Federal agencies are required to have an occupant emergency program that establishes procedures for safeguarding lives and property during According to ISC, an OEP is a emergencies in their respective facilities.critical component of an effective occupant emergency program. Further, these plans are intended to minimize the risk to personnel, property, and other assets within a facility by providing facility-specific response procedures for occupants to follow. Several federal entities—ISC, GSA, and FPS—play a role in protection policy and programs for GSA-owned and -leased facilities. Established by Executive Order 12977, ISC is an interagency organization chaired by DHS to enhance the quality and effectiveness of security in, and protection of, nonmilitary buildings occupied by federal employees for nonmilitary activities in the United States, among other things.agencies, including FPS and GSA. Under the executive order, ISC was directed to develop policies and standards that govern federal facilities’ physical security efforts. As a part of its government-wide effort to develop physical security standards and improve the protection of federal facilities, it also provides guidance on OEPs. In its 2010 standard, ISC ISC includes members from 53 federal departments and lists 10 elements that should be addressed at a minimum in an OEP, and states that the plan must be reviewed annually. As the federal government’s landlord, GSA designs, builds, manages, and maintains federal facilities. Presidential Policy Directive 21 designates DHS and GSA as cosector-specific agencies for the government facilities sector, 1 of 16 critical infrastructure sectors. In 2002, GSA issued its Occupant Emergency Program Guide to provide step-by-step instructions for agencies to use to meet federal regulatory requirements for OEPs. GSA also served as chair and sponsor of ISC’s working group that developed additional guidance for preparing OEPs. The Homeland Security Act of 2002 transferred FPS from GSA to the newly established DHS in March 2003, and required DHS to protect the buildings, grounds, and property that are under the control and custody of GSA and the persons on the property. As part of an agreement between GSA and DHS, FPS provides law enforcement and related security services for GSA’s approximately 9,600 facilities, which include—but are not limited to—responding to incidents and conducting facility security assessments.inspectors to help FPS identify and evaluate potential risks so that countermeasures can be recommended to help prevent or mitigate risks. FPS inspectors are law enforcement officers and trained security experts who perform facility security assessments and inspections and respond to Facility security assessments are conducted by FPS incidents. FPS also assigns an FSL in accordance with the ISC standard and in coordination with the FSC and GSA representative based on a facility’s cumulative rating on five factors established by ISC (plus an adjustment for intangible factors), as shown in figure 1. According to ISC, a facility’s FSL is a key factor in establishing appropriate physical security measures. Further, while the minimum OEP elements in the ISC 2010 standard apply to all FSL facilities, what is appropriate may vary based on facility characteristics. The federal agencies that occupy federal facilities are responsible for preparing and maintaining OEPs; ISC, GSA, and FPS provide guidance or assistance to the agencies in developing OEPs, and FPS can periodically review OEPs. All 20 facilities we visited had written emergency plans in place, the majority of which reflected ISC’s minimum elements for a facility OEP. The OEPs we reviewed varied in length and content based on a number of factors, such as facility security level. Ensuring that each of the approximately 9,600 GSA-owned and -leased facilities protected by FPS has emergency plans to safely evacuate occupants is a complex undertaking. Each agency occupying a facility is responsible for ensuring the safety of its occupants in that facility. Although no one agency accounts for OEPs across the federal government, ISC, GSA, and FPS each provide guidance on what should be included in a plan. FPS also provides a check that plans are in place as part of its periodic facility security assessments. Federal agencies have designated officials to create and oversee emergency plans and duties for the facilities they occupy. According to federal regulations, designated officials are responsible for developing, In the event of implementing, and maintaining the OEP for the facility.an emergency, the designated official is expected to initiate appropriate action according to the OEP, including the evacuation and relocation of facility occupants. The designated official is also to establish, staff, and train an Occupant Emergency Organization, which is to be composed of employees from within agencies designated to perform the requirements established by the plan. We found that all 20 facilities we visited had assigned designated officials to perform these duties. ISC is responsible for issuing policies and standards on facility protection, such as OEPs, but does not review the extent to which federal facilities have OEPs. As previously mentioned, ISC listed 10 minimum elements in its ISC 2010 standard that an OEP should address. In March 2013, ISC issued Occupant Emergency Programs: An Interagency Security Committee Guide, to further assist department and agency officials as they develop and review their occupant emergency programs, including how to develop OEPs that best fit their individual facility and