Critical Infrastructure Protection: DHS Is Taking Action to Better Manage Its Chemical Security Program, but It Is Too Early to Assess Results
Released: 2012-07-26T00:00:00

Letter

Background

The CFATS program is intended to secure the nation’s chemical infrastructure by identifying and protecting high-risk chemical facilities. Section 550 of the DHS appropriations act for fiscal year 2007 requires DHS to issue regulations establishing risk-based performance standards for security of facilities that the Secretary determines to present high levels of security risk. The CFATS rule was published in April 2007 and Appendix A to the rule, published in November 2007, listed 322 chemicals of interest and the screening threshold quantities amount for each. According to the CFATS rule, any facility that possesses (or later comes into possession of) any of these chemicals in quantities that meet or exceed the threshold is required to submit certain information to DHS for screening. According to the rule, if DHS preliminarily determines that a facility is high risk—that is, the facility presents a high risk of significant adverse consequences for human life or health, national security, or critical economic assets if subjected to terrorist attack, compromise, infiltration, or exploitation—the facility must submit a security vulnerability assessment to DHS that identifies security vulnerabilities at the site, among other things. After reviewing the security vulnerability assessment, DHS then makes a final decision as to whether the facility is high-risk and, if so, assigns the facility to a final tier. The rule then requires facilities that have been finally determined to be high-risk to develop and submit for DHS approval site security plans that generally show how they are to address the vulnerabilities identified in the vulnerability assessment, including measures that satisfy applicable risk-based performance standards. In addition, the rule requires that DHS implement a compliance inspection process to ensure that covered facilities are satisfying DHS’s performance standards consistent with their approved site security plans.

ISCD has direct responsibility for implementing DHS’s CFATS rule, including assessing potential risks and identifying high-risk chemical facilities, promoting effective security planning, and ensuring that final high-risk facilities meet the applicable risk-based performance standards though site security plans approved by DHS. ISCD is managed by a Director and a Deputy Director and operates five branches that are, among other things, responsible for information technology operations, policy and planning; providing compliance and technical support; inspecting facilities and enforcing CFATS regulatory standards; and managing logistics, administration, and chemical security training. ISCD receives business support from NPPD and IP for services related to human capital management and training, budget and finance, and acquisitions and procurement. Figure 1 shows ISCD’s current organizational structure within NPPD and IP. Appendix II provides a more detailed organization chart showing the various ISCD divisions.

From fiscal years 2007 through 2012, DHS dedicated about $442 million to the CFATS program. During fiscal year 2012, ISCD was authorized 242 full-time-equivalent positions. For fiscal year 2013, DHS’s budget request for the CFATS program was $75 million and 242 positions.

The CFATS Rule

DHS’s CFATS rule outlines a specific process for administering the program. Any chemical facility that possesses any of the 322 chemicals in the quantities that meet or exceed the threshold quantity outlined in the rule is required to complete an initial screening tool (referred to by DHS as the Top Screen) whereby the facility provides DHS various data, including the name and location of the facility and the chemicals and their quantities at the site. DHS is to use this information to initially determine whether the facility is high risk. If so, DHS is to notify the facility of its preliminary placement in one of four risk-based tiers—tier 1, 2, 3, or 4.

Facilities preliminarily placed in any one of these tiers are considered to be high risk, with tier 1 facilities considered to be the highest risk. Facilities that DHS initially determines to be high risk are required to complete a security vulnerability assessment, which includes the identification of potential critical assets at the facility and a related vulnerability analysis. DHS is to then review the security vulnerability assessment and notify the facility of DHS’s final determination as to whether or not it is considered high risk, and if the facility is determined to be a high-risk facility about its final placement in one of the four tiers. Once this occurs, the facility is required to submit a site security plan or participate in an alternative security program in lieu of a site security plan. The security plan is to describe the security measures to be taken to address the vulnerabilities identified in the vulnerability assessment, and identify and describe how security measures selected by the facility will address the applicable risk-based performance standards. DHS then is to do a preliminary review of the security plan to determine whether it meets the regulatory requirements. If these requirements appear to be satisfied, DHS issues a letter of authorization for the facility’s plan. DHS then conducts an authorization inspection of the facility and subsequently determines whether to approve the security plan. If DHS determines that the plan does not satisfy CFATS requirements (based on its preliminary review after an authorization inspection), DHS then notifies the facility of any deficiencies and the facility must submit a revised plan correcting those deficiencies. If the facility fails to correct the deficiencies, DHS may then disapprove the plan. Following approval, DHS may conduct further inspections to determine if the facility is in compliance with its approved security plan. Figure 2 illustrates the CFATS regulatory process.

