The Homeland Security Act of 2002 provides the basis for DHS responsibilities in the protection of the nation’s critical infrastructure. The act assigns DHS responsibility for developing a comprehensive national plan for securing critical infrastructure and for recommending the measures necessary to protect the key resources and critical infrastructure of the United States in coordination with other agencies and in cooperation with state and local government agencies and authorities, the private sector, and other entities. Other legislation enacted over the last decade has produced major changes in the nation’s approach to maritime security. Much of the federal framework for port security is contained in the Maritime Transportation Security Act of 2002 (MTSA). The MTSA establishes requirements for various layers of maritime security, including requiring a national security plan, area security plans, and facility and vessel security plans. DHS has placed some responsibility for this and other MTSA requirements with the Coast Guard. In October 2006, the Security and Accountability for Every Port Act of 2006 (SAFE Port Act) further refined the nation’s port security framework, For creating and codifying certain port security programs and initiatives.example, the SAFE Port Act required the development of protocols for resumption of trade following a transportation security incident, as well as Salvage Response Plans. DHS emphasizes the importance of resilience through key documents like the NIPP, QHSR, and directives. As the lead federal agency for the Marine Transportation System, the Coast Guard is responsible for facilitating the recovery of the system following a significant transportation disruption and working with maritime stakeholders in the resumption of trade. The Coast Guard is also the Sector-Specific Agency (SSA) for the Maritime subsector of the Transportation sector and coordinates the preparedness activities among the sector’s partners to prevent, protect against, respond to, and recover from all hazards that could have a debilitating effect on homeland security, public health and safety, or economic well-being. IP is responsible for working with public and private sector critical infrastructure partners and leads the coordinated national effort to mitigate risk to the nation’s critical infrastructure. IP also has the overall responsibility for coordinating implementation of the NIPP across 18 critical infrastructure sectors; overseeing the development of 18 Sector- Specific Plans; providing training and planning guidance to SSAs and owners and operators on protective measures to assist in enhancing the security of critical infrastructure within their control; and helping state, local, tribal, territorial, and private sector partners develop the capabilities to mitigate vulnerabilities and identifiable risks to their assets. IP’s Protective Security Coordination Division provides programs and initiatives to enhance critical infrastructure protection and resilience and reduce risk associated with all-hazards incidents. To carry out these responsibilities, IP has deployed PSAs in 50 states and Puerto Rico, with deployment locations based on population density and major concentrations of critical infrastructure. One PSA duty is to coordinate and conduct voluntary assessment services to assist critical infrastructure owners and operators in reviewing and strengthening their security posture. Specifically, PSAs coordinate and carry out various IP protective programs such as the Enhanced Critical Infrastructure Protection (ECIP) initiative, which is a voluntary program focused on forming or maintaining partnerships between DHS and critical infrastructure owners and operators of high-priority assets and systems, as well as other assets of significant value. The PSAs also coordinate and participate in Site Assistance Visit vulnerability assessments to identify security gaps and provide options for consideration to mitigate these identified gaps. These assessments are on-site, asset-specific, nonregulatory assessments conducted at the request of asset owners and operators. Port operations involve a complicated system of systems, which operates across multiple sectors. The port area consists of many assets that are interdependent with other sectors, such as power and water, to continue normal operations. For example, container terminals have large energy needs to operate the cranes that load and unload cargo. In most cases, backup generators cannot produce enough power to keep these cranes operational, so reliable energy production and transportation are vital to maintaining normal port operations. Similarly, refinery, chemical plant, cruise line, ferry, and other port operations also have high energy and water needs. In addition, many port operations rely heavily upon trucking and rail transportation to move personnel and cargo in and out of the port area. Furthermore, the availability of a functional labor force and information technology support—which may be located within or outside of a port area—is important for port stakeholders’ operations. Similarly, many businesses and communities rely on the port