Risk Management: Further Refinements Needed to Assess Risks and Prioritize Protective Measures at Ports and Other Critical Infrastructure
Published: 2005-12-15T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Congress and the President have called for various homeland security efforts to be based on risk management--a systematic process for assessing threats and taking appropriate steps to deal with them. GAO examined how three Department of Homeland Security (DHS) components were carrying out this charge: the Coast Guard, which has overall responsibility for security in the nation's ports; the Office for Domestic Preparedness (ODP), which awards grants for port security projects; and the Information Analysis and Infrastructure Protection Directorate (IAIP), which has responsibility for developing ways to assess risks across all types of critical infrastructure. GAO's work focused on identifying the progress each DHS component has made on risk management and the challenges each faces in moving further.
section_title: What GAO Found
paragraphs: The three DHS components GAO studied varied considerably in their progress in developing a sound risk management framework for homeland security responsibilities. The varied progress reflects, among other things, each component's organizational maturity and the complexity of its task. The Coast Guard, which is furthest along, is the component of longest standing, being created in 1915, while IAIP came into being with the creation of the Department of Homeland Security in 2003. IAIP, which has made the least progress, is not only a new component but also has the most complex task--addressing not just ports but all types of infrastructure. The Coast Guard and ODP have a relatively robust methodology in place for assessing risks at ports; IAIP is still developing its methodology and has had several setbacks in completing the task. All three components, however, have much left to do. In particular, each component is limited in its ability to compare and prioritize risks. The Coast Guard and ODP can do so within a port but not between ports; IAIP has not demonstrated that it can do so either within or between all infrastructure sectors. Each component faces many challenges in making further progress. Success will depend partly on continuing to improve various technical and management processes that are part of risk management. For example, obtaining better quality data from intelligence agencies would help DHS components estimate the relative likelihood of various types of threats--a key element of assessing risks. In the longer term, progress will depend increasingly on how well risk management is coordinated across agencies, because current approaches in many ways are neither consistent nor comparable. Also, weaving risk-based data into the annual budget cycle of program review will be important. Supplying the necessary guidance and coordination is what the Department of Homeland Security was set up to do and, as the Secretary of Homeland Security has stated, what it now needs increasingly to address. This is a key issue for the department as it seeks to identify relative risks and take appropriate actions related to the nation's homeland security activities.

section_title: Letter
paragraphs: The threat of terrorism presents a number of risks to our nation’s seaports  and other types of critical infrastructure. The Department of Homeland  Security (DHS) has three components responsible for the security of  critical infrastructure related to ports and other facilities. The U.S. Coast  Guard has responsibility for port security overall. The Office for Domestic  Preparedness (ODP) is responsible for providing port security grants to  selected maritime facility owners. The Information Analysis and  Infrastructure Protection (IAIP) Directorate is responsible for working  with other federal, state, local, and private organizations to identify and  protect critical infrastructure across the nation. Risk management is a tool  for assessing risks, evaluating alternatives, making decisions, and  implementing and monitoring protective measures. This report provides  an evaluation of the progress made, and challenges faced, by the Coast  Guard, ODP, and IAIP in using risk management to improve homeland  security.
As agreed with your offices, unless you publicly announce its contents  earlier, we plan no further distribution of this report until 30 days after its  issue date. At that time, we will provide copies of this report to  appropriate departments and interested congressional committees. This  report will also be available at no charge on the GAO Web site at  http://www.gao.gov.
If you or your staff have any questions about this report, please contact me  at (415) 904-2200 or at wrightsonm@gao.gov. Key contributors to this  report are listed in appendix III.
section_title: Appendix I: A Risk Management Framework
paragraphs: This appendix describes how we developed the risk management  framework and how we used it to evaluate activities related to homeland  security and combating terrorism. The framework is intended to be a  starting point for risk management activities and will likely evolve as  processes mature and lessons are learned. A glossary is included at the  end of this appendix.
subsections: section_title: General Lack of Uniform Guidance on Risk Management
paragraphs: Although the Homeland Security Act and subsequent strategies advocate  the use of risk management to protect the nation’s critical infrastructure  and key resources, they did not define how this was to be accomplished.  Homeland Security Presidential Directive 7 (HSPD-7) directed the  Secretary of the Department of Homeland Security (DHS) to establish  uniform policies, approaches, guidelines, and methodologies integrating  federal infrastructure protection and risk management activities. However,  no further direction or guidance as to the course of action has been  forthcoming.
