According to FPS officials, since 2010 the agency has required its guards to receive training on how to respond to an active-shooter scenario. However, as our 2013 report shows, FPS faces challenges providing active-shooter response training to all of its guards. According to FPS officials, the agency provides guards with information on how they should respond during an active-shooter incident as part of the 8-hour FPS- provided orientation training. FPS officials were not able to specify how much time is devoted to this training, but said that it is a small portion of the 2-hour special situations training.documents, this training includes instructions on how to notify law enforcement personnel, secure the guard’s area of responsibility, appropriate use of force, and direct building occupants according to emergency plans. According to FPS’s training However, when we asked officials from 16 of the 31 contract guard companies we spoke to if their guards had received training on how guards should respond during active-shooter incidents, responses varied. For example, of the 16 contract guard companies we interviewed about this topic: officials from eight contract guard companies stated that their guards have received active-shooter scenario training during FPS orientation; officials from five guard companies stated that FPS has not provided active-shooter scenario training to their guards during the FPS- provided orientation training; and officials from three guard companies stated that FPS had not provided active-shooter scenario training to their guards during the FPS- provided orientation training, but that the topic was covered at some other time. We were unable to determine the extent to which FPS’s guards have received active-shooter response training. Without ensuring that all guards receive training on how to respond to active-shooter incidents, FPS has limited assurance that its guards are prepared for this threat. FPS agreed with our recommendation that they take immediate steps to determine which guards have not received this training and provide it to them. As part of their 120 hours of training, guards must receive 8 hours of screener training from FPS on how to use x-ray and magnetometer equipment. However, in our September 2013 report, we found that FPS has not provided required screener training to all guards. Screener training is important because many guards control access points at federal facilities and thus must be able to properly operate x-ray and magnetometer machines and understand their results. In 2009 and 2010, we reported that FPS had not provided screener training to 1,500 contract guards in one FPS region. In response to our reports, FPS stated that it planned to implement a program to train its inspectors to provide screener training to all of its contract guards. However, 3 years after our 2010 report, guards continue to be deployed to federal facilities who have never received this training. For example, an official at one contract guard company stated that 133 of its approximately 350 guards (about 38 percent) on three separate FPS contracts (awarded in 2009) have never received their initial x-ray and magnetometer training from FPS. The official stated that some of these guards are working at screening posts. