It is DOD policy that installations, property, and personnel shall be protected and that the authority of a DOD commander to take reasonably necessary and lawful measures to maintain law and order and to protect installation personnel and property includes the individuals’ removal from or denial of access to, an installation when those individuals threaten the orderly administration of the installation. The Under Secretary of Defense for Intelligence develops overall security policy, including requirements for the DOD Physical Security Program, and the secretaries of the military departments and heads of DOD components establish policies and procedures to implement the Under Secretary’s policies. Individuals may seek unescorted, escorted, or trusted traveler access to DOD installations. As previously mentioned, this report focuses on individuals seeking unescorted access. Unescorted installation access requires, with limited exceptions, individuals seeking access to establish their identity, be determined fit for access, and establish an acceptable purpose for their presence on the installation. DOD components’ security forces establish the identity of individuals at authorized installation control points by using identification credentials, specifically a DOD-issued common access card or other credentials listed in DOD guidance. DOD’s Identity Matching Engine for Security and Analysis (IMESA), which is maintained by the Under Secretary of Defense for Personnel and Readiness, helps security forces make current fitness-for-access determinations for installations that have PACS that connect to IMESA. IMESA electronically links PACS to federal government (including DOD’s) and local population databases to verify information contained in individuals’ credentials and to search for derogatory information. IMESA continuously vets individuals for fitness- for-access determinations against these authoritative government databases every 24 hours. If derogatory information is found, IMESA is to send an alert to the PACS so that security forces can take appropriate action if and when those individuals next seek access to installations. Individuals without a common access card or another acceptable credential who seek access to installations with PACS are sent through the installations’ visitor control process where security forces are to (1) authenticate the individuals’ identity, (2) establish an acceptable purpose for their presence on the installations, and (3) make fitness-for-access determinations using any derogatory information from authoritative government databases. These databases could include those accessible through IMESA, where available and as applicable. Figure 1 illustrates the process for gaining unescorted access to installations with PACS that connect to IMESA—both for individuals with and without acceptable credentials. DOD components have fielded the following types of PACS at their domestic installations: DBIDS. DMDC developed DBIDS and it is used by the Air Force, the Navy, the Marine Corps, and DLA to control access to their respective installations. DBIDS consists of hardware and software—specifically, computers, servers, badge printers, and handheld identification devices. DBIDS has the capability to electronically connect to authoritative government databases using IMESA. AIE. The Army developed AIE to control access to its installations. AIE consists of hardware and software—specifically, computers, servers, badge printers, and handheld identification devices. AIE also includes additional hardware such as gate arms and automated pedestals where individuals can scan their own credentials. AIE has the capability to electronically connect to authoritative government databases using IMESA. RAPIDGate. RAPIDGate is a legacy system that according to DMDC officials is no longer being fielded to DOD installations and, according to Army officials, as of October 2018 was in use at only four domestic Army installations. RAPIDGate does not have the capability to electronically connect to authoritative government databases. Deployed by DOD in 2014, IMESA verifies enrolled individuals’ information against (1) DOD’s Defense Enrollment Eligibility Reporting System to determine if the credentials have been revoked; (2) the Federal Bureau of Investigation’s National Crime Information Center’s Wanted Persons file to determine if there are records on the individuals for an outstanding felony warrant; (3) the Federal Bureau of Investigation’s Terrorist Screening Database to determine if the individuals are known or suspected terrorists; and (4) the local population database, according to an OUSD(I) official, to determine if credentials issued by installations have been revoked or have expired. Individuals with enrollable credentials are enrolled in IMESA when their credentials are scanned by PACS for the first time. According to DMDC officials, once individuals are enrolled, IMESA continuously vets them against these authoritative government databases every 24 hours and it takes approximately 2 seconds for each individual’s credential to be vetted through IMESA. Figure 2 illustrates the process of using PACS to electronically connect to IMESA to validate individuals’ identity and continuously vet individuals’ fitness for access to DOD installations. The Under Secretary of Defense for Intelligence is responsible for establishing department-wide physical access control standards, procedures, and guidance, consistent with DOD guidance and applicable laws, to include developing processes for establishing the identity of individuals seeking access to installations. The Under Secretary of Defense for Personnel and Readiness is responsible for designing and maintaining IMESA, and establishing and executing a plan to integrate IMESA with PACS at all DOD installations. DMDC is a center within the Office of the Under Secretary of Defense for Personnel and Readiness that provides identity management services and oversees the fielding and maintenance of DBIDS. DOD components issue their own component- and installation-specific requirements for physical access control. These include physical access barrier requirements such as fences, as well as the use of PACS. Each DOD component has designated a program manager to supervise and oversee its physical security program, to include PACS. According to DOD component guidance and officials: The Army Acquisition Corps, Product Manager for Force Protection Systems, is responsible for the procurement and fielding for the Army’s PACS. The Army Office of the Provost Marshal General develops PACS requirements based on DOD and Army policies for the Army’s physical security program. The Commander Navy Installations Command is responsible for the Navy’s PACS. The Air Force Security Forces Center is responsible for the Air Force’s PACS. The Office of the Deputy Chief of Staff for Logistics, Engineering, and Force Protection, Directorate of Security Forces, is responsible for developing service-wide access control policies. The Commander, Marine Corps Installations Command, is responsible for the Marine Corps’ PACS. The Deputy Commandant, Plans, Policies, and Operations establishes policies, sets requirements, and is responsible for the Marine Corps’ Physical Security Program. DLA Information Operations and Installation Support Security and Emergency Services Staff Directors share responsibility for the DLA’s PACS. Additionally, DOD component installation commanders are responsible for the physical security of their installations, including for the use of PACS. OUSD(I) issued a physical security manual in January 2019 that addresses minimum department-wide standards for access to DOD installations. The manual incorporates and cancels Directive-Type Memorandum 09-012, the interim policy for DOD physical access control that was in effect for about 9 years. The manual directs DOD components to, among other things, implement procedures for all populations to gain access to component installations; field electronic PACS at all DOD installations; and fund the continued operation, maintenance, and enhancement of IMESA with additional government data sources. The manual also states that new electronic PACS and existing electronic PACS undergoing significant upgrades (valued at more than 50 percent of replacement cost) must interface with IMESA. Each DOD component had also issued guidance on installation physical access control standards that pre-date the January 2019 physical security manual. For example, DLA Manual 5200.08 Volume 1 identifies DBIDS as DLA’s PACS and requires certain installation commanders to incorporate and maximize the use of electronic credential authentication. In another example, Army Regulation 190-13 assigns installation commanders responsibility for implementing AIE, when available, and states that deviations from the Army AIE standards and specifications are not authorized without written approval from Army headquarters. DOD component officials said that they will update their guidance to incorporate the DOD installation access control standards contained in OUSD(I)’s 2019 physical security manual. To implement these department-wide access control standards, according to OUSD(I) and DOD component officials, each DOD component has fielded or plans to field PACS that connect to IMESA at all their domestic installations. According to DOD component officials, as of February 2019, the Air Force, the Navy, the Marine Corps, and DLA have fielded DBIDS at all of their domestic installations. Specifically, according to DOD component officials, DBIDS is fielded at: 67 Air Force installations 16 Marine Corps installations According to Army officials, as of February 2019, AIE was fielded at 35 of the Army’s domestic installations. The officials stated that the Army currently plans to field AIE at an additional 60 installations by September 2019, and at all of its remaining domestic installations by the end of fiscal year 2021. However, Army officials told us that, at the direction of the Secretary of the Army, AIE is undergoing additional testing and assessment to inform a comparison with DBIDS. The Secretary of the Army is expected to make a decision sometime in summer 2019 on which PACS to field at remaining Army installations. DMDC plans to enhance IMESA’s capabilities to allow for increased information sharing and vetting, and to expand the type of credentials that DBIDS can scan. Specifically, the Under Secretary of Defense for Intelligence has identified additional authoritative