In July 2007, DHS began reviewing information submitted by approximately 40,000 facilities. By January 2012, DHS had preliminarily determined that approximately 4,500 of these facilities were high risk and preliminarily placed each in one of the four tiers. Each of these approximately 4,500 facilities was to complete a security vulnerability assessment, and those facilities that DHS finally determined to be high risk were to submit a site security plan. According to ISCD officials, the vulnerability assessment process prompted over 1,600 facilities to remove chemicals of interest from their sites, thereby enhancing their security posture and removing them from CFATS coverage. Also, according to division officials, as of February 2012, ISCD had worked with facilities to complete 925 compliance assistance visits whereby division inspectors visit high-risk facilities to provide knowledge of and assistance in complying with CFATS, particularly facilities that were in the process of preparing their security plans.

Senior ISCD Leaders Developed the ISCD Memorandum to Highlight Various Challenges Hindering CFATS Implementation

ISCD’s Memorandum Based Largely on Observations of Senior ISCD Managers

Our review of the ISCD memorandum and discussions with ISCD officials showed that the memorandum was developed during the latter part of 2011 and was developed primarily based on discussions with ISCD staff and the observations of the ISCD Director in consultation with the Deputy Director. In July 2011, a new Director and Deputy Director were appointed to lead ISCD and, at the direction of NPPD’s Under Secretary, began a review of the CFATS program goals, challenges, and potential corrective actions. In November 2011, the Director and Deputy Director provided the Under Secretary the ISCD memorandum entitled “Challenges Facing ISCD, and the Path Forward.” These officials stated that the memorandum was developed to inform leadership about the status of ISCD, the challenges it was facing, and the proposed solutions identified to date. In transmitting a copy of the memorandum to congressional stakeholders following the leak in December 2011, the NPPD Under Secretary discussed caveats about the memorandum. He stated that the memorandum was not a formal compliance audit or program review and in several instances it lacked useful, clarifying context. He stated that the ISCD memorandum was not intended for wider internal or external dissemination beyond the Under Secretary’s office. He further explained that it had not undergone the normal review process by DHS’s Executive Secretariat and contained opinions and conclusions that did not reflect the position of DHS. He also noted that the memorandum did not discuss the “significant progress” ISCD had made to date reaching out to facilities of concern to improve their security posture. For example, senior division officials told us that the memorandum did not note the positive impact of ISCD’s initial screening of facilities, which resulted in many facilities reducing their holdings of regulated materials so that they would no longer be subject to the rule.

The ISCD Director confirmed that she was the primary author of the ISCD memorandum, in consultation with the Deputy Director, and said that the memorandum was intended to be used as an internal management tool. The Director stated that when she was brought onboard, the Under Secretary tasked her to look at CFATS from an outsider’s perspective and identify her thoughts on the program relative to other regulatory regimes, particularly in light of growing concerns about possible human capital issues and problems tiering chemical facilities covered by CFATS. She confirmed that the memo was intended to begin a dialog about the program and challenges it faced. The Director also confirmed that she developed the memorandum by (1) surveying division staff to obtain their opinions on program strengths, challenges, and recommendations for improvement; (2) observing CFATS program operations including the security plan review process; and (3) analyzing an internal DHS report on CFATS operations, which, according to the Director, served as a basis for identifying some administrative challenges and corrective action. The Director told us that senior ISCD officials, including branch chiefs, were given an opportunity to review an initial draft of the memorandum and provided feedback on the assumptions presented. ISCD branch chiefs— the officials responsible for taking corrective actions—confirmed that they were given the opportunity to provide comments on a draft of the memorandum. However, they said that after the leak, almost all of the senior ISCD officials, including branch chiefs, did not have access to the final memorandum per the instruction of the Under Secretary for Management. The senior ISCD and NPPD officials we contacted said that they generally agreed with the material that they saw, but noted that they believed the memorandum was missing context and balance. For example, one NPPD official stated that that the tone of the memorandum was too negative and the problems it discussed were not supported by sound evaluation. The official expressed the view that the CFATS program is now on the right track.

