Critical Infrastructure Protection: DHS Is Taking Action to Better Manage Its Chemical Security Program, but It Is Too Early to Assess Results
Released: 2012-07-26T00:00:00


Highlights: section_title: Why GAO Did This Study
paragraphs: The events of September 11, 2001, triggered a national re-examination of the security of facilities that use or store hazardous chemicals in quantities that, in the event of a terrorist attack, could put large numbers of Americans at risk of serious injury or death. As required by statute, DHS issued regulations that establish standards for the security of high-risk chemical facilities. DHS established the CFATS program to assess the risk posed by these facilities and inspect them to ensure compliance with DHS standards. ISCD, a component of IP, manages the program. A November 2011 internal ISCD memorandum, prepared by ISCD senior managers, has raised concerns about the management of the program. This testimony focuses on (1) how the memorandum was developed and any challenges identified, (2) what actions are being taken in response to any challenges identified, and (3) the extent to which ISCD’s proposed solutions require collaboration with NPPD or IP. GAO’s comments are based on recently completed work analyzing the memorandum and related actions. GAO reviewed laws, regulations, DHS’s internal memorandum and action plans, and related documents, and interviewed DHS officials.

section_title: What GAO Found
paragraphs: The November 2011 memorandum that discussed the management of the Chemical Facility Anti-Terrorism Standards (CFATS) program was prepared based primarily on the observations of the Director of the Department of Homeland Security’s (DHS) Infrastructure Compliance Security Division (ISCD), a component of the Office of Infrastructure Protection (IP) within the National Protection and Programs Directorate (NPPD). The memorandum was intended to highlight various challenges that have hindered ISCD efforts to implement the CFATS program. According to the Director, the challenges facing ISCD included not having a fully developed direction and plan for implementing the program, hiring staff without establishing need, and inconsistent ISCD leadership—factors that the Director believed place the CFATS program at risk. These challenges centered on human capital issues, including problems hiring, training, and managing ISCD staff; mission issues, including overcoming problems reviewing facility plans to mitigate security vulnerabilities and performing compliance inspections; and administrative issues, including concerns about NPPD and IP not supporting ISCD’s management and administrative functions.

ISCD has begun to take various actions intended to address the human capital management, mission, and administrative issues identified in the ISCD memorandum and has developed a 94-item action plan to track its progress. According to ISCD managers, the plan appears to be a catalyst for addressing some of the long-standing issues the memorandum identified. As of June 2012, ISCD reported that 40 percent (38 of 94) of the items in the plan had been completed. These include (1) requiring ISCD managers to meet with staff to involve them in addressing challenges, clarifying priorities, and changing ISCD’s culture and (2) developing a proposal to establish a quality control function over compliance activities. The remaining 60 percent (56 of 94) that were in progress include those requiring longer-term efforts--—i.e., streamlining the process for reviewing facility security plans and developing facility inspection processes; those requiring completion of other items in the plan; or those awaiting action by others, such as approvals by ISCD leadership. ISCD appears to be heading in the right direction, but it is too early to tell if individual items are having their desired effect because ISCD is in the early stages of implementing corrective actions and has not established performance measures to assess results. Moving forward, exploring opportunities to develop measures, where practical, to determine where actual performance deviates from expected results, consistent with internal control standards could help ISCD better identify any gaps between actual and expected results so that it can take further action, where needed. For example, as ISCD develops a new security plan review process, it could look for ways to measure the extent to which the time to do these reviews has been reduced as compared with the time needed under the current review process.

According to ISCD officials, almost half of the action items included in the June 2012 action plan require ISCD collaboration with or action by NPPD and IP. The ISCD memorandum stated that IP and NPPD did not provide the support needed to manage the CFATS program when the program was first under development. ISCD, IP, and NPPD officials confirmed that IP and NPPD are providing needed support and stated that the action plan prompted them to work together to address the various human capital and administrative issues identified.

section_title: What GAO Recommends
paragraphs: GAO recommends that DHS look for opportunities, where practical, to measure its performance implementing actions items. DHS concurred with the recommendation.

section_title: Letter
paragraphs: I am pleased to be here today to discuss the Department of Homeland  Security’s (DHS) efforts to address various challenges in implementing  and managing the Chemical Facility Anti-Terrorism Standards (CFATS)  program. The events of September 11, 2001, triggered a national re- examination of the security of facilities that use or store hazardous  chemicals in quantities that, in the event of a terrorist attack, could put  large numbers of Americans at risk of serious injury or death. Chemicals  held at these facilities can be used to cause harm to surrounding  populations during terrorist attacks, can be stolen and used as chemical  weapons or as precursors (the ingredients for making chemical  weapons), or stolen and used to build an improvised explosive device. To  mitigate this risk, the DHS appropriations act for fiscal year 2007  required DHS to issue regulations to establish risk-based performance  standards for securing high-risk chemical facilities. DHS established the  CFATS program to assess the risk, if any, posed by chemical facilities;  place high-risk facilities in one of four risk-based tiers; require high-risk  facilities to develop security plans; review these plans; and inspect the  facilities to ensure compliance with the regulatory requirements. DHS’s  National Protection and Programs Directorate (NPPD) is responsible for  the CFATS program. Within NPPD, the Infrastructure Security  Compliance Division (ISCD), a component of the Office of Infrastructure  Protection (IP), manages the program.

A November 2011 internal ISCD memorandum, prepared by ISCD’s  Director in consultation with the Deputy Director, has raised concerns about  the management of the CFATS program. The ISCD memorandum, which  was leaked to the media in December 2011, cited an array of challenges  that, according to these officials, hindered ISCD’s ability to implement and  manage the CFATS program. My statement today discusses how the memorandum was developed and what challenges were what actions are being taken to address the challenges identified; and  the extent to which ISCD’s planned actions and proposed solutions  require action to be taken by or in collaboration with NPPD or IP.