government databases that IMESA will connect with to access derogatory information. For example, the Under Secretary of Defense for Intelligence directed the secretaries of the military departments to develop a plan to vet individuals seeking unescorted access to domestic installations for disqualifying derogatory information in additional files within the National Crime Information Center’s database and the Interstate Identification Index by September 30, 2019. According to an OUSD(I) official, IMESA will be able to access two additional National Crime Information Center files by 2020: the National Sexual Offender Registry File and the Violent Persons File. The official also stated that there are plans to connect IMESA to DOD’s Automated Biometric Identification System by 2020. DMDC plans to expand the types of credentials that DBIDS can scan, to include all credentials listed in DOD’s 2019 physical security manual. For example, according to DMDC officials, scheduled enhancements to DBIDS will enable security forces to scan cards and driver’s licenses compliant with the REAL ID Act of 2005 by the end of fiscal year 2019. Moreover, according to DMDC officials, this enhancement will eliminate the time and expense to annually issue and print hundreds of thousands of temporary DBIDS credentials. The officials also stated that DMDC has plans to enable DBIDS handheld devices to read military veterans’ health identification cards, although no time frame for implementation has been set. Army Office of the Provost Marshal General officials told us that AIE can already scan identification cards and driver’s licenses compliant with the REAL ID Act. This capability allows individuals with these credentials to be vetted and enrolled in IMESA in the access control lane without having to go the visitor control center. According to Army officials, this “in-lane” initial vetting and IMESA enrollment takes approximately 30 seconds by checking the National Crime Information Center database and Interstate Identification Index for criminal history and active warrants. Further, these officials told us that the Army has also identified future enhancements to AIE, such as transitioning to a cloud-based version. The officials told us that a cloud-based version of AIE will allow for quicker and more cost- effective fielding because of fewer installation prerequisites and reduced computer hardware requirements. Army officials are also considering other enhancements, such as self-service kiosks and web-based registration options, to streamline and expedite initial visit registrations. The Air Force and DLA monitor their installations’ use of PACS and the Army, the Navy, and the Marine Corps do not. As a part of our work, we conducted numerous site visits to domestic installations to observe the DOD components’ use of PACS, but details concerning our findings associated with these visits are omitted because the information was deemed sensitive by DOD. Air Force and DLA officials stated they routinely collect data on PACS use and the number of credentials scanned at their installations and provide those data to their leadership. Additionally, the Air Force is using these data to brief installation commanders on the risks associated with not using DBIDS at their installations. Army, Navy and Marine Corps officials stated they do not monitor PACS use at their installations because there is not a requirement to do so. Our review of DOD guidance also found no such requirement. DOD component officials emphasized the importance of installation commanders having discretion to make risk-based decisions regarding access control in general, and in deciding when or when not to use PACS. Nevertheless, OUSD(I), Army, Navy, and Marine Corps officials agreed that monitoring installations’ use of PACS would be beneficial and could be readily accomplished without significant cost using existing technology. For example, Army, Navy, and Marine Corps officials stated that their installations could collect monthly scanning data using existing PACS reporting mechanisms to identify below average use and determine if actions are needed to increase use. One OUSD(I) official further stated that, depending on the extent to which installations are not using PACS, changes to guidance might be warranted to require monitoring of the use of PACS. DOD Instruction 5010.40, Managers’ Internal Control Program Procedures directs the Office of the Secretary of Defense and DOD component heads to implement a comprehensive system of internal controls that provides reasonable assurance that programs are operating as intended and to periodically evaluate the effectiveness of those controls. Furthermore, Standards for Internal Control in the Federal Government for performing monitoring activities states that management should monitor and evaluate the results of its internal control systems by obtaining relevant data on a timely basis, and determine appropriate control actions for any identified deficiencies. Because the Army, the Navy, and the Marine Corps do not monitor the use of PACS and because OUSD(I) does not require that they do so, those military services do not know the extent to which PACS are being used at more than 100 installations. Consequently, the military