ISCD Director Was Concerned That Challenges Place the CFATS Program at Risk

The ISCD memorandum discussed numerous challenges that, according to the Director, pose a risk to the program. The Director pointed out that, among other things, ISCD had not approved any site security plans or carried out any compliance inspections on regulated facilities. The Director attributed this to various management challenges, including a lack of planning, poor internal controls, and a workforce whose skills were inadequate to fulfill the program’s mission and highlighted several challenges that have an impact on the progress of the program. In addition, the memorandum provided a detailed discussion of the issues or problems facing ISCD. One group of issues focused on human capital management, problems the author categorized as team issues. According to the Director, these included issues arising out of poor staffing decisions; difficulty establishing a team culture that promotes professionalism, respect, and openness; a lack of measurable employee performance goals and unclear performance and conduct standards; and potential delays associated with notifying ISCD inspector union over policies, procedures, and processes. A second group focused on mission issues, including what the author found to be the slow pace of the site security plan approval process, the lack of an established inspection process, and the ISCD’s inability to perform compliance inspections 5 1/2 years after enactment of the CFATS statute, and the lack of an established records management system to document key decisions. A third group focused on administrative issues, particularly those the Director regarded as a lack of infrastructure and support, both within ISCD and on the part of NPPD and IP. They included the aforementioned concern about over-reliance on contractors, insufficient and inconsistent support by NPPD and IP with regard to human capital needs—including support on the aforementioned staffing issues—and insufficient controls regarding the use of inspector vehicles, purchase cards, and travel.

Additional details on the human capital, mission, and administrative issues identified in the ISCD memorandum are considered “for official use only.”

ISCD Has Begun to Take Various Actions Intended to Address Challenges Identified

ISCD’s Action Plan Includes Time Frames for Completing Action Items and Appears to Be a Catalyst for Addressing Some Legacy Issues

ISCD is using an action plan to track its progress addressing the challenges identified in the memorandum, and, according to senior division officials, the plan may be helping them address some legacy issues that staff were attempting to deal with before the memorandum was developed. As discussed earlier, the ISCD memorandum was accompanied by a proposed action plan that, according to the director, was intended to provide proposed solutions to the challenges identified. The January 2012 version of that plan listed 91 actions to be taken categorized by issue—human capital management issues, mission issues, or administrative issues—that, according to the ISCD Director, were developed to be consistent with the ISCD memorandum. Each action item also listed the coordinator, or individual or unit responsible for the action, and discussed the status of the action, including whether the item was complete or in progress. For example, in the human capital/staffing issues area, one action item was intended to engage ISCD leadership to develop an integration plan for newly hired employees. The IP Business Support Team, which is co-located with ISCD, was responsible for coordinating this action, and at the time the plan was prepared, the action was in progress. According to the plan, a 3-day ISCD 101 course had been developed and a more comprehensive process for acclimating new employees to ISCD was under development. However, the January 2012, version of the action plan did not provide information on when the action was started or to be finished.

In February 2012, ISCD developed a version of the action plan that included the same information as the January 2012, plan. However, it also included quarterly projected completion dates. Since then the division’s action plan has evolved into a more detailed plan containing 94 items. Like the February 2012 plan, March and June 2012 updated versions of the plan contained information on the coordinator, the action to be taken, and the status of each item. However, unlike the February 2012 version of the plan, the March and June versions of the plan provided detailed milestones and timelines for completing action items including calendar dates, and interim actions leading to completion— essentially a road map for managing each action item according to particular dates and milestones. This approach is consistent with The Standard for Program Management, which calls for organizations to develop plans with milestones and time frames to successfully manage programs and projects.

Eleven of the 12 ISCD managers (those other than the Director and Deputy Director) assigned to work as the coordinators of the individual action items told us that even though they were not given the opportunity to view the final version of the ISCD memorandum, the Director provided them the sections of the action plan for which they were responsible to help them develop and implement any corrective actions. They said that they agreed that actions being taken in the plan were needed to resolve challenges facing ISCD. Our discussions with these officials also showed that about 39 percent (37 of 94) of the items in the March and June 2012 action plans addressed some legacy issues that were previously identified and, according to these officials, corrective actions were already under way for all 38 of these action items. For example, one action item called for ISCD to maintain better relations with industry, Congress, and other key stakeholders. ISCD officials said that the ISCD Policy Branch had already begun working on this strategy prior to the development of the memorandum and action plan and that this strategy was given more attention and a higher priority because of the associated action item. An ISCD official expressed the view that the ISCD memorandum and action plan encouraged ISCD to address these and other items sooner than they otherwise might have been addressed.

