Homeland Security: FPS and GSA Should Strengthen Collaboration to Enhance Facility Security
Released: 2016-01-15T00:00:00

Letter

Background

FPS and GSA Organization and Responsibilities

FPS and GSA share responsibility for protecting federal facilities. FPS is primarily responsible for protecting federal employees and visitors in federal facilities held or leased by GSA. Specifically, FPS’s law enforcement and protective security services authority include: (1) protecting federal employees and visitors in approximately 8,900 federal facilities under the control and custody of GSA; (2) enforcing federal laws and regulations aimed at protecting such property and persons (including proactively patrolling facilities, responding to incidents, and exercising arrest authority); and (3) investigating criminal offenses against these facilities and persons. To fund its operations, FPS collects security fees from the agencies it protects and does not receive a separate appropriation. FPS conducts its mission by providing security services through two types of activities: physical security activities such as conducting facility risk assessments and recommending countermeasures—such as security cameras, bollards, barriers, physical access control systems, magnetometers, and x-ray machines—aimed at preventing incidents. law enforcement activities such as proactively patrolling facilities, responding to incidents, conducting criminal investigations, and exercising arrest authority.

GSA serves as the federal government’s landlord and designs, builds, and manages facilities to support the needs of other federal agencies. GSA funds security fixtures based on facility security level requirements on a prioritized, funds available basis. GSA, or the entity that leases the facility, provides project execution, maintenance, and repair of the security fixtures. GSA also has primary responsibility for providing facilities maintenance, space for communications equipment, and building plans, among other services.

Both agencies conduct policy making and high-level planning at the headquarters level. At the regional level, FPS and GSA officials serve as the liaisons from headquarters to the facility level and have responsibility for implementing policies and managing communications. At the facility level, FPS recommends the execution of security countermeasures, provides incident response, and supports emergency plans, whereas GSA manages the government properties. There have been a number of changes over the past decade in structure and authority of government security for federal facility security, especially for FPS. For example, FPS was a component of GSA until 2003, when it transferred to DHS. FPS is currently located within DHS’s National Protection and Programs Directorate (NPPD). See figure 1 for an overview of key FPS and GSA security and protection roles, responsibilities, and operational relationships as outlined in a 2006 memorandum of agreement (MOA) concerning the security of GSA-controlled space.

Facility Security Challenges

The areas in which our prior work has found facility security challenges that FPS faces in carrying out its mission, and between FPS and GSA, focus on operational issues, such as conducting entrance screenings and assessing risk at federal facilities; overseeing FPS’s protective security officers; and collaborating with federal, state, and local entities. Further, between FPS and GSA, we have previously found problems with the quality of data exchanged between GSA and FPS on facilities and their locations. As such, we have made previous recommendations to FPS and GSA related to improving their collaboration. For example, in March 2012, we recommended that GSA ensure that efforts to identify the jurisdictions of all GSA facilities are completed and that the data are provided to FPS so that FPS is better equipped to manage jurisdictional roles and responsibilities at GSA facilities. At the time of our 2012 report, FPS lacked complete data from GSA on the jurisdiction of about one-third of the facilities it protects. Since that time, GSA has made progress with identifying facility jurisdictions. Furthermore, in August 2012, we recommended that FPS coordinate with GSA and other federal tenant agencies to reduce any unnecessary duplication in security assessments of facilities held or leased by GSA. According to ISC guidance, as the security organization for such facilities, FPS is required to conduct risk assessments on a scheduled and recurring basis. FPS has reported progress regarding this issue; however, as of November 2015, the agency has not yet provided us with documentation of its efforts to address the recommendation. Therefore, this recommendation remains open. In light of these previously identified operational challenges, in this report, we focused on how FPS’s and GSA’s working relationship reflects key collaboration practices.