The ability to anticipate future happenings and to choose among  alternatives lies at the heart of risk management and provides us with a  guide, based on good management practices and supported by established  internal controls that can enhance decision making. Although risk  management has long been used for assessing risk in some sectors, such  as environmental issues, health care, finance, and the insurance industry,  the application of risk management principles to the homeland security  area is relatively new. The many areas and activities under homeland  security provide untested and difficult challenges because the source of  the risk is an intelligent adversary with whom there exists little domestic  experience. As a result, the probabilities and consequences of a terrorist  attack are difficult to predict. In spite of this high degree of uncertainty  and the knowledge that not all risk can be eliminated, enhancing  protection from known or potential threats can help prevent or mitigate  adverse events.
section_title: Methodology for Developing a Risk Management Framework
paragraphs: Given that there is no established universally agreed upon set of  requirements or processes for a risk management framework specifically  related to homeland security and combating terrorism, we developed a  framework that would be applicable by reviewing, analyzing, and  synthesizing several sources of information.
We began by reviewing current risk literature and previous GAO reports  and testimonies. We consulted the Government Performance and Results  Act (GPRA) of 1993; the Government Auditing Standards, 2003 Revision,  GAO’s Standards for Internal Control in the Federal Government  (November 1999); guidance from the Office of Management and Budget  (OMB); the work of the President’s Commission on Risk Management;  consulting papers; and the enterprise risk management approach of the  Committee of Sponsoring Organizations (COSO) of the Treadway  Commission. In addition, we consulted with experts in the fields of risk  management, risk modeling, and terrorism. We reviewed numerous  frameworks from industry, government, and academic sources.
We synthesized information from these numerous government, industry,  and academic sources in developing our risk management framework. The  framework was field-tested on several GAO reviews. The draft framework  was then reviewed by three academic experts in risk management. No  substantial changes to the draft framework were recommended.
section_title: A Risk Management Framework
paragraphs: The framework should be considered to be a starting point in a field that is  evolving, and the entire cycle of risk management activities should be  viewed as a goal. The phases contained in the framework are    strategic goals, objectives, and constraints;   risk assessment;    alternatives evaluation;    management selection; and   implementation and monitoring.
The framework has been developed so that individual phases of the  approach, such as risk assessment, do not become ends in themselves, but  provide a full cycle of related activities, from strategic planning through  implementation and monitoring. The process is dynamic, and although the  various phases appear linear, new information can be entered at any  phase. The framework can be used to inform agency officials and decision  makers of the basic components of a risk management system or can be  used as a stand-alone guide. Figure 4 illustrates our risk management  framework and some sources of criteria, such as GAO best practices,  Office of Management and Budget circulars, GAO guidance on internal  controls, and the Government and Performance Act of 1993 and their link  with management processes. While statistical methods and risk-ranking  approaches frequently underlie risk assessment approaches, different  application areas tend to develop their own terminologies and their own  logical sequences for the cause of risk.
The risk management framework is designed to be flexible, in that the  approach may be applied at various organizational levels ranging from that  of a department level of a multiagency organization down to that of a  specific project or program.
Because there is no one uniformly accepted approach to risk management,  terms and activities may differ across applications. However, any  approach that omits the substance of the steps shown in figure 4 is likely  to have material weaknesses. Table 11 summarizes the phases of our risk  management framework and provides examples of elements contained in  those phases.
The following sections provide more detail on the five phases of our risk  management framework.
section_title: Strategic Goals, Objectives, and Constraints
paragraphs: This phase addresses what the strategic goals are attempting to achieve  and the steps needed to attain those results, including milestones and  performance measures to permit measurement of progress toward those  goals. Ideally, management decisions should be made in the context of a  strategic plan, with clearly articulated goals and objectives that flow from  the plan. Strategic goals at the highest level could be considered an “end- state” followed by a logical hierarchy of major goals and subordinate  objectives composed of clear, concise, measurable activities and timelines  to achieve results and ensure accountability. An organization’s program or  plan and risk planning documents should address risk-related issues that  are central to its mission. Our work related to the Government  Performance and Results Act of 1993 has produced guidance that  identifies risk for the congressional oversight of federal agencies’ strategic  plans. The consideration of risk in strategic planning may be incorporated  into planning documents or into specific management strategies.
Currently, it is difficult to translate plans and actions into a clear sense of  how we are progressing in making our nation more secure. One reason is  that homeland security efforts, in general, lack clear goals with  corresponding performance measures to evaluate progress toward these  goals. As others, such as the Gilmore Commission, have stated, a  continuing problem for homeland security has been the lack of clear  strategic guidance about the definition and objectives of preparedness.
Risk management allows entities to operate more effectively in  environments of uncertainty by providing the discipline and structure in  which to address these issues, since risk management is not an end in  itself, but an important component of an entity’s management process. As  such, risk management is interrelated with, among other things, an entity’s  governance, performance management, and internal controls. The process  of risk management provides the rigor and structure necessary to identify  and select among alternative risk responses whose cumulative effect is  intended to reduce risk, and the methodologies and techniques for making  selection decisions. This process enables entities to enhance their  capability to identify potential adverse events, assess risks, and establish  integrated responses. Further, this phase in the planning process would  include support and buy-in from upper levels of management and  stakeholders. Acceptance for concepts of the model from this group  provides the groundwork for future discussions.