ISCD’s June 2012 Plan Update Showed 38 Action Items Completed

Our analysis of the June 2012 version of the ISCD action plan showed that 40 percent of the items in the plan (38 of 94) had been completed. The remaining 60 percent (56 of 94) were in progress. Our analysis of the 38 completed items showed that 32 of the 38 items were associated with human capital management and administrative issues, including those involving culture and human resources, contracting, and documentation. For example, one human capital management issue that is complete called for ISCD to survey staff to obtain their opinions on program strengths and challenges and recommendations for program improvements. According to the June 2012 action plan, the survey was completed and ISCD’s action plan showed the item as completed on January 10, 2012. Another completed human capital action item— categorized by ISCD as a cultural issue—called for ISCD management to hold a series of meetings with employees to involve them in addressing program challenges, clarify program priorities related to its mission, and implement changes in ISCD culture. The June 2012 version of the action plan shows the item as completed on January 10, 2012, but noted that this activity will continue going forward. The remaining 6 of 38 action items categorized by ISCD as completed were associated with mission issues such as 1 action item calling for ISCD to establish a quality control function for compliance and enforcement activities. According to ISCD’s action plan, this item was completed in April 2012, based on development of a proposal to form the quality control section within the division. Figure 3 shows the status of action items by each of the three categories— human capital management issues, mission issues, and administrative issues, as of June 2012. Appendix III provides an overview of the items in the action plan and their status (completed or in progress) by issue (human capital management, mission issues, and administrative issues) and subcategory.

For the remaining 56 items that were in progress, 40 involved human capital management and administrative issues. According to ISCD officials, these 40 issues generally involved longer-term efforts—such as organizational realignment—or those that require approval or additional action on the part of IP or NPPD. For example, ISCD reported that there are 13 action items that are directly or indirectly associated with the division’s realignment efforts, including items that require approval by NPPD and IP. The overall realignment effort related to these action items is intended to address concerns, highlighted in the memorandum, that ISCD’s organizational structure was “stovepiped” and compartmentalized. The plan, which, as of June 2012, was in draft, would, according to officials, reorganize ISCD to “integrate more fully certain functions to enhance the collaborative nature of the work that needs to be performed” and would entail creating new offices, moving and integrating others, and centralizing some functions that are now dispersed throughout the division. In accordance with the affected action items, ISCD and a contractor developed the several elements of the realignment plan for review, and ISCD was awaiting input or guidance from NPPD and IP before associated action items can be completed.

Sixteen of 56 remaining actions items in progress covered mission issues that will likely also require long-term efforts to address. For example, 1 of these mission-related action items entails the development of requirements for an information technology platform to support inspection activities. Another entails the development of plans to improve ISCD’s site security plan review process. Regarding the latter, ISCD encountered delays approving security plans because, according to ISCD officials, the quality of the plans submitted was inconsistent and ISCD did not have dedicated staff with the skills needed to work with facilities to review and approve them. As noted in the ISCD memorandum, the site security plan review process was overly complicated, did not leverage available resources, and created bottlenecks and clearing the backlog of security plan’s was ISCD’s highest priority. To address these concerns, ISCD developed an interim review process to clear the backlog of tier 1 security plans with a goal of completing reviews of those plans by the end of the calendar year. ISCD began to track the action item intended to develop a plan for introducing a new security plan review process, which, according to the June 2012 action plan, is supposed to be completed in July 2012. The development of a new security plan review process may be critical to the effective implementation of the CFATS program. According to an ISCD official, compliance inspections cannot begin until ISCD reviews and approves a facility’s site security plan. In March 2012, the official estimated that it could take at least 18 months for ISCD to complete its first compliance inspections. In commenting on our draft statement, ISCD officials stated that inspections for all of the approximately 4,500 tiered facilities could take several years, contingent upon available resources.

Almost Half of ISCD’s Action Item Completion Dates Have Been Extended since April 2012

Our analysis of the April and June versions of the plan shows that the division had extended the estimated completion dates for nearly half of the action items. Estimated completion dates for 52 percent (48 of 93 items) either did not change (37 items) or the date displayed in the June 2012 plan was earlier than the date in the April 2012 version of the plan (11 items). Conversely, 48 percent (45 of 93) of the items in the June 2012 version of the plan had estimated completion dates that had been extended beyond the date in the April 2012 plan. For example, in the April 2012 plan, ISCD was to work with NPPD and IP on identifying job skills, the correct job series, and job descriptions, action that was estimated to be completed in July 2012. However, the June 2012 plan shows that the completion date for this action item was extended to August 2012, more than 30 days beyond the date estimated in April 2012. Figure 4 shows the extent to which action plan items were completed earlier than planned, did not change, or were extended, from April 2012 through June 2012, for the human capital management, mission, and administrative issues identified in the plan.

