Building Security: New Federal Standards Hold Promise, But Could Be Strengthened to Better Protect Leased Space
Published: 2010-09-22T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The federal government's reliance on leased space underscores the need to physically secure this space and help safeguard employees, visitors, and government assets. In April 2010 the Interagency Security Committee (ISC), comprised of 47 federal agencies and departments and chaired by the Department of Homeland Security (DHS), issued Physical Security Criteria for Federal Facilities (the 2010 standards) which supersede previous ISC standards. In response to Congress' direction to review ISC standards for leased space, this report (1) identifies challenges that exist in protecting leased space and (2) examines how the 2010 standards address these challenges. To conduct this work, GAO analyzed agency documents and interviewed federal officials from ISC, four federal departments selected as case studies based on their large square footage of leased space, and the Federal Protective Service (FPS). GAO also consulted prior work on federal real property and physical security, including key practices in facility protection.
section_title: What GAO Found
paragraphs: Limited information about risks and the inability to control common areas and public access pose challenges to protecting leased space. Leasing officials do not always have the information needed to employ a risk management approach for allocating resources--a key practice in facility protection. Early risk assessments--those conducted before a lease is executed--can provide leasing officials with valuable information; however, FPS, which is the General Service Administration's (GSA) physical security provider, generally does not perform these assessments for leased space under 10,000 square feet--which constitutes a majority of GSA's leases. Under its memorandum of agreement (MOA) with GSA, FPS is not expected to perform these assessments and does not have the resources to do so. Another challenge in protecting leased space is tenant agencies' lack of control over common areas (such as elevator lobbies, loading docks, and the building's perimeter) which hampers their ability to mitigate risk from public access to leased space. In leased space, lessors, not tenant agencies, typically control physical security in common areas. To implement measures to counter risks in common areas, tenant agencies must typically negotiate with and obtain consent from lessors, who may be unwilling to implement countermeasures because of the potential burden or undue effect on other, nonfederal tenants. For example, tenant agencies in a high-risk, multitenant leased facility we visited have been unable to negotiate changes to the common space, including the installation of X-ray machines and magnetometers, because the lessor believed that the proposed countermeasures would inconvenience other tenants and the public. The 2010 standards show potential for addressing some challenges with leased space. These standards align with some key practices in facility protection because they prescribe a decision making process to determine, mitigate, and accept risks using a risk management approach. Further, by requiring that decision making be tracked and documented, the standards facilitate performance measurement that could help enable agency officials to determine if the most critical risks are being prioritized and mitigated. With its emphasis on the uniform use of early risk assessments, the 2010 standards provide a baseline requirement for agencies to consider as they develop protocols and allocate resources for protecting leased space. For example, GSA and FPS must now consider this requirement, which represents an expansion of the services currently expected of FPS, as they renegotiate their MOA. In contrast, a shortfall within the 2010 standards is that they offer little means for addressing tenant agencies' lack of control over common areas and public access. While the 2010 standards outline specific countermeasures for addressing public access, they lack in-depth discussion and guidance--such as best practices--that could provide a framework for working with lessors to implement these countermeasures. Given the critical role that lessors play, such guidance is warranted. As the government's central forum for exchanging information on facility protection, ISC is well positioned to develop and share this guidance.
section_title: What GAO Recommends
paragraphs: GAO recommends that DHS instruct ISC to establish a working group or other mechanism to determine guidance for working with lessors, and to incorporate this guidance into a future ISC standard or other product, as appropriate. DHS concurred with the report's recommendation.

section_title: Letter
paragraphs: In fiscal year 2009, the federal government leased domestically more than  253 million square feet of space with large portions leased by nonmilitary  agencies including the General Services Administration (GSA),  Department of Veterans Affairs (VA), Department of Agriculture (USDA),  and Department of Justice (DOJ). GSA acts as the lead leasing agency,  and leased the majority of this space on behalf of various federal  agencies. The Federal Protective Service (FPS), in the Department of  Homeland Security (DHS), is responsible for the security of GSA-acquir leased space. Other federal agencies— such as VA, USDA, and DOJ— acquire and provide physical security services for leased space, as well.  The federal government’s reliance on leasing has increased in re underscoring the need for physical security to safeguard the employees,  visitors, and government assets in leased space.