Practices That Can Enhance and Strengthen Collaboration

In our prior work, we have identified eight key collaboration practices that we have used to assess collaboration at a range of federal agencies. These practices can help agencies to implement actions to operate across boundaries, including developing compatible policies and procedures and fostering open lines of communication. We also found that positive working relationships among participants from different agencies bridge organizational cultures, and these relationships can build trust and foster communication, which facilitates collaboration. Given many federal agencies’ long-standing challenges working across organizational lines, following these practices could help agencies to enhance and sustain collaboration at all organizational levels. For this review, to assess FPS and GSA collaboration, we focused on six of eight practices identified in our prior work that are particularly relevant to collaboration between FPS and GSA (see fig. 2). These collaboration practices focus on outcomes and strategies, roles and responsibilities, and policies and procedures to facilitate working across agency boundaries. See appendix II for a detailed overview of all eight collaboration practices.

FPS and GSA Collaborate to Some Extent, but Could Strengthen Efforts in Several Areas

FPS and GSA Have Not Fully Defined or Articulated a Common Outcome or Established Mutually Reinforcing or Joint Strategies

While FPS and GSA officials have drafted a joint strategy, the agencies have not defined and articulated a common outcome or fully established mutually reinforcing or joint strategies because they have not agreed on how they will work together to achieve their respective missions. In our prior work, we have found that the collaborative effort requires agency staff working across agency lines to define and articulate the common federal outcome or purpose they are seeking to achieve. We also found that collaborating agencies need to establish strategies that work in concert with those of their partners. In 2012, FPS and GSA drafted, and subsequently received comments on, a joint strategy that includes a common outcome. The document defines an overarching strategic goal of having a federal facility critical infrastructure that balances public access, security, and resiliency to enable continuity of operations and rapid recovery from all hazards. The document also includes objectives that focus on priority activities and describes some of the challenges that exist in securing federal facilities. The draft joint strategy establishes priorities for enhancing the security and resilience of federal facilities. The two agencies had not agreed on how to proceed with negotiations on the draft joint strategy until the completion of our audit work in October 2015. At that time, FPS officials told us that before finalizing the joint strategy, they plan to complete the following documents: (1) an updated MOA (which will be discussed in the next section); (2) the Control Systems Cybersecurity Strategy for Federal Facilities; and (3) the Government Facilities Sector Specific Plan. As of October 2015, they have no timeline for completing these other efforts or the joint strategy. Joint strategies help in aligning the partner agencies’ activities, core processes, and resources to accomplish a common outcome, and the continuing lack of agreement on common security outcomes and strategies could limit FPS’s and GSA’s ability to fully protect federal facilities and their tenants and visitors.

FPS and GSA Have Not Fully Agreed on Roles and Responsibilities

FPS and GSA officials told us that they have not fully agreed on roles and responsibilities for their related missions regarding facility protection because they have not completed discussions on how they will work together based on changes in the facility security environment since 2006. However, as of August 2015, after being stalled for several years, FPS and GSA resumed negotiations on roles and responsibilities. Our prior work supports the value of agencies working together to define and agree on their respective roles and responsibilities. FPS’s and GSA’s facility security roles and responsibilities are documented in regulation, statutes, and policies, some of which are outdated or incomplete (See app. III for more details on these requirements). Among these documents is the 2006 MOA between the two agencies, which has a stated purpose to address roles, responsibilities, and operational relationships between FPS and GSA concerning the security of GSA-controlled space. The MOA lists services provided by FPS and GSA, outlines law- enforcement and physical-security responsibilities, and identifies the need for the two agencies to share information and jointly address security concerns in specific areas, such as new construction and repair and alteration projects. The MOA remains in effect; however, as a result of policy and organization changes affecting roles and responsibilities not reflected in the 2006 MOA, some information is outdated and incorrect. Figure 3 describes policy and organizational changes affecting roles and responsibilities not reflected in the 2006 MOA. We have previously reported that written agreements are most effective when they are regularly updated and monitored.