Finally, various constraints may have an impact on risk management  plans. Some constraints may be imposed by statute, higher-level policy,  budget, or other factors beyond management’s control and may vary with  the scale of the application. Managers at different levels within an  organization will have different degrees of flexibility to institute risk  management countermeasures. An important constraint for federal  agencies, such as DHS, is the role that Congress plays in authorizing and  funding programs. For example, Congress may direct specific actions  affecting how agencies allocate funding.
section_title: Risk Assessment
paragraphs: This phase addresses the process of evaluating the threats and  vulnerabilities of assets so that countermeasures might be instituted to  prevent or mitigate risks. Threat, in the risk management model, concerns  the probability that a specific type of attack will be initiated against a  specific target. It includes any circumstance or event with the potential to  cause loss or damage to the asset. Although agencies may not have enough  information to identify and characterize all threats related to their assets,  known or imagined adverse events would be characterized in some detail.  Effective threat analysis is dependent on an understanding of an  adversary’s intention, motivation, historical data, and capability to  damage. An additional crucial component of risk assessment is  vulnerability, that is, any weakness that an adversary can exploit to harm  or damage the asset. An asset may be highly vulnerable to one mode of  attack but have a low level of vulnerability to another, depending on a  variety of factors, such as countermeasures already in place. While  consequence concerns the result of an adverse event on a particular asset,  criticality is the asset’s relative importance to the entity. A criticality  assessment identifies and prioritizes assets and functions in terms of  specific criteria, such as their importance to public safety and the  economy, as a basis for identifying which structures or processes are  relatively more important to protect from attack. Criticality assessments  are important because they provide, in combination with the framework’s  threat and risk assessments, the basis for prioritizing which assets require  greater protection relative to finite resources and provide information for  later stages in the risk management process. Risk assessments should  utilize the most appropriate subject matter experts in assessing the  components of risk. When dealing with Bayesian probability estimates,  this is critical. In addition, mathematical constructs must be chosen  carefully, specifically tailoring approaches in the context of uncertainty  and data quality.
section_title: Alternative Evaluation
paragraphs: This phase addresses the evaluation of risk reduction methods by  consideration of countermeasures or countermeasure systems and the  costs and benefits associated with them. Ideally, a risk management  framework would include an evaluation of a risk assessment as a valid  decision support tool to establish and prioritize a risk management  strategy. Furthermore, a strategy might include risk management  consultants and decision-making tools, such as software that simulates a  particular type of attack. Information developed in previous phases would  inform decisions.
Specific countermeasures would be considered and prioritized based on a  number of factors, such as the degree of risk reduction they afford and the  cost and difficulty to implement them. Risk assessment may give guidance  to implementing countermeasures or countermeasure systems that may be  used for more than one critical asset, or to prevent, mitigate, or respond to  multiple adverse events occurring simultaneously. In addition, external  risk consultants can be advantageous at this phase in terms of creating a  variety of countermeasure options. While external reviewers cannot  ensure the success of a plan, they can increase the probability of selecting  the most effective countermeasures for the least cost because of their  expertise in the area. Further, risk scenarios might also provide valuable  information pertaining to an entity’s ability to respond to a terrorist event,  evaluate its coordination with other entities, identify problems, and  institute corrective action.
Finally, a risk management strategy should include a cost-benefit analysis  of countermeasure options as they are a critical element of alternatives  evaluation. Major regulatory actions or capital investments of federal  expenditures generally require a cost-benefit or cost-effectiveness  approach. This approach can be useful in evaluating alternatives, since it  links the benefits from risk-reducing countermeasures to the costs  associated with them. In the development of such analyses, quantitative  impacts affecting both costs and benefits are, to the extent possible,  identified in monetary terms.