Like with privately leased space, federally leased space faces threats such  as theft, vandalism, and trespass. And, like federally owned space,  federally leased space can be a target for acts of terrorism, violence, and  destruction. A recent string of high-profile incidents, including shootings  at the entrance to the Pentagon and at a Las Vegas federal courthouse as  well as the intentional crash of a small airplane into an Internal Revenue  Service office, demonstrate the dangerous nature of risks faced by federal  employees in federal buildings and leased space. In 2004, the Interagency  Security Committee (ISC), which has representation from all major federal  departments and agencies, issued Security Standards for Leased Space  (hereafter referred to as the 2004 standards), establishing physical security  standards for federally leased space. These standards were recently  superseded in April 2010 by ISC’s Physical Security Criteria for Federal  Facilities (hereafter referred to as “the 2010 standards”), which were  intended to make security an integral part of the operations, planning,  design, construction, renovation, or acquisition of federal facilities— whether in owned or leased space. In addition, we have identified in our  prior work key practices in facility protection, including allocation of  resources using a risk management approach.
This report responds to House Report No. 110-207 that directed us to  assess the “2004 standards” for protecting leased space. Based on  discussions with your staff and in light of the recently issued 2010  standards, this report (1) identifies challenges that exist in protecting  leased space and (2) examines how the 2010 standards address these  challenges.
To identify challenges in protecting leased space, we conducted case  studies of four agencies and reviewed our prior work on facility  protection. We selected GSA, VA, USDA, and DOJ as case studies based on  their large square footage of leased spaces. As part of our case study  analyses, we analyzed internal policies relevant to physical security and  leasing and interviewed headquarters and field officials from GSA, FPS,  VA, USDA, and DOJ responsible for physical security and leasing. For  example, we analyzed the memorandum of agreement (MOA) between  GSA and DHS and GSA data on its leased space inventory to determine the  expectations for FPS performing early risk assessments. We administered  a data collection instrument among officials responsible for physical  security and also conducted 15 site visits to facilities leased by our case  study agencies. We toured each leased space site and collected  documents, when available, that contained site-specific information on  security risks. At each site, we interviewed the tenant agency official(s)  with primary responsibility for security or another designated official. At  some sites, we also interviewed the security official responsible for the  protecting the space and the lessor. We selected our sites to include a  range of predominant use types, security levels, sole and multitenant  facilities, geographic locations, and also considered the opinions of GSA  officials. We corroborated the quantitative and qualitative data from our  case study agencies and found the data sufficiently reliable for our  purposes. The findings from our case studies and site visits exemplify  physical security challenges in leased space, but cannot be generalized to  challenges facing all federal government lessees. Additionally, we  considered key practices in facility protection, as identified in our prior  work, including allocating security resources using risk management,  leveraging the use of security technology, coordinating protection efforts  and sharing information with other stakeholders, measuring program  performance and testing security initiatives, aligning assets to mission, and  strategically managing human capital.
To examine how the 2010 standards address challenges that exist in  protecting leased space, we conducted a comparative analysis of the 2010  standards to the challenges we identified, as well as to the 2004 standards.  We also interviewed officials from ISC about the chief differences between  the 2004 and the 2010 standards. We reviewed our prior work on GSA and  DHS’s MOA and analyzed how the 2010 standards were applicable to their  renegotiation of the MOA. We also interviewed agency officials from VA,  USDA, and DOJ to determine the impact of the 2010 standards on efforts  underway at their agencies.
We performed our work from July 2009 to September 2010 in accordance  with generally accepted government auditing standards. Those standards  require that we plan and perform the audit to obtain sufficient and  appropriate evidence to provide a reasonable basis for our findings and  conclusions based on our audit objectives. We believe that the evidence  obtained provides a reasonable basis for our findings and conclusions  based on our audit objectives.
subsections: section_title: Background
paragraphs: Real property is generally defined as facilities, land, and anything  constructed on or attached to land. The federal government leases real  property (referred to in this report as leased space) for a variety of  purposes including office spaces, warehouses, laboratories, and housing.
subsections: section_title: Agencies and Relevant Laws
paragraphs: As the federal government’s landlord, GSA designs, builds, manages, and  safeguards buildings to support the needs of other federal agencies. GSA is  authorized to enter into lease agreements with tenant agencies for up to 20  years that the Administrator of GSA considers to be in the interest of the  federal government and necessary to accommodate a federal agency.  GSA uses its authority to lease space for many federal government  agencies, and in fiscal year 2009 acquired more than 182 million square  feet, the most leased space of any federal agency. In response to our 2005  recommendation and to enhance coordination with the FPS, GSA  established the Building Security and Policy Division within the Public  Buildings Service. The division developed the Regional Security Network,  which consists of several security officials for each of GSA’s 11 regions, to  further enhance coordination with FPS at the regional and building levels  and to carry out GSA security policy in collaboration with FPS and tenant  agencies.
