.
Reason GAO stated for conducting the subject audit:  1.  Assess the Interagency Security Committee’s (ISC) progress in fulfilling its responsibilities  2.
Sharing of information between agencies    3.  July 2004, ISC became responsible for reviewing federal agencies physical security plans  4.  ISC lacks an action plan for identifying implementation goals, strategy and timeline  1.  Audit Recommendations to the Secretary of DHS: Direct ISC to develop an action plan that identifies resource needs, goals, and  timeframes for meeting its responsibilities, and proposes strategies for addressing  the challenges it faces. 2.  Audit Recommendations to the Chair of ISC:  With input from ISC member agencies, and considering our work as a starting point,  establish a set of key practices that could guide agencies’ efforts in the facility protection  area.  This effort could evaluate agency action, identify lessons learned, and develop  strategies for overcoming challenges.
section_title: Comments from the Department of the Interior
section_title: Bibliography
subsections: section_title: Department of Defense
paragraphs: U.S. Department of Defense, Office of Inspector General. Interagency  Summary Report on Security Controls Over Biological Agents (D-2003- 126). Washington, D.C.: August 27, 2003.
section_title: Department of Energy
paragraphs: U.S. Department of Energy, Office of Inspector General. Management of  the Nuclear Weapons Production Infrastructure (DOE/IG-0484).  Washington, D.C.:  September 22, 2000.
U.S. Department of Energy, Office of Inspector General. Summary Report  on Allegations Concerning the Department of Energy’s Site Safeguards  and Security Planning Process  (DOE/IG-0482). Washington, D.C.:   September 28, 2000.
U.S. Department of Energy, Office of Inspector General. The U.S.  Department of Energy’s Audit Follow-up Process (DOE/IG-0447).  Washington, D.C.:  July 7, 1999.
U.S. Department of Energy, Office of Inspector General. Special Audit  Report on the Department of Energy’s Arms and Military-Type  Equipment (IG-0385). Washington, D.C.:  February 1, 1996.
U.S. Department of Energy, Office of Inspector General. Audit of the  Department of Energy’s Security Police Officer Training (CR-B-95-03).  Washington, D.C.:  February 6, 1995.
section_title: Department of the Interior
paragraphs: U.S. Department of the Interior, Office of Inspector General. Homeland  Security:  Protection of Critical Infrastructure Systems – Assessment 2:   Critical Infrastructure Systems (2002-I-0053). Washington, D.C.:   September 2002.
U.S. Department of the Interior, Office of Inspector General. Homeland  Security:  Protection of Critical Infrastructure Facilities and National  Icons – Assessment 1:  Supplemental Funding – Plans and Progress   (2002-I-0039). Washington, D.C.:  June 2002.
U.S. Department of the Interior, Office of Inspector General. Progress  Report:  Secretary’s Directives for Implementing Law Enforcement  Reform in Department of the Interior  (2003-I-0062). Washington, D.C.:   August 28, 2003.
U.S. Department of the Interior, Office of Inspector General. Review of  National Icon Park Security (2003-I-0063). Washington, D.C.:  August 2003.
section_title: Department of State
paragraphs: U.S. Department of State, Office of Inspector General. Limited-Scope  Security Inspection of Embassy Port of Spain, Trinidad and Tobago   (SIO-I-03-22). Washington, D.C.:  August 2003.
U.S. Department of State, Office of Inspector General. Security Inspection  of Embassy N’Djamena, Chad (SIO-I-03-27). Washington, D.C.:  June 2003.
U.S. Department of State, Office of Inspector General. Security Inspection  of Embassy Yaoundé, Cameroon (SIO-I-03-28). Washington, D.C.:  March  2003.
U.S. Department of State, Office of Inspector General. Security Inspection  of Embassy Maseru, Lesotho (SIO-I-03-26). Washington, D.C.:  March 2003.
U.S. Department of State, Office of Inspector General. Limited-Scope  Security Inspection of Embassy Belgrade, Serbia and Montenegro (SIO-I- 03-13). Washington, D.C.:  March 2003.
