The Coast Guard owns or leases more than 20,000 shore facilities consisting of various types of buildings and structures. According to Coast Guard guidance, a building is generally defined as a fully enclosed structure that is affixed to the ground, in which personnel work or live, or where equipment is stored. A structure is generally defined as any other construction affixed to the ground that does not meet the definition of a building. The Coast Guard’s shore infrastructure is organized into 13 asset types, known as asset lines. Table 1 provides information on 11 of these asset lines, including examples, numbers of assets, and their replacement value as of 2018. We reported in February 2019 that the Coast Guard faced recapitalization, new construction, and deferred maintenance backlogs for its shore infrastructure totaling at least $2.6 billion as of 2018 and that its backlogs increased by $300 million since fiscal year 2012. Moreover, according to the Coast Guard Civil Engineering program’s 2018 annual report, about 46 percent of the Coast Guard’s shore infrastructure was beyond its overall service life. In 2018, the Coast Guard rated its overall shore infrastructure condition as a C- based on criteria it derived from standards developed by the American Society of Civil Engineers. In addition, some asset lines such as the industrial asset line, whose assets are generally mission-critical, were rated lower. Table 2 shows information about Coast Guard asset lines, including the rate at which the Coast Guard reported that these assets were functioning past their service life, and the condition grades assigned by the Coast Guard for fiscal year 2018. According to Coast Guard guidance, the Office of Civil Engineering and the Shore Infrastructure Logistics Center each play a role in managing the Coast Guard’s infrastructure by assessing risks and helping to mitigate damage from natural disasters or other events. The Office of Civil Engineering is responsible for setting Coast Guard-wide civil engineering policy, which includes facility planning, design, construction, maintenance, and disposal. The Shore Infrastructure Logistics Center is to establish project priorities for the acquisition, programmed depot maintenance, major repair, and modification of shore facilities. This center is also responsible for implementing the Coast Guard’s shore infrastructure policies. According to its guidance, the Coast Guard makes procurement, construction, and improvements funding decisions for its shore infrastructure through enterprise-level planning boards that meet twice a year. These planning boards are to prioritize Coast Guard shore infrastructure needs based on expected appropriations and other prioritization factors or considerations, such as damage caused by natural disasters or the Coast Guard’s need to construct new shore infrastructure or recapitalize existing facilities. The boards are responsible for evaluating potential shore infrastructure projects that have been assessed, ranked, and recommended by Coast Guard managers of various asset lines. For example, aviation asset line managers may recommend to the planning boards aviation-related shore infrastructure projects, such as the recapitalization of runways, landing areas, and hangars. According to the National Academies, climate change poses serious risks to many of the physical and ecological systems on which society depends, although the exact details cannot be predicted with certainty. Moreover, the effects and costs of extreme weather events, such as floods and droughts, are expected to increase in significance as they become more common and intense because of climate change. For example, the National Oceanic and Atmospheric Administration (NOAA) has reported that eight of the 10 costliest tropical cyclones in U.S. history occurred in recent years—from 2005 to 2017. DOD documented seven effects commonly associated with climate change and their potential effects on its infrastructure and operations (see table 3). Although the Coast Guard operates on a smaller scale, it maintains many of the same types of infrastructure as DOD, and these infrastructure are also situated in coastal and riverine locations, and thus subject to the same potential effects from extreme weather events. For example, Coast Guard facilities along the East and Gulf coasts of the United States are vulnerable to hurricanes—which NOAA projects will increase in frequency and severity because of climate change—and may cause flooding or wind damage to Coast Guard infrastructure. Coast Guard infrastructure is also vulnerable to natural disasters that are not associated with climate change. For example, Coast Guard facilities situated on the West Coast, Hawaii and Alaska, are located on or near historic earthquake fault lines. As a result, this infrastructure is more likely to be damaged by earthquakes than infrastructure located elsewhere in the country, according to the Coast Guard. According to Coast Guard officials, it can take months and sometimes years to repair or replace Coast Guard facilities damaged by severe natural disasters. For example, as shown in Figure 1, Coast Guard facilities at Station Port Aransas in Texas suffered significant damage during Hurricane Harvey in 2017. As of April 2019, the Coast Guard was working to demolish these damaged facilities so they could be replaced by one facility that is resilient to hurricanes. DHS established its Critical Infrastructure Risk Management Framework to guide critical infrastructure owners and operators, from both the public and private sector, in investing limited resources to protect critical infrastructure. As shown in Figure 2, the framework consists of five steps that involve (1) setting goals and objectives, (2) identifying infrastructure, (3) assessing and analyzing risk, (4) implementing risk management activities, and (5) measuring the effectiveness of actions taken to address identified risks. According to DHS, agency decision makers can use this framework to prioritize investments, develop plans, and allocate resources for critical infrastructure in a