Transportation Security: TSA Has Taken Actions to Address Transportation Security Acquisition Reform Act Requirements
Released: 2016-02-17T00:00:00

Letter

Background

As a DHS component, TSA follows the department’s policies and procedures for managing its acquisition programs. DHS has established policies and procedures for acquisition management, test and evaluation, and resource allocation. The department uses these policies and procedures to deliver systems that are intended to close critical capability gaps and enable DHS to execute its missions and achieve its goals. DHS’s policies govern TSA’s acquisition programs and are primarily set forth in DHS Acquisition Management Directive 102-01 (AD 102). DHS acquisition policy establishes that an acquisition decision authority shall review the program through the acquisition life cycle phases. Under this directive, an important aspect of an acquisition decision authority’s review and approval of acquisition programs is to ensure that key acquisition documents are completed, including (1) a life cycle cost estimate, which provides an exhaustive and structured accounting of all resources and associated cost elements required to develop, produce, deploy, and sustain a program, and (2) the acquisition program baseline, which establishes a program’s cost, schedule, and performance parameters. When an acquisition program exceeds cost, schedule, or performance thresholds, it is considered to be in breach.

TSA’s acquisition policies, which supplement DHS policies, generally designate roles and responsibilities and identify the procedures that TSA is to use to implement the requirements in DHS policies. For example, a TSA policy designates an official to ensure TSA’s acquisition programs comply with AD 102, including the review and approval of key acquisition program management documents and determining required acquisition documentation for TSA programs. In addition, a TSA policy guide provides the procedures that TSA is to use to meet the acquisition review and reporting requirements defined in AD 102.

TSA Has Generally Addressed TSARA Requirements

TSA Policies and Procedures Address TSARA’s Requirements for Justifying Acquisitions, Establishing Baselines, Managing Inventory, and Consistency with the FAR

Justifying Acquisitions

TSA has policies and procedures that address TSARA’s requirements for justifying acquisitions, including a security-related technology acquisition. TSA had implemented most of these procedures prior to TSARA’s enactment because they were required by existing DHS and TSA policy. For acquisition justifications, TSARA provides that before TSA implements any security-related technology acquisition the agency must, in accordance with DHS policies and directives, conduct an analysis to determine whether the acquisition is justified, or whether the benefits exceed the cost of the acquisition. TSA’s policies and procedures address this requirement. One change resulting from TSARA is the requirement that TSA notify Congress at least 30 days preceding contract awards for new security-related technology acquisitions exceeding $30 million, which TSA addressed by developing new procedures. See appendix I for our detailed analysis on the status of TSA’s efforts to implement all TSARA requirements.

TSA policies and procedures address TSARA provisions related to justifying acquisitions by requiring the development and approval of specific acquisition documents, including a concept of operations and an analysis of alternatives, prior to the implementation of an acquisition. The concept of operations is to include identifying scenarios of transportation security risk and assessing how the use of the proposed acquisition would help improve transportation security. The analysis of alternatives is to include identifying different security solutions, including technology and non-technology solutions, and an analysis of the operational effectiveness, cost, and benefits of each viable solution.

Regarding the requirement that congressional notification be made in advance of obtaining acquisitions of more than $30 million, TSA amended its policies to include the 30-day notification for contracts exceeding $30 million awarded after TSARA’s enactment. TSA also developed a template for a notification letter to Congress that is to include a certification by the TSA Administrator. Consistent with TSARA, TSA is to provide 5-day notice for contract awards that exceed $30 million to facilitate a rapid response if there is a known or suspected imminent threat to transportation security. TSA officials stated they will continue to provide 5-day notice for all individual task order awards or delivery order awards exceeding $1 million or more based on policies in effect prior to TSARA’s enactment. According to TSA officials, TSA has not yet awarded a contract for security-related technology in excess of $30 million since TSARA’s enactment. These officials also said that there have been no acquisitions related to a known or suspected imminent threat to transportation security that would require TSA to immediately notify Congress since TSARA’s enactment.