U.S. Department of State, Office of Inspector General. Limited-Scope  Security Inspection of Embassy Quito, Ecuador and Consulate General  Guyaquil  (SIO-I-03-25). Washington, D.C.:  February 2003.
U.S. Department of State, Office of Inspector General. Security Oversight  Inspection of Embassy Muscat, Oman (SIO-I-03-17). Washington, D.C.:   February 2003.
U.S. Department of State, Office of Inspector General. Limited-Scope  Security Inspection of Embassy Dublin, Ireland (SIO-I-03-08).  Washington, D.C.:  December 2002.
U.S. Department of State, Office of Inspector General. Limited-Scope  Security Inspection of Embassy Apia, Samoa  (SIO-I-03-04). Washington,  D.C.:  November 2002.
U.S. Department of State, Office of Inspector General. Limited-Scope  Security Inspection of Embassy Ljubljana, Slovenia (SIO-I-03-03).  Washington, D.C.:  November 2002.
U.S. Department of State, Office of Inspector General. Limited-Scope  Security Inspection of Embassy Almaty, Kazakhstan (SIO-I-03-02).  Washington, D.C.:  November 2002.
U.S. Department of State, Office of Inspector General. Limited-Scope  Security Inspection of Embassy Amman, Jordan (SIO-I-03-01).  Washington, D.C.:  November 2002.
U.S. Department of State, Office of Inspector General. Classified  Semiannual Report to the Congress:  April 1, 2003 to September 30, 2003.  Washington, D.C.:  September 2003.
U.S. Department of State, Office of Inspector General. Classified  Semiannual Report to the Congress:  October 1, 2002 to March 31, 2003.  Washington, D.C.:  March 2003.
section_title: General Services Administration
paragraphs: General Services Administration, Office of Inspector General. Follow-up  Review of the Federal Protective Service’s Contract Guard Program  (A020092/P/2/R02016). Arlington, VA:  August 29, 2002.
General Services Administration, Office of Inspector General. Report on  Federal Protective Service Security Equipment Countermeasures  Installed at Federal Facilities  (A020092/P/2/R02008). Arlington, VA:   March 29, 2002.
General Services Administration, Office of Inspector General. Audit of the  Federal Protective Service’s Federal Security Risk Manager Program  (A010129/P/2/R02007). Arlington, VA:  March 27, 2002.
General Services Administration, Office of Inspector General. Audit of the  Federal Protective Service’s Intelligence Sharing Program  (A000992/P/2/R01013). Arlington, VA:  March 23, 2001.
General Services Administration, Office of Inspector General. Audit of The  Federal Protective Service’s Contract Guard Program   (A995175/P/2/R00010). Arlington, VA:  March 28, 2000.
General Services Administration, Office of Inspector General. Audit of  Security Measures for New and Renovated Federal Facilities   (A995025/P/H/R99513). Arlington, VA:  March 24, 1999.
General Services Administration, Office of Inspector General. Audit of The  Federal Protective Service’s Program for Upgrading Security at Federal  Facilities  (A70642/P/2/R98024). Arlington, VA:  September 14, 1998.
section_title: Postal Service
paragraphs: U.S. Postal Service, Office of Inspector General. Fiscal Year 1999  Information System Controls:  St. Louis Information Service Center (FR- AR-99-010). Arlington, VA:  September 28, 1999.
U.S. Postal Service, Office of Inspector General. Review of Security Badge  Controls at Postal Service Headquarters (OV-LA-01-001). Arlington, VA:   March 26, 2001.
U.S. Postal Service, Office of Inspector General. Review of United States  Postal Service Personnel Security Program:  Process for Updating  Sensitive Clearances (OV-MA-99-001). Arlington, VA:  March 31, 1998.
section_title: Veterans Affairs
paragraphs: Veterans Affairs, Office of Inspector General. Review of Security and  Inventory Controls Over Selected Biological, Chemical, and Radioactive  Agents Owned by or Controlled at Department of Veterans Affairs  Facilities (02-00266-76). Washington, D.C.:  March 14, 2002.
section_title: Related GAO Products
subsections: section_title: Allocating Resources Using Risk Management
paragraphs: Fiscal Year 2003 U.S. Government Financial Statements: Sustained  Improvement in Federal Financial Management Is Crucial to Addressing  Our Nation’s Future Fiscal Challenges. GAO-04-886T. Washington, D.C.:  July 8, 2004.