risk-informed way. The framework is based on risk management activities, which call for cost-effective use of resources by taking protective actions that offer the greatest mitigation of risk for any given expenditure. According to the NIPP, a risk management approach that aligns with the five key steps can help guide organizational decision making and prioritize actions to more effectively achieve desired outcomes. Since 2005, the Coast Guard has taken actions to improve the resilience of at least 15 storm-damaged shore facilities and has rebuilt them to new standards largely by using supplemental appropriations provided for this purpose. The Coast Guard has also developed new guidance to increase the likelihood that new or recapitalized buildings will withstand natural disasters and follows updated state and local building codes, which a senior Coast Guard official told us led to more resilient buildings, thus limiting risks to Coast Guard personnel and operations. In 2015, the Coast Guard’s Civil Engineering program initiated a formal assessment of owned and occupied Coast Guard buildings to determine which were vulnerable to 10 natural disasters, which, according to agency officials, it aims to complete in 2025. Since 2005, the Coast Guard has taken actions to improve the resilience of its shore infrastructure, largely by using supplemental appropriations for rebuilding facilities damaged by major storms. Specifically, from December 2005 through June 2019, the Coast Guard was appropriated about $2 billion in supplemental funds to, among other things, rebuild or relocate 15 facilities damaged by hurricanes. During this time, the Coast Guard has relocated facilities further inland or to higher ground, upgraded facilities to be more resilient, and designed new facilities with features to protect them from natural disasters. The 2016 and 2017 hurricane seasons were particularly destructive, and the Coast Guard received $719 million in supplemental funding to restore facilities damaged by Hurricanes Matthew, Harvey, Irma, and Maria. Figure 3 below shows Coast Guard shore infrastructure, and associated replacement values, located along the East and Southeast coasts of the United States and the general paths of selected hurricanes in those regions since 2005. The Coast Guard has used supplemental funding to rebuild or relocate at least 15 damaged facilities to enhance their resilience. To improve the resilience of its facilities when rebuilding after hurricanes, Coast Guard officials reported that they generally either relocated the facility inland for better protection from extreme weather or modified the facility to be more resilient by elevating it to protect it from storm surge and flooding. For example: Station Houston, Texas. After this station was damaged by Hurricane Ike in 2008, the Coast Guard determined that this station’s boathouse could not be built above the local floodplain and still meet mission requirements. As a result, the Coast Guard took steps to protect the boathouse from future water damage by using water resistant materials in its construction, elevating its electrical and telecommunications systems above the flood plain, and placing the heating, ventilation, and air conditioning systems on the roof of the building. Sector Houston-Galveston, Texas. After being damaged by Hurricane Ike in 2008, this regional command facility was relocated further inland to provide the new facility with greater protection from extreme weather. It was also designed to withstand wind speeds of up to 115 miles per hour. Station Sandy Hook, New Jersey. After this station was damaged by Hurricane Sandy in 2012, the old building was demolished and replaced on the same site with a facility that was designed to be more resilient. The station’s first floor was constructed with openings to allow flood waters to pass beneath the station. Station Sabine Pass, Texas. Following damage by Hurricane Ike in 2008, the Coast Guard rebuilt this station in 2013 to better withstand floods and high winds (see fig. 4). The new station’s first floor was elevated to a height that exceeds the projected depth of a 100-year flood to protect station equipment. The station was also designed to resist wind speeds up to 130 miles per hour—sufficient to withstand a Category III hurricane. The Coast Guard has also developed new guidance reflecting higher building standards, and follows updated state and local building codes which a senior Coast Guard official told us led to more resilient buildings. In February 2017, the Coast Guard’s Civil Engineering program issued engineering planning guidance intended to increase the likelihood that new or recapitalized buildings would withstand natural disasters and that the design of these buildings would minimize risks to Coast Guard operations and personnel, among other things. This new guidance contains the following requirements: All new permanent, regularly occupied buildings will either be located at least 2 feet above the Federal Emergency Management Agency’s (FEMA) 100-year base flood elevation or meet the level of the 500- year base flood elevation for the proposed site location. To account for storm surge, sea level rise, or periodic flooding, buildings may also be constructed above this elevation as necessary. To ensure operational continuity and safety after a flood event, critical building systems—such as utility and communications systems—are to be located at least 3 feet above the 100-year base flood elevation. Each site will be evaluated for vulnerability to natural hazards, such as earthquakes, tornadoes, and wildfires. This evaluation will identify risk to Coast Guard operations and personnel. A senior Coast Guard official testified to Congress in November 2017 that Coast Guard buildings rebuilt after being damaged by Hurricane Ike in 2008 suffered minimal damage from Hurricanes Harvey and Irma. The official also said that the resilience of these buildings resulted from the recapitalization efforts that made them more storm-resilient and allowed them to align the buildings with modern building codes and