Some agencies have independent or delegated leasing authority which  allow the agency to perform all necessary functions to acquire leased  space without using GSA. In fiscal year 2009, VA, USDA, and DOJ, using  GSA-delegated and/or independent leasing authority, leased a total of  approximately 30 million of square feet to help meet their varying  missions. Specifically,    VA leased approximately 10 million square feet and has a large inventory  of real property, including medical centers, outpatient facilities, and  ambulatory care clinics.
USDA leased approximately 17 million square feet. USDA uses leased  space to administer programs which assist farmers and rural communities,  oversee the safety of meat and poultry, provide low-income families  access to nutritious food, and protect the nation’s forests, among other  things.
DOJ leased approximately 3 million square feet. DOJ is comprised of about  40 component agencies with wide-ranging missions, such as the U.S.  Attorneys’ Offices, Drug Enforcement Agency (DEA), and the Federal  Bureau of Investigation (FBI).
The Homeland Security Act of 2002 established DHS to centralize the  federal government’s efforts to prevent and mitigate terrorist attacks  within the United States—including terrorism directed at federal facilities.
Under the act, FPS was transferred from GSA to DHS. As of October  2009, FPS is organized within DHS’s National Protection and Programs  Directorate. FPS is the primary federal agency responsible for protecting  and securing GSA facilities, visitors, and over 1 million federal employees  across the country. FPS’s basic security services include patrolling the  building perimeter, monitoring building perimeter alarms, dispatching law  enforcement officers through its control centers, conducting criminal  investigations, and performing facility security assessments. FPS also  provides building-specific security services, such as controlling access to  building entrances and exits and checking employees and visitors. FPS is a  fully reimbursable agency—that is, its services are fully funded by security  fees collected from tenant agencies. FPS charges each tenant agency a  basic security fee per square foot of space occupied in a GSA building (66  cents per square foot in fiscal year 2009), among other fees.
ISC, established in 1995 by Executive Order 12977 after the bombing of the  Alfred P. Murrah federal building in Oklahoma City, has representation  from all the major property-holding agencies and a range of  governmentwide responsibilities related to protecting nonmilitary  facilities. These responsibilities generally involve developing policies and  standards, ensuring compliance, and encouraging the exchange of  security-related information. Executive Order 12977 called for each  executive agency and department to cooperate and comply with the  policies and recommendations of the Committee. DHS became responsible  for chairing ISC, which, as of 2007, is housed in the Office of Infrastructure  Protection within DHS’s National Protection and Programs Directorate.  Executive Order 13286, which amended Executive Order 12977, calls for  the Secretary of DHS to monitor federal agency compliance with the  standards issued by ISC.
The 2004 standards, in conjunction with the Facility Security Level  Determinations for Federal Facilities—which ISC issued in 2008 to  update standards issued by DOJ in 1995—prescribed administrative  procedures and various countermeasures for perimeter, entry, and  interior, and, as well as blast and setbacks for leased spaces based upon  five different facility security levels ranging between levels I and V, with  level I being the lowest risk level and level V being the highest. The 2004  standards were specifically developed in response to a perceived need for  security standards that could be applied in a leased space environment.  The Facility Security Level Determinations for Federal Facilities and its  precursors established the criteria and process for determining the  security level of a facility which serves as the basis for implementing the  countermeasures prescribed within other ISC standards, including the  2004 standards.
According to the 2004 standards, when an agency is seeking a new lease, a  security official should determine the security level of the leased space  based on an early risk assessment, which is performed prior to entering  into a new lease. Requirements based on the designated facility security  level, as outlined within the standards, are to be incorporated into a  solicitation for offers (SFO), which is sent to potential lessors, as  minimum requirements. These minimum requirements must be met, with  the exception of blast and setback requirements in existing buildings.  Potential lessors who are unwilling or unable to meet the requirements are  deemed nonresponsive according to the standards and eliminated from the  SFO process.
After a lease is entered into, the Facility Security Level Determinations  for Federal Facilities states that risk assessments, such as facility security  assessments (FSA), be conducted on a periodic and timely basis, with the  facility security level being determined or adjusted as part of each risk  assessment. Specifically, risk assessments are to be conducted every 5  years for facilities classified as facility security level I or II, and every 3  years for facilities classified as facility security level III, IV, or V.
section_title: Key Practices in Facility Protection
paragraphs: We have previously identified, from the collective practices of federal  agencies and the private sector, a set of key facility protection practices  that provide a framework for guiding agencies’ physical security efforts  and addressing challenges. Key facility protection practices as shown in  figure 1 include the following:  Information sharing and coordination establishes a means of  communicating information with other government entities and the  private sector to prevent and respond to security threats.