Establishing Acquisition Baselines

TSA has policies and procedures in place that address TSARA’s requirements to establish acquisition baselines and review whether acquisitions are meeting these requirements. These policies and procedures were largely established prior to TSARA’s enactment. For example, TSA acquisition policies require that TSA prepare an acquisition program baseline, a risk management plan, and the acquisition program office staffing requirements before obtaining an acquisition. According to TSARA, TSA must report a breach if there is a cost overrun of more than 10 percent, a delay in actual or planned schedule for delivery of more than 180 days, or a failure to meet any performance milestone that directly affects security effectiveness.

TSA’s TSARA Implementation Strategy Memorandum addresses TSARA’s requirements for reporting breaches to Congress. Specifically, the memorandum designates the Office of Acquisition as being responsible for implementing TSARA breach requirements and includes procedures that outline the steps TSA should take to notify DHS and Congress about breaches. According to TSA’s TSARA Implementation Strategy Memorandum, TSA had existing policies that require breach memorandums and remediation plans when breaches occur. The procedures state that in the event of a breach, TSA will provide a report to Congress that includes the cause and type of breach and a corrective action plan. In addition, TSA officials have briefed acquisition program staff about TSARA’s breach notification requirement changes. Prior to TSARA’s enactment, TSA followed DHS’s acquisition policies that defines breaches against an acquisition program baseline as performance failures, schedule delays, or cost overruns of up to 15 percent, and did not mandate reporting breaches to congressional committees. As required by TSARA, TSA established procedures to notify Congress within 30 days of schedule delays, cost overruns, or performance failures constituting a breach against acquisition program baselines. As of December 2015, TSA reported that it had not experienced such breaches in any existing acquisitions since TSARA’s enactment.

Managing Inventory

TSA’s policies and procedures address TSARA requirements for managing inventory related to, among other things, (1) using existing units before procuring more equipment; (2) establishing policies and procedures to track the location, use, and quantity of security-related equipment in inventory; and (3) providing for the exception from using just-in-time logistics, a process that involves delivering equipment directly from manufacturers to airports to avoid the need to warehouse equipment.

For example, TSA’s Security Equipment Management Manual describes the policies and procedures that require TSA to use equipment in its inventory if, for example, an airport opens a new terminal or it recapitalizes security-related technology at the end of its life cycles. Additionally, the current TSA system tracks the location, utilization status, and quantity of security-related equipment in inventory. Further, TSA’s policies and procedures describe TSA’s system of internal controls in place prior to TSARA’s enactment to conduct reviews, which require reporting and following up on corrective actions. TSA’s Security Equipment Management Manual provides for two exemptions from just- in-time logistics that are applicable if just-in-time logistics would (1) inhibit planning needed for large-scale equipment delivery to airports or other facilities or (2) reduce TSA’s ability to respond to a terrorist threat.

Executing Responsibilities under TSARA Consistent with the FAR and Departmental Policies

In accordance with TSARA, TSA must execute its acquisition-related responsibilities in a manner consistent with and not duplicative of, the FAR and DHS policies and directives. TSA policy documents state that TSA is required to ensure that its policies and directives are in accordance with the FAR and DHS acquisition and inventory policies and procedures. According to TSA’s TSARA Implementation Strategy Memorandum, TSA was able to address this requirement. For example, TSA formed a working group, chaired by TSA Executive Secretariat staff, as part of an effort to ensure that TSA implemented TSARA in a manner that was consistent with the FAR and DHS policies and directives. DHS officials further reported that TSA’s actions towards implementation of TSARA requirements is part of DHS’s Acquisition Review Board process and has not led to any duplication or inconsistency with the FAR or AD 102.

