Critical Infrastructure Protection: Additional Actions by DHS Could Help Identify Opportunities to Harmonize Access Control Efforts
Released: 2017-02-07T00:00:00

Letter

Background

DHS and other federal agencies help administer access control efforts across a wide range of physical facilities and assets in critical infrastructure sectors for which they are responsible. These federal administrators help operators of critical infrastructure assets safeguard the assets against attacks, sabotage, theft, or misuse while facilitating legitimate access to help ensure the flow of business and operations. In efforts to serve operator needs, administrators must also ensure compliance with federal laws and regulations. Federal agencies play a variety of roles in helping to strike this balance, including but not limited to (1) owning and operating certain types of infrastructure, (2) wholesale operation and management of credentialing programs for specific kinds of infrastructure, (3) partial operation and management of credentialing programs, and (4) providing regulations and guidance to help owners and operators implement effective access control. For example, DHS’s Transportation Security Administration (TSA) manages the entire Transportation Worker Identification Credential (TWIC) qualification process including enrollment, background checks, and credential issuance. However, for the Secure Identification Display Area (SIDA) badge, which facilitates access at airports, and is managed in part by TSA, airport operators use TSA’s background check information to ultimately make final decisions about airport access and badge issuance. Similarly, NRC issues regulations related to access control requirements, which are to be implemented by commercial nuclear power plants, and DOD owns and operates U.S. military installations and facilities and uses the Common Access Card (CAC) as one method to facilitate access to semi-restricted areas within the installations.

Workers who need access to multiple types of critical infrastructure to realize their livelihoods—such as truck drivers and carpenters—often encounter different access control efforts. For example, carpenters and contractors working at seaports and airports may require both a TWIC credential for the seaports and SIDA badges for each specific airport. Similarly, industries that work across different critical infrastructure sectors may encounter multiple federal access control efforts. For example, a company producing or storing regulated chemicals on both land and at seaports may encounter different access control efforts depending on the location of the facility.

See Table 1 for a list of selected federally-administered critical infrastructure access control efforts and a brief description of each effort.

Selected Federal Access Control Efforts have Similar Processes, but Three Key Factors Had an Impact on Stakeholders

Access Control Efforts Follow Similar Processes, but Specific Characteristics of the Efforts Vary

While the six selected federally administered access control efforts we reviewed had varying purposes, standards, or agency responsibilities, they generally included the following process components or phases of DHS’s credentialing lifecycle as depicted in Figure 1.

Although the six efforts we reviewed generally follow similar processes, certain characteristics within these efforts can vary. For instance, we found that roles and responsibilities of the federal administrators and the operator stakeholders in credentialing varied. As an example, TSA is responsible for implementing the entire TWIC credentialing process including enrollment and background checks, while maritime port facility operators—public port authority or privately operated facilities—are responsible for physically verifying the credentials that TSA has issued at ports. In contrast, under the SIDA program, TSA and airport operators each have certain responsibilities for several elements of the credentialing process, including the criminal history record check.

Table 2 summarizes the credentialing processes along with the roles and responsibilities of government and private entities for the six selected efforts we reviewed. Appendix I provides more detailed and specific information about each of the six selected efforts we reviewed.

Access Control Efforts Have Different Impacts on Stakeholders Due to Varying Interests

As previously mentioned, federally-administered access control efforts generally involve two groups of stakeholders: users and operators. Users are individuals who require access to critical infrastructure as an essential function of their job. Users we interviewed that require access to multiple types of critical infrastructure said they recognize the need for security, but are interested in streamlined access control efforts to facilitate legitimate access in a manner that minimizes the related time and costs they incur. They also told us they desire the maximum possible uniformity across standards for background investigation and disqualifying offenses to enhance predictability. Operators are individuals or groups who own or are responsible for managing facilities, such as airports, seaports, and chemical facilities, which may be privately owned, but can also include other government-owned facilities such as military installations. Operators, we spoke with, who are responsible for providing security for critical infrastructure, said they need to maintain control over who enters their facilities so they can manage their accepted level of risk along with the associated costs. Operators said they prefer to retain maximum decision-making authority for granting access as well as the type of credential they use to verify proper vetting.