agency needs. According to ISC officials, the guidance was disseminated via e- mail to the full ISC membership, which includes 53 federal agencies and departments. ISC officials said they rely on agencies located in federal facilities to ensure OEPs are in place and shared several reasons why it would not be feasible for ISC to comprehensively review OEPs. First, according to these officials, ISC decided to use broad guidelines that would allow agencies to develop plans that are suited to the unique characteristics of their facilities. As a result, the guidance does not provide specific standards or metrics against which to compare a facility’s plan. Second, although OEPs are an important part of an overall occupant emergency program, ISC officials said that OEPs are a relatively small part of an agency’s overall emergency and security planning, which may not warrant implementing additional monitoring and data-gathering efforts. Last, ISC officials cited staffing constraints and noted that, per Executive Order 12977, they rely on volunteers from member organizations to carry out the committee’s efforts. GSA also plays a role in coordinating directly with facilities to provide guidance on OEPs and participates in emergency planning efforts. According to GSA officials, its tenant agencies, through their designated officials, are responsible for tracking and reviewing OEPs. Further, designated officials are to represent the government’s interests to public safety and emergency response in conjunction with GSA and other key stakeholders. However, GSA officials said that they will assist agencies with OEPs as requested. GSA officials also told us that they participate on facility security committees and in planning drills and exercises, and can provide GSA and other OEP guidance to their tenants. GSA officials also said that they work with tenants, as well as building owners at leased facilities, to ensure that facilities comply with building safety codes, such as having appropriate exits and fire alarms. Presidential Policy Directive 21 jointly assigns FPS and GSA responsibility for critical infrastructure protection of the government facilities sector. According to a GSA Associate Administrator, there is a need for greater visibility of OEPs. Consequently, GSA and FPS officials told us they have initiated discussions on future collaboration to ensure OEPs are in place and updated at GSA facilities. According to GSA officials, as part of a Joint Strategy for Facility Resilience, GSA and FPS will work collaboratively to develop a platform that could serve as a repository for OEPs, facility security assessments, and other data over the next 2 to 4 years. FPS is responsible for assisting federal agencies with guidance, training, exercises, and drills, and also conducts periodic facility security assessments that include checking OEPs. FPS officials in the three cities we visited said that, when requested, they provide agencies with OEP guidance, which includes an OEP template, and advise the designated and other agency officials regarding an emergency plan that is appropriate for their location and circumstances. According to FPS officials, its OEP template (a Microsoft Word file) can be requested from the DHS and GSA websites and can also be made available to agency officials on a DVD. Of the 20 facilities we visited, officials at 14 reported using FPS guidance or feedback on their OEPs, for example, using the FPS template as a base for their OEPs and officials at 5 facilities reported using their own agency guidance for OEP development. FPS officials in one city we visited reiterated that some agencies have their own emergency coordinators and choose not to use FPS materials. Officials at 1 facility reported not using FPS or other agency guidance for OEP development. FPS also provides evacuation training, including awareness training on active shooter and workplace violence incidents, as well as safety and security.training FPS had provided them, primarily active shooter awareness Officials from 5 of the 20 facilities we visited mentioned specific training, and officials at 1 facility stated that they were planning an active shooter exercise with FPS. Additionally, FPS inspectors in the three locations we visited said they make themselves available to participate in facility exercises and emergency drills, and officials at 11 of the 20 facilities we visited told us that FPS had participated, for example, by providing traffic control services or ensuring all occupants have evacuated. Officials at 5 facilities we visited mentioned that FPS had not consistently participated in drills at their facilities, in one case because FPS had not been invited and in another case because FPS arrived after the drill had been completed. According to FPS officials, FPS participation in exercises and drills can be limited if FPS personnel are not nearby, are on duty responding to actual incidents, or were not given advance notice. FPS inspectors also are to check and answer a series of questions about the facility’s OEP during periodic facility security assessments, including whether or not the facility has a written OEP, and consider whether it addresses the 10 minimum elements for an OEP identified by ISC. FPS’s facility security assessments are to occur periodically, every 3 to 5 years, In July 2011, we reported depending on the security level of the facility. that FPS could not complete security assessments as intended because of limitations in its assessment tool, among other reasons. We recommended that the agency evaluate whether other alternatives for completing security