In 2008, we reported that FPS does not use a comprehensive risk management approach that links threats and vulnerabilities to resource requirements. Without a risk management approach that identifies threats and vulnerabilities and the resources required to achieve FPS’s security goals, there is only limited assurance that programs will be prioritized and resources will be allocated to address existing and potential security threats in an efficient and effective manner. FPS uses a facility-by-facility approach to risk management. Under this approach, FPS assumes that all facilities with the same security level have the same risk regardless of their location. For example, a level IV facility in a metropolitan area is generally treated the same as one in a rural area. We also reported in 2008 that FPS’s approach does not include a process for examining comprehensive risk across the entire portfolio of GSA’s facilities. Both our and DHS’s risk management frameworks include processes for assessing comprehensive risk across assets in order to prioritize countermeasures based on the overall needs of the system. FPS’s building-by-building approach, however, prevents it from comprehensively identifying and prioritizing vulnerabilities and making countermeasure recommendations at a strategic level. Over the years we have advocated the use of a risk management approach that links threats and vulnerabilities to resource requirements and allocation. A risk management approach entails a continuous process of managing risk through a series of actions, including setting strategic goals and objectives, assessing risk, allocating resources based on risk, evaluating alternatives, selecting initiatives to undertake, and implementing and monitoring those initiatives. Risk assessment, an important element of a risk management approach, helps decision makers identify and evaluate potential risks so that countermeasures can be designed and implemented to prevent or mitigate the effects of the risks. In response to our recommendations in this area, FPS began developing a new system referred to as the Risk Assessment Management Program (RAMP). This system is designed to be a central database for capturing and managing facility security information, including the risks posed to federal facilities and the countermeasures in place to mitigate risk. FPS also anticipates that RAMP will allow inspectors to obtain information from one electronic source, generate reports automatically, enable FPS to track selected countermeasures throughout their life cycle, address some concerns about the subjectivity inherent in facility security assessments (FSA), and reduce the amount of time inspectors and managers spend on administrative work. FPS designed RAMP so that it will produce risk assessments that are compliant with Interagency Security Committee (ISC) standards, which, among other things, require risk assessment methodologies to be credible, reproducible, and defensible and for FSAs to be done every 3 to 5 years. According to FPS, RAMP is also compatible with the risk management framework set forth by the National Infrastructure Protection Plan (NIPP), and consistent with the business processes outlined in the memorandum of agreement with GSA. According to FPS, RAMP will support all components of the FSA process, including gathering and reviewing building information; conducting and recording interviews; assessing threats, vulnerabilities, and consequences to develop a detailed risk profile; recommending appropriate countermeasures; and producing FSA reports. FPS also plans to use RAMP to track and analyze certain workforce data, contract guard program data, and other performance data, such as the types and definitions of incidents and incident response times. Currently, FPS is in the process of implementing the first phase of RAMP and plans to have it fully implemented by the end of 2011. We are reviewing the design and implementation of RAMP and will provide Congress with a final report next year. We reported in July 2009 and April 2010 that FPS faces challenges in ensuring that many of the 15,000 contract security guards that FPS relies on to help protect federal facilities have the required training and certification to be deployed at federal facilities. We also identified substantial security vulnerabilities related to FPS’s guard program. Each time they tried, in April and May 2009, our investigators successfully passed undetected through security checkpoints monitored by FPS’s guards, with the components for an improvised explosive device concealed on their persons at 10 level IV facilities in four major metropolitan areas. FPS also took a number of immediate actions to address concerns raised about contract guard management in our July 2009 contract guard report. For example, since July 2009, FPS has increased its penetration tests in some regions and the number of guard inspections it conducts at federal facilities in some metropolitan areas. FPS currently requires its inspectors to complete two guard inspections a week at level IV facilities. Prior to this new requirement, FPS did not have a national requirement for guard inspections, and each region we visited had requirements ranging from no inspections to five inspections per month per FPS inspector. FPS is also in the process of providing additional X-ray and