for their normal operations. Energy, food, and product shipments are vital to port operations, port stakeholders, and the broader community. Interruptions in the supply chain often have secondary and tertiary impacts that may not be immediately obvious to businesses and communities. Figure 1 illustrates some of the key stakeholders within a port and the importance of their interactions. Understanding the interdependencies among various port area stakeholders and other critical partners outside the port area is necessary to ensure and enhance a port’s resilience. National high-level documents currently promote resilience as a key national goal. Specifically, two key White House documents emphasize resilience on a national level—Presidential Policy Directive 8 (PPD-8) and the National Strategy for Global Supply Chain Security. PPD-8 defines resilience as the ability to adapt to changing conditions and withstand and rapidly recover from disruption due to emergencies. The National Strategy for Global Supply Chain Security endorses building a layered defense, addressing threats early, and fostering a resilient system that can absorb and recover rapidly from unanticipated disruptions. Key federal entities, including DHS, are currently working to develop frameworks or other strategies for implementing the goals and objectives of these documents, which should provide greater insights into how they plan to strengthen national resilience. Since 2009, DHS has also emphasized the concept of resilience through two high-level documents—the NIPP and QHSR. The NIPP identifies resilience as a national objective for critical infrastructure protection and defines resilience as the ability to resist, absorb, recover from, or successfully adapt to adversity or a change in conditions. The QHSR identifies ensuring resilience to disaster as one of the nation’s five homeland security missions.resilience as fostering individual, community, and system robustness, adaptability, and capacity for rapid recovery. According to DHS, resilience is one of the foundational elements for a comprehensive approach to homeland security; thus, its missions and programs designed to enhance national resilience span the department. Accordingly, DHS is currently developing a policy to bring a cohesive understanding of resilience to its components and establish resilience objectives. DHS took steps to foster departmentwide resilience initiatives by creating two internal entities—the Resilience Integration Team (RIT) and the Office of Resilience Policy (ORP). In April 2010, DHS formed RIT to develop new initiatives that support the overarching resilience mission set forth in the QHSR. To date, RIT has been the key DHS-wide working group charged with developing and disseminating resilience concepts.According to agency officials, RIT brings together subject matter experts from all components whose missions affect resilience in some manner for monthly meetings. DHS formed ORP in March 2012 to coordinate and promulgate resilience strategies throughout the department. In 2010, RIT officials surveyed components about how their activities addressed resilience in an attempt to gauge components’ understanding of resilience, as discussed in the QHSR. According to RIT officials, component responses showed that component resilience actions were very diverse and represented stovepiped efforts that were still “works in progress.” ORP officials told us that these differing approaches to implementing and identifying resilience efforts were part of the reason they saw a need for one DHS resilience policy. Specifically, ORP saw a need to establish a policy that provides component agencies with a single, consistent, departmentwide understanding of resilience; clarifies and consolidates the concepts from the four high-level guiding documents discussed above; and helps components understand how their activities address DHS’s proposed resilience objectives. The policy is currently in draft status, and ORP officials hope to have an approved policy in place later this year. Although DHS is developing a policy to establish a departmentwide resilience framework, DHS officials stated that they currently have no plans to develop an implementation strategy for DHS’s resilience policy. An implementation strategy that defines goals, objectives, and activities could help ensure that the policy is adopted consistently and in a timely manner by components, and that all components share common priorities and objectives. Additionally, an implementation strategy with specific milestones could help hold ORP and DHS components accountable for taking actions to address resilience objectives identified in the new policy in a timely manner. ORP officials acknowledged that an implementation strategy could be beneficial because it could provide concrete steps for employing DHS’s new resilience policy and harmonizing component efforts. In previous work, we identified key characteristics that should be included in a strategy, as discussed below. Goals, subordinate objectives, activities, and performance measures set clear desired results and priorities, specific milestones, and outcome-related performance