assessments would be more appropriate. DHS agreed with the recommendation and has developed a new facility security assessment tool, the Modified Infrastructure Survey Tool (MIST), which DHS officials said was deployed in April 2012. FPS headquarters officials told us that its agency currently has no national data on which agencies have an OEP, and we previously reported that MIST was not FPS headquarters designed to compare risk across federal facilities.officials said as the agency moves forward with enhancing MIST’s capabilities, it would consider whether it was feasible to add a feature that would allow it to aggregate data across facilities, such as the status of OEPs. According to FPS officials, recommendations about OEPs and evacuation processes, such as suggestions to change assembly points in the event of an evacuation, may be made during facility security assessments. For example, one FPS inspector recommended that 1 facility change its assembly point because he determined that it was too close to the evacuated facility. Although officials at this facility expressed some reluctance in changing the assembly location, the inspector told us that facilities generally implement FPS suggestions. FPS inspectors also said that there have been few examples where agencies did not want to comply. Although agencies do not have to comply with their recommendations on OEPs, FPS inspectors stated that they do have enforcement authority related to life safety issues during an actual emergency event, such as moving occupants to different evacuation locations. Further, FPS headquarters officials said recommendations about OEPs may be made at any time, not just during facility security assessments. All 20 facilities we visited had written OEPs, as required by regulation, which included evacuation procedures. Consistent with the ISC 2010 standard that plans should be reviewed annually, officials at 19 of the 20 facilities we visited reported that they review, and update as needed, their emergency plans on at least an annual basis, and some reported reviewing their plans more frequently. For example, officials at 1 FSL-II facility reported that the OEP program manager reviews the plan on a monthly basis, and officials at a FSL-IV facility said their plan was reviewed quarterly. The OEPs we examined had been reviewed by officials in the past year, except for one. Officials at this FSL-III facility reported that they have an emergency plan in place; however, their OEP had not been annually reviewed, and was last updated in 2004. Officials at that facility said that a revision was currently under way. Officials at all 20 facilities told us they conduct at least one annual evacuation drill, as directed in the ISC 2010 standard, with several officials reporting their facility conducts multiple drills each year. We analyzed the extent to which the selected facilities’ OEPs incorporated elements that should be in an OEP according to the ISC 2010 standard, which outlines 10 minimum elements: 1. purpose and circumstances for activation, 2. command officials and supporting personnel contact information, 3. occupant life safety options (e.g., evacuation, shelter-in-place), 4. local law enforcement and first responder response, 5. special needs individuals (e.g., those with disabilities, or who are 7. special facilities (e.g., child care centers), 8. assembly and accountability, 9. security during and after incident, and 10. training and exercises. We found that 13 of the 20 facilities addressed all of the minimum elements that were applicable; in some of these cases, OEP elements were addressed in other emergency documents, such as supplemental child care OEPs. Seven of the facilities did not address at least one OEP element in the ISC 2010 standard in their OEPs or other documents. That an element was not in the plan or in related documents for 7 facilities does not necessarily indicate potential vulnerabilities for these facilities because other procedures or facility services may address the intent of the OEP element. For example, 6 of the 7 OEPs did not specifically describe security during or after an emergency event. Officials in all six cases identified existing security, such as building security guards, as having responsibility. Officials at 2 facilities reported that they were updating their OEPs after our site visit and would identify existing security in the plans. As another example, at 2 facilities where training or exercises were not included in the OEPs, officials at both facilities (which were housed in leased GSA space) said that building management conducts drills and that they participate. The 2010 standard and 2013 ISC guidance both allow for necessary adjustments to be made to a facility’s emergency plan based on specific requirements or needs. Plans at the 20 facilities we reviewed were unique to each facility, and there were differences in how each element was addressed, as the ISC 2010 standard and 2013 guidance allow. Specific details on how OEP elements are expected to be addressed are not included in ISC’s 2010 standard, which we used to review facility OEPs, or in ISC’s 2013 guidance. ISC officials said that there is so much variability among facilities that it is difficult to identify what would be appropriate for all facilities. For example, in one plan, command official information might include multiple contacts and a detailed list of responsibilities for each official, while another plan refers occupants to security services, which would be responsible for contacting command officials. Appendix II provides other examples of variation in how facilities