While the core OMB guidance for evaluating countermeasures for  budgetary and regulatory purposes focuses on monetary cost-benefit  evaluation, OMB is essentially silent when costs and benefits cannot be  easily quantified or monetized. Costs that are not generally estimated or  included in monetary terms include opportunity costs, that is, the value of  opportunities forgone because resources are applied to antiterrorism  countermeasures. These costs are most controversial when considered in  areas such as public service programs or services curtailed or cancelled.  Benefits are usually measured in terms of the risk reduction they provide.  They are considered in terms of the overall effectiveness of the  countermeasures with respect to the estimated vulnerabilities.
section_title: Management Selection
paragraphs: This phase addresses such issues as determining where resources and  investments will be made, the sources and types of resources needed, and  where those resources would be targeted. Management’s active  participation in this phase is important as decisions are of necessity  influenced by the preferences and value judgments of agency leadership.  For example, some managers will prefer to concentrate countermeasures  on a relatively few critical assets, while others may value distributional  impacts, that is, to distribute resources over a wide variety of assets.  Ideally, a risk management strategy would also identify appropriate  mechanisms to allocate resources, such as grants based on identified  needs. Furthermore, a key factor in the selection of risk reducing  measures is risk tolerance, the level of comfort management has with  various levels of risk. This tolerance may change over time, depending on  new information, changes in financial constraints, and attitude toward  risk. The risk management strategy, with stakeholder input, will identify  what constitutes an acceptable level of risk for assets and how resources  are delegated.
The risk management strategy reflects consideration as to which risks  should be managed immediately and to what extent, and which risks can  be deferred and addressed at a later time. Milestones and timelines for  implementation are important elements that allow evaluating the extent to  which progress is being made toward achieving goals. It also illustrates the  degree of protection that can be obtained and places security and costs in  perspective. The documentation of management decisions, including the  rationales that support the decisions, will provide valuable information for  future adjustments.
section_title: Implementation and Monitoring
paragraphs: This phase addresses the degree to which risk management strategies  contain internal controls and performance measurement guidelines. In  addition to implementing countermeasures, it may also include  implementing new organizational policies and procedures, as well as  human, physical, and technical controls. Countermeasures would be  initiated in accordance with the timelines in the risk management  schedule.
Monitoring and evaluation include, when and where appropriate, external  peer review, testing and validation of countermeasures, evaluating the  effects of these actions on future operation, and identifying unintended  consequences. GAO has also discussed the importance of these activities  as they ensure actions are taken to address risks.
Internal control monitoring should assess the quality of performance over  time and ensure that the findings of audits and other reviews are promptly  resolved. Internal controls help to ensure that procedures are  documented and maintained.
section_title: Difficulties Applying a Risk Management Framework
paragraphs: Risk management represents a unique set of challenges. Developing such a  framework is designed to guide the actions of management to prepare for  and respond to adverse events in an environment of uncertainty. As  applied to homeland security, the ability to determine the likelihood of  terrorism-related events occurring and quantifying the resulting outcomes  is balanced against the benefit as protection (security) provided at an  acceptable cost.
Generally, a major difficulty in executing and implementing a risk  management system occurs because of what is commonly called decision  uncertainty, that is, the assumed goal of minimizing risk does not have a  common meaning. For example, minimizing risk is based on values, the  measure of risk, and the comparison of values and risk. Decision  uncertainty arises when there is controversy or ambiguity concerning how  to compare and weight social objectives. Three major sources of decision  uncertainty are    Risk measurement—although the selection of risk measurement is both  an art and a science, it must be technically correct as well as both valid  and meaningful.
The social cost of risk—in order to make different risks comparable,  various risks often have to be quantified into comparable quantities and  placing values on cost and benefits involves judgments.
The quantification of social values—uncertainty surrounds the level of  risk that is acceptable or can be tolerated. That is, how much money is  to be spent on protection meaning risk reduction and what is the cost  in terms of opportunities forgone because of finite resources. This  value is dependent upon determining society’s risk attitude or  tolerance and may change over time.
Coordination activities suggest that for the results of a risk management  system to be meaningful and useful, all related agencies should be using  similar methods. If agencies’ methods are not compatible, then  comparisons between agencies become difficult and sector or national  risk assessments becomes less reliable. In our earlier work, we concluded  that a structured, systematic approach to risk management offers the best  assurance that activities designed to protect the homeland and combat the  effects of terrorism will produce the most effective and efficient results.  Specific difficulties implementing risk management systems are contained  in chapters 2, 3, and 4.
section_title: Glossary of Risk Management Terms
paragraphs: For purposes of our risk management framework, we use the following  definitions:    Asset—-any person, facility, material, information, or activity that has a  positive or symbolic value. An asset may have a value to an adversary  as well as to its owner, although the nature and magnitude of these  values may differ. Assets may be categorized or combined in many  ways; examples are people, information, equipment, facilities,  operations, and activities.
Benefit—-net outcome, usually translated into monetary terms; a  benefit may include both direct and indirect effects.
Consequence—-the expected worse case or reasonable worse case  impact of a successful attack. The consequence to a particular asset  can be evaluated when threat and vulnerability are considered  together.  This loss or damage may be long- or short-term in nature.
Cost—-input, both direct and indirect.