measures while giving implementing parties flexibility to pursue and achieve those results within a reasonable time frame. Organizational roles, responsibilities, and mechanisms for coordinating their efforts identify the relevant departments, components, or offices and, where appropriate, the different sectors, such as state, local, private, or international sectors. The strategy would also clarify implementing organizations’ relationships in terms of leading, supporting, and partnering. Resources, investments, and risk management identify, among other things, the sources and types of resources and investments associated with the strategy, and where those resources and investments should be targeted. As DHS implements its resilience policy, an implementation strategy with these characteristics could provide ORP with a clear and more complete picture of how DHS components are implementing this policy, as well as how the various programs and activities are helping to enhance critical infrastructure resilience in their areas of responsibility. For example, establishing desired results and priorities, such as departmentwide resilience objectives, could help components better understand and communicate how their actions and strategies fulfill those policy objectives. It could also help ORP maintain awareness of various component actions and how these actions align with the policy while also helping components identify which actions are most critical to addressing these objectives. Additionally, milestones could help to ensure that ORP is receiving timely input from components regarding their actions to address resilience objectives, and help ORP and components determine whether adjustments to the policy are needed. Furthermore, as part of the strategy, developing performance measures, such as the number of components that have reported back on resilience efforts, would help provide ORP with more complete information for gauging the level of component acceptance of the policy and understanding of how components’ actions address resilience objectives. Moreover, identifying relevant government entities and implementing organizations could provide components with clear expectations for collaborating with other partners inside and outside of DHS, and reporting this collaboration back to ORP. This step could also clearly define departmental components responsible for promoting resilience by identifying critical stakeholders and subject matter experts within and outside of DHS. Moreover, clarifying relationships among components, other government entities, and private partners could foster a greater understanding of their dependence on one another and provide valuable perspective for ORP. Finally, identifying the types of resources and investments needed, and where they should be targeted, could help provide guidance to the implementing components to manage resources and lead them to consider where resources should be invested now and in the future based on balancing risk reductions and costs. ORP officials stated that they have focused initial efforts on developing the resilience policy, and had not given consideration to developing an implementation strategy for this policy. Going forward, we believe that focusing efforts on developing an implementation strategy that includes the elements we identified could benefit DHS components’ efforts to enhance resilience. The Coast Guard works with asset owners and operators to assess and enhance various aspects of port critical infrastructure resilience—such as security protection, port recovery, and risk analysis efforts, as described in table 1. In general, officials from the seven Coast Guard sectors we interviewed and various industries at the three ports we visited cited the efforts depicted in table 1 as helpful in addressing or raising awareness of resilience-related issues (e.g., port security and recovery). Their views on the value of some of these key efforts are summarized below. AMSCs. Coast Guard officials we met with at each of the seven sectors stated that they maintain working relationships with port stakeholders via the AMSCs and other groups, which provide a forum for regular communication among port stakeholders on issues related to security and recovery—key elements of resilience. At the three ports we visited, industry stakeholders also cited the importance of the AMSCs in raising awareness of security or resilience issues. In addition, our prior work has illustrated the importance of AMSCs in facilitating information sharing at the port level. One example of Coast Guard efforts to promote resilience at the local level through the AMSC is occurring at Sector Delaware Bay. Coast Guard officials there reported working with members of the local maritime exchange to develop a guide to business continuity planning—an important element in enhancing resilience. According to sector officials, the guide was developed to assist smaller businesses in the port area that lacked the capability or funds to develop a business continuity plan in- house. Delaware Bay officials reported that they have shared this template with other Coast Guard sectors as well. Port security