addressed the 10 minimum elements in the plans we reviewed. We did observe some commonality in the 20 facility OEPs we reviewed, based on facility characteristics such as security level, whether the facility was GSA owned or leased, and occupant characteristics, as shown in table 1. Officials at 14 of 20 facilities in our review identified challenges, and all but one reported responding to challenges they encountered in developing and implementing emergency evacuation procedures. Officials at 6 facilities said that they did not identify any challenges. Half of the officials reporting challenges told us that actual emergency events and exercises helped to identify issues and mitigation steps that allowed their facilities to generally carry out effective emergency evacuations. For example, the majority of officials at facilities we visited in Washington, D.C., who experienced the 2011 earthquake said that because of the lack of earthquake procedures or training, emergency teams could not control employees’ evacuation process. They said that many employees essentially self-evacuated, exposing themselves to hazards such as falling debris and, in one case, evacuated to an unsafe assembly area under an overpass. These officials said that they have since researched proper earthquake procedures, and have revised or are in the process of revising their OEPs accordingly. As shown in figure 2, officials at facilities we visited identified several challenges they addressed. The top three challenges cited by officials at the14 selected facilities that identified challenges were (1) participation (2) knowing which employees are present (9 apathy (10 facilities), facilities), and (3) keeping plan information current (7 facilities). The remaining challenges were cited by 6 or fewer of the selected facilities. Officials at all but 1 facility provided additional detail regarding actions they are taking to mitigate facility evacuation challenges. Officials at that facility reported that the OEP was to be updated, but did not describe how they specifically plan to mitigate OEP challenges they identified. For each of the top three challenges, officials at facilities that cited challenges described some of the actions taken to address those challenges. Employee participation apathy. Officials at 10 of the 20 selected facilities cited apathy as a challenge they encountered, such as employees not participating in or responding quickly to drills; not wanting to stop working or leave the building; not reporting to the assembly area (e.g., going for a coffee break during an evacuation drill); and not volunteering for emergency team responsibilities, such as becoming a floor warden. Officials at 9 of the 10 facilities described a variety of actions to address this challenge, Officials at 5 facilities said that leadership plays a role, such as leading by example, or drawing management or supervisory attention to nonparticipants. For example, at 1 facility, officials said supervisors were notified of the lack of participation in emergency drills and training and asked to emphasize the importance of participation. Officials at another facility indicated that senior leaders lead by example, responding quickly and taking emergency drills and participation seriously to encourage employees to take emergency responsibilities seriously. Officials at 3 facilities said they address apathy by using drills, an awareness campaign, or other efforts to promote participation. At the other 2 facilities where this challenge was identified, officials at 1 facility said they were reviewing challenges and action options, and the other did not provide information on any mitigating activities. Officials at the third facility said that they made efforts to make emergency and evacuation training more interesting and interactive to maintain employee interest and attention, such as implementing a game meant to teach about various emergency situations and proper procedures. Knowing which employees are present (accounting for employees). Officials at 9 of the 20 selected facilities reported encountering this challenge, with employees teleworking or working offsite as a contributing factor. Officials at 8 facilities provided various examples of addressing this challenge. At 6 facilities, officials said they relied on supervisors, managers, and sign-in sheets to keep track of employees. Officials at 2 facilities mentioned using or planning to use technology to account for employees in an emergency situation. One facility is developing an emergency notification system that sends emergency information to as many as 10 different electronic devices to contact an individual and determine the individual’s location. Another facility is planning to use an entry scan system that records who is in the building and can provide a list to take roll at the evacuation rally point to account for employees. At 1 facility, where officials reported they are updating their OEP, efforts to mitigate this challenge were not described. Keeping emergency contact information updated. Officials at 7 of the 20 facilities said that it was an ongoing challenge to keep emergency contacts in the OEP current because of changes in an employee’s contact information or status such as a transfer or retirement. To address this challenge, officials at 6 facilities said they review and update contact information at various points, such as when staff leave; before drills; or on a daily, weekly, monthly, or quarterly basis at different facilities. At one facility, officials said that they rely on tenants to provide notice of personnel changes. At another, an