Based on our interviews with stakeholder groups and associations, the issues mentioned that had an impact on users and operators included (1) operators may add access requirements to vetting and background checks already conducted for federally administered programs; (2) credentials that cannot be used within and across critical infrastructure sectors; and (3) enrollment information that has to be entered multiple times for the same user for similar purposes. It is important to note that although these issues can present challenges for various users and operators, they do not necessarily reflect a deficiency on the part of any specific access control effort or stakeholder group. For the most part, these six selected efforts were created separately in response to different needs, are largely governed by different laws and regulations, and were not necessarily designed to work together.

Facility Operators May Consider Additional Requirements in Making Final Access Decisions

User groups we interviewed expressed a desire to be able to predict denial of access based on clear and standardized requirements; while operator groups described the need for some variability in requirements across sites, so they can manage their context-specific risks. Part of the eligibility vetting process for all the six selected access control efforts we reviewed includes determining if an applicant is on the known or suspected terrorist list or has a criminal history with certain disqualifying offenses that warrant denial of the access. Specific disqualifying offenses can vary across these federal efforts because of differences in the statutes that established the federal efforts. This variability can create some level of complexity for the users of multiple federally-administered efforts, which is compounded when individual on-site critical infrastructure operators impose additional requirements. For example, according to association members representing carpenters, the lack of consistency around whether individuals can qualify for access has led to difficulties aligning staff with critical project tasks. As a result, the time associated with identifying disqualifying offenses can lead to challenges with meeting scheduled project timelines and budgets.

For all six selected federal access control efforts we reviewed, regardless of the way the access effort was structured (whether the infrastructure is government or privately owned and whether an effort is wholly managed by a federal agency or guided by regulation), we found that on-site operators can make the final decision about who can enter their facilities. During our interviews with users and operators we found that on-site operators across multiple infrastructure types have considered additional disqualifying offenses beyond federal baseline requirements. For example with SIDA, CFATS, and commercial nuclear power plants that are regulated under NRC the individual operator examines the individual’s criminal background information and makes his or her own determination regarding access based on their perception of acceptable risk.

In addition, we found that site-specific decision making was taking place under federal efforts for which the government was the sole vetting authority, such as TWIC. For example, port authority representatives told us that ports often perform site-specific background checks even for those individuals with an issued TWIC. Port authority representatives provided two key reasons for conducting their own site-specific background checks on top of the federal government’s process: (1) the ability to view an individual’s comprehensive and recent criminal history and (2) the ability to consider factors that may not be covered in TWIC’s list of disqualifying offenses. Some operator groups that we spoke with noted that the disqualifying offenses covered by programs like TWIC, which is designed to limit terrorism risk, do not cover the full range of safety and security concerns that are ultimately their responsibility to control. For example, a representative from the American Association of Airport Executives told us that airports have the discretion to consider requirements beyond federal regulations, which can be used to disqualify applicants for a SIDA. These additional requirements may reside in state or local ordinance, and can vary from airport to airport. Consequently, some operators perform additional vetting on site, which allows them to align vetting policies and procedures with their accepted types and level of risk.

Even when the federal government has sole vetting authority, facility operators and military installation commanders can choose to add additional vetting procedures to ensure they are managing their facilities based on their own accepted level of risk. For example, in 2009, DOD issued a policy directive to accept, among others, the TWIC and the CAC as identification documents authorized to facilitate physical access to installations. However, according to DOD headquarters officials, the military services maintained that the TWIC was not intended to be used for access to military installations, and consequently this policy has not been implemented uniformly across DOD. For example, truck drivers holding TWIC cards and serving military installations have been at times required to undergo additional background and security checks. According to trucking industry representatives, inconsistency across DOD installations is a source of concern as they do not know what might be required of drivers who are trying to gain access. In addition, delays in gaining access to installations can result in increased costs for the truck drivers, and potentially create cascading delays for their subsequent deliveries. Installation commanders have been given the authority to supplement the DOD procedures and process for accessing their installation to help ensure appropriate response to risk with real-time information and decision making. Consequently, the requirements for access can vary by installation. A TSA official also noted that certain sex offenders may be able to get a TWIC, depending on the offense and when the individual was convicted or released from incarceration. The TSA official stated that this is because sexual offenses are not permanently disqualifying under the TWIC statute and may not point to a terrorism or security risk of a regulated maritime facility; however, a military commander may not want to allow that individual onto his or her installation where families with young children are housed and so may consider such offenses disqualifying.