In our prior work, we have reported on delays in updating the MOA, and in 2012, we recommended that the Administrator of GSA ensure that the agency identifies the jurisdictions of all GSA buildings and that these data are provided to FPS officials to better equip them to manage roles and responsibilities at GSA buildings, and an updated MOA would help GSA implement the needed changes to address this issue.

FPS and GSA officials at the headquarters level have not been able to agree on the level of detail about roles and responsibilities or the services that should be included in the MOA. After resuming negotiations in August 2015, according to GSA, the issues needing further negotiation include: more detailed information on FPS’s billing to GSA for security costs and timely completion of facility security assessments (FSA). According to FPS, the issues needing further negotiations include: more clearly defining roles and responsibilities to improve FPS and GSA collaboration on security matters and clarifying language that may have previously been subject to misinterpretation by parties in the field. As of October 2015, FPS and GSA officials told us that they plan to address the responsibilities for the condition of countermeasures—such as security cameras, magnetometers and x-ray machines—and fixtures—such as bollards, guard booths, and blast-resistant windows—at facilities in updating the MOA. They also told us that GSA plans to add Public Buildings Service (PBS) as a negotiating partner because: (1) FPS normally works with PBS on implementing countermeasures; (2) PBS has engineering expertise; and (3) PBS creates and manages the building system in regard to an agency’s portion of the bill. However, FPS and GSA officials also told us that they have not developed a timeframe for completing negotiations on the MOA.

At the regional level, FPS and GSA officials at the four regions we interviewed told us that an updated MOA would be helpful. Generally, officials told us that they often rely on established working relationships and informal means of communicating and that an updated MOA could clarify roles and responsibilities, particularly in the areas that have changed since the 2006 MOA was established. For example, according to these officials, security systems are now more integrated than when the MOA was written. As a result, it is not always clear where the responsibility lies for the purchase and maintenance of certain security countermeasures. GSA owns facility access control systems and, according to FPS officials, has objected to FPS connecting intrusion detection systems to these access control systems. As such, officials told us that some facility access control systems have been inoperable while GSA and FPS determine which agency will do what. In November 2015, GSA headquarters officials told us that GSA is in the process of updating failing physical access control systems and legacy systems nationwide. As security technology advances, lack of clarity on roles and responsibilities for these systems could result in security gaps potentially leaving the tenants, the public, and the facilities at risk. At the completion of our audit work in October 2015, FPS and GSA headquarters officials told us that they plan to work together to integrate countermeasures within facilities as existing technology reaches the end of its lifecycle.

FPS and GSA Have Not Fully Collaborated in Communicating Existing Policies and Procedures

We have previously found that as agencies bring diverse cultures to the collaborative effort, it is important to address these differences to enable a cohesive working relationship and to create the mutual trust required to enhance and sustain their working relationship. To facilitate collaboration among agencies with different cultures, agencies need to address the compatibility of policies and procedures that will be used in this effort. However, in this review, we found that the FPS and GSA regional officials we spoke to were not always aware of policies and procedures to operate across agencies and regions because FPS and GSA have not fully collaborated in communicating established policies and procedures. As a result, the regions rely on informal communication between the agencies for day-to-day operations. Our prior collaboration work has found that agencies that articulate their agreements in formal documents can strengthen their commitment to working collaboratively. Once formal agreements are documented, agencies must also have a process in place for implementing such agreements at all organizational levels and across agency boundaries. For example, our work has shown that, by having a process in place to obtain and share information on potential threats to federal facilities, agencies can better understand the risks they face and more effectively determine what preventive measures should be implemented. Without policies and procedures that are well understood at all levels—headquarters, regions, and facilities—it is more difficult to share information and coordinate consistently and effectively.