standards. Further, according to Coast Guard civil engineering officials, units impacted by Hurricanes Harvey, Irma and Maria—which had been recapitalized to resilient standards—returned to full mission capability within 2 to 3 days and, in some instances, avoided damage or a loss of mission capability as a result of more resilient construction. For example, operations at Sector Houston-Galveston, which supports a wide range of Coast Guard missions, were not interrupted during Hurricane Harvey, allowing it to serve as the primary federal response hub during this disaster. A senior official from the Coast Guard Facilities Design and Construction Center told us that state and local building codes, which have been updated as a result of lessons learned from natural disasters, have also led to more resilient Coast Guard buildings because the Coast Guard is required to align its facilities standards with these codes. For example, according to this official, Florida updated its building codes after Hurricane Andrew in 1992, which resulted in more resilient buildings in this state. In December 2018, the Coast Guard Civil Engineering program issued updated planning guidance for reconstructing facilities damaged by Hurricanes Matthew, Harvey, Irma, and Maria in 2016 and 2017. According to this guidance, new and renovated facilities are to incorporate resilient construction techniques including, but not limited to, hurricane resistant construction and design, and infrastructure resiliency. These facilities are to have the ability to return to full operations after an event, minimizing any major reconstruction and long-term mission impact. In addition, when the Coast Guard builds a new facility or renovates an existing one that directly supports Coast Guard natural disaster response efforts, that facility is to be built to a higher resiliency level to increase the likelihood that it will remain operational during a natural disaster. In 2015, the Coast Guard’s Civil Engineering program initiated a formal vulnerability assessment of owned and occupied Coast Guard buildings, and according to Coast Guard officials they aim to complete this assessment in 2025. The Coast Guard calls this assessment the Shore Infrastructure Vulnerability Assessment. According to Coast Guard documentation, its focus was to determine the vulnerability of these buildings and Coast Guard personnel to natural disasters. Further, the assessment results are intended to assist with contingency planning by identifying which Coast Guard facilities are likely to remain operational after a natural disaster. According to its documentation, this vulnerability assessment is to be completed in two phases. During Phase I, completed in 2018, the Coast Guard analyzed 3,214 buildings, or approximately 16 percent of its infrastructure, for vulnerabilities to disasters such as floods, earthquakes, and hurricanes. To conduct its analysis, Coast Guard officials analyzed the vulnerability of these buildings to 10 natural disasters using information from other government agencies and professional organizations. For example, the Coast Guard assessed its vulnerability to flooding using FEMA, National Weather Service information, state sources and websites. This analysis identified Coast Guard-wide infrastructure vulnerabilities to coastal risks such as shoreline loss, coastal erosion and earthquakes, as well as tsunami risks on the West Coast of the United States, Alaska, Guam, and Hawaii, and immediate and serious flood risks in Puerto Rico and the Gulf and East Coasts. The Phase I report recommended that Coast Guard units and contingency planners consider these vulnerabilities when preparing contingency plans or making capital investments in Coast Guard facilities. Although the Shore Infrastructure Vulnerability Assessment Phase I report identified multiple vulnerabilities to sixty-eight percent of the assessed infrastructure, Coast Guard Civil Engineering program officials told us they were unable to conclusively determine whether approximately 1,500 assessed buildings were vulnerable to hurricane winds, earthquakes, or tornadoes—leading officials to conclude that they needed to conduct further structural analysis. Accordingly, Coast Guard Civil Engineering program officials initiated plans for Phase II of the assessment, which involves more detailed structural analyses of 1,500 buildings to determine whether they can withstand either earthquakes or tornado and hurricane winds, depending on the building. Since earthquakes strike with essentially no warning, unlike hurricanes and tornadoes, Coast Guard Civil Engineering program officials told us that the Coast Guard considered them to be a greater threat to its personnel and infrastructure. Accordingly, the Coast Guard decided that Phase II of the assessment would prioritize structural analyses for buildings it believes to be more susceptible to damage from earthquakes. Further, it would prioritize the order in which it assesses these buildings based on how critical the building is to Coast Guard operations, building occupant density, and the overall age and condition of the building. The Shore Infrastructure Vulnerability Assessment Phase II analysis began in September 2018 with a contract for about $700,000 to determine if 15 buildings at multiple Coast Guard sites are vulnerable to earthquakes. According to the contract, these assessments are to be completed in October 2021. While the Coast Guard has taken steps to improve the resilience of its shore infrastructure by rebuilding storm damaged facilities and initiating a vulnerability assessment, its overarching processes to improve shore infrastructure resilience are not fully aligned with the five steps of the DHS Critical Infrastructure Risk Management Framework. As previously mentioned, DHS established this framework to guide both public and private resource investment decisions for protecting critical infrastructure. Its five steps include (1) setting goals and objectives, (2) identifying infrastructure, (3) assessing and analyzing risk, (4) implementing risk management activities, and (5) measuring the