Critical Infrastructure Protection: Additional Actions by DHS Could Help Identify Opportunities to Harmonize Access Control Efforts
Released: 2017-02-07T00:00:00


Highlights: section_title: Why GAO Did This Study
paragraphs: Critical infrastructure protection access controls limit access to those with a legitimate need. DHS is the lead federal agency for coordinating critical infrastructure protection efforts with other federal agencies, and partnering with nonfederal stakeholders. The National Defense Authorization Act of 2016 included a provision for GAO to review critical infrastructure access control efforts.

This report examines (1) key characteristics of selected federally-administered critical infrastructure access control efforts and factors that have an impact on stakeholders' use of them; (2) the extent to which DHS has taken actions to harmonize efforts across critical infrastructure sectors; and (3) the extent to which DHS's SCO has taken actions to harmonize access control efforts across DHS. GAO examined six federally-administered access control efforts across three federal departments. Efforts were selected, among other things, to represent a range of efforts that groups of users—such as truck drivers—may encounter while accessing multiple facilities. GAO interviewed DHS, NRC, and DOD officials and users and operators affected by the efforts and reviewed relevant documents.

section_title: What GAO Found
paragraphs: The six selected federally-administered critical infrastructure access control efforts GAO reviewed generally followed similar screening and credentialing processes. Each of these efforts applies to a different type of infrastructure. For example, the Transportation Security Administration's Transportation Worker Identification Credential controls access to ports, the Department of Defense (DOD) Common Access Card controls access to military installations, and the Nuclear Regulatory Commission (NRC) regulates access to commercial nuclear power plants. GAO found that selected characteristics, such as whether a federal agency or another party has responsibility for vetting or what types of prior criminal offenses might disqualify applicants, varied across these access control efforts. In addition, these access control efforts generally affect two groups of stakeholders—users and operators—differently depending on their specific roles and interests. Users are individuals who require access to critical infrastructure as an essential function of their job; while, operators own or manage facilities, such as airports and chemical facilities. Regardless of infrastructure type, users and operators that GAO interviewed reported some common factors that can present challenges in their use of these access controls. For example, both users and operators reported that applicants requiring access to similar types of infrastructure or facilities may be required to submit the same background information multiple times, which can be costly and inefficient.

The Department of Homeland Security (DHS) relies on partnership models to support collaboration efforts among federal and nonfederal critical infrastructure stakeholders, but has not taken actions to harmonize federally-administered access control efforts across critical infrastructure sectors. According to DHS officials, these partnerships have not explored harmonization of access control efforts across sectors, because this has not been raised as a key issue by the members and because DHS does not have a dedicated forum that would engage user groups in exploring these issues and identifying potential solutions. DHS's partnership models offer a mechanism by which DHS and its partners can explore the challenges users and operators may encounter and determine opportunities for harmonizing the screening and credentialing processes to address these challenges.

DHS's Screening Coordination Office (SCO) has taken actions to support harmonization across DHS access control efforts, but it has not updated its goals and objectives to help guide progress toward the department's broader strategic framework for harmonization. SCO's strategic framework is based on two screening and credentialing policy documents—the 2006 Credentialing Initiative Report and 2008 Credentialing Framework Initiative. According to SCO officials, they continue to rely on these documents to provide their office with a high-level strategic approach, but GAO found that the goals and objectives outlined in the two documents are no longer current or relevant. In recent years, SCO has helped the department make progress toward its harmonization efforts by responding to and assisting with department-wide initiatives and DHS component needs, such as developing new programs or restructuring existing ones. However, without updated goals and objectives, SCO cannot ensure that it is best supporting DHS-wide screening and credentialing harmonization efforts.

section_title: What GAO Recommends
paragraphs: GAO recommends that (1) DHS work with partners to identify any opportunities to harmonize access control efforts across critical infrastructure sectors and (2) SCO establish goals and objectives to support its broader strategic framework for harmonization. DHS concurred with both recommendations.

section_title: Letter
paragraphs: The nation’s critical infrastructure—systems, facilities, assets, and  networks provide the essential services that serve as the backbone of our  nation’s economy, security, and health—could be attacked by those who  seek to harm the United States and its interests. Strengthening and  maintaining secure, functioning, and resilient critical infrastructure  requires proactive and coordinated efforts. This endeavor is a shared  responsibility among federal, state, local, tribal, and territorial entities, and  public and private owners and operators of critical infrastructure. One  aspect of maintaining secure critical infrastructure is access control—that  is, limiting the access to physical facilities and assets to only those who  have a legitimate need and have been vetted to ensure there is no  evidence that they pose a risk. Although the federal government owns  little of the nation’s critical infrastructure, federal agencies play various  roles—in partnership with nonfederal stakeholders—to help ensure  effective access control efforts that do not unnecessarily impede the flow  of legitimate business and operations.

The Department of Homeland Security (DHS) is the lead federal agency  responsible for overseeing domestic critical infrastructure protection  efforts, but other federal agencies are responsible for overseeing different  sectors of critical infrastructure, such as the defense industrial base  sector and the energy sector. DHS’s National Infrastructure Protection  Plan (NIPP), outlines the roles and responsibilities of DHS and sector- specific agencies (SSA)—federal departments and agencies responsible  for critical infrastructure protection and resilience activities across 16  critical infrastructure sectors. In 2006, in response to Homeland Security  Presidential Directive/HSPD-11 (HSPD-11) DHS established the  Screening Coordination Office (SCO), located within DHS’s Office of  Policy. SCO is responsible for overseeing DHS’s screening and  credentialing activities, including those aimed at critical infrastructure  access control efforts. “Credentialing,” in this context, refers to the entire  process of determining a person’s eligibility  for a particular license,  privilege, or status, from application for access through issuance, use,  and expiration or potential revocation of an issued credential.

Federally-administered access control efforts generally involve two  groups of stakeholders: users and operators. Users are individuals who  require access to critical infrastructure as an essential function of their  job. Operators own or are responsible for managing facilities, such as  airports, seaports, and chemical facilities, which are generally privately  owned, but can also include government facilities such as military  installations.