official said that the facility’s technology department was able to align its employee finder database with the agency’s separation database to automatically flag when employees have a change in location or status. Information was not available for 1 facility on any efforts to mitigate this challenge. Officials at facilities we visited reported experiencing and addressing other challenges less frequently such as keeping employees trained, evacuating the public and persons with physical handicaps, communicating about an evacuation, and coordinating with other building tenants. Officials who reported encountering these challenges told us that they had mechanisms in place to mitigate the challenges they encountered, such as the use of hand-held radios for communications, so the challenges were not considered an issue that prevented them from carrying out effective emergency evacuations. Other incidents or situations have also prompted facilities to revise their OEPs or for FPS to evaluate emerging threats and revise its training, as discussed in the examples below. Practice drills. During a practice drill evacuation at 1 facility, it was discovered that the path to the evacuation assembly area was up a steep slope and that some of the employees could not make the climb. The assembly area was subsequently changed and the OEP revised. Emerging threats. FPS headquarters officials stated that recent media coverage of active shooter situations has increased the public’s perception of this threat to facility safety and security. A fatal active shooter incident at 1 facility in Los Angeles prompted the revision of safety and evacuation procedures. FPS headquarters officials said that FPS has developed awareness training courses for how to handle an active shooter situation, and has proactively offered this training to facilities. To identify and help agencies address evacuation or OEP challenges, officials at ISC, GSA, and FPS said that they provide initial guidance regarding the OEP, and may provide additional assistance if requested by facilities or agencies. For example, ISC officials stated that they issued their March 2013 OEP Program Guidance in response to concerns raised by ISC’s members for consistency in OEP guidance. Officials said agencies experiencing a challenge regarding their OEPs (or other issues) can ask ISC for specific help such as one-on-one assistance, or referral to other agency officials that have addressed a similar challenge. Also, ISC officials said a working group can be created to identify solutions to an issue, as was the case in developing the 2013 guidance. As discussed earlier, GSA and FPS have published OEP information, and may provide additional information or training assistance in meeting specific challenges on a case-by-case basis. We provided a draft of this report to DHS and GSA for review and comment. GSA had no comments on the report. DHS provided technical comments, which were incorporated as appropriate. DHS also provided written comments, which are summarized below and reprinted in appendix III. In its written comments, DHS reiterated that OEPs are critical in safely evacuating federal facility occupants in an emergency. DHS noted that GAO recognized the complex roles performed by the ISC, GSA, FPS, and agency officials to ensure that the approximately 9,600 GSA-owned and -leased facilities have an OEP. For instance, DHS cited that ISC establishes standards and guidance for developing OEPs that are responsive to individual facility needs, whereas FPS is responsible for coordinating with and assisting department and agency officials in developing facility OEPs, and providing agencies with evacuation training, among other things. DHS also stated that it is committed to working collaboratively with ISC and GSA to identify and mitigate security-related vulnerabilities at federal facilities. We are sending copies of this report to the Department of Homeland Security, the Administrator of the General Services Administration, selected congressional committees, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. Should you or your staff have any questions concerning this report, please contact Joseph Kirschbaum at (202) 512-9971 or by e-mail at kirschbaumj@gao.gov or Mark Goldstein at (202) 512-2834 or goldsteinm@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix IV. 1. who is responsible for ensuring that federal facilities have occupant emergency plans (OEP) in place and the extent to which selected facilities’ OEPs reflect federal guidance and 2. evacuation challenges, if any, that selected facilities experienced and what actions, if any, they reported taking to address these issues. To describe who is responsible for ensuring that federal facilities have OEPs in place, we reviewed federal laws, regulations, executive orders, and guidance related to the oversight of federal facilities. This included relevant sections of the Homeland Security Act of 2002; the regulations regarding federal property facility management and federal agency requirements for OEPs; Executive Order 12977, establishing the Interagency Security Committee (ISC); and Executive Order 13286, amending it. We reviewed OEP guidance issued by ISC, the Federal Protective Service (FPS), and the General Services Administration (GSA). We also reviewed our previous work on the roles of FPS, GSA, and ISC in protecting federal facilities. We interviewed relevant senior agency officials regarding their agencies’ role in ensuring federal facilities have OEPs in place, including ISC officials in Washington, D.C.; officials from FPS and GSA in their headquarters; and