ISCD officials told us that estimated completion dates have been extended for various reasons. They said that one reason for moving these dates was that the work required to address some items was not fully defined when the plan was first developed and as the requirements were better defined, the estimated completion dates were revised and updated. In addition, ISCD officials also stated that timelines have been adversely affected for some action items because staff have been reassigned to work on higher-priority responsibilities, such as moving staff from their assigned duties to work on efforts to reduce the backlog of security plans under review. ISCD officials also told us that some dates have been extended because the division is awaiting actions within ISCD or by NPPD or IP.

Action Plan Performance Measures Could Help Gauge Progress

ISCD, through its action plan, appears to be heading in the right direction toward addressing the challenges identified, but it is too early to tell if the action plan is having the desired effect because (1) the division has only recently completed some action items and continues to work on completing more than half of the others, some of which entail long-term changes, and (2) ISCD has not developed an approach for measuring the results of its efforts. ISCD officials told us that they had not yet begun to plan or develop any measures, metrics, or other documentation focused on measuring the impact of the action plan on overall CFATS implementation because they plan to wait until corrective action on all items has been completed before they can determine the impact of the plan on the CFATS program. For the near term, ISCD officials stated that they plan to assess at a high level the impact of the action plan on CFATS program implementation by comparing ISCD’s performance rates and metrics pre-action plan implementation and post-action plan implementation. However, because ISCD will not be completing some action items until 2014, it will be difficult for ISCD officials to obtain a complete understanding of the impact of the plan on the program using this comparison only.

Now that ISCD has begun to take action to address the challenges identified, ISCD managers may be missing an opportunity to measure the effects or results of some of the actions taken thus far, particularly actions that are either in the early stages of implementation or are in the formative stages. Measuring results associated with particular action items would be consistent with Standards for Internal Control in the Federal Government, which calls for the establishment and review of performance measures and indicators to monitor activities and compare actual performance with planned or expected results throughout the organization and analyze significant differences. We recognize that it might not be practical to establish performance measures for all action items, for example; 1 of the 94 items calls for ISCD to initiate the hiring process for an economist. However, other action items may be candidates for performance measurement because they focus on organizational changes or mission-related issues. For example, once ISCD gets approval to move forward with a plan to reorganize, it could develop interim plans and measures to monitor the progress of integrating various functions and use the information to identify barriers, if any, for completing this effort. Likewise, once ISCD makes the decision to revise its site security plan review process, it could develop measures for implementing those revisions and consider what measures might be appropriate for gauging its success in streamlining the process and completing security plan reviews. By looking for opportunities to develop performance measures covering the various action items and developing such measures, ISCD managers would be better positioned to identify any gaps in their efforts to address the challenges and have tools available to measure and monitor performance in the future. ISCD would also have a framework for providing continuity of operations when new managers or staff are hired, managers move from position to position, or as the program changes. Furthermore, ISCD would be better equipped to inform stakeholders of its progress as the organization moves toward resolving the challenges identified in the ISCD memorandum.

ISCD Officials Stated That Almost Half of the Action Items Require Collaboration with or Action by NPPD or IP

According to ISCD officials, almost half of the action items included in the June 2012 action plan either require ISCD to collaborate with NPPD and IP or require NPPD and IP to take action to address the challenges identified in the ISCD memorandum. NPPD, IP, and ISCD officials have been working together to identify solutions to the challenges the memorandum identified and to close pertinent action items.

One of the issues identified in the ISCD memorandum was the level of NPPD and IP communication and support. According to ISCD officials, at the time the program was established, NPPD and IP communication and support were not adequate for the division to implement the CFATS program within the statutory time frames (which was 6 months following the passage of the CFATS statute). Regarding the ISCD memorandum and the action plan, NPPD, IP, and ISCD officials have been working together to identify solutions to these human capital and administrative challenges. According to division officials, 46 of the 94 action items included in the June 2012 action plan require either action by NPPD and IP or collaboration with NPPD and IP. This includes collaborating with NPPD officials representing the NPPD human capital, facilities, and employee and labor relations offices, among others, and with IP’s Directorate of Management Office.that require action by or collaboration with NPPD or IP are complete; 33 of 46 are in progress.