Credentials Generally Cannot be Used Within or Across Critical Infrastructure Sectors

User groups we interviewed generally expressed a desire for reciprocity across federally-administered access control efforts, in particular when such efforts have or appear to have the same or similar underlying vetting processes and associated risks. Operators, on the other hand, had mixed perspectives on this issue. While some operators emphasized finding solutions to enhance access control reciprocity, others cited barriers to or challenges with a more uniform approach.

Among the six selected access control efforts we reviewed, we found limited mechanisms to use one credential for access to similar facilities within and across sectors (i.e., reciprocity). Two examples of reciprocity are DOD’s CAC, which generally allows access into the semi-restricted areas of most military installations, and the CFATS Personnel Surety Program, which allows regulated high-risk chemical facilities to accept previously-issued TWICs to grant access if they are electronically verified, or other credentials issued through a federally administered screening program, if they are visually verified, and if the screening program periodically vets enrolled individuals against the Terrorist Screening Database. Across the chemical sector, chemical facility access is facilitated by two different access control efforts depending on where the chemical facility is located—land-based facilities are governed by CFATS and maritime-based facilities are governed by TWIC. Officials from NPPD, the DHS component that administers CFATS, stated that NPPD explored allowing land-based chemical facility users to enroll in the TWIC program, but DHS has interpreted the Maritime Transportation Security Act of 2002 to provide limited authority to do so. However, individuals in the field of transportation who are eligible for a TWIC may apply for and receive that credential to satisfy the CFATS requirement. NPPD officials stated that facilities may also use screening results from other agencies, such as the Bureau of Alcohol, Tobacco, Firearms, and Explosives, as long as the vetting process includes checking against the Terrorist Screening Database.

Biographic Information is Collected Multiple Times across Selected Efforts

The user stakeholders we interviewed expressed a desire to be able to enter their biographic information once during the registration and enrollment phase, and have that information reused for other access control efforts, and where possible, for background check processing. Some operator groups we interviewed indicated that it was costly and inefficient for operators and users to enter biographic data multiple times. However, federal administrators are limited in their ability to share biographic information across screening efforts because of information technology, and privacy considerations. Among the six access control efforts we reviewed, there are some mechanisms to reuse biographic information; however, there are no set requirements to do so. For example, operators may collect complete biographic information each time a user applies for a SIDA badge for an airport facility. A user group said that it would like to be able to reuse their biographic information for airports, but TSA officials we interviewed stated that any proposed solution to reuse biographic information would be affected by privacy considerations. Under federal law, personal information collected and maintained by an agency for a particular effort may not be disclosed to another agency, with certain exceptions.

In contrast, within NRC’s regulated commercial nuclear power plants, operators use the Personnel Access Database System (PADS) in cooperation with NRC that allows users to provide biographic information once to access multiple facilities because potential employees sign a release of information form to use the system. Users and operators agreed that they benefited from the ease of PADS because they do not have to submit biographic information for each facility. They told us that PADS allows for employee data to be shared across NRC nuclear power plant facilities in part because it is an industry-operated system that is not constrained by federal privacy requirements that would apply to federal systems.

DHS’s Critical Infrastructure Partnership Structures Provide Opportunities to Harmonize Access Control Efforts

DHS Uses Partnership Structures for Critical Infrastructure Protection

DHS has established roles and responsibilities for supporting collaboration efforts among key stakeholders across critical infrastructure sectors. The department also uses partnership structures to enhance information sharing efforts aimed at strengthening critical infrastructure security. According to Presidential Policy Directive/PPD-21 (PPD-21), DHS is responsible for coordinating the overall federal effort to promote the security and resilience of the nation’s critical infrastructure, provide strategic guidance, and promote a national unity of effort, among other responsibilities. Within DHS, NPPD’s Office of Infrastructure Protection (IP) leads the coordinated national effort to mitigate risk to the nation’s critical infrastructure and is responsible for working with public and private sector critical infrastructure partners to enhance security efforts. Using a partnership approach, NPPD IP’s Sector Outreach and Programs Division works with owners and operators of the nation’s critical infrastructure to develop, facilitate, and sustain strategic relationships and information sharing efforts, including the sharing of best practices. NPPD IP also oversees and supports various partnership councils intended to protect and provide essential functions to enhance response efforts.