Nuclear Security: Several Issues Could Impede the Ability of DOE’s Office  of Energy, Science and Environment to Meet the May 2003 Design Basis  Threat. GAO-04-894T. Washington, D.C.: June 22, 2004.
Homeland Security: Summary of Challenges Faced in Targeting  Oceangoing Cargo Containers for Inspection. GAO-04-557T. Washington,  D.C.: March 31, 2004.
Homeland Security: Management Challenges Facing Federal Leadership.  GAO-03-260. Washington, D.C.: December 20, 2002.
Critical Infrastructure Protection: Significant Challenges Need to Be  Addressed. GAO-02-961T. Washington, D.C.: July 24, 2002.
Homeland Security: Critical Design and Implementation Issues. GAO-02- 957T. Washington, D.C.: July 17, 2002.
Critical Infrastructure Protection: Significant Homeland Security  Challenges Need to Be Addressed. GAO-02-918T. Washington, D.C.: July 9,  2002.
Homeland Security: A Risk Management Approach Can Guide  Preparedness Efforts. GAO-02-208T. Washington, D.C.: October 31, 2001.
Combating Terrorism: Considerations for Investing Resources in  Chemical and Biological Preparedness. GAO-02-162T. Washington, D.C.:  October 17, 2001.
Homeland Security: Key Elements of a Risk Management Approach.  GAO-02-150T. Washington, D.C.: October 12, 2001.
Chemical and Biological Defense: Improved Risk Assessment and  Inventory Management Are Needed. GAO-01-667. Washington, D.C.:  September 28, 2001.
Combating Terrorism: Selected Challenges and Related  Recommendations. GAO-01-822. Washington, D.C.: September 20, 2001.
Combating Terrorism: Actions Needed to Improve DOD Antiterrorism  Program Implementation and Management. GAO-01-909. Washington,  D.C.: September 19, 2001.
Weapons of Mass Destruction: Defense Threat Reduction Agency  Addresses Broad Range of Threats, but Performance Reporting Can Be  Improved. GAO-04-330. Washington, D.C.: February 13, 2004.
section_title: Leveraging Technology
paragraphs: Electronic Government: Smart Card Usage is Advancing Among Federal  Agencies, Including the Department of Veterans Affairs. GAO-05-84T.  Washington, D.C: September 6, 2004.
Information Security: Technologies to Secure Federal Systems. GAO-04- 467. Washington, D.C.: March 9, 2004.
Security: Counterfeit Identification Raises Homeland Security Concerns.  GAO-04-133T. Washington, D.C.: October 1, 2003.
Electronic Government: Challenges to the Adoption of Smart Card  Technology. GAO-03-1108T. Washington, D.C.: September 9, 2003.
Information Security: Challenges in Using Biometrics. GAO-03-1137T.  Washington, D.C.: September 9, 2003.
Border Security: Challenges in Implementing Border Technology. GAO- 03-546T. Washington, D.C.: March 12, 2003.
Electronic Government: Progress in Promoting Adoption of Smart Card  Technology. GAO-03-144. Washington, D.C.: January 3, 2003.
Technology Assessment: Using Biometrics for Border Security. GAO-03- 174. Washington, D.C.: November 15, 2002.
National Preparedness: Technologies to Secure Federal Buildings. GAO- 02-687T. Washington, D.C.: April 25, 2002.
section_title: Information Sharing and Coordination
paragraphs: Information Technology: Major Federal Networks That Support  Homeland Security Functions. GAO-04-375. Washington, D.C.: September  17, 2004 9/11 Commission Report: Reorganization, Transformation, and  Information Sharing. GAO-04-1033T. Washington, D.C.: August 3, 2004.
Critical Infrastructure Protection: Improving Information Sharing with  Infrastructure Sectors. GAO-04-780. Washington, D.C.: July 9, 2004.