magnetometer training in response to our July 2009 testimony. FPS anticipates that guards will be fully trained by the end of 2010. Under FPS’s revised training program, inspectors must receive 30 hours of X-ray and magnetometer training and guards must receive 16 hours. Prior to this revision, guards needed 8 hours of training on X-ray and magnetometer machines. However, despite these changes, we remain concerned about FPS’s oversight of the contract guard program and made recommendations for additional improvements in our April 2010 report. For example, we reported that despite FPS’s recent actions, guards were continuing to neglect or inadequately perform their assigned responsibilities. We also remained concerned that FPS had not acted diligently in ensuring the terms of its guard contract and taken enforcement action when noncompliance occurred. Thus, we recommended, among other things, that FPS identify other approaches that would be cost-beneficial for protecting federal facilities. FPS agreed with this recommendation but has not yet implemented it. We have reported on several issues related to locating FPS within DHS’s Immigration and Customs Enforcement (ICE). For example, we reported in 2008 that some of FPS’s operational and funding challenges stemmed from it being part of ICE. In October 2009, to enable FPS to better focus on its primary facility protection mission, the Secretary of Homeland Security transferred FPS from ICE to the National Protection and Programs Directorate (NPPD). According to DHS, transferring FPS to NPPD will enhance oversight and efficiency while maximizing the department’s overall effectiveness in protecting federal buildings across the country. We are reviewing the transition of FPS into NPPD and will provide Congress with a final report in 2011. FPS has yet to fully ensure that its recent move to an inspector-based workforce does not hinder its ability to protect federal facilities. In 2007, FPS essentially eliminated its police officer position and moved to an all- inspector-based workforce. FPS also decided to place more emphasis on physical security activities, such as completing FSAs, and less emphasis on law enforcement activities, such as proactive patrol. We reported in 2008 that these changes may have contributed to diminished security and increases in inspectors’ workload. Specifically, we found that when FPS is not providing proactive patrol at some federal facilities, there is an increased potential for illegal entry and other criminal activity. For example, in one city we visited, a deceased individual had been found in a vacant GSA facility that was not regularly patrolled by FPS. Under its inspector-based workforce approach, FPS will rely more on local police departments to handle crime and protection issues at federal facilities. However, at about 400 federal facilities across the United States, the federal government has exclusive jurisdiction, and it is unclear if local police have the authority to respond to incidents inside those facilities. Additionally, FPS has not entered into any memorandums of agreement for increased law enforcement assistance at federal facilities. In most of the cities we visited, local law enforcement officials said they would not enter into any agreements with FPS that involve increased responsibility for protecting federal facilities because of liability concerns, existing shortages of staff, and the need to respond to crime in their cities that would make it difficult to divert resources from their primary mission. For example, local law enforcement officials from one location we visited said they are significantly understaffed and overburdened with their current mission and would not be able to take responsibility for protecting federal facilities. We believe that it is important that FPS ensure that its decision to move to an inspector-based workforce does not hamper its ability to protect federal facilities. We recommended in 2008 that FPS clarify roles and responsibilities of local law enforcement agencies in responding to incidents at GSA facilities. While FPS agreed with this recommendation, FPS has decided not to pursue agreements with local law enforcement officials, in part because of reluctance on the part of local law enforcement officials to sign such agreements. In addition, FPS believes that the agreements are not necessary because 96 percent of the properties in its inventory are listed as concurrent jurisdiction facilities where both federal and state governments have jurisdiction over the property. Nevertheless, we continue to believe that these agreements would, among other things, clarify roles and responsibilities of local law enforcement agencies when responding to crime or other incidents. While FPS has recently increased the size of its workforce as mandated by Congress, we reported in our 2009 report that FPS has operated without a human capital plan. We recommended that FPS develop a human capital plan to guide its current and future workforce planning efforts. We have identified human capital management as a high-risk issue throughout the federal government, including within DHS. Without a long-term strategy for managing its current and future workforce needs, including effective processes for hiring, training, and staff development, FPS will be challenged to align its personnel with