Allocating resources using risk management involves identifying  potential threats, assessing vulnerabilities, identifying the assets that are  most critical to protect in terms of mission and significance, and  evaluating mitigation alternatives for their likely effect on risk and their  cost.
Aligning assets to mission can reduce vulnerabilities by reducing the  number of assets that need to be protected.
Strategic human capital management ensures that agencies are well  equipped to recruit and retain high-performing security staff.
Leveraging technology supplements other countermeasures with  technology in a cost-effective manner.
Performance measurement and testing evaluates efforts against broader  program goals and ensures that they are met on time and within budgeting  constraints.
section_title: Limited Risk Information and Lack of Control Over Common Areas and Public Access Pose Challenges to Protecting Leased Space
subsections: section_title: Leasing Officials Sometimes Lack the Information Needed to Employ a Risk Management Approach
paragraphs: Before a lease is signed, early risk assessments can help agencies allocate  resources using a risk management approach, a key practice of facility  protection. Through early risk assessments, security officials are able to  collect key information about potential spaces, security risks, and needed  countermeasures, which help leasing officials, in turn, identify the most  appropriate space to lease and negotiate any needed countermeasures.
Leasing officials primarily rely on security officials to supply information  on physical security requirements for federally leased space. Some tenant  agencies are able to supply leasing officials with key prelease information  because they have developed the security expertise to conduct their own  early risk assessments. For example, DEA has its own in-house security  officials who work with leasing officials to conduct risk assessments early  in the leasing process. This helps leasing officials assess risk and obtain  space specific to DEA’s security needs. Similarly, VA has created internal  policy manuals that describe agency security requirements which help  guide leasing and security officials on how to assess risk and obtain  appropriate space. These manuals are circulated to VA leasing, facilities,  and security officials, and GSA leasing officials are made familiar with  VA’s physical security requirements early in the leasing process for GSA- acquired space. Additionally, VA currently budgets $5 per net usable  square foot for physical building security and sustainability requirements  into all of its leases. At one site, VA officials are in the early stages of  identifying space needs for the relocation of a community-based  outpatient clinic. VA leasing officials and security officials, among others,  are collaborating on decisions that integrate security with the function of  the outpatient clinic that will help ensure funds are available to finance the  security requirements.
Despite the in-house expertise of some tenant agencies, leasing officials  sometimes do not have the information they need to allocate resources  using a risk management approach before a lease is signed because early  risk assessments are not conducted for all leased space. Early risk  assessments are absent for a significant portion of the GSA-acquired  leased space portfolio because FPS does not uniformly conduct these  assessments for spaces under 10,000 square feet—which constitute 69  percent of all GSA leases (see figure 2). While FPS is expected under the  MOA to uniformly conduct early risk assessments for GSA-acquired space  greater than or equal to 10,000 square feet, FPS and GSA officials agree  that FPS is not expected to conduct early risk assessments for spaces  under 10,000 square feet unless it has the resources to do so.
As we have previously reported, FPS faces funding and workforce  challenges, which may limit the resources available to conduct early risk  assessments on spaces under 10,000 square feet. Further, FPS may lack  incentive for prioritizing early risk assessments on smaller spaces, given  that it receives payment on a square footage basis only after a lease has  been signed. Currently, the cost of early risk assessments is distributed  across all tenant agencies. We are examining FPS’s fee structure as part of  our ongoing work in the federal building security area.
According to FPS officials, FPS generally does not have enough time to  complete early risk assessments on spaces less than 10,000 square feet, in  part because GSA has requested early risk assessments too late or too  close to the time when a site selection must be made. A GSA official  involved with physical security stated that even when GSA gives FPS  proper lead time, early risk assessments are still sometimes not conducted  by FPS. For example, in October 2009, GSA requested FPS conduct an  early risk assessment for a leased space under 10,000 square feet within 8  months. One week prior to the June 2010 deadline, GSA was still unsure if  an FPS inspector had been assigned and if a risk assessment had been or  would be conducted. Because FPS did not keep centralized records of the  number of early risk assessments requested by GSA or completed by FPS  in fiscal year 2009, we were unable to analyze how often early risk  assessments are requested and the percentage of requested assessments  that FPS completes.