Cost-benefit analysis—-part of the management decision-making  process in which the costs and benefits of each countermeasure  alternative are compared and the most appropriate alternative is  selected. Costs include the price paid for tangible materials and the  ongoing operational costs associated with implementing the  countermeasures. Benefits are expressed in terms of the amount of risk  reduction based on the overall effectiveness of the countermeasure  with respect to the assessed vulnerabilities.
Countermeasure—-any action taken or physical equipment used  principally to reduce or eliminate one or more vulnerabilities. The cost  of a countermeasure is usually expressed in monetary terms but may  include nonmonetary costs such as reduced operational effectiveness,  unfavorable working conditions, adverse publicity and political  consequences.
Criticality assessment—-identifies and evaluates an entity’s assets or  operations on the basis of a variety of factors, including the importance  of an asset or function and the significance of a system in terms of  national security, economic activity, and public safety. A criticality  assessment provides the basis for determining which assets require  greater or special protection relative to finite resources.
Impact—-the amount of loss or damage that can be expected from a  successful attack on an asset. Loss may be monetary, but may include  loss of lives and destruction of a symbolic structure.
Monitoring and evaluation—-is a continuous repetitive assessment  process to keep a risk management process current and relevant. It  includes, among other activities, external peer review, testing, and  validation.
Opportunity cost—the value of opportunities forgone.
Risk—an event that has a potentially negative impact and the  possibility that such an event will occur and adversely affect an entity’s  assets, activities, and operations. The principal classes of risk from  terrorism are to the general public, targets of symbolic value,  organizational, governmental, and societal infrastructure, cyber and  physical infrastructure, and economic sectors and structures.
Risk assessment—-the process of qualitatively or quantitatively  determining the probability of an adverse event and the severity of its  impact on an asset. It is a function of threat, vulnerability, and  consequence. A risk assessment may include scenarios in which two or  more risks interact to create a greater or lesser impact. A risk  assessment provides the basis for the rank ordering of risks and for  establishing priorities for applying countermeasures.
Risk management—-a continuous process of managing—through a  series of mitigating actions that permeate an entity’s activities—the  likelihood of an adverse event and its negative impact. Risk  management addresses risk before mitigating action, as well as the risk  that remains after countermeasures have been taken.
Scenario—-the combination of weapon and attack mode on a specific  target or critical asset (for example, the release of sarin gas in a  subway train).
Threat—-an indication of the likelihood that a specific type of attack  will be initiated against a specific target or class of targets. It may  include any indication, circumstance, or event with the potential to  cause the loss of or damage to an asset. It can also be defined as an  adversary’s intention and capability to undertake actions that would be  detrimental to a valued asset.
Threat assessment—-the identification and evaluation of adverse  events that can harm or damage an asset. A threat assessment includes  the probability of an event and the extent of its lethality. Threats may  be present at the global, national, or local level.
Vulnerability—-the probability that a particular attempted attack will  succeed against a particular target or class of targets.
Vulnerability assessment—-the identification of weaknesses in  physical structures, personal protection systems, processes or other  areas that may be exploited. A vulnerability assessment identifies  inherent states and the extent of their susceptibility to exploitation  relative to the existence of any countermeasures.
section_title: Appendix II: Comments from the Department of Homeland Security
section_title: Appendix III: GAO Contacts and Staff Acknowledgments
subsections: section_title: GAO Contacts
section_title: Staff Acknowledgments
paragraphs: In addition to the persons named above, David Alexander, Neil Asaba,  Nancy A. Briggs, Christine Davis, Scott Farrow, Kevin Heinz, Emily S.  Pickrell, Albert Schmidt, Stan Stenersen, April Thompson, and L. James  Valverde made key contributions to this report.
section_title: Related GAO Products
paragraphs: Critical Infrastructure Protection: Challenges in Addressing  Cybersecurity. GAO-05-827T. Washington, D.C.: July 19, 2005  Critical Infrastructure Protection: Department of Homeland Security  Faces Challenges in Fulfilling Cybersecurity Responsibilities.   GAO-05-434. Washington, D.C.: May 26, 2005.
Homeland Security: Agency Plans, Implementation, and Challenges  Regarding the National Strategy for Homeland Security. GAO-05-33.  Washington, D.C.: January 14, 2005.
Homeland Security: Further Actions Needed to Coordinate Federal  Agencies’ Facility Protection Efforts and Promote Key Practices.  GAO-05-49. Washington, D.C.: November 30, 2004.
U.S. Postal Service: Physical Security Measures Have Increased at Some  Core Facilities, but Security Problems Continue. GAO-05-48. Washington,  D.C.: November 16, 2004.
Drinking Water: Experts’ Views on How Federal Funding Can Best Be  Spent to Improve Security. GAO-04-1098T. Washington, D.C.: September  30, 2004.