its programmatic goals. FPS concurred with this recommendation and has drafted a workforce analysis plan but has not yet fully developed or implemented a human capital plan. FPS’s primary means of funding its operations—the basic security fee charged to some federal agencies—does not account for a building’s level of risk, the level of service provided, or the cost of providing those services. We reported in 2008 that this issue raises questions about whether some federal agencies are being overcharged by FPS. FPS also does not have a detailed understanding of its operational costs, including accurate information about the cost of providing its security services at federal facilities with different risk levels. Without this type of information, FPS has difficulty justifying the rate of the basic security fee to its customers. We have found that by having accurate cost information, an organization can demonstrate its cost-effectiveness and productivity to stakeholders, link levels of performance with budget expenditures, provide baseline and trend data for stakeholders to compare performance, and provide a basis for focusing an organization’s efforts and resources to improve its performance. In addition, FPS’s fee-based funding system has not always generated sufficient revenue to cover its operational costs. In 2007 we reported that FPS’s collections fell short of covering its projected operational costs, and the steps it took to address the projected shortfalls reduced staff morale, increased attrition rates, and diminished security at some GSA facilities. FPS has yet to evaluate whether its fee-based system or an alternative funding mechanism is most appropriate for funding the agency as we recommended in our 2008 report. FPS agreed with our recommendation and has taken some action, including the development and implementation of an Activity Based Cost framework. We are assessing FPS’s efforts in this area as part of our ongoing review of FPS’s fee-base structure and will provide Congress with a final report in 2011. We have reported that FPS is limited in its ability to assess the effectiveness of its efforts to protect federal facilities. To determine how well it is accomplishing its mission to protect federal facilities, FPS has identified some output measures. These measures include determining whether security countermeasures have been deployed and are fully operational, the amount of time it takes to respond to an incident, and the percentage of FSAs completed on time. While output measures are helpful, outcome measures are also important because they can provide FPS with broader information on program results, such as the extent to which its decision to move to an inspector-based workforce will enhance security at federal facilities or help identify the security gaps that remain at federal facilities and determine what action may be needed to address them. In addition, FPS does not have a reliable data management system that will allow it to accurately track these measures or other important measures such as the number of crimes and other incidents occurring at GSA facilities. Without such a system, it is difficult for FPS to evaluate and improve the effectiveness of its efforts to protect federal employees and facilities, allocate its limited resources, or make informed risk management decisions. For example, weaknesses in one of FPS’s countermeasure tracking systems make it difficult to accurately track the implementation status of recommended countermeasures such as security cameras and X-ray machines. Without this ability, FPS has difficulty determining whether it has mitigated the risk of federal facilities to crime or a terrorist attack. FPS concurred with our recommendations and states that its efforts to address them will be completed in 2012 when its automated information systems are fully implemented. FPS’s ability to protect federal facilities under the control or custody of GSA is further complicated by the FSC structure. The Department of Justice’s 1995 Vulnerability Assessment of Federal Facilities guidelines directed GSA to establish a FSC in each federal facility under its control. FSCs have experienced several issues that may have increased the risk at some federal facilities. For example, FSCs have operated since 1995 without guidelines, policies, or procedures that outline how they should operate, make decisions, or establish accountability. This results in ad hoc security that undermines effective protection of individual facilities as well as the entire facilities’ portfolio. Each FSC consists of a representative from each of the tenant agencies in the facility and is responsible for addressing security issues at its respective facility and approving the implementation of security countermeasures recommended by FPS. After completing its FSAs, FPS makes recommendations to GSA and tenant agencies for building security countermeasures. For example, tenant agencies decide whether to fund countermeasures for security equipment, and FPS is responsible for acquiring, installing, and maintaining approved security equipment. However, we reported in November 2009 that the tenant agency representatives generally do not have any security knowledge or experience but are expected to make security decisions for their respective agencies. We also reported that some of the FSC