Posthearing Questions from September 17, 2003, Hearing on  “Implications of Power Blackouts for the Nation’s Cybersecurity and  Critical Infrastructure Protection: The Electrical Grid, Critical  Interdependencies, Vulnerabilities, and Readiness”. GAO-04-300R.  Washington, D.C.: December 8, 2003.
Homeland Security: Challenges in Achieving Interoperable  Communications for First Responders. GAO-04-231T. Washington, D.C.:  November 6, 2003.
Homeland Security: Information Sharing Responsibilities, Challenges,  and Key Management Issues. GAO-03-1165T. Washington, D.C.: September  17, 2003.
Homeland Security: Efforts to Improve Information Sharing Need to Be  Strengthened. GAO-03-760. Washington, D.C.: August 27, 2003.
Homeland Security: Information Sharing Responsibilities, Challenges,  and Key Management Issues. GAO-03-715T. Washington, D.C.: May 8, 2003.
Information Technology: Terrorist Watch Lists Should Be Consolidated to  Promote Better Integrating and Sharing. GAO-03-322. Washington, D.C.:  April 15, 2003.
Bioterrorism: Information Technology Strategy Could Strengthen Federal  Agencies’ Abilities to Respond to Public Health Emergencies. GAO-03-139.  Washington, D.C.: May 30, 2003.
Homeland Security: Information Sharing Activities Face Continued  Management Challenges. GAO-02-1122T. Washington, D.C.: October 1,  2002.
National Preparedness: Technology and Information Sharing Challenges.  GAO-02-1048R. Washington, D.C.: August 30, 2002.
Homeland Security: Effective Intergovernmental Coordination is Key to  Success. GAO-02-1013T. Washington, D.C.: August 23, 2002.
Homeland Security: Effective Intergovernmental Coordination is Key to  Success. GAO-02-1012T. Washington, D.C.: August 22, 2002.
Homeland Security: Effective Intergovernmental Coordination is Key to  Success. GAO-02-1011T. Washington, D.C.: August 20, 2002.
Homeland Security: Intergovernmental Coordination and Partnership  Will Be Critical to Success. GAO-02-901T. Washington, D.C.: July 3, 2002.
Homeland Security: Intergovernmental Coordination and Partnership  Will Be Critical to Success. GAO-02-900T. Washington, D.C.: July 2, 2002.
Homeland Security: Intergovernmental Coordination and Partnership  Will Be Critical to Success. GAO-02-899T. Washington, D.C.: July 1, 2002.
National Preparedness: Integration of Federal, State, Local, and Private  Sector Efforts is Critical to an Effective National Strategy for Homeland  Security. GAO-02-621T. Washington, D.C.: April 11, 2002.
Combating Terrorism: Intergovernmental Cooperation in the  Development of a National Strategy to Enhance State and Local  Preparedness. GAO-02-550T. Washington, D.C.: April 2, 2002.
Combating Terrorism: Enhancing Partnerships Through a National  Preparedness Strategy. GAO-02-549T. Washington, D.C.: March 28, 2002.
Combating Terrorism: Critical Components of a National Strategy to  Enhance State and Local Preparedness. GAO-02-548T. Washington, D.C.:  March 25, 2002.
Combating Terrorism: Intergovernmental Partnership in a National  Strategy to Enhance State and Local Preparedness. GAO-02-547T.  Washington, D.C.: March 22, 2002.
Homeland Security: Progress Made; More Direction and Partnership  Sought. GAO-02-490T. Washington, D.C.: March 12, 2002.
Combating Terrorism: Key Aspects of a National Strategy to Enhance  State and Local Preparedness. GAO-02-473T. Washington, D.C.: March 1,  2002.
Bioterrorism: Review of Public Health Preparedness Programs. GAO-02- 149T. Washington, D.C.: October 10, 2001.
Bioterrorism: Public Health and Medical Preparedness. GAO-02-141T.  Washington, D.C.: October 9, 2001.
Bioterrorism: Coordination and Preparedness. GAO-02-129T. Washington,  D.C.: October 5, 2001.
Combating Terrorism: Observations on Federal Spending to Combat  Terrorism. GAO/T-NSIAD/GGD-99-107. Washington, D.C.: March 11, 1999.
section_title: Aligning Assets to Mission
paragraphs: Embassy Construction: State Department Has Implemented Management  Reforms, but Challenges Remain. GAO-04-100. Washington, D.C.:  November 4, 2003.