As reported in the National Infrastructure Protection Plan (NIPP), DHS has created partnership structures to collaborate and engage federal and nonfederal stakeholders in critical infrastructure discussions and to enhance critical infrastructure resilience efforts. These voluntary partnership structures provide forums for critical infrastructure stakeholders—federal, state, local, tribal, territorial, and private sector officials—to come together, exchange ideas, and leverage resources. The Critical Infrastructure Partnership Advisory Council (CIPAC) serves as a forum among critical infrastructure stakeholders to facilitate interaction and coordination of critical infrastructure activities, including planning, coordinating, and exchanging information on cross-sector issues and implementing security and resilience program initiatives. CIPAC membership consists of representatives from the Government Coordinating Councils (GCC) and Sector Coordinating Councils (SCC)— federal, state, and local agency officials and private owners and operators, respectively—who work together to coordinate strategies, activities, and policies across governmental entities within each of the 16 critical infrastructure sectors.

The NIPP also establishes voluntary cross-sector councils to develop national priorities related to strengthening critical infrastructure security. Specifically, the Critical Infrastructure Cross-Sector Council provides a forum for SCCs to address cross-sector issues and interdependencies. This council’s activities primarily focus on identifying and disseminating critical infrastructure security and resilience best practices across sectors, and identifying areas where cross-sector collaboration could advance national priorities. Additional cross-sector councils representing state, local, tribal, and territorial partners serve as forums for members to (1) facilitate enhanced communication and coordination across sectors, (2) evaluate and promote implementation of risk-informed critical security and resilience programs, and (3) promote resilience activities in the public and private sectors, mainly through awareness, education, and mentorship on a wide variety of subjects, among other activities. Within NPPD, the Interagency Security Committee (ISC) serves as a forum for chief security officers and other federal agency officials to develop federal security standards and policies to enhance physical security of non-DOD federal facilities and engage with industry stakeholders to advance best practices. Collectively, these voluntary DHS partnership structures are designed to provide federal agencies a better understanding of the risks associated with critical infrastructure security and an enhanced awareness to make informed decisions about critical infrastructure priorities.

Partnership Structures Provide Opportunities for Harmonization of Access Control Efforts across Critical Infrastructure Sectors

According to NPPD senior officials, DHS voluntary partnership structures exist to discuss a variety of issues that have an impact on critical infrastructure security, but DHS has not used these structures to identify opportunities to harmonize regulated screening and credentialing efforts. The issues discussed earlier in this report about users’ and operators’ experiences across different access control efforts illustrate that there are administrative burden and costs both within and outside of government when the efforts are inconsistent or their administration appears to be less efficient. However, those findings also highlight that there are few, if any, obvious solutions, as many of the issues involve tradeoffs across competing needs of different stakeholder groups and ongoing consideration of the appropriate balance to manage risk without unnecessarily impeding business and operations. In that regard, NPPD officials stated there are challenges, and developing a one-size fits all approach to harmonizing credentialing procedures is not a feasible solution because of the complexities within and across critical infrastructure sectors. Nonetheless, they acknowledged that finding opportunities to harmonize efforts is a worthwhile goal to pursue.

Guidance from DHS partnership structures and our best practices call for entities to identify and share best practices and to collaborate by seeking means to address needs by leveraging resources and establishing compatible policies, procedures, and practices. Specifically, the CIPAC charter document, calls for CIPAC to facilitate interaction among federal government, private sector, and state, local, territorial, and tribal entities to conduct deliberations and form consensus positions to assist the federal government in engaging in implementing security and resilience program initiatives, including conducting operational activities related to critical infrastructure security, sharing threat, vulnerability and risk information, and best practices with one another. Similarly, our work on enhancing collaboration across organizational boundaries calls for entities to, among other things, (1) identify and address needs by leveraging resources and (2) establish compatible policies, procedures, and other means to operate across agency boundaries.

Given NPPD IP’s role as the DHS component responsible for leading the national effort to strengthen the security and resilience of the nation’s critical infrastructure, DHS is well positioned to facilitate collaboration across stakeholder groups—users, operators, and federal administrators—to identify opportunities to harmonize access control efforts across critical infrastructure sectors. According to NPPD officials, the CIPAC partnership structure would serve as an appropriate forum for critical infrastructure stakeholders to discuss potential harmonization efforts moving forward. However, NPPD IP officials responsible for overseeing CIPAC and ISC stated that their cross-sector partnership structures have engaged in limited efforts to explore harmonization of access control efforts, because harmonization has not been raised as a key issue or urgent concern by its members.