effectiveness of actions taken to address identified risks. According to the first step of the DHS Critical Infrastructure Risk Management Framework, organizations should define specific goals for what they intend to accomplish and establish objectives to help them achieve the goals (see text box). Organizations that establish broad strategic goals for risk management can also benefit from translating these goals into specific, measurable objectives to assess the extent to which its actions actually reduce risk (see text box). DHS Critical Infrastructure Risk Management Framework—Step 1 Organizations should define specific outcomes, conditions, end points, or performance targets that collectively describe an effective and desired risk management posture. By defining risk management goals and expressing them in terms of the objectives and outcomes the organization intends to accomplish, stakeholders, including those at all levels of government and the private sector, would be better able to tailor their risk management programs and activities to address infrastructure resilience needs. Our review of four key Coast Guard documents related to managing its shore infrastructure showed that some of these documents refer to resilience and identify it as an important factor to its operational success. However, none of the documents we reviewed identified a measurable goal or objective for improving shore infrastructure resilience. Instead, the documents either include goals related to management of the shore infrastructure program, or include no goals at all. Specifically: The Coast Guard Shore Infrastructure Strategic Plan for 2017-2021 includes what it describes as performance and foundational goals, including a foundational goal for improving resilience, contingency preparedness, and response to natural hazards. However, the plan does not link this foundational goal to a specific objective and performance target that could guide Coast Guard actions to improve shore infrastructure resilience. For example, an objective could be to increase the percentage of mission critical buildings that are within or above base flood elevations by a certain date, and annual targets could be established to assess progress toward this goal. The Coast Guard issued its agency-wide strategic plan in November 2018 which states that resilient shore infrastructure is directly connected to Coast Guard operational readiness and successful mission execution. The plan further stated that to meet its operational needs, the Coast Guard will prioritize the repair or replacement of degraded shore infrastructure that negatively affects operations or hinders workforce readiness. However, this plan does not identify the shore infrastructure resilience goals the Coast Guard hopes to achieve or any objectives to measure progress toward these goals. Moreover, this plan does not include goals or measures to guide such prioritization. In February 2019, we reported that Coast Guard Engineering program officials were not able to provide documents showing how they had directed field units to prioritize the repair or replacement of degraded shore infrastructure. In July 2019, the Coast Guard was able to provide one planning document that was specifically created to help manage its response to Hurricanes Harvey, Irma, Maria, and Matthew that included guidance on improving infrastructure resilience. Based on our interviews with Coast Guard engineering program and Shore Infrastructure Logistics Center officials, the Coast Guard is still in the initial stages of incorporating resilience plans and objectives into the shore infrastructure program. In July 2019, Civil Engineering program officials told us that the Coast Guard had updated its Civil Engineering Strategic Plan to direct its personnel to develop a communication plan and resource strategy for infrastructure resiliency projects based on the Shore Infrastructure Vulnerability Assessment’s Phase II results. The Coast Guard provided us with a copy of this plan in August 2019, and while this document includes two measures that can be useful to account for actions taken, it did not include goals or performance targets to guide the prioritization of resiliency projects, and Civil Engineering program officials were not able to provide documents showing how they had made decisions to incorporate resilience into the repair and replacement of degraded shore infrastructure. Coast Guard officials also reported that they had initiated a separate resilience effort in 2018 at the direction of DHS, which required all operational components to participate in the development of the 2018 DHS Resilience Framework, and to develop individual component resilience plans to guide its approach to resilience planning. According to the Coast Guard, their plan was submitted to DHS in August 2019. When we discussed this effort with Coast Guard officials, they were able to provide few details about their efforts and no documentation about their progress to date. We also discussed this effort with DHS officials managing the process, but they were not able to tell us whether this new endeavor will align with or compete for resources with ongoing Coast Guard assessment processes. According to the second step of the DHS Critical Infrastructure Risk Management Framework, organizations should identify infrastructure assets that are critical for security and national preparedness (see text box). DHS Critical Infrastructure Risk Management Framework—Step 2 Organizations should identify assets, systems, and networks that contribute to critical functionality, and collect information pertinent to risk management, including analysis of dependencies and interdependencies. Through this step, it is important to identify assets that are both nationally significant and those that may not be significant on a national level but are, nonetheless, important to state, local, or regional critical infrastructure security and resilience and national preparedness efforts. We found that the Coast Guard identified many occupied buildings that may be important to operations and assessed their