During our review, we found that, in some cases, FPS and GSA have their own policies and procedures for collaboration with other agencies, such as in the case of FPS’s Regional Information Sharing Plan. FPS developed this plan in 2009, and it provides policies and procedures for the collection, review, analysis, and dissemination of criminal or national security information within FPS and to stakeholders, and it also requires dissemination to the GSA Regional Officer of Security. However, in the regions we reviewed, several officials said they did not know of formal policies and procedures related to collaborating on facility protection issues. For example, GSA officials at one region told us that their role, as compared with FPS’s role, in the protection of federal facilities is not clearly defined and said that they were unaware of formal security standards, policies, and procedures for GSA. The officials told us it makes it difficult to do their jobs without the ability to link security activities to joint security management procedures. A GSA official at another region we interviewed noted a lack of planning and guidance related to facility security, a lack that could lead to duplicative efforts, confusion regarding roles and responsibilities, and an inability to monitor whether FPS and GSA meet their security requirements. GSA officials from these two regions said that in their previous experience at other agencies, they had more specific policies and procedures that help guide their efforts.

FPS and GSA officials in all four regions we visited told us that policies and procedures related to facility protection are not always clear, in part, because the MOA has not been updated for changes in security practices. An updated MOA would drive needed changes in policies and procedures. The lack of collaboration in communicating compatible policies and procedures makes it difficult for the agencies to effectively implement their security mission and can negatively affect day-to-day operations. For example, we reported in 2009 that in the absence of comprehensive plans, many aspects of homeland-security information sharing can be ineffective and fragmented—a situation that could result in greater vulnerability to security threats.

FPS and GSA Have Not Jointly Developed Mechanisms to Monitor, Evaluate, and Report on Results or Reinforce Accountability for Collaboration through Agency Plans and Reports

FPS and GSA officials have not jointly developed mechanisms to monitor, evaluate, and report on the results of their shared responsibilities or ways to reinforce accountability for collaborative efforts through agency plans and reports. FPS and GSA officials have not yet focused on these areas of collaboration. The officials told us that updating the MOA will provide them an opportunity to develop ways to address these practices. Our prior work has found that when agencies monitor, evaluate, and report on the results of collaboration, they can better identify areas for improvement. Further, agencies contributing to the same or similar results should collaborate to ensure that goals are consistent. The agencies’ plans and reports can reinforce accountability by aligning goals and strategies with the collaborative effort, and, in turn, public reporting can reinforce accountability for results. In this review, we found that FPS and GSA individually monitor specific areas of facility security—FPS completes facility security assessments (FSA), and GSA conducts an annual tenant survey on satisfaction with facilities, which includes three questions about security. However, the two agencies have not developed the mechanisms to monitor their shared responsibilities. For example, while the 2006 MOA calls for FPS to provide data to GSA on specific actions, such as completed countermeasures and copies of executive summaries of FSAs, it does not require the two agencies to monitor, evaluate, or report on the results of these efforts.

Further, FPS’s and GSA’s security-related performance measures, which allow agencies to track progress in achieving their goals, and to assist in monitoring and evaluating results, are limited. For example, NPPD’s strategic plan does include two performance measures for FPS; GSA’s strategic plan does not include any security-related performance measures. Specifically, NPPD tracks the percentage of tenants satisfied with the level of security provided at federal facilities and the percentage of evaluations conducted at high-risk facilities that found no deficiencies related to countermeasures. FPS has many other security-related responsibilities, as described above, which contribute to the agency’s performance. Performance measures that align with agency-wide goals and missions can facilitate developing better mechanisms to monitor and evaluate results. Further, because FPS and GSA have not developed mechanisms to monitor and evaluate their collaboration for facility protection, the agencies do not have the means in place to systemically identify areas for improvement. It may be more challenging for the agencies to develop mechanisms to monitor, evaluate, and report on results, and to incorporate collaborative goals into their respective plans and reports, without having first defined and articulated a common outcome—the first of the key practices we assessed in this review.

With regard to plans and reports, at a high level, both agencies’ strategic plans mention the importance of collaboration with other agencies in general and, therefore, can function as a tool to drive collaboration with relevant agencies and partners. However, the plans do not align goals and strategies to the agencies’ collaborative efforts. As such, the plans do not serve to facilitate reinforcing agency accountability to ensure that FPS and GSA’s related missions are accomplished.