As of June 2012, 13 of the 46 items With regard to completed items, these focused largely on human capital and administrative issues. For example, 1 completed item required ISCD leaders to establish regular meetings with NPPD and IP human capital officials to ensure better communication and visibility on human capital issues. Our discussions with ISCD and NPPD officials confirmed that this action item was closed because meetings covering human capital issues have begun and are held on a weekly and recurring basis. NPPD, IP, and ISCD told us that one of the topics of discussion during the weekly meetings is the hiring of specialists so that the division has assurance that the CFATS reviews and inspection process properly include their expertise. According to these officials, hiring certain types of specialists is a difficult challenge given that ISCD is competing with other organizations, including organizations within DHS, for individuals that possess these specialized skills. These officials also stated that these weekly meetings provide NPPD, IP, and ISCD an opportunity to discuss human capital issues as they come up and ensure that the division’s hiring process runs smoothly. To further assist with ISCD’s hiring efforts, IP officials said that one IP human capital staff member is moving to be co-located with the division with the intent that this co-located staff member will be an important accelerator to the hiring process and help keep ISCD hiring on track. Another related action item required similar meetings between ISCD and NPPD’s Office of Employee and Labor Relations to discuss union-related issues. This item was closed because these NPPD staff members meet weekly with ISCD senior leaders to discuss how the union operates and how they should work with the union, and help them understand and properly address the division’s obligations to the union.

With regard to the 33 of 46 actions items requiring collaboration with NPPD and IP that are in progress, 23 require NPPD or IP to review and approve work completed by ISCD or make policy decisions before the division can list the action item as complete. For example,

Twelve of the 33 action items involve ISCD’s development of the aforementioned realignment plan. As of June 2012, ISCD had forwarded the realignment plan to NPPD and IP for review and was awaiting approval so that the plan could be forwarded to DHS for review and comment.

Another action item requires ISCD to develop a human capital strategic plan. According to the June 2012 action plan, ISCD is waiting for NPPD to release its Human Capital Strategic Plan to finalize this action item and plans to use the guidance provided in the NPPD plan to develop an ISCD Strategic Human Capital Plan.

ISCD continues to work on the remaining 10 of the 33 in-progress action items that require NPPD or IP action or division collaboration with NPPD and IP. According to the June 2012 action plan, completion of these action items is dependent upon ISCD staff completing an internal review of an ISCD-drafted set of standard operating procedures or memorandum, or an analysis of an existing ISCD procedure. Once ISCD finalizes these 10 action items, the outputs are to be forwarded to NPPD and IP for review, comment, and approval, where appropriate.

Additional details on action items that require collaboration with or action by NPPD or IP are considered “for official use only.”

Conclusions

ISCD has identified numerous challenges it has encountered implementing the CFATS program and has developed an action plan that is intended to help address these challenges. This appears to be a step in the right direction as officials continue their efforts to better manage the program and establish a viable process consistent with the statute and the CFATS rule. Because of the scope and breadth of the action plan and given that that many of the action items were recently completed (38 of 94 action items) or are in progress (56 of 94 action items), it is too early to tell whether they will have the effect of helping ISCD overcome and resolve all the problems it has identified. However, ISCD, working with NPPD and IP, may be better positioned to understand and report on its progress by looking for opportunities to measure the effect of efforts to implement key action items, especially since many of the action items are either recently completed or in their formative stages. By developing performance measures, where practical, ISCD, IP, and NPPD would be better equipped to identify any gaps between actual and planned or expected results and take corrective action, where necessary, consistent with Standards for Internal Control in the Federal Government.

Furthermore, ISCD, IP, and NPPD would be better positioned to report on their progress developing a viable CFATS program to key stakeholders, including Congress.

Recommendation for Executive Action

To better ensure that DHS can better understand the effect of its actions as it moves forward with its efforts to address the challenges facing ISCD as it implements the CFATS program, we recommend that the Secretary of Homeland Security direct the Under Secretary for NPPD, the Assistant Secretary for IP, and the Director of ISCD, in conjunction with the development of ISCD’s strategic plan, to look for opportunities, where practical, to measure results of their efforts to implement particular action items, and where performance measures can be developed, periodically monitor these measures and indicators to identify where corrective actions, if any, are needed.

Agency Comments and our Evaluation

We provided a draft of this statement to the Secretary of Homeland Security for review and comment. The Deputy Under Secretary for NPPD and the Assistant Secretary for Infrastructure Protection provided oral comments on July 23, 2012, and stated that NPPD agreed with our recommendation. NPPD officials said that they intend to provide an updated action plan that includes a new action item to “develop metrics for measuring, where practical, results of efforts to implement action plan items, including processes for periodic monitoring and indicators for corrective actions.” The Deputy Under Secretary also noted that these new measures would be in addition to the program metrics NPPD uses to measure the overall progress of the CFATS program.