This statement today is based on work we recently completed for you on  this ISCD memorandum and related actions. To conduct this work, we  reviewed applicable laws and regulations, as well as NPPD, IP, and ISCD  policies and procedures for administering the CFATS program. We also  analyzed the ISCD memorandum prepared by the ISCD Director in  consultation with the Deputy Director, compared it with the proposed  action plan ISCD officials prepared to address the challenges identified,  and compared subsequent action plans to monitor ISCD’s progress. We  interviewed senior ISCD officials (including the ISCD Director and Deputy  Director) to discuss the challenges identified and planned corrective  actions. We also interviewed NPPD and IP officials to obtain their views  on the causes for the challenges, ISCD’s proposed actions, and their  roles in working with ISCD to address the challenges. We obtained and  reviewed available documentation (e.g., standard operating procedures  and ISCD memos) relevant to each action item. Finally, we compared the  results of our analysis of the proposed action plan, and our discussions  with DHS, NPPD, IP, and ISCD officials, with various criteria, including  the CFATS law and regulations; DHS policies, procedures and reports;  Standards for Internal Control in the Federal Government; The Standard  for Program Management, and past GAO and DHS Office of Inspector  General (OIG) reports. We identified limitations that should be  considered when using our results. For example, the ISCD memorandum  represented the views of the senior ISCD officials that prepared the  memorandum and may not be representative of the views of other  officials within the CFATS program. Also, our results are based on ISCD’s  action plan as of June 2012 so these results reflect the status of ISCD’s  progress up to that point in time.

We conducted this performance audit from February 2012 to July 2012 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our analysis based  on our audit objectives. Appendix I discusses our scope and methodology  and related limitations in greater detail.
subsections: section_title: Background
paragraphs: The CFATS program is intended to secure the nation’s chemical  infrastructure by identifying and protecting high-risk chemical facilities.  Section 550 of the DHS appropriations act for fiscal year 2007 requires  DHS to issue regulations establishing risk-based performance standards  for security of facilities that the Secretary determines to present high  levels of security risk. The CFATS rule was published in April 2007 and  Appendix A to the rule, published in November 2007, listed 322 chemicals  of interest and the screening threshold quantities amount for each.  According to the CFATS rule, any facility that possesses (or later comes  into possession of) any of these chemicals in quantities that meet or  exceed the threshold is required to submit certain information to DHS for  screening. According to the rule, if DHS preliminarily determines that a  facility is high risk—that is, the facility presents a high risk of significant  adverse consequences for human life or health, national security, or  critical economic assets if subjected to terrorist attack, compromise,  infiltration, or exploitation—the facility must submit a security vulnerability  assessment to DHS that identifies security vulnerabilities at the site,  among other things. After reviewing the security vulnerability assessment,  DHS then makes a final decision as to whether the facility is high-risk  and, if so, assigns the facility to a final tier. The rule then requires  facilities that have been finally determined to be high-risk to develop and  submit for DHS approval site security plans that generally show how they  are to address the vulnerabilities identified in the vulnerability  assessment, including measures that satisfy applicable risk-based  performance standards. In addition, the rule requires that DHS implement  a compliance inspection process to ensure that covered facilities are  satisfying DHS’s performance standards consistent with their approved  site security plans.

ISCD has direct responsibility for implementing DHS’s CFATS rule,  including assessing potential risks and identifying high-risk chemical  facilities, promoting effective security planning, and ensuring that final  high-risk facilities meet the applicable risk-based performance standards  though site security plans approved by DHS. ISCD is managed by a  Director and a Deputy Director and operates five branches that are,  among other things, responsible for information technology operations, policy and planning; providing compliance and technical support;  inspecting facilities and enforcing CFATS regulatory standards; and  managing logistics, administration, and chemical security training. ISCD  receives business support from NPPD and IP for services related to  human capital management and training, budget and finance, and  acquisitions and procurement. Figure 1 shows ISCD’s current  organizational structure within NPPD and IP. Appendix II provides a more  detailed organization chart showing the various ISCD divisions.

From fiscal years 2007 through 2012, DHS dedicated about $442 million  to the CFATS program. During fiscal year 2012, ISCD was authorized  242 full-time-equivalent positions. For fiscal year 2013, DHS’s budget  request for the CFATS program was $75 million and 242 positions.
subsections: section_title: The CFATS Rule
paragraphs: DHS’s CFATS rule outlines a specific process for administering the  program. Any chemical facility that possesses any of the 322 chemicals in  the quantities that meet or exceed the threshold quantity outlined in the  rule is required to complete an initial screening tool (referred to by DHS  as the Top Screen) whereby the facility provides DHS various data,  including the name and location of the facility and the chemicals and their  quantities at the site. DHS is to use this information to initially determine  whether the facility is high risk. If so, DHS is to notify the facility of its  preliminary placement in one of four risk-based tiers—tier 1, 2, 3, or 4.

Facilities preliminarily placed in any one of these tiers are considered to  be high risk, with tier 1 facilities considered to be the highest risk.  Facilities that DHS initially determines to be high risk are required to  complete a security vulnerability assessment, which includes the  identification of potential critical assets at the facility and a related  vulnerability analysis. DHS is to then review the security vulnerability  assessment and notify the facility of DHS’s final determination as to  whether or not it is considered high risk, and if the facility is determined to  be a high-risk facility about its final placement in one of the four tiers.  Once this occurs, the facility is required to submit a site security plan or  participate in an alternative security program in lieu of a site security  plan. The security plan is to describe the security measures to be taken  to address the vulnerabilities identified in the vulnerability assessment,  and identify and describe how security measures selected by the facility  will address the applicable risk-based performance standards. DHS then  is to do a preliminary review of the security plan to determine whether it  meets the regulatory requirements. If these requirements appear to be  satisfied, DHS issues a letter of authorization for the facility’s plan. DHS  then conducts an authorization inspection of the facility and subsequently  determines whether to approve the security plan. If DHS determines that  the plan does not satisfy CFATS requirements (based on its preliminary  review after an authorization inspection), DHS then notifies the facility of  any deficiencies and the facility must submit a revised plan correcting  those deficiencies. If the facility fails to correct the deficiencies, DHS may  then disapprove the plan. Following approval, DHS may conduct further  inspections to determine if the facility is in compliance with its approved  security plan. Figure 2 illustrates the CFATS regulatory process.