FPS’s and GSA’s Incomplete Collaboration Creates Inefficiencies and Security Risks at the Regional Level

FPS’s and GSA’s incomplete collaboration, particularly with regard to three key collaboration practices—the lack of agreement on roles and responsibilities, communicating compatible policies and procedures, and mechanisms to monitor, evaluate, and report on results—essential elements to organizing joint efforts and facilitating decision making across agency boundaries—makes day-to-day operations more challenging and creates inefficiencies and security risks at the regional level, as discussed below.

In our prior work and in this review, we found cases in which the MOA laid out roles and responsibilities that FPS or GSA did not consistently follow. For example, in 2009, we reported that FPS was not following a requirement of the MOA that it share the results of FSAs with GSA. FPS believed that the FSA executive summary contained sufficient information for GSA to make decisions about purchasing and implementing FPS’s recommended countermeasures. However, GSA officials at all levels said that the FSA executive summary did not contain enough information on threats and vulnerabilities. Moreover, GSA security officials told us that FPS does not consistently share FSA executive summaries across all regions. This lack of information sharing highlights the need for additional policies and procedures. We recommended that the Director of FPS reach consensus with GSA and tenant agencies on what information GSA needs to fulfill its facility security responsibilities. In February 2014, FPS implemented our recommendation by issuing a policy directive on the implementation of FSAs that outlines a policy for sharing FSAs with GSA and ensuring that sensitive information is safeguarded.

Although developing this directive is a positive step toward improving collaboration, in this review, we found that FPS still inconsistently shares FSAs with GSA at the four regions we reviewed. For example, GSA officials at one region told us that although FSAs had not always been shared in the past, FPS now shares the information and provides the assessments. Conversely, GSA officials from another region we visited said that FPS does not always share FSAs. For instance, the GSA officials said that FPS sometimes does not provide facility managers with the appropriate FSA information and that the facility manager first becomes aware of the FSA during the facility security committee (FSC) meeting. Similar to what we found in 2009, GSA officials from this region expressed a need for an updated MOA to help clarify information sharing issues. In October 2015, FPS officials told us that they have addressed GSA’s concerns involving sharing FSAs. For example, FPS officials said, as a result of changing their assessment tool, the FSC now receives complete copies of the FSAs. We previously reported that information sharing and coordination among organizations is crucial to producing comprehensive and practical approaches and solutions to address security threats directed at federal facilities. As discussed above, we previously found that written agreements are most effective when they are regularly updated and monitored. In that same work, we found a case in which the ineffective implementation of a written agreement between two federal government agencies likely led to sporadic and limited collaboration among the two agencies. Similarly, without properly implementing written agreements such as the 2006 MOA, FPS and GSA may experience some of these same challenges, and according to one of the key collaboration practices we have identified, the lack of mechanisms to monitor, evaluate, and report on results makes it difficult to identify and remedy cases of inconsistent implementation at the regional level.

During our review, we found that FPS and GSA communicate informally at the regional level in the absence of formal policies and procedures. GSA officials from two of the four regions we interviewed told us that they rely on working relationships to keep things running smoothly because they are not aware of compatible policies and procedures. For example, GSA officials in one region told us that FPS regional officials brief them on security threats quarterly. GSA officials added that FPS and GSA regional officials also meet to discuss security incidents, changes in ISC standards, and new GSA space requirements. The GSA regional officials told us that they are working with their FPS counterparts to create a joint regional-information-sharing strategy. FPS officials in another region told us that they hold quarterly meetings with GSA regional officials to discuss security issues, including upcoming events, such as protests, that could affect facility security, as well as how and when to inform tenant agencies about actions they need to take, such as expanded telework, during the events.