Leasing and security officials from our case study agencies agreed they are  best able to negotiate necessary countermeasures before a lease is  executed. Because of the immediate costs associated with relocating, after  a tenant agency moves in, it may be forced to stay in its current leased  space, having to accept unmitigated risk (if countermeasures cannot be  negotiated) or expend additional time and resources to put  countermeasures in place (and negotiate supplemental lease agreements)  once a lease has been signed. For example, a DEA leasing official stated  that relocation is often not a viable solution given costs, on average, of  between $10 and $12 million to find and move an office to a new space.  Furthermore, at one of our site visits, DEA officials have been working to  install a costly fence—a DEA physical security requirement for this  location that was originally planned as part of the built-to-suit facility, but  canceled because of a lack of funds. According to DEA officials, now that  DEA has acquired funding for the fence, they have been negotiating for  more than a year with GSA and the lessor to receive supplemental lease  agreements, lessor’s design approval, and resolve issues over the  maintenance and operation of the fence. According to DEA officials, fence  construction is expected to commence in January 2011.
section_title: Tenant Agencies’ Lack of Control Over Common Areas in Leased Space Can Hamper Their Ability to Mitigate Risks
paragraphs: Balancing public access with physical security and implementing security  measures in common areas of federally leased space are major challenges.  The public visits both owned and leased federal facilities for government  services, as well as for other business transactions. In leased space, the  number and range of people accessing these buildings can be large and  diverse, and building access is generally less restricted than in owned  space. Fewer access restrictions and increased public access heighten the  risk of violence, theft, and other harm to federal employees and the public.
In leased space, it can be more difficult to mitigate risks associated with  public access because tenant agencies typically do not control common  areas, which are usually the lessor’s responsibility, particularly in  multitenant buildings. Common areas, as shown in figure 3, can include  elevator lobbies, building corridors, restrooms, stairwells, loading docks,  the building perimeter, and other areas.
FSAs can identify countermeasures to address risks with public access,  but FSA recommendations can be difficult to implement because tenant  agencies must negotiate all changes with the lessor. Lessors may resist  heightened levels of security in common areas—such as restricted public  access—because of the potential adverse effect on other tenants in the  building. For example, a multitenant facility security level IV building we  visited, housing the United States Forest Service among other federal  agencies, experienced difficulty installing X-ray machines and  magnetometers in the main lobby. The lessor deemed these proposed  countermeasures inconvenient and disruptive for some other tenants,  including two commercial businesses located on the ground floor—a  daycare center and a sundries shop—and for the public. Because the  livelihood of these businesses depends on pedestrian traffic and because  federal tenant agencies did not lease the lobby, per se, the lessor resisted  having additional security countermeasures in place that would restrict  public access.
While some tenant agency officials at our site visits stated that lessors  were responsive to security needs in common areas, other tenant agency  officials we spoke with said that negotiating security enhancements to  common areas with lessors is a problem that can lead to a lack of  assurance that security risks and vulnerabilities are being mitigated. A  regional GSA official involved with physical security stated that because  GSA and tenant agencies do not control common areas in buildings where  they lease space, it can be challenging to secure loading docks, hallways,  and corridors. Another regional GSA official involved with physical  security stated that tenant agencies do what they can by implementing  countermeasures in their own leased space rather than in common areas,  for example, by regulating access at the entrances to leased space rather  than at the building entrances. At one site, a FBI official indicated that by  relocating to a new leased space, FBI, as the sole tenant, would be able to  better control common areas and public access.
Overall, the negative effects of these challenges are significant because  GSA, FPS, and tenant agencies can be poorly positioned to implement the  practices that we have identified as key to protecting the physical security  of leased spaces. Tenant agencies that are unable to identify and address  vulnerabilities may choose space poorly, misallocate resources, and be  limited in their ability to implement effective countermeasures.  Furthermore, when tenant agencies are unable to allocate resources  according to identified vulnerabilities, they may also be unable to employ  the other key practices in facility protection. For example, tenant agencies  may not be able to leverage technology to implement the most appropriate  countermeasures if it requires a presence in common areas that are not  under the control of the federal tenant.
section_title: The 2010 Standards Show Potential for Addressing Some Challenges with Leased Space
subsections: section_title: The 2010 Standards’ Focus on Decision Making and Documentation Aligns with Some Key Facility Protection Practices
paragraphs: In April 2010, ISC issued the Physical Security Criteria for Federal  Facilities, also known as the 2010 standards. These standards define a  decision-making process for determining the security measures required at  a facility. According to the standards, it is critical that departments and  agencies recognize and integrate the process as part of the real property  acquisition process (i.e., leasing process) in order to be most effective. The  2010 standards provide in-depth descriptions of the roles of security  officials who conduct and provide early risk assessments, the tenant  agency, and the leasing agency (e.g., GSA) and also define each entity’s  respective responsibilities for implementing the standards’ decision- making process. For example, the 2010 standards state that:    Tenant agencies are the decision maker as to whether to fully mitigate or  accept risk. Tenant agencies must either pay for the recommended  security measures and reduce the risk, or accept the risk and live with the  potential consequences.