In July 2007, DHS began reviewing information submitted by  approximately 40,000 facilities. By January 2012, DHS had preliminarily  determined that approximately 4,500 of these facilities were high risk and  preliminarily placed each in one of the four tiers. Each of these  approximately 4,500 facilities was to complete a security vulnerability  assessment, and those facilities that DHS finally determined to be high  risk were to submit a site security plan. According to ISCD officials, the  vulnerability assessment process prompted over 1,600 facilities to  remove chemicals of interest from their sites, thereby enhancing their  security posture and removing them from CFATS coverage. Also,  according to division officials, as of February 2012, ISCD had worked with  facilities to complete 925 compliance assistance visits whereby division  inspectors visit high-risk facilities to provide knowledge of and assistance  in complying with CFATS, particularly facilities that were in the process of  preparing their security plans.

section_title: Senior ISCD Leaders Developed the ISCD Memorandum to Highlight Various Challenges Hindering CFATS Implementation
subsections: section_title: ISCD’s Memorandum Based Largely on Observations of Senior ISCD Managers
paragraphs: Our review of the ISCD memorandum and discussions with ISCD officials  showed that the memorandum was developed during the latter part of  2011 and was developed primarily based on discussions with ISCD staff  and the observations of the ISCD Director in consultation with the Deputy  Director. In July 2011, a new Director and Deputy Director were  appointed to lead ISCD and, at the direction of NPPD’s Under Secretary,  began a review of the CFATS program goals, challenges, and potential  corrective actions. In November 2011, the Director and Deputy Director  provided the Under Secretary the ISCD memorandum entitled  “Challenges Facing ISCD, and the Path Forward.” These officials stated  that the memorandum was developed to inform leadership about the  status of ISCD, the challenges it was facing, and the proposed solutions  identified to date. In transmitting a copy of the memorandum to  congressional stakeholders following the leak in December 2011, the  NPPD Under Secretary discussed caveats about the memorandum. He  stated that the memorandum was not a formal compliance audit or  program review and in several instances it lacked useful, clarifying  context. He stated that the ISCD memorandum was not intended for  wider internal or external dissemination beyond the Under Secretary’s  office. He further explained that it had not undergone the normal review  process by DHS’s Executive Secretariat and contained opinions and  conclusions that did not reflect the position of DHS. He also noted that the  memorandum did not discuss the “significant progress” ISCD had made  to date reaching out to facilities of concern to improve their security  posture. For example, senior division officials told us that the  memorandum did not note the positive impact of ISCD’s initial screening  of facilities, which resulted in many facilities reducing their holdings of  regulated materials so that they would no longer be subject to the rule.

The ISCD Director confirmed that she was the primary author of the ISCD  memorandum, in consultation with the Deputy Director, and said that the  memorandum was intended to be used as an internal management tool.  The Director stated that when she was brought onboard, the Under  Secretary tasked her to look at CFATS from an outsider’s perspective and  identify her thoughts on the program relative to other regulatory regimes,  particularly in light of growing concerns about possible human capital  issues and problems tiering chemical facilities covered by CFATS. She  confirmed that the memo was intended to begin a dialog about the  program and challenges it faced. The Director also confirmed that she  developed the memorandum by (1) surveying division staff to obtain their  opinions on program strengths, challenges, and recommendations for  improvement; (2) observing CFATS program operations including the  security plan review process; and (3) analyzing an internal DHS report on  CFATS operations, which, according to the Director, served as a basis  for identifying some administrative challenges and corrective action. The  Director told us that senior ISCD officials, including branch chiefs, were  given an opportunity to review an initial draft of the memorandum and  provided feedback on the assumptions presented. ISCD branch chiefs— the officials responsible for taking corrective actions—confirmed that they  were given the opportunity to provide comments on a draft of the  memorandum. However, they said that after the leak, almost all of the  senior ISCD officials, including branch chiefs, did not have access to the  final memorandum per the instruction of the Under Secretary for  Management. The senior ISCD and NPPD officials we contacted said that  they generally agreed with the material that they saw, but noted that they  believed the memorandum was missing context and balance. For  example, one NPPD official stated that that the tone of the memorandum  was too negative and the problems it discussed were not supported by  sound evaluation. The official expressed the view that the CFATS  program is now on the right track.

section_title: ISCD Director Was Concerned That Challenges Place the CFATS Program at Risk
paragraphs: The ISCD memorandum discussed numerous challenges that, according  to the Director, pose a risk to the program. The Director pointed out that,  among other things, ISCD had not approved any site security plans or  carried out any compliance inspections on regulated facilities. The  Director attributed this to various management challenges, including a  lack of planning, poor internal controls, and a workforce whose skills were  inadequate to fulfill the program’s mission and highlighted several  challenges that have an impact on the progress of the program. In  addition, the memorandum provided a detailed discussion of the issues or  problems facing ISCD. One group of issues focused on human capital  management, problems the author categorized as team issues. According  to the Director, these included issues arising out of poor staffing  decisions; difficulty establishing a team culture that promotes  professionalism, respect, and openness; a lack of measurable employee  performance goals and unclear performance and conduct standards; and  potential delays associated with notifying ISCD inspector union over  policies, procedures, and processes. A second group focused on mission  issues, including what the author found to be the slow pace of the site  security plan approval process, the lack of an established inspection  process, and the ISCD’s inability to perform compliance inspections 5 1/2  years after enactment of the CFATS statute, and the lack of an  established records management system to document key decisions. A  third group focused on administrative issues, particularly those the  Director regarded as a lack of infrastructure and support, both within  ISCD and on the part of NPPD and IP. They included the aforementioned  concern about over-reliance on contractors, insufficient and inconsistent  support by NPPD and IP with regard to human capital needs—including  support on the aforementioned staffing issues—and insufficient controls  regarding the use of inspector vehicles, purchase cards, and travel.

Additional details on the human capital, mission, and administrative  issues identified in the ISCD memorandum are considered “for official use  only.”

section_title: ISCD Has Begun to Take Various Actions Intended to Address Challenges Identified
subsections: section_title: ISCD’s Action Plan Includes Time Frames for Completing Action Items and Appears to Be a Catalyst for Addressing Some Legacy Issues
paragraphs: ISCD is using an action plan to track its progress addressing the  challenges identified in the memorandum, and, according to senior  division officials, the plan may be helping them address some legacy  issues that staff were attempting to deal with before the memorandum  was developed. As discussed earlier, the ISCD memorandum was  accompanied by a proposed action plan that, according to the director,  was intended to provide proposed solutions to the challenges identified.  The January 2012 version of that plan listed 91 actions to be taken  categorized by issue—human capital management issues, mission  issues, or administrative issues—that, according to the ISCD Director,  were developed to be consistent with the ISCD memorandum. Each  action item also listed the coordinator, or individual or unit responsible for  the action, and discussed the status of the action, including whether the  item was complete or in progress. For example, in the human  capital/staffing issues area, one action item was intended to engage ISCD  leadership to develop an integration plan for newly hired employees. The  IP Business Support Team, which is co-located with ISCD, was  responsible for coordinating this action, and at the time the plan was  prepared, the action was in progress. According to the plan, a 3-day ISCD  101 course had been developed and a more comprehensive process for  acclimating new employees to ISCD was under development. However,  the January 2012, version of the action plan did not provide information  on when the action was started or to be finished.

In February 2012, ISCD developed a version of the action plan that  included the same information as the January 2012, plan. However, it  also included quarterly projected completion dates. Since then the  division’s action plan has evolved into a more detailed plan containing 94  items. Like the February 2012 plan, March and June 2012 updated  versions of the plan contained information on the coordinator, the action  to be taken, and the status of each item. However, unlike the February  2012 version of the plan, the March and June versions of the plan  provided detailed milestones and timelines for completing action items  including calendar dates, and interim actions leading to completion— essentially a road map for managing each action item according to  particular dates and milestones. This approach is consistent with The  Standard for Program Management, which calls for organizations to  develop plans with milestones and time frames to successfully manage  programs and projects.

Eleven of the 12 ISCD managers (those other than the Director and  Deputy Director) assigned to work as the coordinators of the individual  action items told us that even though they were not given the opportunity  to view the final version of the ISCD memorandum, the Director provided  them the sections of the action plan for which they were responsible to  help them develop and implement any corrective actions. They said that  they agreed that actions being taken in the plan were needed to resolve  challenges facing ISCD. Our discussions with these officials also showed  that about 39 percent (37 of 94) of the items in the March and June 2012  action plans addressed some legacy issues that were previously  identified and, according to these officials, corrective actions were already  under way for all 38 of these action items. For example, one action item  called for ISCD to maintain better relations with industry, Congress, and  other key stakeholders. ISCD officials said that the ISCD Policy Branch  had already begun working on this strategy prior to the development of  the memorandum and action plan and that this strategy was given more  attention and a higher priority because of the associated action item. An  ISCD official expressed the view that the ISCD memorandum and action  plan encouraged ISCD to address these and other items sooner than they  otherwise might have been addressed.

section_title: ISCD’s June 2012 Plan Update Showed 38 Action Items Completed
paragraphs: Our analysis of the June 2012 version of the ISCD action plan showed  that 40 percent of the items in the plan (38 of 94) had been completed.  The remaining 60 percent (56 of 94) were in progress. Our analysis of the  38 completed items showed that 32 of the 38 items were associated with  human capital management and administrative issues, including those  involving culture and human resources, contracting, and documentation.  For example, one human capital management issue that is complete  called for ISCD to survey staff to obtain their opinions on program  strengths and challenges and recommendations for program  improvements. According to the June 2012 action plan, the survey was  completed and ISCD’s action plan showed the item as completed on  January 10, 2012. Another completed human capital action item— categorized by ISCD as a cultural issue—called for ISCD management to  hold a series of meetings with employees to involve them in addressing  program challenges, clarify program priorities related to its mission, and  implement changes in ISCD culture. The June 2012 version of the action  plan shows the item as completed on January 10, 2012, but noted that  this activity will continue going forward. The remaining 6 of 38 action  items categorized by ISCD as completed were associated with mission  issues such as 1 action item calling for ISCD to establish a quality control  function for compliance and enforcement activities. According to ISCD’s  action plan, this item was completed in April 2012, based on development  of a proposal to form the quality control section within the division. Figure  3 shows the status of action items by each of the three categories— human capital management issues, mission issues, and administrative  issues, as of June 2012. Appendix III provides an overview of the items in  the action plan and their status (completed or in progress) by issue  (human capital management, mission issues, and administrative issues)  and subcategory.

For the remaining 56 items that were in progress, 40 involved human  capital management and administrative issues. According to ISCD  officials, these 40 issues generally involved longer-term efforts—such as  organizational realignment—or those that require approval or additional  action on the part of IP or NPPD. For example, ISCD reported that there  are 13 action items that are directly or indirectly associated with the  division’s realignment efforts, including items that require approval by  NPPD and IP. The overall realignment effort related to these action items  is intended to address concerns, highlighted in the memorandum, that  ISCD’s organizational structure was “stovepiped” and compartmentalized.  The plan, which, as of June 2012, was in draft, would, according to  officials, reorganize ISCD to “integrate more fully certain functions to  enhance the collaborative nature of the work that needs to be performed”  and would entail creating new offices, moving and integrating others, and  centralizing some functions that are now dispersed throughout the  division. In accordance with the affected action items, ISCD and a  contractor developed the several elements of the realignment plan for  review, and ISCD was awaiting input or guidance from NPPD and IP  before associated action items can be completed.

Sixteen of 56 remaining actions items in progress covered mission issues  that will likely also require long-term efforts to address. For example, 1 of  these mission-related action items entails the development of  requirements for an information technology platform to support inspection  activities. Another entails the development of plans to improve ISCD’s site  security plan review process. Regarding the latter, ISCD encountered  delays approving security plans because, according to ISCD officials, the  quality of the plans submitted was inconsistent and ISCD did not have  dedicated staff with the skills needed to work with facilities to review and  approve them. As noted in the ISCD memorandum, the site security plan  review process was overly complicated, did not leverage available  resources, and created bottlenecks and clearing the backlog of security  plan’s was ISCD’s highest priority. To address these concerns, ISCD  developed an interim review process to clear the backlog of tier 1 security  plans with a goal of completing reviews of those plans by the end of the  calendar year. ISCD began to track the action item intended to develop a  plan for introducing a new security plan review process, which, according  to the June 2012 action plan, is supposed to be completed in July 2012.  The development of a new security plan review process may be critical to  the effective implementation of the CFATS program. According to an  ISCD official, compliance inspections cannot begin until ISCD reviews  and approves a facility’s site security plan. In March 2012, the official  estimated that it could take at least 18 months for ISCD to complete its  first compliance inspections. In commenting on our draft statement, ISCD  officials stated that inspections for all of the approximately 4,500 tiered  facilities could take several years, contingent upon available resources.

section_title: Almost Half of ISCD’s Action Item Completion Dates Have Been Extended since April 2012
paragraphs: Our analysis of the April and June versions of the plan shows that the  division had extended the estimated completion dates for nearly half of  the action items. Estimated completion dates for 52 percent (48 of 93  items) either did not change (37 items) or the date displayed in the June  2012 plan was earlier than the date in the April 2012 version of the plan  (11 items). Conversely, 48 percent (45 of 93) of the items in the June  2012 version of the plan had estimated completion dates that had been  extended beyond the date in the April 2012 plan. For example, in the April  2012 plan, ISCD was to work with NPPD and IP on identifying job skills,  the correct job series, and job descriptions, action that was estimated to  be completed in July 2012. However, the June 2012 plan shows that the  completion date for this action item was extended to August 2012, more  than 30 days beyond the date estimated in April 2012. Figure 4 shows the  extent to which action plan items were completed earlier than planned,  did not change, or were extended, from April 2012 through June 2012, for  the human capital management, mission, and administrative issues  identified in the plan.

ISCD officials told us that estimated completion dates have been  extended for various reasons. They said that one reason for moving these  dates was that the work required to address some items was not fully  defined when the plan was first developed and as the requirements were  better defined, the estimated completion dates were revised and updated.  In addition, ISCD officials also stated that timelines have been adversely  affected for some action items because staff have been reassigned to  work on higher-priority responsibilities, such as moving staff from their  assigned duties to work on efforts to reduce the backlog of security plans  under review. ISCD officials also told us that some dates have been  extended because the division is awaiting actions within ISCD or by  NPPD or IP.

section_title: Action Plan Performance Measures Could Help Gauge Progress
paragraphs: ISCD, through its action plan, appears to be heading in the right direction  toward addressing the challenges identified, but it is too early to tell if the  action plan is having the desired effect because (1) the division has only  recently completed some action items and continues to work on  completing more than half of the others, some of which entail long-term  changes, and (2) ISCD has not developed an approach for measuring the  results of its efforts. ISCD officials told us that they had not yet begun to  plan or develop any measures, metrics, or other documentation focused  on measuring the impact of the action plan on overall CFATS  implementation because they plan to wait until corrective action on all  items has been completed before they can determine the impact of the  plan on the CFATS program. For the near term, ISCD officials stated that  they plan to assess at a high level the impact of the action plan on  CFATS program implementation by comparing ISCD’s performance rates  and metrics pre-action plan implementation and post-action plan  implementation. However, because ISCD will not be completing some  action items until 2014, it will be difficult for ISCD officials to obtain a  complete understanding of the impact of the plan on the program using  this comparison only.

Now that ISCD has begun to take action to address the challenges  identified, ISCD managers may be missing an opportunity to measure the  effects or results of some of the actions taken thus far, particularly actions  that are either in the early stages of implementation or are in the  formative stages. Measuring results associated with particular action  items would be consistent with Standards for Internal Control in the  Federal Government, which calls for the establishment and review of  performance measures and indicators to monitor activities and compare  actual performance with planned or expected results throughout the  organization and analyze significant differences. We recognize that it  might not be practical to establish performance measures for all action  items, for example; 1 of the 94 items calls for ISCD to initiate the hiring  process for an economist. However, other action items may be  candidates for performance measurement because they focus on  organizational changes or mission-related issues. For example, once  ISCD gets approval to move forward with a plan to reorganize, it could  develop interim plans and measures to monitor the progress of integrating  various functions and use the information to identify barriers, if any, for  completing this effort. Likewise, once ISCD makes the decision to revise  its site security plan review process, it could develop measures for  implementing those revisions and consider what measures might be  appropriate for gauging its success in streamlining the process and  completing security plan reviews. By looking for opportunities to develop  performance measures covering the various action items and developing  such measures, ISCD managers would be better positioned to identify  any gaps in their efforts to address the challenges and have tools  available to measure and monitor performance in the future. ISCD would  also have a framework for providing continuity of operations when new  managers or staff are hired, managers move from position to position, or  as the program changes. Furthermore, ISCD would be better equipped to  inform stakeholders of its progress as the organization moves toward  resolving the challenges identified in the ISCD memorandum.

section_title: ISCD Officials Stated That Almost Half of the Action Items Require Collaboration with or Action by NPPD or IP
paragraphs: According to ISCD officials, almost half of the action items included in the  June 2012 action plan either require ISCD to collaborate with NPPD and  IP or require NPPD and IP to take action to address the challenges  identified in the ISCD memorandum. NPPD, IP, and ISCD officials have  been working together to identify solutions to the challenges the  memorandum identified and to close pertinent action items.

One of the issues identified in the ISCD memorandum was the level of  NPPD and IP communication and support. According to ISCD officials, at  the time the program was established, NPPD and IP communication and  support were not adequate for the division to implement the CFATS  program within the statutory time frames (which was 6 months following  the passage of the CFATS statute). Regarding the ISCD memorandum  and the action plan, NPPD, IP, and ISCD officials have been working  together to identify solutions to these human capital and administrative  challenges. According to division officials, 46 of the 94 action items  included in the June 2012 action plan require either action by NPPD and  IP or collaboration with NPPD and IP. This includes collaborating with  NPPD officials representing the NPPD human capital, facilities, and  employee and labor relations offices, among others, and with IP’s  Directorate of Management Office.that require action by or collaboration with NPPD or IP are complete; 33  of 46 are in progress.

As of June 2012, 13 of the 46 items  With regard to completed items, these focused largely on human capital  and administrative issues. For example, 1 completed item required ISCD  leaders to establish regular meetings with NPPD and IP human capital  officials to ensure better communication and visibility on human capital  issues. Our discussions with ISCD and NPPD officials confirmed that this  action item was closed because meetings covering human capital issues  have begun and are held on a weekly and recurring basis. NPPD, IP, and  ISCD told us that one of the topics of discussion during the weekly  meetings is the hiring of specialists so that the division has assurance  that the CFATS reviews and inspection process properly include their  expertise. According to these officials, hiring certain types of specialists is  a difficult challenge given that ISCD is competing with other  organizations, including organizations within DHS, for individuals that  possess these specialized skills. These officials also stated that these  weekly meetings provide NPPD, IP, and ISCD an opportunity to discuss  human capital issues as they come up and ensure that the division’s  hiring process runs smoothly. To further assist with ISCD’s hiring efforts,  IP officials said that one IP human capital staff member is moving to be  co-located with the division with the intent that this co-located staff  member will be an important accelerator to the hiring process and help  keep ISCD hiring on track. Another related action item required similar  meetings between ISCD and NPPD’s Office of Employee and Labor  Relations to discuss union-related issues. This item was closed because  these NPPD staff members meet weekly with ISCD senior leaders to  discuss how the union operates and how they should work with the union,  and help them understand and properly address the division’s obligations  to the union.

With regard to the 33 of 46 actions items requiring collaboration with  NPPD and IP that are in progress, 23 require NPPD or IP to review and  approve work completed by ISCD or make policy decisions before the  division can list the action item as complete. For example,

Twelve of the 33 action items involve ISCD’s development of the  aforementioned realignment plan. As of June 2012, ISCD had  forwarded the realignment plan to NPPD and IP for review and was  awaiting approval so that the plan could be forwarded to DHS for  review and comment.

Another action item requires ISCD to develop a human capital  strategic plan. According to the June 2012 action plan, ISCD is  waiting for NPPD to release its Human Capital Strategic Plan to  finalize this action item and plans to use the guidance provided in the  NPPD plan to develop an ISCD Strategic Human Capital Plan.

ISCD continues to work on the remaining 10 of the 33 in-progress action  items that require NPPD or IP action or division collaboration with NPPD  and IP. According to the June 2012 action plan, completion of these  action items is dependent upon ISCD staff completing an internal review  of an ISCD-drafted set of standard operating procedures or  memorandum, or an analysis of an existing ISCD procedure. Once ISCD  finalizes these 10 action items, the outputs are to be forwarded to NPPD  and IP for review, comment, and approval, where appropriate.

Additional details on action items that require collaboration with or action  by NPPD or IP are considered “for official use only.”

section_title: Conclusions
paragraphs: ISCD has identified numerous challenges it has encountered  implementing the CFATS program and has developed an action plan that  is intended to help address these challenges. This appears to be a step in  the right direction as officials continue their efforts to better manage the  program and establish a viable process consistent with the statute and  the CFATS rule. Because of the scope and breadth of the action plan and  given that that many of the action items were recently completed (38 of  94 action items) or are in progress (56 of 94 action items), it is too early to  tell whether they will have the effect of helping ISCD overcome and  resolve all the problems it has identified. However, ISCD, working with  NPPD and IP, may be better positioned to understand and report on its  progress by looking for opportunities to measure the effect of efforts to  implement key action items, especially since many of the action items are  either recently completed or in their formative stages. By developing  performance measures, where practical, ISCD, IP, and NPPD would be  better equipped to identify any gaps between actual and planned or  expected results and take corrective action, where necessary, consistent  with Standards for Internal Control in the Federal Government.

Furthermore, ISCD, IP, and NPPD would be better positioned to report on  their progress developing a viable CFATS program to key stakeholders,  including Congress.

section_title: Recommendation for Executive Action
paragraphs: To better ensure that DHS can better understand the effect of its actions  as it moves forward with its efforts to address the challenges facing ISCD  as it implements the CFATS program, we recommend that the Secretary  of Homeland Security direct the Under Secretary for NPPD, the Assistant  Secretary for IP, and the Director of ISCD, in conjunction with the  development of ISCD’s strategic plan, to look for opportunities, where  practical, to measure results of their efforts to implement particular action  items, and where performance measures can be developed, periodically  monitor these measures and indicators to identify where corrective  actions, if any, are needed.

section_title: Agency Comments and our Evaluation
paragraphs: We provided a draft of this statement to the Secretary of Homeland  Security for review and comment. The Deputy Under Secretary for NPPD  and the Assistant Secretary for Infrastructure Protection provided oral  comments on July 23, 2012, and stated that NPPD agreed with our  recommendation. NPPD officials said that they intend to provide an  updated action plan that includes a new action item to “develop metrics  for measuring, where practical, results of efforts to implement action plan  items, including processes for periodic monitoring and indicators for  corrective actions.” The Deputy Under Secretary also noted that these  new measures would be in addition to the program metrics NPPD uses to  measure the overall progress of the CFATS program.

DHS also provided technical comments, which we incorporated as  appropriate.

As agreed with your offices, we will continue to review the CFATS  program and review ISCD’s efforts to manage the mission aspects of the  program. This will include ISCD efforts to determine chemical facility risk;  manage the process used to assess vulnerabilities, review security plans,  and perform inspections; and work with owners and operators of high-risk  chemical facilities. We expect to report the results of these efforts early in  2013.

Chairman Aderholt, Ranking Member Price, and members of the  subcommittee, this completes my prepared statement. I would be happy  to respond to any questions you may have at this time.

section_title: GAO Contact and Staff Acknowledgements
paragraphs: For information about this statement please contact Stephen L. Caldwell,  Director, Homeland Security and Justice, at (202) 512-8777 or  CaldwellS@gao.gov. Contact points for our Offices of Congressional  Relations and Public Affairs may be found on the last page of this  statement. Other individuals making key contributions include John F.  Mortin, Assistant Director; Ellen Wolfe, Analyst-in-Charge; Charles  Bausell; Jose Cardenas; Andrew M. Curry; Michele Fejfar; Tracey King;  Marvin McGill; Mona E. Nichols-Blake; and Jessica Orr.

section_title: Appendix I: Objectives, Scope and Methodology
paragraphs: This statement discusses how the internal Infrastructure Security  Compliance Division’s (ISCD) memorandum (the ISCD memorandum)  was developed and what challenges were identified, what actions are  being taken to address the challenges identified, and the extent to which  ISCD’s planned actions and proposed solutions require collaboration with  National Protection and Programs Directorate (NPPD) or the Office of  Infrastructure Protection (IP).

To determine how the ISCD memorandum was developed and the  challenges outlined in the memorandum, we reviewed and analyzed the  memorandum to determine the various Chemical Facility Anti-Terrorism  Standards (CFATS) program challenges as identified by the  memorandum’s author—i.e., the ISCD Director, who was the primary  author, in consultation with the Deputy Director. As a part of our analysis,  we grouped the challenges into overarching categories—human capital  management issues, mission issues, and administrative issues—and  used the sub-categories developed by the author of the ISCD  memorandum to summarize the types of challenges or problems  described in the ISCD memorandum. We also interviewed 14 ISCD  senior officials (including the ISCD Director and Deputy Director) to  confirm our understanding of the challenges identified, determine how the  memorandum was developed, and obtain ISCD officials’ views on what  may have created the CFATS program challenges.

To determine what actions ISCD is taking to address the challenges  identified in the memorandum, we analyzed and compared the various  action plans that were prepared by ISCD senior officials between January  2012 and June 2012. We developed a list of the 94 action items included  in the June plan and determined the status of each action item  (completed or in progress), the extent to which the ISCD officials  responsible for leading efforts for the action item agreed that the action  item addressed an existing problem, and the extent to which the activities  related to the action item were in progress prior to the ISCD  memorandum’s release. Where possible, we obtained and reviewed  documentation (e.g., standard operating procedures and ISCD memos)  relevant to each action item to support ISCD officials’ views that the  status of the action item was accurate and whether the work on the action  item was in progress before the development and release of the ISCD  memorandum. We also compared the results of our analysis of the action  plans and our discussions with program officials with various criteria,  including the CFATS law and regulations; Department of Homeland  Security (DHS) policies, procedures, and reports; Standards for Internal  Control in the Federal Government; and The Standard for Program  Management.

To determine the extent to which ISCD’s planned actions and proposed  solutions require collaboration with or action by NPPD or IP officials, we  interviewed 11 NPPD and 9 IP officials identified by ISCD officials who  are to work with ISCD to implement corrective actions. Using the results  of these interviews and our analysis of the ISCD memorandum and action  plan, we determined the extent to which collaboration among ISCD,  NPPD, and IP is required to implement corrective action, if at all. Where  available, we obtained and reviewed NPPD, IP, and ISCD documentation  (e.g., policies, standard operating procedures, and internal memos)  relevant to each action item that requires NPPD or IP support or action in  working with ISCD to overcome those challenges.

We identified three limitations that should be considered when using our  results. First, ISCD’s memorandum is largely based on the efforts of the  ISCD Director in consultation with the ISCD Deputy Director and may not  be representative of the views of other senior officials within the CFATS  program. Furthermore, the conclusions reached in the memorandum  were not obtained by using a formal compliance audit or program review  procedures, nor were the assumptions validated. Second, our results are  based on the status of the action plan as of June 2012, so these results  are valid only up until this point in time. Third, documentary evidence  about the development of the CFATS program and the causes for the  issues identified in the ISCD memorandum is, for the most part, not  available. Program officials did not maintain records of key decisions and  the basis for those decisions during the early years of the program.  During preliminary discussions, the members of current management  team qualified that much of their knowledge about program decisions  during the early years of the program is their best guess of what  happened and why.

We conducted this performance audit from February 2012 to July 2012 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our analysis based  on our audit objectives.

section_title: Appendix II: ISCD Organizational Structure within NPPD and IP as of June 2012
paragraphs: This appendix provides the organizational structure used to manage the  Chemical Facility Anti-Terrorism Standards program within the  Infrastructure Security Compliance Division. ISCD has direct  responsibility for implementing DHS’s CFATS rule, including assessing  high-risk chemical facilities, promoting collaborative security planning,  and ensuring that covered facilities meet DHS’s risk-based performance  standards. ISCD is managed by a Director and a Deputy Director and  operates five branches that are, among other things, responsible for  information technology operations; policy and planning; providing  compliance and technical support; inspecting facilities and enforcing  CFATS regulatory standards; and managing logistics, administration, and  chemical security training. ISCD receives business support from the  National Protection and Programs Directorate and the Office of  Infrastructure Protection for services related to human capital  management and training, budget and finance, and acquisitions and  procurement. Figure 5 shows the organizational structure of NPPD, IP,  and ISCD.

section_title: Appendix III: Summary of ISCD Action Plan by Issue and Subcategory, and Status
paragraphs: This appendix provides a summary of the status and progress of action  items grouped by issue and sub-category. The Infrastructure Security  Compliance Division is using an action plan to track its progress in  addressing the challenges identified in the November 2011 ISCD  memorandum prepared by the ISCD Director in consultation with the  Deputy Director. The ISCD memorandum was accompanied by an action  plan that, according to the authors of the memorandum, was intended to  provide solutions to addressing the challenges identified. Table 1  provides an overview of the items in the action plan and their status  (completed or in progress) by issue (human capital management, mission  issues, and administrative issues) and subcategory.

section_title: Related GAO Products
paragraphs: Critical Infrastructure Protection: DHS Could Better Manage Security  Surveys and Vulnerability Assessments. GAO-12-378, Washington, D.C.:  May 31, 2012.

Critical Infrastructure Protection: DHS Has Taken Action Designed to  Identify and Address Overlaps and Gaps in Critical Infrastructure Security  Activities. GAO-11-537R. Washington, D.C.: May 19, 2011.

Critical Infrastructure Protection: DHS Efforts to Assess and Promote  Resiliency Are Evolving but Program Management Could Be  Strengthened. GAO-10-772. Washington, D.C.: September 23, 2010.

Critical Infrastructure Protection: Update to National Infrastructure  Protection Plan Includes Increased Emphasis on Risk Management and  Resilience. GAO-10-296. Washington, D.C.: March 5, 2010.

The Department of Homeland Security’s (DHS) Critical Infrastructure  Protection Cost-Benefit Report. GAO-09-654R. Washington, D.C.:   June 26, 2009.