tenant agency representatives also do not have the authority to commit their respective organizations to fund security countermeasures. Thus, when funding for security countermeasures is needed, each federal tenant agency representative that does not have funding authority must obtain approval from his or her headquarters office. According to some FSC members, in some instances funding for security countermeasures is not always available because the request for funding is generally made after the budget is formulated. In addition, while FPS, GSA, and tenant agencies are responsible for some aspects of protecting federal facilities, it is unclear who is the final arbiter or accountable for final decisions. We reported in November 2009 that the FSC structure may not contribute to effective protection of federal facilities for several reasons. Some FSC members may not have the security expertise needed to make risk-based decisions. They may find the associated costs prohibitive. Tenant agencies may lack complete understanding of why recommended countermeasures are necessary because they do not receive an adequate amount of information from FPS. Moreover, we found some instances in 2008 and 2009 where the FSC structure contributed to increased risk at some federal facilities. For example, an FPS official in a major metropolitan area stated that over the last 4 years inspectors have recommended 24-hour coverage at one high- risk facility located in a high-crime area multiple times; however, the FSC was not able to obtain approval from all its members. In addition, several FPS inspectors stated that their regional managers have instructed them not to recommend security countermeasures in FSAs if FPS would be responsible for funding the measures because there is not sufficient funding in regional budgets to purchase and maintain the security equipment. Moreover, at a different location, members of a FSC told us that they met as needed, although even when they hold meetings, one of the main tenant agencies typically does not participate. GSA officials commented that this tenant adheres to its agency’s building security protocols and does not necessarily follow GSA’s tenant policies and procedures, which GSA thinks creates security risks for the entire building. ISC recently began to develop guidance for FSC operations, which may address some of these issues. The committee, however, has yet to announce an anticipated date for issuance of this guidance. In response to our many recommendations, FPS has a number of ongoing improvements that, once fully implemented, should enhance its ability to protect the over 1 million federal government employees and members of the public who visit federal facilities each year. In addition, FSCs have a significant role in ensuring the effective protection of federal facilities; however, they face a number of issues in carrying out their security responsibilities. For example, they have operated without any procedures since their creation in 1995, and efforts to develop guidance are incomplete. Without specific guidance or procedures, FSCs have operated in an ad hoc manner, and there is a lack of assurance that federal facilities under the control and custody of GSA are effectively protected by FPS. Moreover, no actions have been taken on these issues since we identified them in our November 2009 report. As such, these weaknesses continue to result in ad hoc security and increased risk at some federal facilities. Therefore, we are making a recommendation for the Secretary of DHS to address this matter. GAO recommends that the Secretary of DHS direct the Under Secretary of NPPD and the Director of FPS to work in consultation with GSA and ISC to develop and implement procedures that, among other things, outline the FSCs’ organizational structure, operations, decision-making authority, and accountability. We provided a draft of this report to DHS for review and comment. DHS concurred with the recommendation in this report. Regarding the status of our recommendations listed in appendix I, FPS commented that it is actively pursuing initiatives and implementing measures to address the nine recommendations that we reported as not implemented. We believe our characterization of FPS’s efforts to address our recommendations reflects the data provided by FPS. We are also concerned that the steps FPS described in its documents are not comprehensive enough to address the recommendations that we reported as not implemented. For example, regarding our recommendation to identify other approaches and options that would be most beneficial and financially feasible for protecting federal facilities, FPS states that it most recently coordinated with DHS’s Science and Technology Directorate to better define requirements for the next generation of security technology. However, we continue to believe that given the challenges FPS faces with managing its contract guard program, among other things, FPS needs to undertake a comprehensive review of how it protects federal facilities. FPS has not provided us with this type of analysis or information. We are also concerned about the reliability of the preliminary data FPS used to evaluate whether its fee- based system or an alternative funding mechanism is appropriate to fund the agency. We are currently reviewing the reliability of FPS’s Activity