Informal communication is part of a collaborative relationship and may enable the agencies to conduct day-to-day operations, but it may also result in inefficiencies and less than optimal use of resources, as well as security risks. Regional officials provided us with examples of construction and alteration projects, personnel redeployment, security incidents, and threat-based reporting that could have benefitted from policies and procedures and more formal communication to ensure security. We found that these regional examples most closely relate to three of the six collaboration practices we included in our review: (1) agreeing on roles and responsibilities; (2) establishing compatible policies and procedures; and (3) developing mechanisms to monitor, evaluate, and report on results. See table 3 for examples of some of these inefficiencies and security risks and the effect at the regional level.

FPS’s and GSA’s reliance on informal communication at the regional level and resulting inefficiencies from a lack of information sharing, echo findings from our prior work on FPS’s facility protection. We have previously found that in the post-September 11 era, it is crucial that federal agencies work together to share information to advance homeland security and critical infrastructure-protection efforts. The ability to share security-related information can unify the efforts of federal agencies in preventing or minimizing terrorist attacks. However, we found that many aspects of homeland-security information sharing can be ineffective and fragmented. FPS officials are sometimes reluctant to share information that they consider law enforcement sensitive, and this reluctance can have an impact on GSA’s ability to manage its facilities and on collaboration between the two agencies to ensure security. As we previously found, GSA has raised strong arguments for having this information, and FPS could do more to resolve this situation. We concluded that FPS and GSA should share information in a timely manner to support homeland security and critical infrastructure-protection efforts and that, without a greater focus on defining the consistency, frequency, and content of communication between the agencies, FPS would be ill-equipped to sufficiently mange facility security as new threats emerge.

In October 2015, FPS and GSA officials acknowledged that communication among the agencies at the regional level can be improved. The officials told us that they will begin monthly meetings between key FPS and GSA officials to develop a strategy for improving communication at the regional level.

The incomplete implementation of key collaboration practices— particularly with regard to agreement on roles and responsibilities, compatible policies and procedures, and mechanisms to monitor, evaluate, and report on results—leaves day-to-day operational decisions to the regional and facility levels, a situation that may result in inconsistent management practices among regions across the country. As noted in the cases above, this practice could lead to FPS and GSA not making the best use of limited resources to build and renovate facilities, and may increase security lapses, putting facilities, tenants and the public at greater risk.

Conclusion

The nature of FPS’s and GSA’s related missions for federal facility security and protection and the presence of potential threats to these facilities require effective collaboration. At the same time, the agencies have different cultures, training, and ways of operating, which can present additional challenges to working well together. To meet these challenges, FPS and GSA have taken some steps to improve collaboration over the past year, and as of October 2015, FPS and GSA officials stated that they plan to address several of these issues. For example, drafting a joint strategy and, in August 2015, resuming negotiations to update the 2006 MOA that outlines FPS’s and GSA’s facility security roles and responsibilities represent positive efforts. Agreeing on and articulation of a common outcome that is consistent with the two agencies’ related agency goals and missions and finalizing a joint strategy to align their efforts, could help FPS and GSA to improve their working relationship. Reaching agreement in these key areas will help to enhance the agencies’ ability to protect federal facilities and has become more pressing given how much has changed in the security environment since the original MOA was put in place nearly 10 years ago. Communicating existing policies and procedures, within both agencies, for operating across agency boundaries could help to improve the inconsistency in day- to-day communication and operations across the regions. Further, establishing mechanisms to monitor, evaluate, and report on the results of the agencies’ efforts to accomplish their mission, or a means to ensure agency accountability for collaboration through agency plans and reports can help ensure that agencies achieve intended results. Without working to strengthen these key collaboration practices, FPS and GSA risk their ability to meet their mission to adequately identify and address serious security risks.