services do not have the data they need to evaluate the effectiveness of PACS and inform risk-based decisions to safeguard personnel and mission– critical, high-value installation assets. Demonstrating the importance of using PACS that connect to IMESA, we note that, according to DMDC, IMESA has identified more than 42,000 instances of individuals who were granted access to a DOD installation and were subsequently issued a felony warrant. Installation security forces call the DMDC helpdesk for assistance in resolving DBIDS technical issues. According to DMDC officials, this helpdesk handles technical issues for more than 100 DMDC applications and programs, including DBIDS, and is staffed 24 hours a day, 7 days a week. DMDC helpdesk staff classify DBIDS technical issues into one of three tiers, based on complexity and the estimated time to resolve an issue. According to DMDC officials, tier I issues tend to be the least complex and typically take the least time to resolve, whereas tier III issues tend to be the most complex and typically take the longest time to resolve. Tier II issues fall between tier I and tier III issues with respect to complexity and anticipated resolution time. Below are examples of issues that are experienced in each tier: Tier I. Unresponsive computer screens, passwords that need to be reset, and relatively simple network printer issues. Tier II. Handheld device battery charging issues, network synchronization issues, and problems installing fingerprint readers. Tier III. Handheld devices not connecting to servers, locked user accounts, and equipment that needs to be replaced. According to DMDC officials, all calls to the helpdesk are initially handled by a tier I customer service representative. The tier I representative triages the issue using DBIDS reference materials, and if he or she is unable to resolve the issue it is passed to a tier II customer service representative. If the tier II representative is unable to resolve the issue using DBIDS reference materials, then, with a supervisor’s review and approval, the call is transferred to the tier III group. The issue is then assigned to either the tier III hardware group or the tier III software/application group, depending on the nature of the technical issue. According to DMDC officials, the tier III hardware group is located in Ashburn, Virginia, and the tier III software/application group is located at DMDC’s offices in Seaside, California. The Army also has instituted a tiered approach for resolving AIE technical issues through its helpdesk. The AIE helpdesk is also staffed 24 hours a day, 7 days a week. Similar to DBIDS, the Army classifies AIE technical issues into one of three tiers, based on complexity and time to resolve. According to Army officials, all Army installation security forces’ calls to the helpdesk are initially handled by a tier I customer service representative who tries to resolve the issue using AIE reference materials. If the tier I representative is unable to resolve the issue, the issue is passed to a tier II field service representative. The field service representative is expected to contact the installation within 24 hours and attempt to resolve the issue by email or phone. If the field service representative is unable to resolve the issue remotely, the representative will make an in-person service visit to attempt to resolve the issue. If the issue cannot be resolved, then the customer service representative classifies the issue as tier III and transfers the issue to AIE system engineers for resolution. According to Army officials, tier III issues are usually Army-wide issues, such as problems associated with software updates. DMDC has collected data on DBIDS technical issues; however, DMDC has not been able to assess its performance due to a lack of performance measures and associated goals. Table 1 shows the number of DBIDS technical issues and the average time it took to resolve them, by tier, from January 2016 through July 2018. Specific details regarding the number of issues and the resolution time were omitted because the information was deemed sensitive by DOD. The Army collects data on AIE technical issues and has developed performance measures and associated goals to assess AIE performance. Specifically, the AIE Reliability Analytics Model tracks real-time information on operational availability with a goal of 100 percent, the number and age of open helpdesk tickets with a goal of resolving tier II issues within 48 hours, and field service representative performance with a goal of a 100 percent closure rate for tier II issues. According to Army officials, the Army is currently developing specific targets for its tier I and tier III technical issues. The Army has used data on AIE technical issues to improve AIE performance. For example, due to the age and number of tickets, the Army analyzed 646 AIE helpdesk tickets generated from October 2017 through February 2018 and determined that the root causes of the most prevalent technical issues were site server and handheld device failures. As a result of its analysis, the Army implemented an AIE software update and has begun fielding a more reliable brand of handheld device to installation security forces. According to Army officials, AIE operational