Based Costing framework and will reassess FPS’s efforts to address this recommendation at the end of our review. DHS’s comments are presented in appendix II. DHS also provided technical clarifications, which we incorporated into the report as appropriate. We are sending copies of this report to appropriate congressional committees, the Secretary of Homeland Security, and other interested parties. In addition, the report will be available at no charge on GAO’s Web site at http//www.gao.gov. If you have any questions about this report, please contact me at (202) 512-2834 or or goldsteinm@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix III. In addition to the contact name above, Tammy Conquest, Assistant Director; Jennifer Clayborne; Delwen Jones; and Susan Michal-Smith made key contributions to this report.

Summary: To accomplish its mission of protecting about 9,000 federal facilities, the Federal Protective Service (FPS) currently has a budget of about $1 billion, about 1,225 full-time employees, and about 15,000 contract security guards. However, protecting federal facilities and their occupants from a potential terrorist attack or other acts of violence remains a daunting challenge for the Department of Homeland Security's (DHS) Federal Protective Service. GAO has issued numerous reports on FPS's efforts to protect the General Services Administration's (GSA) facilities. This report (1) recaps the major challenges we reported that FPS faces in protecting federal facilities and discusses FPS's efforts to address them and (2) identifies an additional challenge that FPS faces related to the facility security committees (FSC), which are responsible for addressing security issues at federal facilities. This report is based primarily on our previous work and recent FPS interviews. Since 2007, we have reported that FPS faces significant challenges with protecting federal facilities, and in response FPS has recently started to take steps to address some of them. In 2008, we reported that FPS does not use a risk management approach that links threats and vulnerabilities to resource requirements. Without a risk management approach that identifies threats and vulnerabilities and the resources required to achieve FPS's security goals, there is limited assurance that programs will be prioritized and resources will be allocated to address existing and potential security threats in an efficient and effective manner. FPS recently began implementing a new system referred to as the Risk Assessment Management Program (RAMP). This system is designed to be a central database for capturing and managing facility security information, including the risks posed to federal facilities and the countermeasures that are in place to mitigate risk. FPS expects that RAMP will enhance its approach to assessing risk, managing human capital, and measuring performance. Our July 2009 report on FPS's contract guard program also identified a number of challenges that the agency faces in managing its contract guard program, including ensuring that the 15,000 guards that are responsible for helping to protect federal facilities have the required training and certification to be deployed at a federal facility. In response to our report, FPS took a number of immediate actions with respect to contract guard management. For example, FPS has increased the number of guard inspections it conducts at federal facilities in some metropolitan areas and revised its guard training. We have not reviewed whether these actions are sufficient to fulfill our recommendations. Another area of continuing concern is that FPS continues to operate without a human capital plan and does not have an accurate estimate of its current and future workforce needs. In our July 2009 report, we recommended that FPS develop a human capital plan to guide its current and future workforce planning efforts. While FPS agreed with this recommendation, it has not yet fully developed or implemented a human capital plan. As we reported in 2009, FPS's ability to protect GSA facilities is further complicated by the FSC structure. Each FSC includes FPS, GSA, and a tenant agency representative and is responsible for addressing security issues at its respective facility and approving the funding and implementation of security countermeasures recommended by FPS. However, there are several weaknesses with the FSC. First, FSCs have operated since 1995 without procedures that outline how they should operate or make decisions, or that establish accountability. Second, the tenant agency representatives to the FSC generally do not have any security knowledge or experience but are expected to make security decisions for their respective agencies. Third, many of the FSC tenant agency representatives also do not have the authority to commit their respective organizations to fund security countermeasures. No actions have been taken on these issues since our 2009 report, and thus these weaknesses continue to result in ad hoc security and increased risk at some federal facilities. GAO recommends that the Secretary of DHS direct the Director of FPS to work in consultation with other representatives of the FSC to develop and implement procedures that, among other things, outline the committees' organization structure, operations, and accountability. DHS concurred with GAO's recommendation.