exercises. Officials from six of the seven sectors and industry officials at the three ports we visited cited the importance of addressing recovery and resilience planning issues through various training exercises, whether sponsored by the Coast Guard or other entities. For example, officials in one Coast Guard sector spoke about the importance of a training exercise focused on waterway recovery in getting intermodal stakeholders (such as container terminal operators) to think beyond impacts on their own facilities and consider the resilience of the port area as a whole (e.g., how the port would meet the needs of partners dependent on its shipping services). PSGP. Officials at five of the seven Coast Guard sectors—as well as industry stakeholders at the three ports we visited—cited the PSGP as an important means of addressing risk management and resilience issues in port areas. For example, one river pilots’ association reported that it used PSGP funds to expand the use of a radar system for tracking vessels and provided access to the information to the Coast Guard, police, and other authorities. Thus, this system could both increase portwide awareness and aid in recovery efforts following an incident. In addition, officials at four Coast Guard sectors, as well as industry stakeholders, pointed to the PRMP as helpful in identifying security gaps and priorities to be addressed. MSRAM. Coast Guard officials have stated that, as part of the evolution of MSRAM, it is taking preliminary steps to make MSRAM more helpful in assessing resilience. Specifically, the agency is considering ways to use MSRAM data and other tools to help mitigate the criticality or risk levels of key critical infrastructure while also improving its estimates of secondary economic impacts of an event. According to MSRAM program officials, these efforts are in very early stages. While not focused specifically on ports, IP assists critical infrastructure owners and operators of individual assets throughout the nation in understanding their own level of resilience through voluntary assessments and surveys. IP also conducts assessments of regional resilience in some areas of the country. As discussed earlier, IP employs voluntary assessments and security surveys aimed at helping these owners and operators identify and potentially address vulnerabilities, among other things. In addition, IP has two key efforts designed to help enhance resilience—its Resilience Index/Assessment Methodology and Regional Resiliency Assessment Program (RRAP), described below. Resilience Index/Assessment Methodology. IP has developed a Resilience Index for its vulnerability assessments and security surveys. This index is intended to provide the levels of resilience at critical infrastructure, guide prioritization of resources for improving critical infrastructure, and also provide information to owners/operators about their facility’s standing relative to those of similar sector assets and how they may increase resilience. IP is also in the process of developing a new Resilience Assessment Methodology to improve DHS’s ability to assess asset-level resilience, inform regional resilience efforts, and measure progress in enhancing resilience. RRAP. These assessments are conducted to assess vulnerability to help improve resilience and allow for an analysis of infrastructure “clusters” and systems in various regions. This program, which uses vulnerability assessments and surveys, along with other tools, has included ports as a transportation hub element of a larger regional analysis, but has not yet been applied to focus solely on a port. The RRAP evaluates critical infrastructure on a regional level to examine vulnerabilities, threats, and potential consequences from an all- hazards perspective to identify dependencies, interdependencies, cascading effects, resilience characteristics, and gaps. For example, an RRAP review could involve compiling information from reviews of critical infrastructure assets—such as electricity providers and transport companies—to form an overall assessment of a key transportation and energy corridor within a state. The RRAP assessments are conducted by DHS officials, including PSAs in collaboration with SSAs; other federal officials; state, local, territorial, and tribal officials; and the private sector, depending upon the sectors and assets selected as well as a resilience subject matter expert or experts. The results of the RRAP are to be used to enhance the overall security posture of the assets, surrounding communities, and the geographic region covered by the project. According to DHS officials, the results of specific asset-level assessments conducted as part of the RRAP are made available to asset owners and operators and other partners (as appropriate), but the final analysis and report are delivered to the state where the RRAP occurred. Further, according to DHS, while it continues to perform surveys and assessments at individual assets, prioritizing efforts to focus on regional assessments allows DHS to continue to meet evolving threats and challenges. IP officials also informed us that through the RRAPs, the focus of its vulnerability