vulnerability through its Shore Infrastructure Vulnerability Assessment process, but this process did not identify all shore infrastructure assets that are critical to its missions or screen them for all vulnerabilities. Specifically, through the Shore Infrastructure Vulnerability Assessment Phase I, the Coast Guard identified and screened all occupied Coast Guard buildings over 1,000 gross square feet—about 16 percent of all Coast Guard infrastructure— for vulnerabilities to 10 natural disasters. The analysis found that approximately 68 percent (2,200) of the 3,214 buildings it assessed are vulnerable to certain natural disasters. However, the initial screening did not include other mission critical infrastructure, as the framework recommends, even though the loss of such structures could also impact its ability to carry out its missions. For example, the Coast Guard did not include structures in Phase I of the Shore Infrastructure Vulnerability Assessment, such as aircraft runways, and therefore has not determined whether such structures are vulnerable to flooding following a severe storm, or which ones are at greatest risk for such flooding. Phase II is also not expected to include these assets, as Civil Engineering program officials stated it is not intended to identify any additional infrastructure. Rather, in Phase II for example, Civil Engineering program officials will determine whether roughly 45 percent of the buildings on the West Coast that were screened in Phase I, are vulnerable to earthquakes, as the results of Phase I were inconclusive for these buildings. This DHS framework step recommends that stakeholders identify assets and networks that contribute to critical functionality and analyze their dependencies and interdependencies. The Coast Guard has two such measures to help identify the criticality of its shore infrastructure for conducting its missions. The Mission Essentiality Index measure classifies shore infrastructure assets into one of four tiers based on the degree to which they are mission critical. Similarly, the Mission Dependency Index scores building criticality based on how quickly the loss of utilities would impact operations, and how difficult it would be to relocate operations in advance of a natural disaster. Coast Guard officials told us they used Mission Dependency Index scores to help identify which buildings to include first during Phase II of the Shore Infrastructure Vulnerability Assessment. However, they did not consider either of these measures when they conducted the initial screening for Phase I, which prevented operational risks from being fully considered. Using this information at the beginning of its Shore Infrastructure Vulnerability Assessment process could have provided the Coast Guard with useful information to help it assess its critical infrastructure, as the DHS framework recommends. Coast Guard officials stated in July 2019 that they believe that the mission critical assets collocated with the assessed buildings would have the same vulnerabilities given their geographic proximity. While this may be the case for structures that are collocated with assessed buildings, unoccupied structures (such as piers and runways) may be built with different requirements and building codes; consequently, they may differ in the extent of their vulnerabilities to the same natural hazard threats. Furthermore, the Shore Infrastructure Vulnerability Assessment Phase I report did not demonstrate the extent to which Coast Guard structure are collocated with the occupied buildings the Coast Guard analyzed. They also told us that the Coast Guard has not tracked the performance of its infrastructure, particularly piers and runways, because it has always been able to find alternative means to continue operations. However, by identifying all of its mission critical infrastructure that may be vulnerable to natural disasters, the Coast Guard would be more fully informed of the possible scenarios that could affect their capabilities in the event of a natural disaster, and which infrastructure facilities are most likely to be affected. Such information could also better position the Coast Guard to plan for and execute mission operations from alternative locations if needed. According to the third step of the DHS Critical Infrastructure Risk Management Framework, organizations should assess and analyze risks to understand infrastructure vulnerabilities and threats, as well as the potential consequences of an incident or known vulnerabilities (see text box). DHS Critical Infrastructure Risk Management Framework—Step 3 Organizations should assess and analyze risks, taking into consideration the potential direct and indirect consequences of an incident, known vulnerabilities to various potential threats or hazards, and general or specific threat information. Risks can be assessed in terms of their likelihood and potential consequences. This step supports an assessment strategy that results in sound, scenario-based consequence and vulnerability estimates, as well as an assessment of the likelihood that the given threat or hazard will occur. Organizations should consider potential harm to operations and impacts on mission in executing a critical infrastructure risk management approach. The Shore Infrastructure Vulnerability Assessment process is the Coast Guard’s main action to formally assess and analyze its shore infrastructure, according to Civil Engineering program officials. This process was intended to help contingency planners anticipate which infrastructure is likely to remain operational following a natural disaster, and assist with operational and future capital investment decisions, according to a senior Coast Guard official. We found that through this process, the Coast Guard assessed and analyzed certain elements of risk for its shore infrastructure, such as potential vulnerabilities of certain infrastructure to multiple natural disasters—information which could help inform its processes to improve resilience. However, the Coast Guard has not identified the potential direct and indirect consequences posed by natural