Financial Market Preparedness: Improvements Made, but More Action  Needed to Prepare for Wide-Scale Disasters. GAO-04-984. Washington,  D.C.: September 27, 2004.
Nuclear Regulatory Commission: Preliminary Observations on Efforts  to Improve Security at Nuclear Power Plants. GAO-04-1064T. Washington,  D.C.: September 14, 2004.
U.S. Postal Service: Better Guidance Is Needed to Ensure an Appropriate  Response to Anthrax Contamination. GAO-04-239. Washington, D.C.:  September 9, 2004.
Public Key Infrastructure: Examples of Risk and Internal Control  Objectives Associated with Certification Authorities. GAO-04-1023R.  Washington, D.C.: August 10, 2004.
Combating Terrorism: DOD Efforts to Improve Installation  Preparedness Can Be Enhanced with Clarified Responsibilities and  Comprehensive Planning. GAO-04-855. Washington, D.C.: August 9, 2004.
Homeland Security: Transformation Strategy Needed to Address  Challenges Facing the Federal Protective Service. GAO-04-537.  Washington, D.C.: July 14, 2004.
Critical Infrastructure Protection: Improving Information Sharing with  Infrastructure Sectors. GAO-04-780. Washington, D.C.: July 9, 2004.
Information Security: Agencies Need to Implement Consistent Processes  in Authorizing Systems for Operation. GAO-04-376. Washington, D.C.:  June 28, 2004.
National Nuclear Security Administration: Key Management Structure  and Workforce Planning Issues Remain as NNSA Conducts Downsizing.  GAO-04-545. Washington, D.C.: June 25, 2004.
Nuclear Security: Several Issues Could Impede Ability of DOE’s Office of  Energy, Science, and Environment to Meet the May 2003 Design Basis  Threat. GAO-04-894T. Washington, D.C.: June 22, 2004.
Information Security: Information System Controls at the Federal  Deposit Insurance Corporation. GAO-04-630. Washington, D.C.: May 28,  2004.
Posthearing Questions Related to Fragmentation and Overlap in the  Federal Food Safety System. GAO-04-832R. Washington, D.C.: May 26,  2004.
Terrorism Insurance: Effects of Terrorism Risk Insurance Act of 2002.  GAO-04-720T. Washington, D.C.: April 28, 2004.
Nuclear Security: DOE Needs to Resolve Significant Issues before It  Fully Meets the New Design Basis Threat. GAO-04-623. Washington, D.C.:  April 27, 2004.
Terrorism Insurance: Implementation of the Terrorism Risk Insurance  Act of 2002. GAO-04-307. Washington, D.C.: April 23, 2004.
Critical Infrastructure Protection: Establishing Effective Information  Sharing with Infrastructure Sectors. GAO-04-699T. Washington, D.C.:  April 21, 2004.
Homeland Security: Federal Action Needed to Address Security  Challenges at Chemical Facilities. GAO-04-482T. Washington, D.C.:  February 23, 2004.
Posthearing Questions from the September 17, 2003, Hearing on  “Implications of Power Blackouts for the Nation’s Cybersecurity and  Critical Infrastructure Protection: The Electric Grid, Critical  Interdependencies, Vulnerabilities, and Readiness.” GAO-04-300R.  Washington, D.C.: December 8, 2003.
Security: Counterfeit Identification Raises Homeland Security  Concerns. GAO-04-133T. Washington, D.C.: October 1, 2003.
Nuclear Regulatory Commission: Oversight of Security at Commercial  Nuclear Power Plants Needs to Be Strengthened. GAO-03-752.  Washington, D.C.: September 4, 2003.
Nuclear Security: DOE Faces Security Challenges in the Post September  11, 2001, Environment. GAO-03-896TNI. Washington, D.C.: June 24, 2003.
Nuclear Security: NNSA Needs to Better Manage Its Safeguards and  Security Program. GAO-03-471. Washington, D.C.: May 30, 2003.
Information Security: Progress Made, but Challenges Remain to Protect  Federal Systems and the Nation’s Critical Infrastructures. GAO-03-564T.  Washington, D.C.: April 8, 2003.
Homeland Security: EPA’s Management of Clean Air Act Chemical  Facility Data. GAO-03-509R. Washington, D.C.: March 14, 2003.
Homeland Security: Voluntary Initiatives Are Under Way at Chemical  Facilities, but the Extent of Security Preparedness Is Unknown.   GAO-03-439. Washington, D.C.: March 14, 2003.
Potential Terrorist Attacks: Additional Actions Needed to Better Prepare  Critical Financial Market Participants. GAO-03-414. Washington, D.C.:  February 12, 2003.
Potential Terrorist Attacks: More Actions Needed to Better Prepare  Critical Financial Markets. GAO-03-468T. Washington, D.C.: February 12,  2003.