DHS also provided technical comments, which we incorporated as appropriate.

As agreed with your offices, we will continue to review the CFATS program and review ISCD’s efforts to manage the mission aspects of the program. This will include ISCD efforts to determine chemical facility risk; manage the process used to assess vulnerabilities, review security plans, and perform inspections; and work with owners and operators of high-risk chemical facilities. We expect to report the results of these efforts early in 2013.

Chairman Aderholt, Ranking Member Price, and members of the subcommittee, this completes my prepared statement. I would be happy to respond to any questions you may have at this time.

GAO Contact and Staff Acknowledgements

For information about this statement please contact Stephen L. Caldwell, Director, Homeland Security and Justice, at (202) 512-8777 or CaldwellS@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Other individuals making key contributions include John F. Mortin, Assistant Director; Ellen Wolfe, Analyst-in-Charge; Charles Bausell; Jose Cardenas; Andrew M. Curry; Michele Fejfar; Tracey King; Marvin McGill; Mona E. Nichols-Blake; and Jessica Orr.

Appendix I: Objectives, Scope and Methodology

This statement discusses how the internal Infrastructure Security Compliance Division’s (ISCD) memorandum (the ISCD memorandum) was developed and what challenges were identified, what actions are being taken to address the challenges identified, and the extent to which ISCD’s planned actions and proposed solutions require collaboration with National Protection and Programs Directorate (NPPD) or the Office of Infrastructure Protection (IP).

To determine how the ISCD memorandum was developed and the challenges outlined in the memorandum, we reviewed and analyzed the memorandum to determine the various Chemical Facility Anti-Terrorism Standards (CFATS) program challenges as identified by the memorandum’s author—i.e., the ISCD Director, who was the primary author, in consultation with the Deputy Director. As a part of our analysis, we grouped the challenges into overarching categories—human capital management issues, mission issues, and administrative issues—and used the sub-categories developed by the author of the ISCD memorandum to summarize the types of challenges or problems described in the ISCD memorandum. We also interviewed 14 ISCD senior officials (including the ISCD Director and Deputy Director) to confirm our understanding of the challenges identified, determine how the memorandum was developed, and obtain ISCD officials’ views on what may have created the CFATS program challenges.

To determine what actions ISCD is taking to address the challenges identified in the memorandum, we analyzed and compared the various action plans that were prepared by ISCD senior officials between January 2012 and June 2012. We developed a list of the 94 action items included in the June plan and determined the status of each action item (completed or in progress), the extent to which the ISCD officials responsible for leading efforts for the action item agreed that the action item addressed an existing problem, and the extent to which the activities related to the action item were in progress prior to the ISCD memorandum’s release. Where possible, we obtained and reviewed documentation (e.g., standard operating procedures and ISCD memos) relevant to each action item to support ISCD officials’ views that the status of the action item was accurate and whether the work on the action item was in progress before the development and release of the ISCD memorandum. We also compared the results of our analysis of the action plans and our discussions with program officials with various criteria, including the CFATS law and regulations; Department of Homeland Security (DHS) policies, procedures, and reports; Standards for Internal Control in the Federal Government; and The Standard for Program Management.

To determine the extent to which ISCD’s planned actions and proposed solutions require collaboration with or action by NPPD or IP officials, we interviewed 11 NPPD and 9 IP officials identified by ISCD officials who are to work with ISCD to implement corrective actions. Using the results of these interviews and our analysis of the ISCD memorandum and action plan, we determined the extent to which collaboration among ISCD, NPPD, and IP is required to implement corrective action, if at all. Where available, we obtained and reviewed NPPD, IP, and ISCD documentation (e.g., policies, standard operating procedures, and internal memos) relevant to each action item that requires NPPD or IP support or action in working with ISCD to overcome those challenges.

We identified three limitations that should be considered when using our results. First, ISCD’s memorandum is largely based on the efforts of the ISCD Director in consultation with the ISCD Deputy Director and may not be representative of the views of other senior officials within the CFATS program. Furthermore, the conclusions reached in the memorandum were not obtained by using a formal compliance audit or program review procedures, nor were the assumptions validated. Second, our results are based on the status of the action plan as of June 2012, so these results are valid only up until this point in time. Third, documentary evidence about the development of the CFATS program and the causes for the issues identified in the ISCD memorandum is, for the most part, not available. Program officials did not maintain records of key decisions and the basis for those decisions during the early years of the program. During preliminary discussions, the members of current management team qualified that much of their knowledge about program decisions during the early years of the program is their best guess of what happened and why.