Leasing officials will determine how additional countermeasures will be  implemented or consider expanding the delineated area, in conjunction  with the tenant agency, during the leasing acquisition process.
Security officials are responsible for identifying and analyzing threats and  vulnerabilities, and recommending appropriate countermeasures. Once a  credible and documented risk assessment has been presented to and  accepted by the tenant agency, the security official is not liable for any  future decision to accept risk.
The 2010 standards align with some key practices in facility protection  because these standards focus on allocating resources using a risk  management approach and measuring performance. As previously  discussed, having information on risks and vulnerabilities allows tenant  agencies to maximize the impact of limited resources and assure that the  most critical risks are being prioritized and mitigated. Likewise,  performance measurement, via tracking and documentation of decision  making, can help agencies to determine the effectiveness of security  programs and establish accountability at the individual facility level. By  allocating resources using a risk management approach and measuring  performance, tenant agencies and the federal government will be better  positioned to comprehensively and strategically mitigate risk across the  entire portfolio of real property.
Allocating resources using a risk management approach is a central tenet  of the 2010 standards. The 2010 standards prescribe a decision-making  process to determine the risk posed to a facility (level of risk), the  commensurate scope of security (level of protection) needed, and the  acceptance of risk when countermeasures will not be implemented or  implemented immediately. Like the 2004 standards, the 2010 standards  outline a minimum set of physical security countermeasures for a facility  based on the space’s designated facility security level. The 2010 standards  allow for this level of protection to be customized to address site specific  conditions in order to achieve an acceptable level of risk. The 2004  standards allowed for some countermeasures to be unmet due to facility  limitations, building owner acceptance, lease conditions, and the  availability of adequate funds, but required a plan for moving to security  compliant space in the future in such instances. According to the 2004  standards, these exemptions allowed agencies to obtain the best security  solution available when no compliant space was available. According to  the ISC Executive Director, the 2004 standards were, in effect, lower  standards because of the operational considerations given to leased  space. The Executive Director said that the 2010 standards correct this  weakness by focusing on decision making that can lead to an acceptable  level of protection and risk through a variety of means, rather than a  standard that simply prescribes a fixed set of countermeasures that can  then be circumvented by exemptions as in the 2004 standards.
Additionally, the 2010 standards emphasize documentation of the decision- making process—a cornerstone for performance measurement. The 2004  standards required agencies to provide written justification for exceeding  the standard and documentation of the limiting conditions that  necessitated agencies to go below the standard. The 2010 standards more  explicitly state that “the project documentation must clearly reflect the  reason why the necessary level of protection cannot be achieved. It is  extremely important that the rationale for accepting risk be well  documented, including alternate strategies that are considered or  implemented, and opportunities in the future to implement the necessary  level of protection.” More specifically, the 2010 standards state that any  decision to reject implementation of countermeasures outright or defer  implementation due to cost (or other factors) must be documented,  including the acceptance of risk in such circumstances and that tenant  agencies should retain documents pertinent to these decisions, such as  risk assessments. The ISC Executive Director stated that after the  standards are fully implemented, the federal government will be able to  accurately describe the state of federal real property and physical security.
For each facility, there will be documentation—a “final building report”—  containing information on physical security decision making, including the  costs of implementing countermeasures. Each agency will be able to  assess their entire portfolio of real property by aggregating these final  building reports to determine the overall status and cost of physical  security. These reports will be able to demonstrate the federal  government’s level of protection against potential threats, according to the  executive director. We agree that if the standards succeed in moving  agencies to track and document such information at a building level, then  tenant agency, leasing, and security officials will be better able to  determine if the most critical risks are being prioritized and mitigated  across an entire real property portfolio and to determine the gaps and  efficacy of agency-level security programs.
section_title: ISC Standards Could Spur Agencies to Allocate the Resources Necessary for Early Risk Assessment
paragraphs: Early risk assessments are key initial steps in the decision-making process  prescribed by the 2010 standards. The standards contain a direct call for  risk assessments to be conducted and used early in the leasing process.  The standards prescribe the following:    Prospective tenant agencies will receive information regarding whether  the level of protection can be achieved in a delineated area.
Security officials will conduct risk assessments and determine facility  security levels early to determine required countermeasures that leasing  officials should include within SFOs.
Security officials will evaluate the proposed security plans of potential  lessors responding to the SFOs and update the risk assessment on offers in  the competitive range to identify threats and vulnerabilities for the specific  properties and recommend any additional security measures to tenant  agencies and leasing officials.