disasters on its infrastructure, or the consequences associated with its operational risks—that is, risks affecting its ability to carry out its missions if shore infrastructure is damaged. Specifically: Through Phase I of the Shore Infrastructure Vulnerability Assessment process, the Coast Guard determined that its personnel and operations are generally more vulnerable to certain threats. For example, Phase I determined that about 880 assessed buildings may be vulnerable to earthquakes, which according to the Coast Guard, represent approximately 45 percent of its assessed buildings on the West Coast. Similarly, it also identified about 800 buildings that may be vulnerable to tornadoes and approximately 1,000 buildings vulnerable to hurricanes. However, the Coast Guard has not analyzed the potential consequences of damage to the infrastructure that it identified as vulnerable. For example, it has not assessed the economic losses associated with potential catastrophic disasters, such as costs for rebuilding assets or taking other actions to respond to and recover from natural disasters. Additionally, the Coast Guard has not assessed long-term costs that could result from environmental damage to its property caused by these events. Without also determining consequence information, the Coast Guard is not positioned to provide decision makers with the type of information the DHS Critical Infrastructure Risk Management Framework recommends for making cost effective risk management decisions. As the Coast Guard begins to conduct Phase II, it is unclear whether it will include information on potential consequences in its assessment. The Coast Guard initiated Phase II in September 2018 and intends to assess about 1,500 buildings for vulnerabilities to natural disasters by 2025. Coast Guard officials stated that Phase II would entail following civil engineering standards for conducting the assessments. These assessments are expected to entail on-site contractor assessments of about 1,500 buildings. In 2018, the first year of Phase II, the Coast Guard contracted for an assessment of 15 buildings, and Shore Infrastructure Logistics Center officials said they expect this assessment to be completed in 2021. According to Civil Engineering program officials, the purpose of Phase II is to understand whether 1,500 buildings identified in Phase I as inconclusive are indeed vulnerable to certain natural hazards. This information can help Coast Guard officials better understand the likelihood that vulnerabilities exist, but the plan for Phase II does not support an assessment strategy that results in sound, scenario-based consequence and vulnerability estimates, as well as an assessment of the likelihood that the given threat or hazard will occur or the operational risks that may be affected, as this step recommends. According to the fourth step of the DHS Critical Infrastructure Risk Management Framework, organizations should implement risk management activities by evaluating risk reduction methods that consider countermeasures that result in controlling, accepting, transferring, or avoiding risks (see text box). DHS Critical Infrastructure Risk Management Framework—Step 4 Organizations should evaluate risk reduction methods by considering countermeasures that result in controlling, accepting, transferring, or avoiding risks. Approaches can include prevention, protection, mitigation, response, and recovery activities. Ideally, the selection and implementation of appropriate risk management activities helps to focus planning, increase coordination, and support effective resource allocation and incident management decisions. We found that the Coast Guard identified thousands of infrastructure vulnerabilities to natural disasters through its Shore Infrastructure Vulnerability Assessment process, and has contracted for more detailed structural analyses of the buildings with vulnerabilities that were deemed inconclusive with respect to seismic and windstorm threats. However, the Coast Guard has not taken action to mitigate risks for those buildings with confirmed vulnerabilities. Our analysis of Phase I results showed that of the 3,214 buildings the Coast Guard analyzed, 32 percent had two or more identified vulnerabilities and an average Mission Dependency Index of 34, and 10 percent had three or more identified vulnerabilities with an average Mission Dependency Index of 38. The average Mission Dependency Index score for all 3,214 buildings was 30. These results indicate that the Coast Guard has data on buildings that may be more vulnerable than others and have relatively greater mission value. Despite the availability of this information, the Coast Guard has not taken steps to develop a mitigation strategy for these buildings, as the DHS Critical Infrastructure Risk Management Framework recommends. Coast Guard officials stated that they had sufficient information from Phase I about how their facilities would perform against eight of the ten disasters, so they elected to further study those buildings with inconclusive results on earthquakes and wind. According to the DHS Critical Infrastructure Risk Management Framework, risk assessments are to inform the selection and implementation of mitigation activities and the establishment of risk management priorities for organizations. Effective risk management activities are comprehensive, coordinated, and cost-effective. The framework further states that risk management decisions should be made based on an analysis of the costs and other impacts, as well as the projected benefits of identified courses of action—including the no-action alternative if a risk is considered to be effectively managed already. However, it is unclear whether and to what extent the civil engineering staff and other decision makers consider the Shore Infrastructure Vulnerability Assessment results as part of the planning board processes where decisions are made about which infrastructure projects will be prioritized for funding. Civil Engineering program officials told us that hazard mitigation strategies will be employed for buildings