The National Defense Authorization Act for Fiscal Year 2016 included a  provision for us to report on the background check, access control, and  credentialing requirements of federal efforts for the protection of critical  infrastructure and key resources, with an emphasis on harmonization— identifying and implementing opportunities to enhance efficiency within or  across related processes—by enhancing interoperability  and reducing  redundancy. This report (1) describes key characteristics of selected  federal critical infrastructure access control efforts and factors that have  an impact on stakeholders’ use of them; (2) examines the extent to which  DHS has taken actions to harmonize federally-administered access  control efforts across critical infrastructure sectors; and (3) examines the  extent to which DHS’s Screening Coordination Office has taken actions to  harmonize critical infrastructure access control efforts across the  department.

To answer our first objective, we examined six federally-administered  access control efforts across three federal departments—DHS, the  Department of Defense (DOD), and the Nuclear Regulatory Commission  (NRC). We focused on efforts that (1) were regulated or guided by the  federal government and (2) facilitated access to physical facilities or assets. The six federal access control efforts included are:  Transportation Worker Identification  Credential (TWIC), Hazardous  Materials Endorsement (HME), Secure Identification  Display Area (SIDA),  Common Access Card (CAC), Chemical Facility Anti-Terrorism Standards  (CFATS), and Commercial Nuclear Power Plant Regulations (NRC).

To select the access control efforts, we initially focused on DHS- administered programs and reviewed DHS’s 2006 Credentialing Initiative  Report (CIR). We selected four access control efforts administered by  DHS based on our review of the CIR and identified the seven DHS  screening and credentialing effort related to access control. Those seven  access related efforts are a subset of other DHS credentialing efforts that  focused on screening efforts related to access to controlled locations,  such as ports or secure areas. We selected three of these seven DHS  access efforts because they regulate or facilitate access to critical  infrastructure assets. Because the three access control efforts identified  from DHS’s CIR were related to the transportation sector, we included  another effort within DHS, but for another sector—CFATS, which is  related to the chemical sector but not included in the CIR because it was  implemented after 2006.

To provide context and perspective on government-wide efforts, we also  selected federal efforts administered by agencies outside of DHS. To  identify these two efforts, we spoke with DHS federal administrators or  nonfederal stakeholders related to the four access control efforts we  selected above to obtain information on other frequently used access  control efforts they identified as relevant to accessing secure critical  infrastructure. We included access control efforts administered by DOD  and NRC, which are the two federal departments responsible for the  access control related to military installations (CAC) and commercial  nuclear power plants (NRC regulations), respectively.

Our selection does not represent the universe of federal access control  efforts. For instance, the NIPP lists 16 critical infrastructure sectors; while  the access control efforts in our review relate to 4 of the sectors:  Chemical; Government Facilities (Military  Installations); Nuclear Reactors,  Materials, and Waste; and Transportation. The results from our selection  are not generalizable, but they provide perspectives on organizational  structures and operational policies and procedures across different  infrastructure types and different federal agencies.

To collect information on the key characteristics of the federal access  control efforts in our review, we developed a standard set of questions  based on the credentialing and screening phases identified in DHS’s  2006 CIR and submitted it to DHS, DOD, and NRC federal administrators.  We reviewed relevant regulations, policies and procedures, and  interviewed DHS, DOD, and NRC administrators to corroborate the  information obtained from the standard set of questions.

To determine the factors that had an impact on stakeholders’ use of the  access control efforts, we interviewed user and operator stakeholder  groups. To identify the types of users and operators that may encounter  the federal critical infrastructure access control efforts in our review, we  consulted our prior critical infrastructure work, spoke with agency officials  from DHS, NRC, and DOD, and reviewed published DHS critical  infrastructure documentation. We met with nonfederal stakeholder groups  that represented owners and operators who are responsible for managing  critical infrastructure facilities, for example, the American Association of  Airport Executives. To select associations representing user groups, we  limited our selection to users that would regularly require access to  multiple types of critical infrastructure, such as truck drivers and skilled  trades workers, such as the United Brotherhood of Carpenters. We  interviewed the nonfederal stakeholder groups described above to  understand the impacts and challenges of our selected access control  efforts on stakeholders.

While the sample of stakeholder groups encompasses the six critical  infrastructure access control efforts in our review, the cross-section of  stakeholder groups we spoke to is a non-generalizable sample. As such,  viewpoints expressed by such groups cannot be extended to the entire  population of stakeholders. However, the sample allowed us to gain  insights into the interests and perspectives of the stakeholder  communities related to accessing secure critical infrastructure. Our  findings from interviews with nonfederal stakeholder groups cannot be  generalized to all users or operators of critical infrastructure facilities but  provide useful insight into their experiences and perspectives.

To answer our second objective assessing DHS’s actions to harmonize  access control efforts across critical infrastructure sectors, we reviewed  the 2013 NIPP to identify existing partnership structures designed to  enhance collaboration among critical infrastructure stakeholders. We also  interviewed officials from the DHS National Protection and Programs  Directorate (NPPD) Office of Infrastructure Protection—the lead DHS  entity responsible for leading the coordinated effort to secure the nation’s  critical infrastructure—to determine what actions DHS and its partnership  structures have taken to harmonize access control efforts. Additionally,  we interviewed DOD and NRC officials to corroborate DHS’s external  harmonization efforts with these agencies. We compared the actions DHS  has taken with its internal guidance governing partnership structures and  our prior work on best practices to enhance and sustain collaboration.

To answer our third objective examining SCO’s efforts to harmonize  access control efforts across DHS, we reviewed the 2006 Credentialing  Initiative  Report as well as a follow-up report DHS issued in July 2008,  which serves as a strategic framework for the department to improve  credentialing processes through eliminating redundant activities, leverage  investments across programs, and reduce costs of implementing new  capabilities, among other efforts. We also examined, through reviewing  documents and interviewing SCO officials, the actions SCO has taken to  implement the recommendations outlined in the CIR. We compared  SCO’s activities and progress toward harmonization goals to Standards  for Internal Control in the Federal Government to evaluate the extent to  which SCO had goal and objectives in place designed to help achieve  DHS’s broader strategic framework.

We conducted this performance audit from January 2016 to February  2017 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: DHS and other federal agencies help administer access control efforts  across a wide range of physical facilities and assets in critical  infrastructure sectors for which they are responsible. These federal  administrators help operators of critical infrastructure assets safeguard  the assets against attacks, sabotage, theft, or misuse while facilitating  legitimate access to help ensure the flow of business and operations. In  efforts to serve operator needs, administrators must also ensure  compliance with federal laws and regulations. Federal agencies play a  variety of roles in helping to strike this balance, including but not limited to  (1) owning and operating certain types of infrastructure, (2) wholesale  operation and management of credentialing programs for specific kinds of  infrastructure, (3) partial operation and management of credentialing  programs, and (4) providing regulations and guidance to help owners and  operators implement effective access control. For example, DHS’s  Transportation Security Administration (TSA) manages the entire  Transportation Worker Identification  Credential (TWIC) qualification  process including enrollment, background checks, and credential  issuance. However, for the Secure Identification  Display Area (SIDA)  badge, which facilitates access at airports, and is managed in part by  TSA, airport operators use TSA’s background check information to  ultimately make final decisions about airport access and badge issuance.  Similarly, NRC issues regulations related to access control requirements,  which are to be implemented by commercial nuclear power plants, and  DOD owns and operates U.S. military installations and facilities and uses  the Common Access Card (CAC) as one method to facilitate access to  semi-restricted areas within the installations.

Workers who need access to multiple types of critical infrastructure to  realize their livelihoods—such as truck drivers and carpenters—often  encounter different access control efforts. For example, carpenters and  contractors working at seaports and airports may require both a TWIC  credential for the seaports and SIDA badges for each specific airport.  Similarly, industries that work across different critical infrastructure  sectors may encounter multiple federal access control efforts. For  example, a company producing or storing regulated chemicals on both  land and at seaports may encounter different access control efforts  depending on the location of the facility.

See Table 1 for a list of selected federally-administered critical  infrastructure access control efforts and a brief description of each effort.

section_title: Selected Federal Access Control Efforts have Similar Processes, but Three Key Factors Had an Impact on Stakeholders
subsections: section_title: Access Control Efforts Follow Similar Processes, but Specific Characteristics of the Efforts Vary
paragraphs: While the six selected federally administered access control efforts we  reviewed had varying purposes, standards, or agency responsibilities,  they generally included the following process components or phases of  DHS’s credentialing lifecycle as depicted in Figure 1.

Although the six efforts we reviewed generally follow similar processes,  certain characteristics within these efforts can vary. For instance, we  found that roles and responsibilities of the federal administrators and the  operator stakeholders in credentialing varied. As an example, TSA is  responsible for implementing the entire TWIC credentialing process  including enrollment and background checks, while maritime port facility  operators—public port authority or privately operated facilities—are  responsible for physically verifying the credentials that TSA has issued at  ports. In contrast, under the SIDA program, TSA and airport operators  each have certain responsibilities for several elements of the  credentialing process, including the criminal history record check.

Table 2 summarizes the credentialing processes along with the roles and  responsibilities of government and private entities for the six selected  efforts we reviewed. Appendix I provides more detailed and specific  information about each of the six selected efforts we reviewed.

section_title: Access Control Efforts Have Different Impacts on Stakeholders Due to Varying Interests
paragraphs: As previously mentioned, federally-administered access control efforts  generally involve two groups of stakeholders: users and operators. Users  are individuals who require access to critical infrastructure as an essential  function of their job. Users we interviewed that require access to multiple  types of critical infrastructure said they recognize the need for security,  but are interested in streamlined access control efforts to facilitate  legitimate access in a manner that minimizes the related time and costs  they incur. They also told us they desire the maximum possible uniformity  across standards for background investigation and disqualifying offenses  to enhance predictability. Operators are individuals or groups who own or  are responsible for managing facilities, such as airports, seaports, and  chemical facilities, which may be privately owned, but can also include  other government-owned facilities such as military installations.  Operators, we spoke with, who are responsible for providing security for  critical infrastructure, said they need to maintain control over who enters  their facilities so they can manage their accepted level of risk along with  the associated costs. Operators said they prefer to retain maximum  decision-making authority for granting access as well as the type of  credential they use to verify proper vetting.

Based on our interviews with stakeholder groups and associations, the  issues mentioned that had an impact on users and operators included (1)  operators may add access requirements to vetting and background  checks already conducted for federally administered programs; (2)  credentials that cannot be used within and across critical infrastructure  sectors; and (3) enrollment information that has to be entered multiple  times for the same user for similar purposes. It is important to note that  although these issues can present challenges for various users and  operators, they do not necessarily reflect a deficiency on the part of any  specific access control effort or stakeholder group. For the most part,  these six selected efforts were created separately in response to different  needs, are largely governed by different laws and regulations, and were  not necessarily designed to work together.
subsections: section_title: Facility Operators May Consider Additional Requirements in Making Final Access Decisions
paragraphs: User groups we interviewed expressed a desire to be able to predict  denial of access based on clear and standardized requirements; while  operator groups described the need for some variability in requirements  across sites, so they can manage their context-specific risks. Part of the  eligibility  vetting process for all the six selected access control efforts we  reviewed includes determining if an applicant is on the known or  suspected terrorist list or has a criminal history with certain disqualifying  offenses that warrant denial of the access. Specific disqualifying offenses  can vary across these federal efforts because of differences in the  statutes that established the federal efforts. This variability can create  some level of complexity for the users of multiple federally-administered  efforts, which is compounded when individual  on-site critical infrastructure  operators impose additional requirements. For example, according to  association members representing carpenters, the lack of consistency  around whether individuals can qualify for access has led to difficulties  aligning staff with critical project tasks. As a result, the time associated  with identifying disqualifying offenses can lead to challenges with meeting  scheduled project timelines and budgets.

For all six selected federal access control efforts we reviewed, regardless  of the way the access effort was structured (whether the infrastructure is  government or privately owned and whether an effort is wholly managed  by a federal agency or guided by regulation), we found that on-site  operators can make the final decision about who can enter their facilities.  During our interviews with users and operators we found that on-site  operators across multiple infrastructure types have considered additional  disqualifying offenses beyond federal baseline requirements. For example  with SIDA, CFATS, and commercial nuclear power plants that are  regulated under NRC the individual operator examines the individual’s  criminal background information and makes his or her own determination  regarding access based on their perception of acceptable risk.

In addition, we found that site-specific decision making was taking place  under federal efforts for which the government was the sole vetting  authority, such as TWIC. For example, port authority representatives told  us that ports often perform site-specific background checks even for  those individuals with an issued TWIC. Port authority representatives  provided two key reasons for conducting their own site-specific  background checks on top of the federal government’s process: (1) the  ability to view an individual’s comprehensive and recent criminal history  and (2) the ability to consider factors that may not be covered in TWIC’s  list of disqualifying offenses. Some operator groups that we spoke with  noted that the disqualifying offenses covered by programs like TWIC,  which is designed to limit terrorism risk, do not cover the full range of  safety and security concerns that are ultimately their responsibility to  control. For example, a representative from the American Association of  Airport Executives told us that airports have the discretion to consider  requirements beyond federal regulations, which can be used to disqualify  applicants for a SIDA. These additional requirements may reside in state  or local ordinance, and can vary from airport to airport. Consequently,  some operators perform additional vetting on site, which allows them to  align vetting policies and procedures with their accepted types and level  of risk.

Even when the federal government has sole vetting authority, facility  operators and military installation commanders can choose to add  additional vetting procedures to ensure they are managing their facilities  based on their own accepted level of risk. For example, in 2009, DOD  issued a policy directive to accept, among others, the TWIC and the CAC  as identification documents authorized to facilitate physical access to  installations. However, according to DOD headquarters officials, the  military services maintained that the TWIC was not intended to be used  for access to military installations, and consequently this policy has not  been implemented uniformly across DOD. For example, truck drivers  holding TWIC cards and serving military installations have been at times  required to undergo additional background and security checks.  According to trucking industry representatives, inconsistency across DOD  installations is a source of concern as they do not know what might be  required of drivers who are trying to gain access. In addition, delays in  gaining access to installations can result in increased costs for the truck  drivers, and potentially create cascading delays for their subsequent  deliveries. Installation commanders have been given the authority to  supplement the DOD procedures and process for accessing their  installation to help ensure appropriate response to risk with real-time  information and decision making. Consequently, the requirements for  access can vary by installation. A TSA official also noted that certain  sex offenders may be able to get a TWIC, depending on the offense and  when the individual was convicted or released from incarceration. The  TSA official stated that this is because sexual offenses are not  permanently disqualifying under the TWIC statute and may not point to a  terrorism or security risk of a regulated maritime facility; however, a  military commander may not want to allow that individual onto his or her  installation where families with young children are housed and so may  consider such offenses disqualifying.

section_title: Credentials Generally Cannot be Used Within or Across Critical Infrastructure Sectors
paragraphs: User groups we interviewed generally expressed a desire for reciprocity  across federally-administered access control efforts, in particular when  such efforts have or appear to have the same or similar underlying vetting  processes and associated risks. Operators, on the other hand, had mixed  perspectives on this issue. While some operators emphasized finding  solutions to enhance access control reciprocity, others cited barriers to or  challenges with a more uniform approach.

Among the six selected access control efforts we reviewed, we found  limited mechanisms to use one credential for access to similar facilities  within and across sectors (i.e., reciprocity). Two examples of reciprocity  are DOD’s CAC, which generally allows access into the semi-restricted  areas of most military installations, and the CFATS Personnel Surety  Program, which allows regulated high-risk chemical facilities to accept  previously-issued TWICs to grant access if they are electronically verified,  or other credentials issued through a federally administered screening  program, if they are visually verified, and if the screening program  periodically vets enrolled individuals against the Terrorist Screening  Database. Across the chemical sector, chemical facility access is  facilitated by two different access control efforts depending on where the  chemical facility is located—land-based facilities are governed by CFATS  and maritime-based facilities are governed by TWIC. Officials from  NPPD, the DHS component that administers CFATS, stated that NPPD  explored allowing land-based chemical facility users to enroll in the TWIC  program, but DHS has interpreted the Maritime Transportation Security  Act of 2002 to provide limited authority to do so. However, individuals in  the field of transportation who are eligible for a TWIC may apply for and  receive that credential to satisfy the CFATS requirement. NPPD officials  stated that facilities may also use screening results from other agencies,  such as the Bureau of Alcohol, Tobacco, Firearms, and Explosives, as  long as the vetting process includes checking against the Terrorist  Screening Database.

section_title: Biographic Information is Collected Multiple Times across Selected Efforts
paragraphs: The user stakeholders we interviewed expressed a desire to be able to  enter their biographic information once during the registration and  enrollment phase, and have that information reused for other access  control efforts, and where possible, for background check processing.  Some operator groups we interviewed indicated that it was costly and  inefficient for operators and users to enter biographic data multiple times.  However, federal administrators are limited in their ability to share  biographic information across screening efforts because of information  technology, and privacy considerations. Among the six access control  efforts we reviewed, there are some mechanisms to reuse biographic  information; however, there are no set requirements to do so. For  example, operators may collect complete biographic information each  time a user applies for a SIDA badge for an airport facility. A user group  said that it would like to be able to reuse their biographic information for  airports, but TSA officials we interviewed stated that any proposed  solution to reuse biographic information would be affected by privacy  considerations. Under federal law, personal information collected and  maintained by an agency for a particular effort may not be disclosed to  another agency, with certain exceptions.

In contrast, within NRC’s regulated commercial nuclear power plants,  operators use the Personnel Access Database System (PADS) in  cooperation with NRC that allows users to provide biographic information  once to access multiple facilities because potential employees sign a  release of information form to use the system. Users and operators  agreed that they benefited from the ease of PADS because they do not  have to submit biographic information for each facility. They told us that  PADS allows for employee data to be shared across NRC nuclear power  plant facilities in part because it is an industry-operated system that is not  constrained by federal privacy requirements that would apply to federal  systems.

section_title: DHS’s Critical Infrastructure Partnership Structures Provide Opportunities to Harmonize Access Control Efforts
subsections: section_title: DHS Uses Partnership Structures for Critical Infrastructure Protection
paragraphs: DHS has established roles and responsibilities for supporting  collaboration efforts among key stakeholders across critical infrastructure  sectors. The department also uses partnership structures to enhance  information sharing efforts aimed at strengthening critical infrastructure  security. According to Presidential Policy Directive/PPD-21 (PPD-21),  DHS is responsible for coordinating the overall federal effort to promote  the security and resilience of the nation’s critical infrastructure, provide  strategic guidance, and promote a national unity of effort, among other  responsibilities. Within DHS, NPPD’s Office of Infrastructure Protection  (IP) leads the coordinated national effort to mitigate risk to the nation’s  critical infrastructure and is responsible for working with public and private  sector critical infrastructure partners to enhance security efforts. Using a  partnership approach, NPPD IP’s Sector Outreach and Programs Division  works with owners and operators of the nation’s critical infrastructure to  develop, facilitate, and sustain strategic relationships and information  sharing efforts, including the sharing of best practices. NPPD IP also  oversees and supports various partnership councils intended to protect  and provide essential functions to enhance response efforts.

As reported in the National Infrastructure Protection Plan (NIPP), DHS  has created partnership structures to collaborate and engage federal and  nonfederal stakeholders in critical infrastructure discussions and to  enhance critical infrastructure resilience efforts. These voluntary  partnership structures provide forums for critical infrastructure  stakeholders—federal, state, local, tribal, territorial, and private sector  officials—to come together, exchange ideas, and leverage resources. The  Critical Infrastructure Partnership Advisory Council (CIPAC) serves as a  forum among critical infrastructure stakeholders to facilitate interaction  and coordination of critical infrastructure activities, including planning,  coordinating, and exchanging information on cross-sector issues and  implementing security and resilience program initiatives. CIPAC  membership consists of representatives from the Government  Coordinating Councils (GCC) and Sector Coordinating Councils (SCC)— federal, state, and local agency officials and private owners and  operators, respectively—who work together to coordinate strategies,  activities, and policies across governmental entities within each of the 16  critical infrastructure sectors.

The NIPP also establishes voluntary cross-sector councils to develop  national priorities related to strengthening critical infrastructure security.  Specifically, the Critical Infrastructure Cross-Sector Council provides a  forum for SCCs to address cross-sector issues and interdependencies.  This council’s activities primarily focus on identifying and disseminating  critical infrastructure security and resilience best practices across sectors,  and identifying areas where cross-sector collaboration could advance  national priorities. Additional  cross-sector councils representing state,  local, tribal, and territorial partners serve as forums for members to (1)  facilitate enhanced communication and coordination across sectors, (2)  evaluate and promote implementation of risk-informed critical security and  resilience programs, and (3) promote resilience activities in the public and  private sectors, mainly through awareness, education, and mentorship on  a wide variety of subjects, among other activities. Within NPPD, the  Interagency Security Committee (ISC) serves as a forum for chief security  officers and other federal agency officials to develop federal security  standards and policies to enhance physical security of non-DOD federal  facilities and engage with industry stakeholders to advance best  practices. Collectively, these voluntary DHS partnership structures are  designed to provide federal agencies a better understanding of the risks  associated with critical infrastructure security and an enhanced  awareness to make informed decisions about critical infrastructure  priorities.

section_title: Partnership Structures Provide Opportunities for Harmonization of Access Control Efforts across Critical Infrastructure Sectors
paragraphs: According to NPPD senior officials, DHS voluntary partnership structures  exist to discuss a variety of issues that have an impact on critical  infrastructure security, but DHS has not used these structures to identify  opportunities to harmonize regulated screening and credentialing efforts.  The issues discussed earlier in this report about users’ and operators’  experiences across different access control efforts illustrate that there are  administrative burden and costs both within and outside of government  when the efforts are inconsistent or their administration appears to be  less efficient. However, those findings also highlight that there are few, if  any, obvious solutions, as many of the issues involve tradeoffs across  competing needs of different stakeholder groups and ongoing  consideration of the appropriate balance to manage risk without  unnecessarily impeding business and operations. In that regard, NPPD  officials stated there are challenges, and developing a one-size fits all  approach to harmonizing credentialing procedures is not a feasible  solution because of the complexities within and across critical  infrastructure sectors. Nonetheless, they acknowledged that finding  opportunities to harmonize efforts is a worthwhile goal to pursue.

Guidance from DHS partnership structures and our best practices call for  entities to identify and share best practices and to collaborate by seeking  means to address needs by leveraging resources and establishing  compatible policies, procedures, and practices. Specifically, the CIPAC  charter document, calls for CIPAC to facilitate interaction among federal  government, private sector, and state, local, territorial, and tribal entities  to conduct deliberations and form consensus positions to assist the  federal government in engaging in implementing security and resilience  program initiatives, including conducting operational activities related to  critical infrastructure security, sharing threat, vulnerability  and risk  information, and best practices with one another. Similarly, our work on  enhancing collaboration across organizational boundaries calls for entities  to, among other things, (1) identify and address needs by leveraging  resources and (2) establish compatible policies, procedures, and other  means to operate across agency boundaries.

Given NPPD IP’s role as the DHS component responsible for leading the  national effort to strengthen the security and resilience of the nation’s  critical infrastructure, DHS is well positioned to facilitate collaboration  across stakeholder groups—users, operators, and federal  administrators—to identify opportunities to harmonize access control  efforts across critical infrastructure sectors. According to NPPD officials,  the CIPAC partnership structure would serve as an appropriate forum for  critical infrastructure stakeholders to discuss potential harmonization  efforts moving forward. However, NPPD IP officials responsible for  overseeing CIPAC and ISC stated that their cross-sector partnership  structures have engaged in limited efforts to explore harmonization of  access control efforts, because harmonization has not been raised as a  key issue or urgent concern by its members.

However, NPPD IP officials stated that issues raised when considering  the user perspectives alongside the operator perspectives would not  necessarily have emerged in these groups, because as of October 2016,  none of the existing CIPAC partnership forums would be appropriate for  users or user groups—such as contractors, workers, and others seeking  access to multiple critical infrastructure facilities—to share their  experiences or concerns. As of October 2016, DHS does not have a  dedicated partnership structure that allows for users to share their  experiences in navigating through federal access control efforts.  Additionally,  DHS officials stated that users are not specifically included in  the NIPP’s Sector Partnership Model.

Moreover, NPPD IP officials from the Sector Outreach and Programs  Division, who are responsible for coordinating DHS’s partnership  structures, stated that government and industry stakeholders have begun  initial discussions to enhance information sharing efforts, which could  include leveraging information across access control efforts. Specifically,  NPPD IP officials reported that during a biannual meeting in July 2016,  CIPAC members discussed ways to improve information sharing efforts  between government and industry stakeholders related to harmonizing  access control efforts. Further, they reported that government and  industry stakeholders agreed to create a CIPAC standing committee  designed to identify key concerns and engage with members to propose  recommendations aimed at enhancing information sharing efforts.  Although this effort represents a step towards beginning the discussion of  harmonizing access controls efforts, DHS has not fully engaged all  relevant stakeholders, specifically users, to explore whether additional  opportunities exist to harmonize access control efforts across critical  infrastructure sectors. Using existing partnership structures or creating  new forums could help DHS more effectively fulfill its role as the facilitator  of shared best practices and enhanced collaboration across critical  infrastructure partners. In doing so, DHS may be better positioned to  identify and implement opportunities to enhance efficiencies within and  across related access control efforts.

section_title: SCO Has Taken Actions to Harmonize DHS Access Control Efforts, but Has Not Updated Its Goals and Objectives to Support Its Strategic Framework
subsections: section_title: SCO Goals and Actions to Harmonize DHS Access Control Efforts
paragraphs: A role of SCO, according to DHS Office of Policy officials, is to serve as a  department-wide policy advocate for coordination and harmonization of  credentialing and screening efforts within DHS. SCO, which is located in  the DHS Office of Policy, maintains roughly 30 full-time equivalent staff  across different portfolio teams, such as Identity  and Credentialing and  Watchlisting and Vetting. SCO officials stated that while it is not the sole  entity responsible for assessing and harmonizing screening processes  across the department, the office provides subject matter expertise and  guidance on screening and credentialing policies and practices with the  aim of reducing duplicative, stand-alone DHS programs and processes.  SCO works with DHS components that are responsible for overseeing  screening and credentialing efforts, such as TSA and NPPD, to achieve  DHS’s screening and credentialing harmonization objectives. These  objectives include identifying and resolving policy issues and program  challenges associated with screening and credentialing, supporting  department-wide resources that service screening and credentialing  efforts, integrating interdependent resources and processes across DHS  programs, and representing DHS to external stakeholders.

SCO officials reported that their primary activities fall into three general  categories: consultant activities, investment-related decision activities,  and working group participatory activities. Specifically, SCO officials  stated that they assist DHS components in developing and improving  credentialing and screening programs by participating in department-wide  budget decisions, and through departmental or component-specific  working groups that help guide the development of new programs or the  restructuring of existing programs.

According to officials, SCO relies on two foundational policy documents  as the overarching strategic framework for promoting harmonization and  instructing components on methods for improving access control  programs and processes—the 2006 Credentialing Initiative Report (CIR)  and the 2008 Credentialing Framework Initiative (CFI). The CIR  identified common problems, challenges, and areas where DHS could  improve screening and credentialing programs and processes. Examples  of identified problem areas include inconsistent vetting processes for  similar programs and the issuance of multiple credentials in cases where  one would be sufficient. The report also identified four recommendations  for addressing the aforementioned problems. As part of its efforts to  address the recommendations outlined in the CIR, SCO published the  CFI, an implementation strategy document designed to guide investments  and improve the department’s ability to meet its mission by improving  screening and credentialing processes.

SCO officials stated that they have engaged with DHS components to  advance screening and credentialing efficiencies over the past ten years  of operation. Through internal annual accomplishment reports and in  interviews, SCO provided several examples of activities they have  undertaken to advance each of the recommendations outlined in the CIR  to advance screening and credentialing efficiencies.

Recommendation 1: Design credentials to support multiple  licenses, privileges or status. SCO led a Common Enrollment  Coordinating Council (CECC) sub-team, which was tasked to  identify opportunities to develop best practices in DHS’ screening  and credentialing enrollment environment. Of the 18  recommendations produced by the CECC sub-team, three were  approved by the Joint Requirements Council, which plans to  escalate recommendations to DHS leadership for study and  possible implementation.

Recommendation 2: Vetting processes, associated with like  uses and like risks, should not be duplicative. SCO partnered  with NPPD and TSA to implement the CFATS Personnel Surety  Program, which requires that individuals seeking access to  restricted areas or critical assets within high-risk chemical facilities  are vetted for ties to terrorism. According to SCO and NPPD  officials, SCO worked with NPPD to ensure that CFATS vetting  standards were aligned with existing DHS vetting efforts to allow  the use of screening resources from TSA.

Recommendation 3: Entitlement to a license, privilege, or  status should be verified using electronic scanning  technology. SCO officials stated they consulted with the U.S.  Coast Guard to develop draft regulations pertaining to the  implementation of electronic card readers at maritime facilities to  more effectively validate the authenticity of TWIC cards.  SCO  officials stated that many maritime facilities are currently validating  TWICs using visual inspection, and these regulations are  designed to help reduce that practice. As we have previously  reported, the reliance on the visual inspection of TWICs is  vulnerable to the use of counterfeit credentials to gain access.

Recommendation 4: Establish a preference for ‘enroll once,  use many’  environments. SCO officials stated that they  consulted with TSA and the U.S. Coast Guard to ensure that  certain biographic data elements collected by TSA from maritime  workers, as well as the results of TSA’s terrorist screening check  for the TWIC program, were available for individuals also applying  for a U.S. Coast Guard-sponsored Merchant Mariner Credential  (MMC). According to SCO officials, the result of such efforts was  partial reciprocity between the TWIC and MMC programs.

section_title: SCO Has Not Updated Its Goals and Objectives to Support its Strategic Framework for Department-wide Access Control Harmonization
paragraphs: In its early years, SCO operated under the direction of the strategic policy  vision and implementation plans laid out in the 2006 CIR and the 2008  CFI; however, since then, SCO has not updated the goals and objectives  outlined in the implantation plans. The 2008 CFI lists a number of  structured tasks necessary to implement its recommendations, including  the development of a communications timeline for stakeholder  engagement and the development and periodic update of CFI  implementation goals and objectives. SCO officials stated that the  implementation plans are no longer relevant to SCO’s current role in the  department. Moreover,  in our discussions with SCO officials they  described several opportunities to harmonize screening and credentialing  efforts that DHS had yet to achieve, such as the integration of information  technology systems. Officials from the DHS Office of Policy, which  oversees SCO operations, stated that Office of Policy goals and  objectives for SCO come directly from the DHS Office of the Secretary.  However, our review of office goals from fiscal years 2015 and 2016  showed that none of the Office of Policy’s goals specifically tasked SCO  with actionable goals or objectives in support of the strategic policy vision  outlined in the CIR and CFI. Additionally,  no guidance from the  Secretary’s office was issued to SCO from 2009 to 2014.

SCO officials stated that their internal planning processes are largely  informal rather than a systematic approach to identifying and  documenting strategic goals and objectives that could help SCO  management pursue the most promising opportunities to support DHS’s  harmonization efforts and monitor how well its routine activities align with  those goals and objectives. Standards for Internal Control in the Federal  Government calls for agencies to define objectives clearly to meet its  mission, strategic plan, goals, and requirements of applicable laws and  regulations. Further, the standards call for management to define  objectives in specific and measurable terms so they are understood at all  levels of the entity. This involves clearly defining what is to be achieved,  who is to achieve it, how it will be achieved, and the timeframes for  achievement. Without updated goals and objectives, SCO is missing an  important management control to help it ensure that it supports the best  opportunities for DHS-wide screening and credentialing harmonization.

section_title: Conclusions
paragraphs: Balancing the need to secure critical infrastructure while promoting a  harmonized screening and credentialing process to access critical  infrastructure continues to pose challenges for stakeholders—users and  operators—because their interests vary and are not necessarily aligned  with each other. DHS is responsible for leading the federal government’s  effort to protect the nation’s critical infrastructure, and has created  partnership structures to support stakeholder collaboration. Therefore it is  well-positioned to explore whether opportunities exist among all  stakeholders, including users, to harmonize screening and credentialing  processes to provide access in a timely manner. Although DHS does not  have a specific partnership structure dedicated for users to share their  experiences, DHS’s existing partnership structures or new forums could  serve as platforms for all critical infrastructure stakeholders to learn from  one another and discuss available options to leverage resources. Using  new or existing partnership structures to explore whether opportunities  exist to harmonize screening and credentialing processes across critical  infrastructure sectors could better position DHS to more effectively  balance the need to secure critical infrastructure while promoting  harmonized screening and credentialing process.

Within DHS’s Office of Policy, the Screening Coordination Office (SCO) is  responsible for the coordination and harmonization of screening and  credentialing efforts department wide. Although SCO issued foundational  policy documents in 2006 and 2008 outlining a strategic framework and  implementation plans to harmonize DHS access control efforts, since that  time SCO has not updated its goals and objectives to identify  improvements needed. Goals and objectives in support of SCO’s  strategic framework would better position it to pursue the highest priorities  and best opportunities for DHS-wide screening and credentialing  harmonization.

section_title: Recommendations for Executive Action
paragraphs: To enhance its ability to fulfill its role as the facilitator of cross-sector  collaboration and best-practices sharing, we recommend that the  Secretary of Homeland Security direct the Assistant Secretary of  Infrastructure Protection, Office of Infrastructure Protection, take the  following action:  Explore with key critical infrastructure partners, whether and what  opportunities exist to harmonize federally-administered screening  and credentialing access control efforts across critical  infrastructure sectors.

To help ensure that SCO uses its time and resources to pursue the most  efficient and effective screening and credentialing harmonization goals on  behalf of the department, we recommend that the Secretary of Homeland  Security direct the Deputy Assistant Secretary for Screening  Coordination, Office of Policy, take the following action:  Establish goals and objectives to support its broader strategic  framework for harmonization.

section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report for review and comment to DHS, NRC,  and DOD for their review and comment. DHS and NRC provided written  comments, which are reproduced in Appendix II and III.  In their  comments, DHS concurred with each recommendation and described  actions underway or planned to address them including estimated  timeframes for completion. If fully implemented, these actions should  address the intent of the recommendations and better position DHS to  balance the need to secure critical infrastructure while promoting a  harmonized screening and credentialing process to access critical  infrastructure. For example, in regards to exploring whether and what  opportunities exist to harmonize federally-administered screening and  credentialing access control efforts across critical infrastructure sectors,  DHS noted that they are working to harmonize access control efforts  across critical infrastructure as much as practical and remain committed  to working towards that end with interagency partners. Specific actions  identified to be completed around April 2017 include considering drafting  a plan that will include an analysis of how to further explore opportunities  to harmonize federally-administered screening and credentialing access  control efforts across critical infrastructure sectors. More specifically, the  Interagency Security Committee will request that its Steering  Subcommittee discuss potential avenues for addressing any gaps and  areas of further collaboration related to screening and credentialing  access control efforts of federal facilities.

In regards to establishing goals and objectives to support the Screening  Coordination Office’s (SCO) broader strategic framework for  harmonization, DHS identified actions to direct SCO to establish updated  goals and objectives to support the broader strategic framework for more  efficient and effective vetting. SCO will provide their goals and objectives  to DHS components once finalized to be completed by June 2017.

DHS and DOD also provided technical comments, which were  incorporated as appropriate.

We are sending copies of this report to the appropriate congressional  committees; the Secretaries of Homeland Security and Defense, and the  Chairman of the Nuclear Regulatory Commission. In addition, the report  is available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions concerning this report, please  contact me at (404) 679-1875 or CurrieC@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made significant contributions  to this report are listed in Appendix IV.

section_title: Appendix I: Life Cycle Characteristics for Selected Access Control Efforts
paragraphs: To address the research question related to describing key characteristics  of selected federal access control efforts, we distributed a standard set of  questions to three federal agencies—Department of Homeland Security  (DHS), Nuclear Regulatory Commission (NRC) and the Department of  Defense (DOD). Our questions reflected the screening and credentialing  life cycle stages reported by DHS’s Screening Coordination Office,  including Registration and Enrollment, Vetting, Issuance, Expiration and  Revocation, Redress, and Waiver. Tables 3 through 8 below summarize  the aggregated responses received from the 3 agencies to our questions.

section_title: Appendix II: Comments from the Department of Homeland Security

section_title: Appendix III: Comments from the Nuclear Regulatory Commission

section_title: Appendix IV: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact

section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Kathryn Godfrey (Assistant  Director), Amber Edwards (Analyst-in-Charge), Josh Diosomito, Adrian  Pavia, Vijay Barnabas, Tracey King, Richard Hung, Lorraine Ettaro,  Dominick Dale, Marc Schwartz, and Joseph Kirschbaum made key  contributions to this report.


Question-summary annotations: questions: question: To what extent did the access control efforts have similar screening and credentialing processes?
answer: The six selected federally-administered critical infrastructure access control efforts GAO reviewed generally followed similar screening and credentialing processes.
child_questions: question: What types of infrastructure do these access control efforts focus on?
answer: For example, the Transportation Security Administration's Transportation Worker Identification Credential controls access to ports, the Department of Defense (DOD) Common Access Card controls access to military installations, and the Nuclear Regulatory Commission (NRC) regulates access to commercial nuclear power plants.

question: What differences can be found between these access control efforts?
answer: GAO found that selected characteristics, such as whether a federal agency or another party has responsibility for vetting or what types of prior criminal offenses might disqualify applicants, varied across these access control efforts. In addition, these access control efforts generally affect two groups of stakeholders—users and operators—differently depending on their specific roles and interests.

question: What factors may pose challenges in the use of these access controls?
answer: For example, both users and operators reported that applicants requiring access to similar types of infrastructure or facilities may be required to submit the same background information multiple times, which can be costly and inefficient.

questions: question: Why are partnership models important for the DHS?
answer: The Department of Homeland Security (DHS) relies on partnership models to support collaboration efforts among federal and nonfederal critical infrastructure stakeholders, but has not taken actions to harmonize federally-administered access control efforts across critical infrastructure sectors.
child_questions: question: Why hasn't the DHS taken actions to harmonize access control efforts across sectors?
answer: According to DHS officials, these partnerships have not explored harmonization of access control efforts across sectors, because this has not been raised as a key issue by the members and because DHS does not have a dedicated forum that would engage user groups in exploring these issues and identifying potential solutions.

question: How could the DHS's partnership models be used in the harmonization of access control efforts?
answer: DHS's partnership models offer a mechanism by which DHS and its partners can explore the challenges users and operators may encounter and determine opportunities for harmonizing the screening and credentialing processes to address these challenges.

questions: question: To what extent has the SCO taken actions to support harmonization?
answer: DHS's Screening Coordination Office (SCO) has taken actions to support harmonization across DHS access control efforts, but it has not updated its goals and objectives to help guide progress toward the department's broader strategic framework for harmonization.

question: What is the SCO's strategic framework based on?
answer: SCO's strategic framework is based on two screening and credentialing policy documents—the 2006 Credentialing Initiative Report and 2008 Credentialing Framework Initiative.
child_questions: question: To what extent are these documents still suitable for the SCO strategic framework?
answer: According to SCO officials, they continue to rely on these documents to provide their office with a high-level strategic approach, but GAO found that the goals and objectives outlined in the two documents are no longer current or relevant.
child_questions: question: Why is the lack of updated goals an issue for the SCO?
answer: However, without updated goals and objectives, SCO cannot ensure that it is best supporting DHS-wide screening and credentialing harmonization efforts.

questions: question: What does this report examine?
answer: This report examines (1) key characteristics of selected federally-administered critical infrastructure access control efforts and factors that have an impact on stakeholders' use of them; (2) the extent to which DHS has taken actions to harmonize efforts across critical infrastructure sectors; and (3) the extent to which DHS's SCO has taken actions to harmonize access control efforts across DHS.

question: What access control efforts did GAO examine?
answer: GAO examined six federally-administered access control efforts across three federal departments.
child_questions: question: How were these efforts selected?
answer: Efforts were selected, among other things, to represent a range of efforts that groups of users—such as truck drivers—may encounter while accessing multiple facilities.

question: How did GAO source its data for this report?
answer: GAO interviewed DHS, NRC, and DOD officials and users and operators affected by the efforts and reviewed relevant documents.