assessment efforts has evolved over the years from a single- facility assessment to an approach that integrates the results of multiple single-facility assessments to inform a regional analysis of resilience and security through the study of dependencies and interdependencies between and among asset operators. IP officials stated that the Coast Guard participates in RRAPs that include a maritime component. The officials have also informed us that the results of Coast Guard reports and assessments are included in the Resiliency Assessment (the RRAP final report) for RRAPs that include a maritime component, and the information is appropriately derived to alleviate any information-sharing concerns. IP also reports that it has done some ECIPs/Site Assistance Visits at facilities associated with ports (e.g., refineries, storage facilities, and marine terminals). In addition, officials we spoke with from four Coast Guard sectors and PSAs representing five areas report maintaining relationships with one another through the AMSCs or other venues to facilitate information sharing. While the Coast Guard and IP have collaborated on some regional resilience assessments, there may be opportunities for further collaboration and use of existing tools to conduct portwide resilience assessment efforts. For example, IP and the Coast Guard could leverage some of the expertise and tools discussed above—such as the RRAP approach—to develop assessments of the overall resilience of one or more specific port areas. Currently, many of the Coast Guard’s formal security assessments (i.e., facility security plan reviews and MSRAM) are focused on asset-level security. For example, our prior work on MSRAM demonstrates that this tool assesses security risks to individual assets, not regions or systems of assets. In addition, the facility security plan reviews are not voluntary, but are conducted to fulfill regulatory requirements. In contrast, IP’s RRAP allows for a broader, more systemic analysis of resilience, and industry provides information to IP on a voluntary basis. IP officials stated that IP has not conducted any RRAPs focused exclusively on ports, and does not intend to, because of the Coast Guard’s role as lead agency for ensuring port safety, recovery planning, and security, and because IP has limited resources for conducting additional RRAPs. However, IP has conducted RRAPs of regional corridors that have a nexus to a port or waterside critical infrastructure assets. For example, one recent RRAP review focused on a regional transportation and energy corridor and discussed the critical importance of a local port in providing fuel, medicine, and other “life-sustaining” goods throughout the state. The report found, among other things, that the port had no emergency power- generating capability; thus, a disruption to the power grid supporting port operations could seriously affect distribution of these life-sustaining goods to state residents. The report recommended that the port work to establish an agreement with another local entity to secure emergency power supplies. This work illustrates the potential vulnerabilities—and mitigation steps—that could be identified through a port-focused resilience review. In addition, NIAC supports further use of RRAPs, reporting that the RRAP is viewed in the field as a “model of collaboration” in understanding regional and community resilience and recommended that its use be expanded “as quickly as feasible.” ORP officials have also stated that having Coast Guard and IP leverage resources and collaborate on systematic portwide resilience assessments could be beneficial. In addition, during the course of our review, we learned of a state-led, ongoing effort to assess portwide resilience at one port area that could prove to be an example of beneficial collaboration that enhances the understanding of port resilience. The New Jersey Office of Homeland Security and Preparedness is leading an effort to develop a computer- based decision support tool that could model the impacts of various disruptions on all critical infrastructure owners and operators within the New York/New Jersey port area. The project team—in collaboration with federal, state, local, and private stakeholders—is examining data from critical facilities and prior assessments to develop decision-making tools to model various scenarios. In addition, according to involved officials, the model is designed to be expandable and transferrable to other ports. Project officials stated that cooperation by critical industry stakeholders has been a key factor in the project’s development so far. These officials stated that they hope to develop three key tools: (1) a decision support tool that identifies port area vulnerabilities; (2) a port recovery and resumption-of-trade plan that helps to develop strategic issues to be addressed; and (3) a compendium of specific recommendations in the area of resilience, some aimed at specific facilities, some requiring portwide cooperation to address. Various stakeholder groups have noted that in addition to the development of tools to enhance resilience, collaboration among partners is also key because of