VA Health Care: Framework for Analyzing Capital Asset Realignment for  Enhanced Services Decisions. GAO-03-1103R. Washington, D.C.: August 18,  2003.
Major Management Challenges and Program Risks: Department of State.  GAO-03-107. Washington, D.C.: January 2003.
Overseas Presence: Framework for Assessing Embassy Staff Levels Can  Support Rightsizing Initiatives. GAO-02-780. Washington, D.C.: July 26,  2002.
Overseas Presence: Observations on a Rightsizing Framework. GAO-02- 659T. Washington, D.C.: May 1, 2002.
Overseas Presence: More Work Needed on Embassy Rightsizing. GAO-02- 143. Washington, D.C.: November 27, 2001.
section_title: Strategic Human Capital Management
paragraphs: Human Capital: Building on the Current Momentum to Transform the  Federal Government. GAO-04-976T. Washington, D.C.: July 20, 2004.
Information Technology: Training Can Be Enhanced by Greater Use of  Leading Practices. GAO-04-791. Washington, D.C.: June 24, 2004.
Results-Oriented Government: Shaping the Government to Meet 21st  Century Challenges. GAO-03-1168T. Washington, D.C.: September 17, 2003.
Results-Oriented Cultures: Creating a Clear Linkage between Individual  Performance and Organizational Success. GAO-03-488. Washington, D.C.:  March 14, 2003.
Human Capital: Building on the Current Momentum to Address High- Risk Issues. GAO-03-637T. Washington, D.C.: April 8, 2003.
High-Risk Series: Strategic Human Capital Management. GAO-03-120.  Washington, D.C.: January 2003.
Human Capital: A Self-Assessment Checklist for Agency Leaders.  GAO/OCG-00-14G. Washington, D.C.: September 2000.
Executive Guide: Leading Practices in Capital Decision-Making. AIMD- 99-32. Washington, D.C.: December 1998.
section_title: Performance Measurement and Testing
paragraphs: Weaknesses in Screening Entrants Into the United States. GAO-03-438T.  Washington, D.C.: January 30, 2003.
Building Security: Interagency Security Committee Has Had Limited  Success in Fulfilling Its Responsibilities. GAO-02-1004. Washington, D.C.:  September 17, 2002.
Security Breaches at Federal Buildings in Atlanta, Georgia. GAO-02- 668T. Washington, D.C.: April 30, 2002.
Homeland Security: Responsibility and Accountability For Achieving  National Goals. GAO-02-627T. Washington, D.C.: April 11, 2002.
Bioterrorism: Federal Research and Preparedness Activities. GAO-01-915.  Washington, D.C.: September 28, 2001.
Combating Terrorism: Observations on Options to Improve the Federal  Response. GAO-01-660T. Washington, D.C.: April 24, 2001.
Combating Terrorism: Analysis of Federal Counterterrorist Exercises.  GAO/NSIAD-99-157BR. Washington, D.C.: June 25, 1999.
Federal Law Enforcement: Investigative Authority and Personnel at 13  Agencies. GAO/GGD-96-154. Washington, D.C.: September 30, 1996.
section_title: Challenges and Lessons Learned in Homeland Security
paragraphs: Critical Infrastructure Protection: Challenges for Selected Agencies and  Industry Sectors. GAO-03-233. Washington, D.C.: February 28, 2003.
Combating Terrorism: Funding Data Reported to Congress Should Be  Improved. GAO-03-170. Washington, D.C.: November 26, 2002.
Combating Terrorism: Actions Needed to Guide Services’ Antiterrorism  Efforts at Installations. GAO-03-14. Washington, D.C.: November 1, 2002.
Homeland Security: Challenges and Strategies in Addressing Short-and  Long-Term National Needs. GAO-02-160T. Washington, D.C.: November 7,  2001.
Combating Terrorism: FEMA Continues to Make Progress in  Coordinating Preparedness and Response. GAO-01-15. Washington, D.C.:  March 20, 2001.