determined to be vulnerable, as the Coast Guard plans and executes major construction and recapitalization projects through its existing planning board processes. They also provided us with updated planning board guidance, issued in March 2019, which directs Coast Guard officials to consider improving shore infrastructure resilience as a significant factor in the decision-making process. They also noted that the Coast Guard’s updated policy described earlier requires compliance with higher building standards, which helps ensure that newly constructed facilities will be more resilient than the ones they replace. Shore Infrastructure Logistics Center officials, however, were unable to provide us with documentation showing whether and to what extent risk reduction methods were considered during past planning board processes. Furthermore, since they are not required to incorporate Shore Infrastructure Vulnerability Assessment results into future planning board decisions, it is unclear whether future Coast Guard planning boards will be focused on addressing the most critical risks, or will consider resilience as a factor when choosing projects to fund. This is of particular concern since in at least 5 cases, the Coast Guard’s backlog list for Procurement, Construction and Improvement projects includes boat stations that the Coast Guard had previously identified as suitable for closure. According to step five of the DHS Critical Infrastructure Risk Management Framework, organizations should use metrics and other evaluation procedures to measure progress and assess the effectiveness of efforts to secure and strengthen the resilience of critical infrastructure (see text box). DHS Critical Infrastructure Risk Management Framework—Step 5 Organizations should use metrics and other evaluation procedures to measure progress and assess the effectiveness of efforts to secure and strengthen the resilience of critical infrastructure. They are an important step in the critical infrastructure risk management process to enable assessment of improvements in critical infrastructure security and resilience. They provide a basis for accountability, document actual performance, promote effective management and provide a feedback mechanism for informed decision making. We found that the Coast Guard has identified some specific measures, but they are too narrow to measure the agency’s progress or assess the effectiveness of its efforts to improve its shore infrastructure resilience. For example, the Coast Guard established metrics to count the number and dollar value of certain projects to improve resilience, such as seismic improvement or floodplain adaptation projects, that the Civil Engineering program plans and accomplishes each year. While these measures can be useful to account for actions taken and funds invested in these particular actions, they do not indicate whether the resilience of Coast Guard shore infrastructure has improved or is improving as a result of the actions being measured. Coast Guard officials told us that they have not used the DHS Critical Infrastructure Risk Management Framework to guide actions to improve the resilience of its critical infrastructure because they have instead focused on implementing the Shore Infrastructure Vulnerability Assessment to provide them information they intend to use to influence resource investment decisions in the future. However, without a complete understanding of the vulnerabilities of its infrastructure and the consequences to Coast Guard operations if it is damaged, the Coast Guard risks questionable recapitalization investments for its resilience when selecting projects to fund from its $2.6 billion maintenance backlogs. Given that the five steps of the DHS Critical Infrastructure Risk Management Framework are intended to guide decision making and prioritize actions to more effectively achieve desired outcomes, having processes that fully align with the five key steps of the framework would provide greater assurance that the Coast Guard is investing its shore infrastructure resources to manage potential damage and expenses from extreme weather events in the future. The Coast Guard’s shore infrastructure program includes a range of facilities and structures that are vital to the agency’s ability to fulfill its missions, and it constitutes a significant fiscal commitment that requires ongoing investment to maintain. By nature of their mission and location, many facilities and structures are vulnerable to potentially catastrophic natural disasters that are projected to occur more frequently and have required over $2 billion in supplemental funding over recent years to replace or repair. The Coast Guard faces the difficult decision of determining how best to invest its limited resources in improving the resilience of its shore infrastructure to better manage the costs of repairing or replacing such infrastructure after natural hazards occur. DHS’s Critical Infrastructure Risk Management Framework provides a decision making approach that can help ensure risk-informed resource investments, but the Coast Guard has not fully aligned its processes for improving shore infrastructure resilience with any of the five steps outlined in this framework. The Coast Guard’s Shore Infrastructure Vulnerability Assessment process is the agency’s main approach to understanding shore infrastructure vulnerabilities, but this process is limited in scope and not expected to be completed until at least 2025. For the Coast Guard’s planning board processes, officials were unable to verify that they have consistently considered resilience as a significant factor when selecting projects or that they plan to do so in the future. This is of particular concern given the current condition of Coast Guard shore infrastructure and the existing $2.6 billion backlogs of infrastructure maintenance and recapitalization projects that compete for finite funding. By fully aligning its processes with DHS’s recommended risk management framework for critical infrastructure, the Coast Guard would be better positioned to reduce its future fiscal exposure to