the expertise that each party can contribute to a better understanding of resilience. For example, NIAC and the State, Local, Tribal, and Territorial Government Coordinating Council have reported on a general lack of understanding by state and local community partners of the nature of interdependencies among infrastructure sectors and across communities. Both organizations recommended that IP take a lead role in developing tools and techniques that could help community partners at the state and local levels identify and assess infrastructure interdependencies. We have reported in the past on how collaborating agencies can better identify and address needs by leveraging one another’s’ resources to obtain additional benefits that would not be available if they were working separately.also states that program management should ensure there are adequate means of communicating with, and obtaining information from, external stakeholders that may have a significant impact on the agency achieving Standards for Internal Control in the Federal Government its goals. Thus, a collaborative effort between the Coast Guard and IP to assess portwide resilience—leveraging tools and assessment approaches developed by either component, which could include MSRAM and the RRAP—could yield benefits. Specifically, the Coast Guard’s assessments of port/maritime assets coupled with IP’s assessments of other critical infrastructure with a port nexus could lead to a better understanding of the interdependencies critical to keeping a port operational. DHS officials have stated that any collaborative efforts to assess portwide resilience must take into account the difference between the Coast Guard’s regulatory and IP’s voluntary missions. For example, certain information gathered by IP from industry through voluntary assessments, surveys, or programs such as RRAP cannot be shared with the Coast Guard (or other federal entities) for regulatory purposes, though it can be shared for conducting other types of analyses, such as port security reviews.structuring any such collaboration, DHS would have to protect such information. DHS’s support for enhancing resilience is already evident in IP’s voluntary assessments, as well as DHS’s involvement in and endorsement of the New York/New Jersey port area project. Identifying opportunities to leverage tools and resources to collaboratively conduct portwide resilience assessments could enhance stakeholders’ understanding of interdependencies with other port partners, and help to focus scarce resources to enhance resilience for the port area. This understanding is important to maintaining port operations, thus minimizing the potential adverse economic impact on the U.S. economy in the event of a disruption in port operations. DHS has taken initial steps to emphasize the concept of resilience among its components by developing a resilience policy. This has been an important step and is appropriately intended to provide component agencies with a single, consistent, departmentwide understanding of resilience. Developing an implementation strategy for this new policy is the next key step that could help strengthen DHS’s resilience efforts. For example, an implementation strategy that identifies goals and objectives could help DHS components to identify, among other things, the actions that are most critical to addressing DHS’s policy objectives. Similarly, an implementation strategy that identifies responsible entities and their roles, as well as specific milestones and performance measures, could provide components with clear expectations for collaborating with other partners, and enhance DHS’s awareness of components’ understanding and implementation of the policy. This collective information, in turn, would allow DHS to better assess the progress being made by its components in addressing DHS resilience objectives. At the port level, U.S. ports, waterways, and vessels are part of a major economic engine, and a significant disruption to this system could have a widespread impact on the U.S. economy, as well as global shipping, international trade, and the global economy. Coast Guard and IP actions have addressed some aspects of critical infrastructure resilience, but the Coast Guard and IP could take additional action to enhance their collaboration and use existing tools and resources to promote portwide resilience. For example, IP and the Coast Guard could leverage existing expertise and tools—such as IP’s RRAP approach—to develop assessments of the overall resilience of one or more port areas. Having relevant agencies collaborate and leverage one another’s resources to conduct joint portwide resilience assessments could further all stakeholders’ understanding of interdependencies with other port partners, and better direct scarce resources to enhance port resilience. To better ensure consistent implementation of and accountability for DHS’s resilience policy, we recommend that the Secretary of Homeland Security direct the Assistant Secretary for Policy to develop an implementation strategy for this new policy that identifies the following characteristics and others that may be deemed appropriate: steps