availability has increased and technical issues are resolved more quickly since the AIE Reliability Analytics Model came online in September 2017. For example, from September 2017 through August 2018, AIE’s operational availability increased from 93 percent to 98 percent and the average ticket age for all tiers decreased by 33 percent. Increased AIE operational availability allows for increased continuous vetting of individuals seeking access to Army installations. Army officials at all levels have access to the model, and the Army Product Manager for Force Protection Systems sends weekly emails to Army leadership highlighting AIE performance achievements and challenges. We have previously reported, that by tracking performance and developing performance measures, agencies can better evaluate whether they are making progress and achieving their goals. Further, to fully address challenges agencies must be able to demonstrate progress achieved through corrective actions, which is possible through the reporting of performance measures. Characteristics of effective performance measures include having baseline or trend data, setting measurable program goals, and establishing time frames for achieving goals. Program goals communicate what results the agency seeks and allow agencies to assess or demonstrate the degree to which those desired results are achieved. Both performance measures and goals give managers crucial information to identify gaps in program performance and plan any needed improvements. Although user agreements between DMDC and the DOD components state that DMDC will provide helpdesk and maintenance support, the agreements do not include performance measures and associated goals regarding DBIDS’ operational availability and the timely resolution of technical issues. DMDC officials acknowledged that performance measures and associated goals would likely reduce the time it takes to resolve DBIDS technical issues, particularly for tier II and tier III issues. However, until DMDC develops performance measures and goals, its ability to systematically address the underlying issues negatively affecting DBIDS’ operational availability is hindered. Although according to DOD officials DOD has fielded or plans to field PACS that connect to IMESA at all domestic installations, only the Air Force and DLA have monitored PACS use at their installations. The Army, the Navy, and the Marine Corps at more than 100 installations have not monitored the use of PACs because, as stated by officials, there is not a requirement to do so. As a result, these components do not have the data necessary to evaluate PACS effectiveness and inform risk-based decisions regarding PACS use to safeguard personnel and mission- critical, high-value installation assets. Further, DOD component and installation officials told us about their dissatisfaction with the time it takes to resolve DBIDS’ technical issues. Although the Army has developed performance measures and associated goals for its helpdesk that have improved the ability to resolve technical issues and overall AIE operational availability, DMDC has not. Without such performance measures and associated goals, DMDC is unable to systematically evaluate how well DBIDS is performing and address underlying issues negatively affecting DBIDS’ operational availability. We are making the following five recommendations to the Department of Defense: The Secretary of Defense should ensure that the Under Secretary of Defense for Intelligence requires that DOD components (including the military departments and DLA) monitor the use of PACS at their installations. (Recommendation 1) The Secretary of the Army should ensure that the Office of Provost Marshal General monitors the use of PACS at Army installations. (Recommendation 2) The Secretary of the Navy should ensure that the Commander, Navy Installations Command, monitors the use of PACS at Navy installations. (Recommendation 3) The Secretary of the Navy, in coordination with the Commandant of the Marine Corps, should ensure that the Commander, Marine Corps Installations Command, monitors the use of PACS at Marine Corps installations. (Recommendation 4) The Secretary of Defense should ensure that the Under Secretary of Defense for Personnel and Readiness develops appropriate performance measures and associated goals for the timely resolution of DBIDS technical issues to facilitate improved PACS performance. (Recommendation 5) We provided a draft of this report to DOD for comment. In its written comments, reproduced in appendix II, DOD concurred with our five recommendations and identified actions that it was taking or planned to take to implement our recommendations. Regarding our second recommendation, DOD concurred with that recommendation to monitor the use of PACS at Army installations, and on the basis of the department’s written comments we modified the recommendation to indicate that the Army Office of the Provost Marshal General is responsible for monitoring the use of PACS at Army installations. DOD also provided technical comments, which we incorporated as appropriate. We are sending copies of this report to the appropriate congressional committees, the Secretary of Defense, and the Under Secretary of Defense for Intelligence. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-9627 or maurerd@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III. In this report we (1) describe actions the Department of Defense (DOD) has taken to develop guidance on physical access to domestic installations and to field physical access control systems (PACS) at these installations, (2) evaluate the extent to which DOD components have monitored the use of fielded PACS at these installations, and (3) evaluate the extent to which DOD has implemented an approach for addressing PACS technical issues and assessing associated performance. This report is a public version of a sensitive report that we issued on May 31, 2019. The sensitive report included an objective related to the extent to which security forces at various DOD domestic installations used fielded PACS. DOD deemed a significant portion of the information related to this objective to be sensitive, necessitating protection from public disclosure. This public report omits information related to our observations of PACS use at these installations and the risks associated with not using PACS. As a result of this omission, we updated the wording of the second objective to focus on DOD components’ efforts to monitor the use of fielded PACS at installations. Although the second objective and the information associated with it in this public report is more limited, we relied on the same methodology to support our findings and the excluded information does not impact our recommendations. The first and third objectives in this report are the same as in the sensitive report and use the same methodology as in the sensitive report. DOD deemed some of the detailed information presented in conjunction with the third objective to be sensitive, necessitating protection from public disclosure. As a result, this public report omits specific details regarding the technical issues of PACs. This report focuses on physical access controls at authorized access control points at DOD’s domestic installations that are owned and operated by the Army, the Navy, the Air Force, the Marine Corps, and the Defense Logistics Agency (DLA). We did not consider actions DOD has taken to prevent unauthorized access to its domestic installations by means such as tunneling under or climbing over perimeter barriers. For objective one, we analyzed key Office of the Under Secretary of Defense for Intelligence (OUSD(I)) and DOD component policies outlining physical access control requirements. The key guidance documents we analyzed are listed in table 2. Additionally, we interviewed officials from OUSD(I), the Joint Staff, each of the DOD components, and the U.S. Northern Command to discuss the guidance documents and any efforts to update, revise, or draft new guidance on the use of installation PACS. We also reviewed DOD component documentation and interviewed OUSD(I) and DOD component officials to determine the extent to which PACS was fielded at domestic installations and to identify ongoing efforts to field PACS at additional domestic installations. Finally, we interviewed DOD officials to identify any planned future enhancements to PACS and the Identify Matching Engine for Security and Analysis (IMESA). For our second objective, we focused on individuals seeking unescorted access to DOD domestic installations. We reviewed and analyzed OUSD(I), DOD component, and installation-specific guidance on the use and monitoring of PACS. We conducted site visits to six domestic installations to meet with installation command and security force officials to discuss their experiences using PACS and to observe their use of PACS. We then compared the guidance and our observations with Standards for Internal Control in the Federal Government for monitoring activities, which states that management should obtain data on a timely basis so that they can be used for effective monitoring. Although findings from these six installations are not generalizable to all DOD domestic installations, they are illustrative of how PACS are used, and more generally, how installation access is controlled. In selecting the six installations to visit we considered installation ownership to ensure that we included an installation from each DOD component, geographic proximity among installations, and the type of PACS used by the installation. We also visited an installation where no PACS was installed. We limited our site selection to active-duty installations in the continental United States. Based on this methodology we visited Fort Stewart, Georgia; Moody Air Force Base, Georgia; Naval Station Mayport, Florida; Marine Corps Support Facility Blount Island, Florida; Tobyhanna Army Depot, Pennsylvania; and DLA Distribution Center Susquehanna, Pennsylvania. For our third objective, we reviewed DOD user agreements to determine the support agreement terms, requirements, and responsibilities for addressing PACS technical issues. We analyzed DOD component data on the number and type of Defense Biometric Identification System (DBIDS) helpdesk technical issues reported from January 2016 through July 2018, and compared the data with provisions in the user agreements that discuss the PACS helpdesk. We also compared the steps the Army and DMDC have taken or planned to