However, NPPD IP officials stated that issues raised when considering the user perspectives alongside the operator perspectives would not necessarily have emerged in these groups, because as of October 2016, none of the existing CIPAC partnership forums would be appropriate for users or user groups—such as contractors, workers, and others seeking access to multiple critical infrastructure facilities—to share their experiences or concerns. As of October 2016, DHS does not have a dedicated partnership structure that allows for users to share their experiences in navigating through federal access control efforts. Additionally, DHS officials stated that users are not specifically included in the NIPP’s Sector Partnership Model.

Moreover, NPPD IP officials from the Sector Outreach and Programs Division, who are responsible for coordinating DHS’s partnership structures, stated that government and industry stakeholders have begun initial discussions to enhance information sharing efforts, which could include leveraging information across access control efforts. Specifically, NPPD IP officials reported that during a biannual meeting in July 2016, CIPAC members discussed ways to improve information sharing efforts between government and industry stakeholders related to harmonizing access control efforts. Further, they reported that government and industry stakeholders agreed to create a CIPAC standing committee designed to identify key concerns and engage with members to propose recommendations aimed at enhancing information sharing efforts. Although this effort represents a step towards beginning the discussion of harmonizing access controls efforts, DHS has not fully engaged all relevant stakeholders, specifically users, to explore whether additional opportunities exist to harmonize access control efforts across critical infrastructure sectors. Using existing partnership structures or creating new forums could help DHS more effectively fulfill its role as the facilitator of shared best practices and enhanced collaboration across critical infrastructure partners. In doing so, DHS may be better positioned to identify and implement opportunities to enhance efficiencies within and across related access control efforts.

SCO Has Taken Actions to Harmonize DHS Access Control Efforts, but Has Not Updated Its Goals and Objectives to Support Its Strategic Framework

SCO Goals and Actions to Harmonize DHS Access Control Efforts

A role of SCO, according to DHS Office of Policy officials, is to serve as a department-wide policy advocate for coordination and harmonization of credentialing and screening efforts within DHS. SCO, which is located in the DHS Office of Policy, maintains roughly 30 full-time equivalent staff across different portfolio teams, such as Identity and Credentialing and Watchlisting and Vetting. SCO officials stated that while it is not the sole entity responsible for assessing and harmonizing screening processes across the department, the office provides subject matter expertise and guidance on screening and credentialing policies and practices with the aim of reducing duplicative, stand-alone DHS programs and processes. SCO works with DHS components that are responsible for overseeing screening and credentialing efforts, such as TSA and NPPD, to achieve DHS’s screening and credentialing harmonization objectives. These objectives include identifying and resolving policy issues and program challenges associated with screening and credentialing, supporting department-wide resources that service screening and credentialing efforts, integrating interdependent resources and processes across DHS programs, and representing DHS to external stakeholders.

SCO officials reported that their primary activities fall into three general categories: consultant activities, investment-related decision activities, and working group participatory activities. Specifically, SCO officials stated that they assist DHS components in developing and improving credentialing and screening programs by participating in department-wide budget decisions, and through departmental or component-specific working groups that help guide the development of new programs or the restructuring of existing programs.

According to officials, SCO relies on two foundational policy documents as the overarching strategic framework for promoting harmonization and instructing components on methods for improving access control programs and processes—the 2006 Credentialing Initiative Report (CIR) and the 2008 Credentialing Framework Initiative (CFI). The CIR identified common problems, challenges, and areas where DHS could improve screening and credentialing programs and processes. Examples of identified problem areas include inconsistent vetting processes for similar programs and the issuance of multiple credentials in cases where one would be sufficient. The report also identified four recommendations for addressing the aforementioned problems. As part of its efforts to address the recommendations outlined in the CIR, SCO published the CFI, an implementation strategy document designed to guide investments and improve the department’s ability to meet its mission by improving screening and credentialing processes.

SCO officials stated that they have engaged with DHS components to advance screening and credentialing efficiencies over the past ten years of operation. Through internal annual accomplishment reports and in interviews, SCO provided several examples of activities they have undertaken to advance each of the recommendations outlined in the CIR to advance screening and credentialing efficiencies.