needed to achieve results, by developing priorities, milestones, and performance measures; responsible entities, their roles compared with those of others, and mechanisms needed for successful coordination; and sources and types of resources and investments associated with the strategy, and where those resources and investments should be targeted. To allow for more efficient efforts to assess portwide resilience, the Secretary of Homeland Security should direct the Assistant Secretary of Infrastructure Protection and the Commandant of the Coast Guard to look for opportunities to collaborate to leverage existing tools and resources to conduct assessments of portwide resilience. In developing this approach, DHS should consider the use of data gathered through IP’s voluntary assessments of port area critical infrastructure or regional RRAP assessments—taking into consideration the need to protect information collected voluntarily—as well as Coast Guard data gathered through its MSRAM assessments, and other tools used by the Coast Guard. We provided a draft of this report to the Secretary of Homeland Security for review and comment. In its written comments reprinted in appendix I, DHS concurred with both of our recommendations. With regard to our first recommendation, that DHS develop an implementation plan for its forthcoming resilience policy, DHS stated that while its RIT has worked to draft a resilience policy including findings and policy statements from key strategic documents such as the QHSR, the department has yet to commence developing an implementation strategy. DHS also noted that it has undertaken a range of activities that support resilience and that further avenues—such as an implementation strategy—are under consideration. Developing an implementation strategy for its resilience policy that addresses the steps needed to achieve results; identifies entities responsible for implementing the policy, their roles, and coordination mechanisms; and determines the resources and investments associated with the strategy would address the intent of our recommendation. With regard to our second recommendation, that DHS seek opportunities for IP and the Coast Guard to collaborate in assessing portwide resilience, DHS stated that the two components would work with ORP in defining their roles in contributing to port resilience. DHS also stated that the RIT would create a subcommittee this fiscal year to provide a forum for discussing the harmonization of resilience activities and programs across DHS. These proposed actions appear to be positive steps in enhancing IP and Coast Guard collaboration that would address the intent of this recommendation. DHS provided technical comments, which we incorporated as appropriate. We are sending copies of this report to the Secretary of Homeland Security, applicable congressional committees, and other interested parties. This report is also available at no charge on GAO’s website at http://www.gao.gov. If you or your staffs have questions about this report, please contact me at (202) 512-9610 or caldwells@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix II. Stephen L. Caldwell, (202) 512-9610 or CaldwellS@gao.gov. In addition to the contact named above, Dawn Hoff, Assistant Director, and Adam Couvillion, Analyst-in-Charge, managed this assignment. Adam Anguiano, Michele Fejfar, Eric Hauswirth, Tracey King, and Jessica Orr made significant contributions to the work. Maritime Security: Progress and Challenges 10 Years after the Maritime Transportation Security Act. GAO-12-1009T. Washington, D.C.: September 11, 2012. Critical Infrastructure Protection: DHS Could Better Manage Security Surveys and Vulnerability Assessments. GAO-12-378. Washington, D.C.: May 31, 2012. Maritime Security: Coast Guard Efforts to Address Port Recovery and Salvage Response. GAO-12-494R. Washington, D.C.: April 6, 2012. Coast Guard: Security Risk Model Meets DHS Criteria, but More Training Could Enhance Its Use for Managing Programs and Operations. GAO-12-14. Washington, D.C.: November 17, 2011. Port Security Grant Program: Risk Model, Grant Management, and Effectiveness Measures Could Be Strengthened. GAO-12-47. Washington, D.C.: November 17, 2011. Critical Infrastructure Protection: DHS Has Taken Action Designed to Identify and Address Overlaps and Gaps in Critical Infrastructure Security Activities. GAO-11-537R. Washington, D.C.: May 19, 2011. Maritime Security: DHS Progress and Challenges in Key Areas of Port Security. GAO-10-940T. Washington, D.C.: July 21, 2010. Critical Infrastructure Protection: DHS Efforts to Assess and Promote Resiliency Are Evolving but Program Management Could Be Strengthened. GAO-10-772. Washington, D.C.: September 23, 2010. Critical Infrastructure Protection: Update to National Infrastructure Protection Plan Includes Increased Emphasis on Risk Management and Resilience. GAO-10-296. Washington, D.C.: March 5, 2010. Maritime Security: The SAFE Port Act: Status and Implementation One Year Later. GAO-08-126T. Washington, D.C.: October 30, 2007. Port Risk Management: Additional Federal Guidance Would Aid Ports in Disaster Planning and Recovery. GAO-07-412. Washington, D.C.: March 28, 2007. Risk Management: Further Refinements Needed to Assess Risks and Prioritize Protective Measures at Ports and Other Critical Infrastructure. GAO-06-91. Washington, D.C.: December 15, 2005. Maritime Security: New Structures Have Improved Information Sharing, but Security Clearance Processing Requires Further Attention. GAO-05-394. Washington, D.C.: April 15, 2005.