address helpdesk technical issues with Standards for Internal Control in the Federal Government for developing performance measures, which states that management should establish performance measures and indicators. We interviewed officials from DOD components and the installations we visited to discuss their experiences with PACS helpdesks, and their views on the performance and reliability of PACS. We assessed the reliability of the helpdesk technical issue data by interviewing knowledgeable officials about the data and by testing the raw data to determine the accuracy of the summary data provided by DOD. Additionally, we collected and analyzed the raw data to determine whether calculations were made correctly. We determined that the data were sufficiently reliable for our understanding the number and types of PACS technical issues. To address our three reporting objectives, we met with officials from the DOD organizations listed in table 3. We conducted this performance audit from February 2018 to August 2019 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. We subsequently worked with DOD from July 2019 to August 2019 to prepare this public version of the original sensitive report. This public version was also prepared in accordance with these standards. In addition to the contact name above, GAO staff who made key contributions on this report include Brian Lepore, Director (retired); Jason Bair, Acting Director; Marc Schwartz, Assistant Director; Shawn Arbogast, Analyst-in-Charge; Jamilah Moon; Richard Hung; Mae Jones; Amie Lesser; Serena Lo; Amber Lopez Roberts; and Carter Stevens.

Summary: In November 2009, an Army officer killed or wounded 45 people at Fort Hood, Texas; 4 years later in September 2013, a Navy contractor killed or wounded 16 people at the Washington Navy Yard in Washington, D.C. Independent reviews conducted in the aftermath of these shootings identified physical access control weaknesses at DOD installations. The conference report accompanying the National Defense Authorization Act for Fiscal Year 2018 contained a provision for GAO to assess DOD's installation access control efforts. GAO (1) described actions DOD has taken to develop guidance on physical access to domestic installations and to field PACS at these installations, (2) evaluated the extent to which DOD has monitored the use of fielded PACS at these installations, and (3) evaluated the extent to which DOD has implemented an approach for addressing PACS technical issues and assessing associated performance. GAO analyzed DOD guidance on physical access control requirements, and visited installations to discuss with installation command and security force officials their experiences using PACS. This is a public version of a sensitive report that GAO issued in May 2019. Information that DOD deemed sensitive has been omitted. The Department of Defense (DOD) has issued guidance on accessing its domestic installations and strengthening physical access control systems (PACS)—used to scan credentials to authenticate the identity and authorize individuals to access DOD installations. Specifically, DOD has recently issued guidance directing the fielding of PACS and has fielded or plans to field such systems at domestic installations. The Defense Manpower Data Center (DMDC) developed the PACS used by the Air Force, the Navy, the Marine Corps, and the Defense Logistics Agency. The Army developed its own PACS. Both types of PACS electronically connect to DOD's Identity Matching Engine for Security and Analysis (IMESA). IMESA accesses authoritative government databases to determine an individual's fitness for access (i.e., whether an individual is likely a risk to an installation or its occupants), and continually vets this fitness for subsequent visits (see fig.). The Air Force and DLA have monitored their installations' use of PACS, but the Army, the Navy, and the Marine Corps have not. Army, Navy, and Marine Corps installation officials stated that they do not monitor PACS use at their installations because there is no requirement to do so. Because the Army, the Navy, and the Marine Corps do not monitor PACS use and DOD does not require that they do so, those military services do not have the data they need to evaluate the effectiveness of PACS and make informed risk-based decisions to safeguard personnel and mission-critical, high-value installation assets. DOD, Army, Navy, and Marine Corps officials agreed that monitoring installations' use of PACS would be beneficial and could be readily accomplished without significant cost using existing technology. The Army and DMDC have used a tiered approach and established helpdesks to address PACS technical issues. The Army has established performance measures and goals to assess its approach, which has improved the ability to resolve technical issues. DMDC, however, does not have performance measures and goals, and thus lacks the information needed to evaluate its PACS' performance and address issues negatively affecting operational availability. GAO made five recommendations, including that DOD monitor installations' use of PACS and develop appropriate performance measures and goals for resolving technical issues to improve PACS performance. DOD concurred with GAO's recommendations.