FPS and GSA officials in the three field locations where we conducted site visits to selected federal facilities, as described below. To describe the extent to which the selected facilities’ OEPs reflect federal guidance, we conducted site visits at 20 of the GSA facilities protected by FPS.follows: We selected a nonprobability sample of facilities as We selected three geographically diverse areas with a concentration of GSA facilities from GSA’s top 15 major real estate markets. Specifically, we selected two areas from the top 5 markets in terms of GSA assets (Los Angeles, California, and Washington, D.C.), and one area from a smaller GSA market defined as having fewer than 100 facilities (Kansas City, Missouri). To ensure a subset of facilities would be able to discuss evacuation experiences they have had, we selected 9 facilities total from the three areas that had reported an evacuation incident to an FPS MegaCenter during 2011 or 2012. Each of the four FPS MegaCenters records incidents such as fire alarms, suspicious packages, and evacuation drills that are reported to that center as part of the center’s operations log, with an activity code that can be queried for incidents. Only incidents reported to a MegaCenter are captured, so, for example, if local police respond to a call at a facility and do not call FPS, the incident would not be included in the MegaCenter data. According to discussions with MegaCenter data officials and a review of the data content, we determined that the incident data were reliable for our purposes, as our sample was not intended to be representative of all incidents. We used a list provided by GSA from its Real Estate Across the United States (REXUS) database to select the remaining 11 facilities to provide a mix of owned and leased properties, and a mix of facility security levels. We determined that the REXUS database was reliable for our purposes based on a review of database documents and discussion with relevant GSA officials. See table 2 for a summary of characteristics of the 20 facilities we selected. For all selected facilities, we reviewed the extent to which the OEPs included the 10 minimum elements that should be included based on ISC’s Physical Security Standard (ISC 2010 standard) for federal facilities. For example, 1 element that an OEP should include is information on “Special Needs Individuals (disabled, deaf, etc.).” For each facility in our sample, two team members reviewed the OEP and assessed whether or not each of the elements was addressed. The ISC 2010 standard indicates that the 10 elements should be present; however, it notes that the scope and complexity of the OEP are dependent on the facility’s size, population, and mission, and the standard does not provide a description of, or detail on, what should be included for each element. Further, not all elements may be applicable for a facility, for example, if the facility does not have a child care or other special facility. Because of the general nature of the elements, we assessed whether a particular element was present in a facility’s OEP, not its quality or comprehensiveness. We reviewed additional documents provided by agency officials, such as child care center emergency plans, emergency cards for quick use, and FPS’s facility security assessment protocol, used by FPS inspectors when periodically checking OEPs. We also interviewed GSA property managers and officials from agencies who occupy each facility about the facility’s plan. Further, those officials were those identified by GSA and the tenant agency as most knowledgeable about the OEP, which in some cases was the designated official, and in other cases, the facility official was, for example, a manager involved with facility security. While the findings from our 20 case studies are not generalizable to all GSA-owned and -leased facilities, they provide specific examples of how selected facilities have addressed emergency plan requirements and provide insights from a range of federal facilities. To describe the challenges and evacuation experiences of the 20 selected facilities, we discussed specific evacuation instances with facility and GSA officials, the challenges officials face in planning and executing evacuation plans, and any steps taken to mitigate the challenges. We asked about evacuation challenges in general, and about specific challenges that were identified by a review of the literature and from discussion with FPS. We also asked officials at the facilities we visited about challenges, and they determined whether they perceived an issue to be a challenge or not. Where available, we reviewed after-action reports documenting facility evacuation experiences. We also discussed evacuation experiences and challenges with ISC, GSA, and FPS officials. Our findings regarding what issues presented challenges and how such challenges could be resolved cannot be generalized to all GSA-owned and -leased facilities; however, they provide specific examples of issues encountered and how varying facilities addressed them. We conducted this performance audit from August 2012 to October 2013 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Facility plans we reviewed addressed the ISC minimum 10 elements in a variety of ways, consistent with agency guidance and facility characteristics. Guidance in the ISC 2010 Physical Security Criteria for Federal Facilities notes that an OEP’s scope and complexity will be dependent on a facility’s size, population, and mission. Table 3 presents excerpts from OEPs from the 20 selected facilities we visited in Washington, D.C.; Kansas City, Missouri; and Los Angeles, California; and were selected to show the variation in how plan elements were addressed. Joseph Kirschbaum, 202-512-9971, or kirschbaumj@gao.gov, Mark Goldstein, 202-512-2834, or goldsteinm@gao.gov. In addition to the contacts named above, Leyla Kazaz (Assistant Director), Tammy Conquest (Assistant Director), Dorian Dunbar, Eric Hauswirth, Mary Catherine Hult, Monica Kelly, Tracey King, Erica Miles, Linda Miller, and Kelly Rubin made key contributions to this report.