the effects of catastrophic natural disasters. The Commandant of the Coast Guard should ensure that the Deputy Commandant for Mission Support implements risk management processes that more fully align with the five key steps outlined in DHS’s Critical Infrastructure Risk Management Framework to better guide agency shore infrastructure investment decisions. This should include (1) setting goals and objectives, (2) identifying critical infrastructure, (3) assessing and analyzing risks and costs, (4) implementing risk management activities, and (5) measuring the effectiveness of actions taken. (Recommendation 1) We provided a draft of this report to DHS for review and comment. In its comments, reproduced in appendix I, DHS concurred with our recommendation. DHS, through the Coast Guard, also provided technical comments, which we incorporated as appropriate. DHS concurred with the intent of our recommendation to formalize its shore infrastructure risk management processes, and stated that it plans to make progress towards implementing GAO’s recommendation concurrently with the development and implementation of its Component Resilience Plan, in accordance with the recently mandated DHS Resilience Framework. It intends to complete these efforts by the end of 2021. The Coast Guard also intends to develop, by July 2020, goals and objectives for measuring the effectiveness of actions taken to identify resilience readiness gaps and resource needs. We will continue to monitor these efforts. We are sending copies of this report to the appropriate congressional committees, the Secretary of the Department of Homeland Security, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-3841 or AndersonN@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix II. Nathan J. Anderson, (202) 512-3841 or andersonn@gao.gov. In addition to the contact above, Dawn Hoff (Assistant Director), Landis Lindsey (Analyst-in-Charge), Michael Armes, John Bauckman, Jason Berman, Chuck Bausell, Rick Cederholm, Kendall Childers, John Crawford, Billy Commons, Andrew Curry, Dominick Dale, Elizabeth Dretsch, Shannon Finnegan, Michele Fejfar, Peter Haderlein, Eric Hauswirth, Susan Hsu, Michael Pinkham, John Mingus, and Jan Montgomery, made key contributions to this report.

Summary: The Coast Guard, within DHS, owns or leases more than 20,000 shore facilities such as piers, boat and air stations, and housing units at over 2,700 locations. This infrastructure is often positioned on coastlines where it is vulnerable to damage from extreme weather. Noting the importance of protecting critical infrastructure from such risks, in 2013 DHS updated its risk management guidance for enhancing infrastructure resilience—which is the ability to prepare and plan for, absorb and recover from, or successfully adapt to adverse events. GAO was asked to review Coast Guard efforts to improve the resilience of its shore infrastructure. This report (1) describes Coast Guard actions to improve shore infrastructure resilience since 2005, and (2) examines the extent to which its processes to improve shore infrastructure resilience follow DHS's key steps for critical infrastructure risk management. GAO reviewed and analyzed Coast Guard guidance and data on assessed infrastructure and interviewed Coast Guard officials. GAO also compared Coast Guard policies, procedures, and actions to manage shore infrastructure against DHS's framework for managing risks to critical infrastructure. Since 2005, the U.S. Coast Guard's main actions to improve resilience have been to repair or rebuild shore infrastructure to higher building standards after it has been damaged by extreme weather events. The Coast Guard has received more than $2 billion in supplemental appropriations since 2005 to improve resilience after severe storms (see figure). The Coast Guard has also developed new guidance requiring that repairs and new construction meet higher building standards to make it more resilient. Further, in 2015, the Coast Guard began an assessment of certain occupied buildings to identify their vulnerabilities to ten natural hazards, such as hurricanes and earthquakes. As of 2018, this assessment covered approximately 16 percent of the Coast Guard's shore infrastructure. The Coast Guard aims to complete the assessment in 2025. Coast Guard processes to improve shore infrastructure resilience do not fully align with the Department of Homeland Security's (DHS) key steps for critical infrastructure risk management. These steps are described in DHS's Critical Infrastructure Risk Management Framework, which recommends that DHS components, among other things, identify critical infrastructure, assess risks, and implement risk management activities. While the Coast Guard has identified some vulnerable shore infrastructure through its ongoing assessment, it has not identified all shore assets that may be vulnerable, such as piers and runways; or assessed operational risks affecting its ability to complete missions with these assets. In addition, the Coast Guard has not taken steps to develop mitigation strategies for buildings already identified as vulnerable. Moreover, Coast Guard data show a growing backlog of at least $2.6 billion in recapitalization, new construction, and deferred maintenance projects that compete for finite funding. However, Coast Guard officials were unable to verify that they have consistently selected projects to also enhance resilience. Coast Guard officials stated that they have not used the DHS framework and have instead focused on implementing their ongoing vulnerability assessment. Fully aligning its processes with the DHS framework would better position the Coast Guard to reduce its future fiscal exposure to the effects of extreme weather events. GAO recommends that the Coast Guard revise its processes for improving shore infrastructure resilience to more fully align with key steps of the DHS critical infrastructure risk management framework. This should include, for example, identifying critical infrastructure, assessing risks, and implementing risk management activities. DHS concurred with our recommendation.