Recommendations for Executive Action

Given the collaboration challenges that FPS and GSA face in protecting federal facilities, we are making four recommendations to the Secretary of Homeland Security and the Administrator of the General Services Administration. Specifically, we recommend that the DHS Secretary direct FPS to take and that the GSA Administrator take the following actions: 1. FPS and GSA headquarters officials should establish a plan with timeframes for reaching agreement on a joint strategy and finalizing it in order to define and articulate a common understanding of expected outcomes and align the two agencies’ activities and core processes to achieve their related missions. 2. FPS and GSA headquarters officials should establish a plan with timeframes for reaching agreement on the two agencies’ respective roles and responsibilities for federal facility security, and update and finalize the two agencies’ MOA accordingly. 3. FPS and GSA headquarters officials should develop a process to ensure that compatible policies and procedures, including those for information sharing, are communicated at the regional level so that regional officials at both agencies have common information on how to operationalize the two agencies’ collaborative efforts. 4. FPS and GSA headquarters officials should develop mechanisms to monitor, evaluate, and report on their collaborative efforts to protect federal facilities in order to identify possible areas for improvement and to reinforce accountability.

Agency Comments and Our Evaluation

We provided a draft of this report to DHS and GSA for their review and comment, and both agencies provided written comments in response. DHS concurred with our recommendations and provided actions and timeframes for completion. DHS’s official written response is reprinted in appendix IV. GSA agreed with our findings and agreed to work with FPS to address them. GSA’s official written response is reprinted in appendix V. DHS’s and GSA’s responses are a positive step toward addressing our recommendations, and we look forward to updates on the agencies’ progress as these efforts move forward. DHS and GSA also provided technical comments, which we incorporated as appropriate.

DHS officials stated that they are working to update their respective roles and responsibilities and to define a joint strategy and outcome for federal facility protection. Specifically, DHS stated that the MOA will include roles and responsibilities for each organization where there are clear dependencies. DHS also stated that in collaboration with GSA, FPS will document how field personnel can better execute their responsibilities. Furthermore, DHS stated that FPS and GSA headquarters personnel have agreed to meet monthly to review and address identified areas for improvement, and the officials expect to further define mechanisms to monitor, evaluate, and report on their collaborative efforts to protect federal facilities during these monthly meetings.

As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the appropriate congressional committees, the Secretary of Homeland Security, the Administrator of the General Services Administration, and other interested parties. In addition, the report is available at no charge on the GAO web site at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-2834 or rectanusl@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix VI.

Appendix I: Objectives, Scope, and Methodology

The objectives of our report were to assess (1) how the agencies’ collaboration reflects key practices to ensure facility security and (2) the impact of their collaboration practices on day-to-day operations at the regional and facility levels. To obtain contextual information and establish criteria for our work, we reviewed our prior reports and other reports and literature related to FPS, collaboration between agencies, and facility security and protection issues published between 2005 and 2015 to identify issues, prior findings, and recommendations related to FPS and GSA collaboration that had not been addressed. We identified eight practices described in our previous work that can help enhance and sustain collaboration as well as implementation approaches. We selected six of the eight practices most relevant to issues we identified in our prior work on facility security and collaboration to assess the status of FPS and GSA collaborative efforts and how they affect the agencies’ operations. We selected the following six practices: define and articulate a common outcome, establish mutually reinforcing or joint strategies, agree on roles and responsibilities, establish compatible policies, procedures, and other means to operate develop mechanisms to monitor, evaluate, and report on results, and reinforce agency accountability for collaborative efforts through agency plans and reports.

Additional interagency collaboration practices we did not select for our review include: (1) identify and address needs by leveraging resources and (2) reinforce individual accountability for collaborative efforts through performance management systems. We did not select these two practices because they were less relevant to FPS and GSA collaboration issues we have previously identified. See Appendix II for a detailed overview of all eight collaboration practices.