Information Technology: Federal Laws, Regulations, and Mandatory  Standards to Securing Private Sector Information Technology Systems  and Data in Critical Infrastructure Sectors. GAO-08-1075R. Washington,  D.C.: September 16, 2008.

Risk Management: Strengthening the Use of Risk Management Principles  in Homeland Security. GAO-08-904T. Washington, D.C.: June 25, 2008.

Critical Infrastructure Protection: Sector Plans Complete and Sector  Councils Evolving. GAO-07-1075T. Washington, D.C.: July 12, 2007.

Critical Infrastructure Protection: Sector Plans Complete and Sector  Councils Continue to Evolve. GAO-07-706R. Washington, D.C.:   July 10, 2007.

Critical Infrastructure: Challenges Remain in Protecting Key Sectors.  GAO-07-626T. Washington, D.C.: March 20, 2007.

Homeland Security: Progress Has Been Made to Address the  Vulnerabilities Exposed by 9/11, but Continued Federal Action Is Needed  to Further Mitigate Security Risks. GAO-07-375. Washington, D.C.:  January 24, 2007.

Critical Infrastructure Protection: Progress Coordinating Government and  Private Sector Efforts Varies by Sectors’ Characteristics. GAO-07-39.  Washington, D.C.: October 16, 2006.

Information Sharing: DHS Should Take Steps to Encourage More  Widespread Use of Its Program to Protect and Share Critical  Infrastructure Information. GAO-06-383. Washington, D.C.:   April 17, 2006.

Risk Management: Further Refinements Needed to Assess Risks and  Prioritize Protective Measures at Ports and Other Critical Infrastructure.  GAO-06-91. Washington, D.C.: December 15, 2005.

Protection of Chemical and Water Infrastructure: Federal Requirements,  Actions of Selected Facilities, and Remaining Challenges. GAO-05-327.  Washington, D.C.: March 28, 2005.

This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.


Question-summary annotations: questions: question: What did the November 2011 memorandum discuss?
answer: The November 2011 memorandum that discussed the management of the Chemical Facility Anti-Terrorism Standards (CFATS) program was prepared based primarily on the observations of the Director of the Department of Homeland Security’s (DHS) Infrastructure Compliance Security Division (ISCD), a component of the Office of Infrastructure Protection (IP) within the National Protection and Programs Directorate (NPPD).
child_questions: question: What was the memorandum supposed to highlight?
answer: The memorandum was intended to highlight various challenges that have hindered ISCD efforts to implement the CFATS program.
child_questions: question: What sorts of challenges have been facing ISCD?
answer: According to the Director, the challenges facing ISCD included not having a fully developed direction and plan for implementing the program, hiring staff without establishing need, and inconsistent ISCD leadership—factors that the Director believed place the CFATS program at risk.
child_questions: question: What aspects do these challenges center on?
answer: These challenges centered on human capital issues, including problems hiring, training, and managing ISCD staff; mission issues, including overcoming problems reviewing facility plans to mitigate security vulnerabilities and performing compliance inspections; and administrative issues, including concerns about NPPD and IP not supporting ISCD’s management and administrative functions.

questions: question: What situations is ISCD attempting to address through various actions?
answer: ISCD has begun to take various actions intended to address the human capital management, mission, and administrative issues identified in the ISCD memorandum and has developed a 94-item action plan to track its progress.
child_questions: question: What have managers said about the plan?
answer: According to ISCD managers, the plan appears to be a catalyst for addressing some of the long-standing issues the memorandum identified.

question: As of June of 2012, how had the ISCD done on finishing the 94-item action plan?
answer: As of June 2012, ISCD reported that 40 percent (38 of 94) of the items in the plan had been completed.
child_questions: question: What parts of the plan were achieved?
answer: These include (1) requiring ISCD managers to meet with staff to involve them in addressing challenges, clarifying priorities, and changing ISCD’s culture and (2) developing a proposal to establish a quality control function over compliance activities.

question: What parts of the plan remain to be completed?
answer: The remaining 60 percent (56 of 94) that were in progress include those requiring longer-term efforts--—i.e., streamlining the process for reviewing facility security plans and developing facility inspection processes; those requiring completion of other items in the plan; or those awaiting action by others, such as approvals by ISCD leadership.

question: It is too early to tell what regarding the ISCD?
answer: ISCD appears to be heading in the right direction, but it is too early to tell if individual items are having their desired effect because ISCD is in the early stages of implementing corrective actions and has not established performance measures to assess results.
child_questions: question: What would be helpful as the ISCD moves forward?
answer: Moving forward, exploring opportunities to develop measures, where practical, to determine where actual performance deviates from expected results, consistent with internal control standards could help ISCD better identify any gaps between actual and expected results so that it can take further action, where needed.
child_questions: question: How could ISCD implement these ideas as it develops a new security plan review process?
answer: For example, as ISCD develops a new security plan review process, it could look for ways to measure the extent to which the time to do these reviews has been reduced as compared with the time needed under the current review process.

questions: question: How did the events of September 11, 2001 affect the security of hazardous waste facilities?
answer: The events of September 11, 2001, triggered a national re-examination of the security of facilities that use or store hazardous chemicals in quantities that, in the event of a terrorist attack, could put large numbers of Americans at risk of serious injury or death. As required by statute, DHS issued regulations that establish standards for the security of high-risk chemical facilities.
child_questions: question: Why was the CFATS program established?
answer: DHS established the CFATS program to assess the risk posed by these facilities and inspect them to ensure compliance with DHS standards.
child_questions: question: Why does ISCD have concerns about the management of the CFATS program?
answer: ISCD, a component of IP, manages the program. A November 2011 internal ISCD memorandum, prepared by ISCD senior managers, has raised concerns about the management of the program.

question: What is the purpose of this testimony?
answer: This testimony focuses on (1) how the memorandum was developed and any challenges identified, (2) what actions are being taken in response to any challenges identified, and (3) the extent to which ISCD’s proposed solutions require collaboration with NPPD or IP.
child_questions: question: How did GAO gather information for this report?
answer: GAO’s comments are based on recently completed work analyzing the memorandum and related actions. GAO reviewed laws, regulations, DHS’s internal memorandum and action plans, and related documents, and interviewed DHS officials.