Summary: Recent emergencies, such as earthquakes in the nation's capital, have raised concerns about how prepared federal agencies are in the 9,600 facilities owned or leased by GSA and protected by the Department of Homeland Security's FPS to safely evacuate occupants in federal buildings. All federal agencies are required to prepare OEPs for their facilities, which describe actions agencies should take to plan for a safe evacuation during an emergency. GAO was asked to provide information on how prepared GSA-owned and -leased facilities are to evacuate occupants during an emergency. This report describes (1) who is responsible for ensuring that federal facilities have OEPs in place and the extent to which selected facilities' OEPs reflect federal guidance, and (2) the evacuation challenges, if any, selected facilities experienced and what actions, if any, they reported taking to address these issues. GAO reviewed federal regulations and guidance on OEPs, including documents from ISC, GSA, and FPS, which develop governmentwide physical security standards and policies, such as minimum elements for OEPs. GAO also reviewed OEPs and interviewed facility officials at 20 GSA-owned and -leased facilities, selected based on geographic dispersion, recent evacuations, and facility security level. While not generalizable to all GSA-owned and -leased facilities the results provided perspectives of varying facilities. DHS written and technical comments were incorporated, as appropriate. GSA did not have any comments. Federal agencies occupying facilities owned or leased by the General Services Administration (GSA) are responsible for preparing and maintaining occupant emergency plans (OEP), with assistance or guidance from the Federal Protective Service (FPS) and others, and the majority of selected federal facilities' OEPs GAO reviewed reflect federal guidance. As required by federal regulations, all 20 selected facilities had OEPs and had designated officials, who are responsible for maintaining OEPs and initiating action according to the OEP in the event of an emergency, including the evacuation of facility occupants. Consistent with federal guidance, officials at 19 of the 20 selected facilities reported that they review and update OEPs at least annually, and officials at 1 facility said they were in the process of updating their OEP. When requested, FPS provides OEP guidance, such as templates to facility officials. Officials at 14 facilities reported using FPS guidance or feedback for their OEPs, officials at 1 facility reported not using FPS guidance, and officials at 5 facilities said they used their own agency's guidance. FPS also checks OEPs during periodic facility security assessments--conducted at least every 3 to 5 years-- to assess overall facility risk. GSA officials said they have a role in coordinating directly with facilities to provide guidance and feedback on OEPs, and to help facility officials plan drills and exercises. To assist agency officials as they develop OEPs that best fit individual facilities and agency needs, the Interagency Security Committee (ISC), a Department of Homeland Security-chaired policy development organization, in April 2010 identified 10 minimum elements, such as exercises or evacuating occupants with special needs, that should be addressed in an OEP. Thirteen of the 20 selected facilities addressed all 10 minimum elements in OEPs or related documents. Seven facilities' OEPs did not address at least 1 of the 10 elements; however, lack of an element does not necessarily indicate potential vulnerabilities for that facility because the intent of the element may be addressed by other procedures or modified based on facility characteristics. For example, evacuation exercises were not included in OEPs for 2 facilities located in leased GSA space; however, officials said they participate in drills conducted by building management. The 20 selected facility OEPs were unique to each facility and how OEPs addressed particular elements. Officials at 14 of 20 facilities identified evacuation challenges. The most frequently cited challenges included employee apathy toward participating in drills, accounting for employees, and keeping contact information updated. Officials at all but one facility, which was updating its OEP, reported various ways they addressed evacuation challenges, including using technology such as entry scan systems and radios to track and communicate with employees and making evacuation training more interesting to employees. Other incidents and emerging threats also prompted officials to change OEPs or evacuation training. For example, during the 2011 Washington, D.C., earthquake, officials at selected facilities in the D.C. area said that the lack of employee training on earthquake procedures may have exposed employees to potential hazards when they self-evacuated. Officials reported revising their OEPs to include procedures for earthquakes. Recent shootings also prompted facility officials to revise their OEPs and participate in FPS awareness training on active shooter incidents. Officials at 6 facilities did not report challenges.