Potential Terrorist Attacks: Additional Actions Needed to Better Prepare  Critical Financial Market Participants. GAO-03-251. Washington, D.C.:  February 12, 2003.
High-Risk Series: Protecting Information Systems Supporting the  Federal Government and the Nation’s Critical Infrastructures.   GAO-03-121. Washington, D.C.: January 1, 2003.
Combating Terrorism: Actions Needed to Guide Services’ Antiterrorism  Efforts at Installations. GAO-03-14. Washington, D.C.: November 1, 2002.
Homeland Security: Department of Justice’s Response to Its  Congressional Mandate to Assess and Report on Chemical Industry  Vulnerabilities. GAO-03-24R. Washington, D.C.: October 10, 2002.
Building Security: Interagency Security Committee Has Had Limited  Success in Fulfilling Its Responsibilities. GAO-02-1004. Washington, D.C.:  September 17, 2002.
Chemical Safety: Emergency Response Community Views on the  Adequacy of Federally Required Chemical Information. GAO-02-799.  Washington, D.C.: July 31, 2002.
Critical Infrastructure Protection: Significant Homeland Security  Challenges Need to Be Addressed. GAO-02-918T. Washington, D.C.: July 9,  2002.
Information Security: Corps of Engineers Making Improvements, but  Weaknesses Continue. GAO-02-589. Washington, D.C.: June 10, 2002.
Security Breaches at Federal Buildings in Atlanta, Georgia.   GAO-02-668T. Washington, D.C.: April 30, 2002.
National Preparedness: Technologies to Secure Federal Buildings.   GAO-02-687T. Washington, D.C.: April 25, 2002.
Diffuse Security Threats: Technologies for Mail Sanitation Exist, but  Challenges Remain. GAO-02-365. Washington, D.C.: April 23, 2002.
Terrorism Insurance: Rising Uninsured Exposure to Attacks Heightens  Potential Economic Vulnerabilities. GAO-02-472T. Washington, D.C.:  February 27, 2002.
Critical Infrastructure Protection: Significant Challenges in  Safeguarding Government and Privately Controlled Systems from  Computer-Based Attacks. GAO-01-1168T. Washington, D.C.: September 26,  2001.
Combating Terrorism: Actions Needed to Improve DOD Antiterrorism  Program Implementation and Management. GAO-01-909. Washington,  D.C.: September 19, 2001.
Critical Infrastructure Protection: Significant Challenges in Protecting  Federal Systems and Developing Analysis and Warning Capabilities.  GAO-01-1132T. Washington, D.C.: September 12, 2001.
subsections: section_title: Maritime Security
paragraphs: Coast Guard: Progress Being Made on Addressing Deepwater Legacy  Asset Condition Issues and Program Management, but Acquisition  Challenges Remain. GAO-05-757. Washington, D.C.: July 22, 2005.
Coast Guard—Electronic Certification Procedures. B-302789.  Washington, D.C.: July 6, 2005  Coast Guard: Preliminary Observations on the Condition of Deepwater  Legacy Assets and Acquisition Management Challenges. GAO-05-651T.  Washington, D.C.: June 21, 2005.
Maritime Security: Enhancements Made, but Implementation and  Sustainability Remain Key Challenges. GAO-05-448T. Washington, D.C.:  May 17, 2005.
Coast Guard: Preliminary Observations on the Condition of Deepwater  Legacy Assets and Acquisition Management Challenges. GAO-05-307T.  Washington, D.C.: April 20, 2005.
Maritime Security: New Structures Have Improved Information  Sharing, but Security Clearance Processing Requires Further Attention.  GAO-05-394. Washington, D.C.: April 15, 2005.
Coast Guard: Observations on Agency Priorities in Fiscal Year 2006  Budget Request. GAO-05-364T. Washington, D.C.: March 17, 2005.
Homeland Security: Process for Reporting Lessons Learned from Seaport  Exercises Needs Further Attention. GAO-05-17. Washington, D.C.:   January 14, 2005.
Coast Guard: Station Readiness Improving, but Resources Challenges  and Management Concerns Remain. GAO-05-161. Washington, D.C.:  January 31, 2005.
Port Security: Planning Needed to Develop and Operate Maritime Worker  Identification Card Program. GAO-05-106. Washington, D.C.: December  10, 2004.
Maritime Security: Better Planning Needed to Help Ensure an Effective  Port Security Assessment Program. GAO-04-1062. Washington, D.C.:  September 30, 2004.
Maritime Security: Partnering Could Reduce Federal Costs and  Facilitate Implementation of Automatic Vessel Identification System.  GAO-04-868. Washington, D.C.: July 23, 2004.