Critical Infrastructure Protection: Challenges to Building a  Comprehensive Strategy for Information Sharing and Coordination.  GAO/T-AIMD-00-268. Washington, D.C.: July 26, 2000.
Combating Terrorism: Observations on Growth in Federal Programs.  GAO/T-NSIAD-99-181. Washington, D.C.: June 9, 1999.
Combating Terrorism: Spending on Governmentwide Programs Requires  Better Management and Coordination. GAO/NSIAD-98-39. Washington,  D.C.: December 1, 1997.
section_title: Other Products Related to Facility Security
paragraphs: Homeland Security: Transformation Strategy Needed to Address  Challenges Facing the Federal Protective Service. GAO-04-537.  Washington, D.C.: July 14, 2004.
General Services Administration: Factors Affecting the Construction and  Operating Costs of Federal Buildings. GAO-03-609T. Washington, D.C.:  April 2, 2003.
High-Risk Series: Federal Real Property. GAO-03-122. Washington, D.C.:  January 2003.
Building Security: Security Responsibilities for Federally Owned and  Leased Facilities. GAO-03-8. Washington, D.C.: October 31, 2002.
Diffuse Security Threats: USPS Air Filtration Systems Need More Testing  and Cost Benefit Analysis before Implementation. GAO-02-838.  Washington, D.C.: August 22, 2002.
Homeland Security: Key Elements to Unify Efforts Are Underway but  Uncertainty Remains. GAO-02-610. Washington, D.C.: June 7, 2002.
Federal Real Property: Better Governmentwide Data Needed for Strategic  Decisionmaking. GAO-02-342. Washington, D.C.: April 16, 2002.
Highlights of GAO’s Conference on Options to Enhance Mail Security and  Postal Operations. GAO-02-315SP. Washington, D.C.: December 20, 2001.
General Services Administration: Status of Efforts to Improve  Management of Building Security Upgrade Program. GAO/T-GGD/OSI-00- 19. Washington, D.C.: October 7, 1999 General Services Administration: Many Building Security Upgrades  Made But Problems Have Hindered Program Implementation. GAO/T- GGD-98-141. Washington, D.C.: June 4, 1998.
section_title: Other Products Related to Security Topics
paragraphs: Combating Terrorism: Evaluation of Selected Characteristics in National  Strategies Related to Terrorism. GAO-04-408T. Washington, D.C.: February  3, 2004.
Homeland Security Advisory System: Preliminary Observations  Regarding Threat Level Increases from Yellow to Orange. GAO-04-453R.  Washington, D.C.: February 26, 2004.
Homeland Security: Preliminary Observations on Efforts to Target  Security Inspections of Cargo Containers. GAO-04-325T. Washington,  D.C.: December 16, 2003.
Aviation Security: Efforts to Measure Effectiveness and Strengthen  Security Programs. GAO-04-285T. Washington, D.C.: November 20, 2003.
Bioterrorism: A Threat to Agriculture and the Food Supply. GAO-04-259T.  Washington, D.C.: November 19, 2003.
Aviation Security: Efforts to Measure Effectiveness and Address  Challenges. GAO-04-232T. Washington, D.C.: November 5, 2003.
Aviation Security: Progress Since September 11, 2001 and the Challenges  Ahead. GAO-03-1150T. Washington, D.C.: September 9, 2003.
Transportation Security: Post-September 11th Initiatives and Long-Term  Challenges. GAO-03-616T. Washington, D.C.: April 1, 2003.
Combating Terrorism: Observations on National Strategies Related to  Terrorism. GAO-03-519T. Washington, D.C.: March 3, 2003.
Overseas Presence: Conditions of Overseas Diplomatic Facilities. GAO- 03-557T. Washington, D.C.: March 20, 2003.
Mass Transit: Federal Action Could Help Transit Agencies Address  Security Challenges. GAO-03-263. Washington, D.C.: December 13, 2002.
Mass Transit: Challenges in Securing Transit Systems. GAO-02-1075T.  Washington, D.C.: September 18, 2002.
Combating Terrorism: Department of State Programs to Combat  Terrorism Abroad. GAO-02-1021. Washington, D.C.: September 6, 2002.