Recommendation 1: Design credentials to support multiple licenses, privileges or status. SCO led a Common Enrollment Coordinating Council (CECC) sub-team, which was tasked to identify opportunities to develop best practices in DHS’ screening and credentialing enrollment environment. Of the 18 recommendations produced by the CECC sub-team, three were approved by the Joint Requirements Council, which plans to escalate recommendations to DHS leadership for study and possible implementation.

Recommendation 2: Vetting processes, associated with like uses and like risks, should not be duplicative. SCO partnered with NPPD and TSA to implement the CFATS Personnel Surety Program, which requires that individuals seeking access to restricted areas or critical assets within high-risk chemical facilities are vetted for ties to terrorism. According to SCO and NPPD officials, SCO worked with NPPD to ensure that CFATS vetting standards were aligned with existing DHS vetting efforts to allow the use of screening resources from TSA.

Recommendation 3: Entitlement to a license, privilege, or status should be verified using electronic scanning technology. SCO officials stated they consulted with the U.S. Coast Guard to develop draft regulations pertaining to the implementation of electronic card readers at maritime facilities to more effectively validate the authenticity of TWIC cards. SCO officials stated that many maritime facilities are currently validating TWICs using visual inspection, and these regulations are designed to help reduce that practice. As we have previously reported, the reliance on the visual inspection of TWICs is vulnerable to the use of counterfeit credentials to gain access.

Recommendation 4: Establish a preference for ‘enroll once, use many’ environments. SCO officials stated that they consulted with TSA and the U.S. Coast Guard to ensure that certain biographic data elements collected by TSA from maritime workers, as well as the results of TSA’s terrorist screening check for the TWIC program, were available for individuals also applying for a U.S. Coast Guard-sponsored Merchant Mariner Credential (MMC). According to SCO officials, the result of such efforts was partial reciprocity between the TWIC and MMC programs.

SCO Has Not Updated Its Goals and Objectives to Support its Strategic Framework for Department-wide Access Control Harmonization

In its early years, SCO operated under the direction of the strategic policy vision and implementation plans laid out in the 2006 CIR and the 2008 CFI; however, since then, SCO has not updated the goals and objectives outlined in the implantation plans. The 2008 CFI lists a number of structured tasks necessary to implement its recommendations, including the development of a communications timeline for stakeholder engagement and the development and periodic update of CFI implementation goals and objectives. SCO officials stated that the implementation plans are no longer relevant to SCO’s current role in the department. Moreover, in our discussions with SCO officials they described several opportunities to harmonize screening and credentialing efforts that DHS had yet to achieve, such as the integration of information technology systems. Officials from the DHS Office of Policy, which oversees SCO operations, stated that Office of Policy goals and objectives for SCO come directly from the DHS Office of the Secretary. However, our review of office goals from fiscal years 2015 and 2016 showed that none of the Office of Policy’s goals specifically tasked SCO with actionable goals or objectives in support of the strategic policy vision outlined in the CIR and CFI. Additionally, no guidance from the Secretary’s office was issued to SCO from 2009 to 2014.

SCO officials stated that their internal planning processes are largely informal rather than a systematic approach to identifying and documenting strategic goals and objectives that could help SCO management pursue the most promising opportunities to support DHS’s harmonization efforts and monitor how well its routine activities align with those goals and objectives. Standards for Internal Control in the Federal Government calls for agencies to define objectives clearly to meet its mission, strategic plan, goals, and requirements of applicable laws and regulations. Further, the standards call for management to define objectives in specific and measurable terms so they are understood at all levels of the entity. This involves clearly defining what is to be achieved, who is to achieve it, how it will be achieved, and the timeframes for achievement. Without updated goals and objectives, SCO is missing an important management control to help it ensure that it supports the best opportunities for DHS-wide screening and credentialing harmonization.

Conclusions

Balancing the need to secure critical infrastructure while promoting a harmonized screening and credentialing process to access critical infrastructure continues to pose challenges for stakeholders—users and operators—because their interests vary and are not necessarily aligned with each other. DHS is responsible for leading the federal government’s effort to protect the nation’s critical infrastructure, and has created partnership structures to support stakeholder collaboration. Therefore it is well-positioned to explore whether opportunities exist among all stakeholders, including users, to harmonize screening and credentialing processes to provide access in a timely manner. Although DHS does not have a specific partnership structure dedicated for users to share their experiences, DHS’s existing partnership structures or new forums could serve as platforms for all critical infrastructure stakeholders to learn from one another and discuss available options to leverage resources. Using new or existing partnership structures to explore whether opportunities exist to harmonize screening and credentialing processes across critical infrastructure sectors could better position DHS to more effectively balance the need to secure critical infrastructure while promoting harmonized screening and credentialing process.