To assess the status of FPS and GSA efforts to collaborate for their related missions of facility security and protection, we reviewed Department of Homeland Security (DHS), NPPD, FPS, and GSA regulations, policy documents, and strategic plans. We also reviewed the 2006 Memorandum of Agreement between DHS and GSA that defines the security responsibilities of FPS and GSA at federal facilities, as well as a draft FPS and GSA joint strategic plan for protection of federal facilities. In addition, we reviewed Presidential Policy Directive 21, which refined and clarified roles and responsibilities for critical infrastructure and emphasized overall collaboration among agencies. We also reviewed pertinent laws and presidential executive orders, the Homeland Security Act of 2002, Titles 6, 40, and 41 of the United States Code, and Presidential Executive Orders 12977 and 13286, which describe FPS and GSA protection authorities. In addition, we reviewed the Government Performance and Results Act (GPRA) of 1993, the GPRA Modernization Act of 2010, and Office of Management and Budget Circular A11, which define federal agencies’ responsibilities for creating strategic plans, goals, and measures. We interviewed DHS, FPS, and GSA headquarters officials about their regulations, policies, plans, agreements, regional and facility level operations, and ongoing efforts to improve federal facility security collaboration through implementation of our six selected collaboration practices. We also interviewed Interagency Security Committee officials about their efforts to improve federal facility security collaboration.

To assess how FPS and GSA collaboration affects day-to-day operations at the regional and facility levels, we selected four FPS and GSA regions for review: Region 3 (Mid-Atlantic); Region 5 (Great Lakes); Region 7 (Greater Southwest); and Region 10 (Northwest/Arctic). We selected these four regions because they comprise about 41 percent of all GSA leased and owned facilities, are geographically dispersed, and include a mix of urban and rural federal facilities and a range of FSLs. During our reviews of these four regions, we collected FPS and GSA operational documents, plans, policies, and procedures. We interviewed FPS and GSA regional managers and directors about their respective facility security collaborative efforts and how the status of FPS and GSA collaboration and implementation of our six selected collaboration practices affect their operations. During our visits to the Chicago and Dallas Regions, we judgmentally selected two facilities to tour in each region based on the size and tenant agency composition. During our tours of these four facilities, we observed how FPS and GSA collaborate at the facility level to provide security, and interviewed FPS security officers and GSA facility managers about their collaborative efforts to provide facility security and about how the status of FPS and GSA collaboration and implementation of our six selected collaboration practices affect their operations. We also reviewed Facility Security Committee (FSC) meeting minutes for the four regions we reviewed. We requested the most recent FSC meeting minutes for five facilities at each of the four regions we reviewed based on interviews with FPS and GSA regional officials, facilities we visited, and the tenant make-up and size of a facility. In reporting on how FPS and GSA collaboration affects day-to- day operations at the regional and facility levels, we focus on three of the six practices that most closely related to the issues we found in the regions we visited, including: (1) agreeing on roles and responsibilities; (2) establishing compatible policies, procedures, and other means to operate across agency boundaries; and (3) developing mechanisms to monitor, evaluate, and report on results. The information we obtained during our site visits and interviews is not generalizable and cannot be used to represent the opinions of all agency officials. We used the information from these site visits and interviews to provide illustrative examples throughout our report.

We conducted this performance audit from January 2015 to December 2015 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Key Collaboration Practices

In our prior work, we have identified eight key collaboration practices that we have used to assess collaboration at a range of federal agencies. Agencies can enhance and sustain their collaborative efforts by engaging in these eight practices. Running throughout these practices are a number of factors such as leadership, trust, and organizational culture that are necessary elements for a collaborative working relationship. See table 3 below for a detailed overview of all eight collaboration practices.

Appendix III: Established Federal Protective Service’s (FPS) and General Services Administration’s (GSA) Roles and Responsibilities

Appendix IV: Comments from the Department of Homeland Security

Appendix V: Comments from the General Services Administration

Appendix VI: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the contact named above, Amelia Shachoy (Assistant Director), Geoffrey Hamilton, Raymond Griffith, Judy Guilliams-Tapia, Matthew Latour, Michael Mgebroff, Amy Rosewarne, Kelly Rubin, John Sheehan, and Sarah Veale made significant contributions to this report.