We conducted this performance audit from February 2012 to July 2012 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our analysis based on our audit objectives.

Appendix II: ISCD Organizational Structure within NPPD and IP as of June 2012

This appendix provides the organizational structure used to manage the Chemical Facility Anti-Terrorism Standards program within the Infrastructure Security Compliance Division. ISCD has direct responsibility for implementing DHS’s CFATS rule, including assessing high-risk chemical facilities, promoting collaborative security planning, and ensuring that covered facilities meet DHS’s risk-based performance standards. ISCD is managed by a Director and a Deputy Director and operates five branches that are, among other things, responsible for information technology operations; policy and planning; providing compliance and technical support; inspecting facilities and enforcing CFATS regulatory standards; and managing logistics, administration, and chemical security training. ISCD receives business support from the National Protection and Programs Directorate and the Office of Infrastructure Protection for services related to human capital management and training, budget and finance, and acquisitions and procurement. Figure 5 shows the organizational structure of NPPD, IP, and ISCD.

Appendix III: Summary of ISCD Action Plan by Issue and Subcategory, and Status

This appendix provides a summary of the status and progress of action items grouped by issue and sub-category. The Infrastructure Security Compliance Division is using an action plan to track its progress in addressing the challenges identified in the November 2011 ISCD memorandum prepared by the ISCD Director in consultation with the Deputy Director. The ISCD memorandum was accompanied by an action plan that, according to the authors of the memorandum, was intended to provide solutions to addressing the challenges identified. Table 1 provides an overview of the items in the action plan and their status (completed or in progress) by issue (human capital management, mission issues, and administrative issues) and subcategory.

Related GAO Products

Critical Infrastructure Protection: DHS Could Better Manage Security Surveys and Vulnerability Assessments. GAO-12-378, Washington, D.C.: May 31, 2012.

Critical Infrastructure Protection: DHS Has Taken Action Designed to Identify and Address Overlaps and Gaps in Critical Infrastructure Security Activities. GAO-11-537R. Washington, D.C.: May 19, 2011.

Critical Infrastructure Protection: DHS Efforts to Assess and Promote Resiliency Are Evolving but Program Management Could Be Strengthened. GAO-10-772. Washington, D.C.: September 23, 2010.

Critical Infrastructure Protection: Update to National Infrastructure Protection Plan Includes Increased Emphasis on Risk Management and Resilience. GAO-10-296. Washington, D.C.: March 5, 2010.

The Department of Homeland Security’s (DHS) Critical Infrastructure Protection Cost-Benefit Report. GAO-09-654R. Washington, D.C.: June 26, 2009.

Information Technology: Federal Laws, Regulations, and Mandatory Standards to Securing Private Sector Information Technology Systems and Data in Critical Infrastructure Sectors. GAO-08-1075R. Washington, D.C.: September 16, 2008.

Risk Management: Strengthening the Use of Risk Management Principles in Homeland Security. GAO-08-904T. Washington, D.C.: June 25, 2008.

Critical Infrastructure Protection: Sector Plans Complete and Sector Councils Evolving. GAO-07-1075T. Washington, D.C.: July 12, 2007.

Critical Infrastructure Protection: Sector Plans Complete and Sector Councils Continue to Evolve. GAO-07-706R. Washington, D.C.: July 10, 2007.

Critical Infrastructure: Challenges Remain in Protecting Key Sectors. GAO-07-626T. Washington, D.C.: March 20, 2007.

Homeland Security: Progress Has Been Made to Address the Vulnerabilities Exposed by 9/11, but Continued Federal Action Is Needed to Further Mitigate Security Risks. GAO-07-375. Washington, D.C.: January 24, 2007.

Critical Infrastructure Protection: Progress Coordinating Government and Private Sector Efforts Varies by Sectors’ Characteristics. GAO-07-39. Washington, D.C.: October 16, 2006.

Information Sharing: DHS Should Take Steps to Encourage More Widespread Use of Its Program to Protect and Share Critical Infrastructure Information. GAO-06-383. Washington, D.C.: April 17, 2006.

Risk Management: Further Refinements Needed to Assess Risks and Prioritize Protective Measures at Ports and Other Critical Infrastructure. GAO-06-91. Washington, D.C.: December 15, 2005.

Protection of Chemical and Water Infrastructure: Federal Requirements, Actions of Selected Facilities, and Remaining Challenges. GAO-05-327. Washington, D.C.: March 28, 2005.

This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.