Within DHS’s Office of Policy, the Screening Coordination Office (SCO) is responsible for the coordination and harmonization of screening and credentialing efforts department wide. Although SCO issued foundational policy documents in 2006 and 2008 outlining a strategic framework and implementation plans to harmonize DHS access control efforts, since that time SCO has not updated its goals and objectives to identify improvements needed. Goals and objectives in support of SCO’s strategic framework would better position it to pursue the highest priorities and best opportunities for DHS-wide screening and credentialing harmonization.

Recommendations for Executive Action

To enhance its ability to fulfill its role as the facilitator of cross-sector collaboration and best-practices sharing, we recommend that the Secretary of Homeland Security direct the Assistant Secretary of Infrastructure Protection, Office of Infrastructure Protection, take the following action: Explore with key critical infrastructure partners, whether and what opportunities exist to harmonize federally-administered screening and credentialing access control efforts across critical infrastructure sectors.

To help ensure that SCO uses its time and resources to pursue the most efficient and effective screening and credentialing harmonization goals on behalf of the department, we recommend that the Secretary of Homeland Security direct the Deputy Assistant Secretary for Screening Coordination, Office of Policy, take the following action: Establish goals and objectives to support its broader strategic framework for harmonization.

Agency Comments and Our Evaluation

We provided a draft of this report for review and comment to DHS, NRC, and DOD for their review and comment. DHS and NRC provided written comments, which are reproduced in Appendix II and III. In their comments, DHS concurred with each recommendation and described actions underway or planned to address them including estimated timeframes for completion. If fully implemented, these actions should address the intent of the recommendations and better position DHS to balance the need to secure critical infrastructure while promoting a harmonized screening and credentialing process to access critical infrastructure. For example, in regards to exploring whether and what opportunities exist to harmonize federally-administered screening and credentialing access control efforts across critical infrastructure sectors, DHS noted that they are working to harmonize access control efforts across critical infrastructure as much as practical and remain committed to working towards that end with interagency partners. Specific actions identified to be completed around April 2017 include considering drafting a plan that will include an analysis of how to further explore opportunities to harmonize federally-administered screening and credentialing access control efforts across critical infrastructure sectors. More specifically, the Interagency Security Committee will request that its Steering Subcommittee discuss potential avenues for addressing any gaps and areas of further collaboration related to screening and credentialing access control efforts of federal facilities.

In regards to establishing goals and objectives to support the Screening Coordination Office’s (SCO) broader strategic framework for harmonization, DHS identified actions to direct SCO to establish updated goals and objectives to support the broader strategic framework for more efficient and effective vetting. SCO will provide their goals and objectives to DHS components once finalized to be completed by June 2017.

DHS and DOD also provided technical comments, which were incorporated as appropriate.

We are sending copies of this report to the appropriate congressional committees; the Secretaries of Homeland Security and Defense, and the Chairman of the Nuclear Regulatory Commission. In addition, the report is available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions concerning this report, please contact me at (404) 679-1875 or CurrieC@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made significant contributions to this report are listed in Appendix IV.

Appendix I: Life Cycle Characteristics for Selected Access Control Efforts

To address the research question related to describing key characteristics of selected federal access control efforts, we distributed a standard set of questions to three federal agencies—Department of Homeland Security (DHS), Nuclear Regulatory Commission (NRC) and the Department of Defense (DOD). Our questions reflected the screening and credentialing life cycle stages reported by DHS’s Screening Coordination Office, including Registration and Enrollment, Vetting, Issuance, Expiration and Revocation, Redress, and Waiver. Tables 3 through 8 below summarize the aggregated responses received from the 3 agencies to our questions.

Appendix II: Comments from the Department of Homeland Security

Appendix III: Comments from the Nuclear Regulatory Commission

Appendix IV: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the contact named above, Kathryn Godfrey (Assistant Director), Amber Edwards (Analyst-in-Charge), Josh Diosomito, Adrian Pavia, Vijay Barnabas, Tracey King, Richard Hung, Lorraine Ettaro, Dominick Dale, Marc Schwartz, and Joseph Kirschbaum made key contributions to this report.