Port Security: Nation Faces Formidable Challenges in Making New  Initiatives Successful. GAO-02-993T. Washington, D.C.: August 5, 2002.
National Preparedness: Integrating New and Existing Technology and  Information Sharing into an Effective Homeland Security Strategy.  GAO-02-811T. Washington, D.C.: June 7, 2002.
Homeland Security: A Framework for Addressing the Nation’s Efforts.  GAO-01-1158T. Washington, D.C.: September 21, 2001.
Combating Terrorism: Comments on H.R. 525 to Create a President’s  Council on Domestic Terrorism Preparedness. GAO-01-555T. Washington,  D.C.: May 9, 2001.
Combating Terrorism: Comments on Counterterrorism Leadership and  National Strategy. GAO-01-556T. Washington, D.C.: March 27, 2001.
Embassy Construction: Better Long-Term Planning Will Enhance  Program Decision-making. GAO-01-11. Washington, D.C.: January 22,  2001.
FAA Computer Security: Recommendations to Address Continuing  Weaknesses. GAO-01-171. Washington, D.C.: December 6, 2000.
FAA Computer Security: Actions Needed to Address Critical Weaknesses  That Jeopardize Aviation Operations. GAO/T-AIMD-00-330. Washington,  D.C.: September 27, 2000.
FAA Computer Security: Concerns Remain Due to Personnel and Other  Continuing Weaknesses. GAO/AIMD-00-252. Washington, D.C.: August 16,  2000.
Combating Terrorism: Action Taken but Considerable Risks Remain for  Forces Overseas. GAO/NSIAD-00-181. Washington, D.C.: July 19, 2000.
State Department: Overseas Emergency Security Program Progressing,  but Costs Are Increasing. GAO/NSIAD-00-83. Washington, D.C.: March 8,  2000.
Combating Terrorism: Issues in Managing Counterterrorist Programs.  GAO/T-NSIAD-00-145. Washington, D.C.: April 6, 2000.
State Department: Progress and Challenges in Addressing Management  Issues. GAO/T-NSIAD-00-124. Washington, D.C.: March 8, 2000.
State Department: Major Management Challenges and Program Risks.  GAO/T-NSIAD/AIMD-99-99. Washington, D.C.: March 4, 1999.
Major Management Challenges and Program Risks: Department of State.  GAO/OCG-99-12. Washington, D.C.: January 1999.
Combating Terrorism: Opportunities to Improve Domestic Preparedness  Program Focus and Efficiency. GAO/NSIAD-99-3. Washington, D.C.:  November 12, 1998.
Foreign Affairs Management: Major Challenges Facing the Department  of State. GAO/T-NSIAD-98-251. Washington, D.C.: September 17, 1998.
Combating Terrorism: Efforts to Protect U.S. Forces in Turkey and the  Middle East. GAO/T-NSIAD-98-44. Washington, D.C.: October 28, 1997.
Combating Terrorism: Federal Agencies’ Efforts to Implement National  Policy and Strategy. GAO/NSIAD-97-254. Washington, D.C.: September 26,  1997.
Combating Terrorism: Status of DOD Efforts to Protect Its Forces  Overseas. GAO/NSIAD-97-207. Washington, D.C.: July 21, 1997.
Aviation Security: FAA’s Procurement of Explosives Detection Devices.  GAO/RCED-97-111R. Washington, D.C.: May 1, 1997.
Aviation Security: Posting Notices at Domestic Airports. GAO/RCED-97- 88R. Washington, D.C.: March 25, 1997.
Aviation Security: Technology’s Role in Addressing Vulnerabilities.  GAO/T-RCED/NSIAD-96-262. Washington, D.C.: September 19, 1996.
Aviation Security: Urgent Issues Need to Be Addressed. GAO/T- RCED/NSIAD-96-251. Washington, D.C.: September 11, 1996.
Aviation Security: Immediate Action Needed to Improve Security. GAO/T- RCED/NSIAD-96-237. Washington, D.C.: August 1, 1996.
Aviation Security: FAA Can Help Ensure That Airports’ Access Control  Systems are Cost-Effective. GAO/RCED-95-25. Washington, D.C.: March 1,  1995.