The 2004 standards outlined more broadly that the initial facility security  level should be determined by a security official based on a risk  assessment and that those potential lessors who are unwilling or unable to  meet the standard be considered unresponsive to the SFO. The 2010  standards also make no distinction or exemptions to the requirement for  early risk assessments of leased space, based on a space’s square footage  or any other wholesale factor.
Like the 2004 standards, the 2010 standards apply to all buildings and  facilities in the United States occupied by federal employees for  nonmilitary activities. Further, according to the 2010 standards, each  executive agency and department shall comply with the policies and  recommendations prescribed by the standards. Given this, the 2010  standards’ language on early risk assessments, as previously discussed,  should encourage agencies to perform and use these assessments in leased  space—including spaces under 10,000 square feet. Specifically, language  within the standards directing agencies to uniformly perform and use early  risk assessments as part of the prescribed decision-making process is  useful, because it provides a baseline for agencies to consider as they  develop protocols and allocate resources for protecting leased space.
Since leased space for nonmilitary activities acquired by GSA is subject to  ISC standards, and FPS provides security services for GSA-acquired leased  space, it is up to both agencies to figure out how to meet the 2010  standards in light of available resources. However, as previously  discussed, FPS already faces resource and other challenges in conducting  these early risk assessments. Given these current challenges, it will likely  be difficult for FPS to meet the 2010 standards, which would necessitate  an expansion of the services FPS is expected to perform under the current  MOA. In October 2009, we reported that FPS and GSA recognized that the  MOA renegotiation can serve as an opportunity to discuss service issues  and develop mutual solutions. Both FPS and GSA officials reported that  the delivery of early risk assessments was being reviewed as part of the  MOA. As part of the MOA renegotiations, GSA’s Regional Security  Network developed a flowchart to expressly show the need for FPS  services, such as early risk assessments. According to FPS officials, one of  the goals of the MOA is to clarify how early and from whom GSA officials  ought to request these risk assessments from FPS.
Other agencies will also have to consider how they will meet the 2010  standards’ requirement for early risk assessments. VA and USDA have  efforts underway to further standardize their leasing guidance which  represent opportunities for doing just this. According to VA officials, VA  will review and update its leasing and security manuals to reflect the 2010  standards and is currently assessing what other additional revisions to  these manuals may be warranted. VA can now incorporate the 2010  standards’ baseline decision-making process for its leasing and security  officials, which would help support the use of early risk assessments.  USDA is also modifying a department-level leasing handbook to  incorporate the 2010 standards, since leasing officials can play a  significant role in physical security in the leasing process, particularly  given the limited number of security officials within USDA. Additionally,  USDA is considering realigning its few security officials to report to a  department-level office (rather than be organized under each agency) in  order to maximize available resources for performing such things as risk  assessments. According to officials from agencies within VA and USDA,  department-level direction is a valuable resource that leasing officials rely  on for determining what activities must be undertaken during the leasing  process.
section_title: ISC Standards Lack Guidance for Working with Lessors
paragraphs: A shortfall within the 2010 standards is that they do not fully address the  challenge of not controlling common areas and public access in leased  space. Though the standards speak to tenant agencies, leasing officials,  and security officials about their various roles and responsibilities in  implementing the standard, the 2010 standards lack in-depth discussion  for these entities about how to work with lessors to implement  countermeasures. The 2010 standards outline specific countermeasures  for addressing public access as part of protecting a facility’s entrance and  interior security, such as signage, guards, and physical barriers. Similar to  the 2004 standards, the 2010 standards acknowledge that the ability to  implement security countermeasures is dependent on lessors.  Nevertheless, like the 2004 standards, there is little discussion on ways for  tenant agencies, leasing officials, and security officials to work with or  otherwise leverage lessors, which in our view is a significant omission  given that implementing countermeasures can depend largely on lessors’  cooperation.