TSA Developed and Submitted Its Technology Investment Plan and a Small Business Report Generally in Accordance with TSARA

Technology Investment Plan

TSA submitted a Strategic Five-Year Technology Investment Plan (the Plan) to Congress that generally addresses TSARA-mandated elements. For example, the Plan that TSA submitted to Congress identifies capability gaps and security-related technology acquisition needs and procedures. Specifically, the Plan describes TSA’s test, evaluation, modeling, and simulation capabilities, and identifies security- related technologies that are at or near the end of their life cycles. In addition, the Plan identifies TSA’s efforts to provide the private sector with greater predictability and clarity about TSA’s security-related technology needs and acquisition procedures by sharing testing documents and plans. TSA also took steps to ensure that the Plan adhered to TSARA by (1) consulting with DHS officials and an advisory committee, (2) obtaining approval of the Secretary of Homeland Security prior to publishing the Plan, (3) incorporating private sector input on the Plan, and (4) identifying the nongovernment persons who contributed to writing the Plan.

Small Business Report

TSARA required TSA to submit a report to congressional committees on TSA’s performance record in meeting its published small business contracting goals during fiscal year 2014. In April 2015, TSA reported for fiscal year 2014 that it fell 1.5 percent short of its small business contracting goal of 23 percent, and 1.6 percent short of its Historically Underutilized Business Zones (HUBZone) program goal of 3 percent of its total contracts. To meet its small business contracting goal, TSA would have had to award an additional $22 million in contracts to small businesses of its $1.5 billion in total contracts. According to TSA officials, small businesses’ limited ability to support security-related technology acquisition and TSA’s existing large scale prime contract awards to large businesses for human resources and information technology are part of the challenges that it faces in meeting its small business goals.

TSARA provides that if the small business contracting goals are not met, or if the agency’s performance is below the published DHS small business contracting goals, TSA’s report is to include a list of challenges that contributed to TSA’s performance and an action plan, prepared after consultation with other federal departments and agencies. The report submitted by TSA includes an action plan for integrating small business concerns into the acquisition planning procedures and enhancing outreach to disabled, women-owned and HUBZone businesses. TSA’s small business officials also said that they attend monthly meetings with officials from other DHS components’ small business units and conduct outreach events with small businesses. To develop the action plan, TSA did not consult with the Secretary of Defense and the heads of federal departments and agencies that met their small business goals as required by TSARA. However, TSA officials said that they met with the Department of Defense Office of Small Business Programs after they developed the action plan and the agency plans to fully comply with TSARA’s small business requirements in the future.

DHS and TSA Officials Report That It Is Too Early to Determine Whether Efforts to Implement TSARA Will Result in Any Efficiencies, Cost Savings, or Delays

DHS and TSA officials reported that to date TSA has not identified any efficiencies, cost savings, or delays from its implementation of TSARA. TSA officials further stated that because many of their current policies and procedures that met the provisions of the law were in place prior to TSARA’s enactment, it was unlikely for TSARA to result in major cost savings, efficiencies, or delays. TSA officials reported that they recently developed a mechanism to track its progress in implementing follow-on actions identified in the Plan, such as ongoing stakeholder engagement, as well as to track progress and identify challenges and best practices in implementing TSARA requirements to help update the Plan.

Agency Comments and Our Evaluation

We provided a draft of this report to DHS for review and comment. DHS did not provide formal comments but provided technical comments from TSA which we incorporated as appropriate.

We are sending copies of this report to the appropriate congressional committees and the Secretary of Homeland Security. In addition, the report is available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact me at (202) 512-7141 or groverj@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix II.

Appendix I: Status of TSA Efforts to Address TSARA Requirements

In the following tables, we identify the status of Transportation Security Administration (TSA) efforts to address requirements of the Transportation Security Acquisition Reform Act (TSARA).

Appendix II: GAO Contact and Staff Acknowledgments

GAO Contact

Jennifer A. Grover, (202) 512-7141 or groverj@gao.gov.

Staff Acknowledgments

In addition to the contact named above, Glenn Davis (Assistant Director), Nima Patel Edwards (Analyst-in-Charge), David Alexander, Rodney Bacigalupo, Richard Hung, Thomas Lombardi, Luis E. Rodriguez, Tovah Rom, Carley Shinault, and Edith Sohna made key contributions to this report.