Summary: U.S. ports are part of an economic engine handling more than $700 billion in merchandise annually, and a disruption to port operations could have a widespread impact on the global economy. DHS has broad responsibility for protection and resilience of critical infrastructure. Within DHS, the Coast Guard is responsible for the maritime environment, and port safety and security, and IP works to enhance critical infrastructure resilience. Recognizing the importance of the continuity of operations in critical infrastructure sectors, DHS has taken initial steps to emphasize the concept of resilience. GAO was asked to review port resilience efforts. This report addresses the extent to which (1) DHS has provided a road map or plan for guiding resilience efforts, and (2) the Coast Guard and IP are working with port stakeholders and each other to enhance port resilience. To address these objectives, GAO analyzed key legislation and DHS documents and guidance. GAO conducted site visits to three ports, selected based on geography, industries, and potential threats; GAO also interviewed DHS officials and industry stakeholders. Information from site visits cannot be generalized to all ports, but provides insights. The Department of Homeland Security (DHS) is developing a resilience policy, but an implementation strategy is a key next step that could help strengthen DHS resilience efforts. DHS defines resilience as the ability to resist, absorb, recover from, or adapt to adversity, and some high-level documents currently promote resilience as a key national goal. Specifically, two key White House documents emphasize resilience on a national level--the 2011 Presidential Policy Directive 8 and the 2012 National Strategy for Global Supply Chain Security. Since 2009, DHS has emphasized the concept of resilience and is currently in the process of developing a resilience policy, the initial steps of which have included creating two internal entities--the Resilience Integration Team and the Office of Resilience Policy (ORP). According to ORP officials, they saw a need to establish a policy that provides component agencies with a single, consistent, departmentwide understanding of resilience that clarifies and consolidates resilience concepts from high-level guiding documents, and helps components understand how their activities address DHS's proposed resilience objectives. ORP officials hope to have an approved policy in place later this year. However, DHS officials stated that currently there are no plans to develop an implementation strategy for this policy. An implementation strategy that defines goals, objectives, and activities; identifies resource needs; and lays out milestones is a key step that could help ensure that DHS components adopt the policy consistently and in a timely manner. For example, an implementation strategy with goals and objectives could provide ORP with a more complete picture of how DHS components are implementing this policy. The Coast Guard and the Office of Infrastructure Protection (IP) work with stakeholders to address some aspects of critical infrastructure resilience, but they could take additional collaborative actions to promote portwide resilience. The Coast Guard is port focused and works with owners and operators of assets, such as vessels and port facilities, to assess and enhance various aspects of critical infrastructure resilience in ports--such as security protection, port recovery, and risk analysis efforts. In contrast, IP, through its Regional Resiliency Assessment Program (RRAP), conducts assessments with a broader regional focus, but is not port specific. An RRAP assessment is conducted to assess vulnerability to help improve resilience and allow for an analysis of infrastructure "clusters" and systems in various regions--for example, a regional transportation and energy corridor. The Coast Guard and IP have collaborated on some RRAP assessments, but there may be opportunities for further collaboration to conduct port-focused resilience assessments. For example, IP and the Coast Guard could collaborate to leverage existing expertise and tools--such as the RRAP approach--to develop assessments of the overall resilience of specific port areas. Having relevant agencies collaborate and leverage one another's resources to conduct joint portwide resilience assessments could further all stakeholders' understanding of interdependencies with other port partners, and help determine where to focus scarce resources to enhance resilience for port areas. GAO recommends that DHS develop an implementation strategy for its resilience policy and that the Coast Guard and IP identify opportunities to collaborate to leverage existing tools and resources to assess port resilience. DHS concurred with GAO's recommendations.