Maritime Security: Substantial Work Remains to Translate New  Planning Requirements into Effective Port Security. GAO-04-838.  Washington, D.C.: June 30, 2004.
Coast Guard: Station Spending Requirements Met, but Better Processes  Needed to Track Designated Funds. GAO-04-695. June 14, 2004.
Coast Guard: Key Management and Budget Challenges for Fiscal Year  2005 and Beyond. GAO-04-636T. Washington, D.C.: April 7, 2004.
Homeland Security: Summary of Challenges Faced in Targeting  Oceangoing Cargo Containers for Inspection. GAO-04-557T.   Washington, D.C.: March 31, 2004.
Coast Guard Programs: Relationship between Resources Used and  Results Achieved Needs to Be Clearer. GAO-04-432. Washington, D.C.:  March 22, 2004.
Homeland Security: Preliminary Observations on Efforts to Target  Security Inspections of Cargo Containers. GAO-04-325T.   Washington, D.C.: December 16, 2003.
Posthearing Questions Related to Aviation and Port Security.   GAO-04-315R. Washington, D.C.: December 12, 2003.
Maritime Security: Progress Made in Implementing Maritime  Transportation Security Act, but Concerns Remain. GAO-03-1155T.  Washington, D.C.: September 9, 2003.
Container Security: Expansion of Key Customs Programs Will Require  Greater Attention to Critical Success Factors. GAO-03-770.   Washington, D.C.: July 25, 2003.
Homeland Security: Challenges Facing the Department of Homeland  Security in Balancing its Border Security and Trade Facilitation  Missions. GAO-03-902T. Washington, D.C.: June 16, 2003.
Coast Guard: Challenges during the Transition to the Department of  Homeland Security. GAO-03-594T. Washington, D.C.: April 1, 2003.
Transportation Security: Post-September 11th Initiatives and Long- Term Challenges. GAO-03-616T. Washington, D.C.: April 1, 2003.
Coast Guard: Comprehensive Blueprint Needed to Balance and Monitor  Resource Use and Measure Performance for All Missions. GAO-03-544T.  Washington, D.C.: March 12, 2003.
Homeland Security: Challenges Facing the Coast Guard as It  Transitions to the New Department. GAO-03-467T. Washington, D.C.:  February 12, 2003.
Coast Guard: Strategy Needed for Setting and Monitoring Levels of  Effort for All Missions. GAO-03-155. Washington, D.C.: November 12,  2002.
Port Security: Nation Faces Formidable Challenges in Making New  Initiatives Successful. GAO-02-993T. Washington, D.C.: August 5, 2002.
Combating Terrorism: Preliminary Observations on Weaknesses in  Force Protection for DOD Deployments through Domestic Seaports.   GAO-02-955TNI. Washington, D.C.: July 23, 2002.
section_title: Risk Management
paragraphs: Passenger Rail Security: Enhanced Federal Leadership Needed to  Prioritize and Guide Security Efforts. GAO-05-851. September 9, 2005  Homeland Security: Actions Needed to Better Protect National Icons and  Federal Office Buildings from Terrorism. GAO-05-790. June 24, 2005.
Protection of Chemical and Water Infrastructure: Federal Requirements,  Actions of Selected Facilities, and Remaining Challenges. GAO-05-327.  Washington, D.C.: March 28, 2005.
Transportation Security: Systematic Planning Needed to Optimize  Resources. GAO-05-357T. February 15, 2005  Homeland Security: Agency Plans, Implementation, and Challenges  Regarding the National Strategy for Homeland Security. GAO-05-33.  January 14, 2005.
Homeland Security: Further Actions Needed to Coordinate Federal  Agencies’ Facility Protection Efforts and Promote Key Practices.   GAO-05-49. November 30, 2004  General Aviation Security: Increased Federal Oversight is Needed, but  Continued Partnership with the Private Sector is Critical to Long-Term  Success. GAO-05-144. November 10, 2004.
Air Traffic Control: System Management Capabilities Improved, but  More Can Be Done to Institutionalize Improvements. GAO-04-901.   August 20, 2004  Aviation Security: Challenges in Using Biometric Technologies.   GAO-04-785T. May 19, 2004.
Homeland Security: Summary of Challenges Faced in Targeting  Oceangoing Cargo Containers for Inspection. GAO-04-557T. March 31,  2004  Rail Security: Some Actions Taken to Enhance Passenger and Freight  Rail Security, but Significant Challenges Remain. GAO-04-598T.   March 23, 2004.
Homeland Security: A Risk Management Approach Can Guide  Preparedness Efforts. GAO-02-208T. Washington, D.C.: October 31, 2001.
Homeland Security: Key Elements of a Risk Management Approach.  GAO-02-150T. Washington, D.C.: October 12, 2001.