Given the critical role that lessors play, guidance for tenant agencies,  leasing officials, and security officials—such as best practices—from ISC  could be helpful for agencies as they attempt to meet the baseline level of  protection prescribed within the 2010 standards for protecting leased  space. Best practices comprise the collective practices, processes, and  systems of leading organizations, including federal agencies and the  private sector. Best practices can provide agencies, though diverse and  complex, with a framework for meeting similar mission goals, such as  facility protection. Guidance on working with lessors could suggest such  practices as the inclusion of clauses within SFOs and lease agreements  that obligate lessors to a level of protection in common areas as defined in  ISC standards (i.e., deemed necessary by tenant agencies, in conjunction  with security officials, as the result of FSAs conducted after a lease is  executed). Currently, GSA standard leasing templates contain language  stipulating that lessors must provide a level of security that reasonably  prevents unauthorized entry during nonduty hours and deters loitering or  disruptive acts in and around leased space. Prior to the execution of the  lease, leasing officials and tenant agencies could also negotiate or stipulate  a cost-sharing structure with lessors in the event that future  countermeasures are needed. For example, GSA standard leasing  templates already reserve that right of the government to temporarily  increase security in the building under lease, at its own expense and with  its own personnel during heightened security conditions due to emergency  situations. A best practice could be that such existing language regarding  common areas and the implementation of security countermeasures be  articulated and linked to ISC standards more definitively within SFO and  leasing agreements. This could provide tenant agencies, leasing officials,  and security officials the leverage necessary for compelling lessors to  allow or cooperatively implement security countermeasures in common  areas in order to mitigate risks from public access.
As the government’s central forum for exchanging information and  guidance on facility protection, ISC is well positioned to develop and share  best practices. ISC has the capacity to create a working group or other  mechanism to address this gap in its 2010 standards. ISC has previously  developed best practices in physical security issues, and one of its five  standing subcommittees is focused on developing best practices related to  technology. Officials from our case study agencies reported that their  agencies use ISC guidance and standards in developing policies and  protocols for physical security and leasing. Moreover, we have reported  that previous ISC standards have been viewed as useful in communicating  increased physical security needs to private owners and involving them  directly in the process of security program development for their  buildings.
section_title: Conclusions
paragraphs: Federal agencies continue to rely on leased space to meet various  missions, but the limited use of early risk assessments and a lack of  control over common areas present challenges to protecting this space.  Though all risks can never be completely predicted or eliminated, it is  imperative to address these challenges because they leave GSA, FPS, and  tenant agencies poorly positioned to implement key practices in facility  protection, such as allocating resources using a risk management  approach, leveraging technology, and measuring performance. As the  government-wide standard for protecting nonmilitary federal facilities, the  2010 standards are aligned with some of these practices, providing  direction on the roles of various entities and their responsibilities in  achieving minimum levels of protection and acceptable levels of risk.  Specifically, the 2010 standards hold promise for positioning the federal  government to begin comprehensively assessing risks with its requirement  for documenting building-specific security decision making. The 2010  standards’ prescription that risk assessments be used early in all new lease  acquisitions is significant because it could provide the impetus for  agencies to examine and allocate the resources needed for implementing  early risk assessments, in particular for leases under 10,000 square feet. In  contrast, the standards’ lack of discussion on working with lessors is  notable, given the significant role these entities have in implementing  countermeasures that could mitigate risks from public access, particularly  in common areas, such as lobbies and loading docks. Guidance to tenant  agencies, leasing officials, and security officials on how to work with  lessors, such as best practices, would give helpful direction as these  entities work together to secure common areas and protect leased space.
section_title: Recommendation for Executive Action
paragraphs: To enhance the value of ISC standards for addressing challenges with  protecting leased space, we recommend that the Secretary of Homeland  Security instruct the Executive Director of the ISC, in consultation, where  appropriate, with ISC member agencies to  (1) establish an ISC working group or other mechanism to determine  guidance for working with lessors, which may include best practices to  secure common areas and public access, and  (2) subsequently incorporate these findings into a future ISC standard or  other product, as appropriate.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to DHS, GSA, VA, USDA, and DOJ for  review and comment. DHS concurred with our recommendation and GSA,  VA, USDA, and DOJ provided technical comments, which we incorporated  as appropriate. DHS’s comments are contained in Appendix I.
We will send copies of this report to the Secretary of Homeland Security,  FPS Director of DHS, the Administrator of GSA, the Secretary of VA, the  Secretary of Agriculture, the Attorney General, and appropriate  congressional committees. In addition, the report will be available at no  charge on the GAO Web site at http://www.gao.gov.
If you have any questions about this report, please contact me at (202) 512- 2834 or goldsteinm@gao.gov. Contact points for our Offices of  Congressional Relations and Public Affairs may be found on the last page  of this report. GAO staff who made major contributions to this report are  listed in appendix II.
section_title: Appendix I: Comments from the Department of Homeland Security
section_title: Appendix II: GAO Contact and Staff Acknowledgments
subsections: section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, David E. Sausville, Assistant  Director; Delwen Jones; Susan Michal-Smith; Sara Ann Moessbauer;  Meghan Squires; Kyle Stetler; and Friendly Vang-Johnson made key  contributions to this report.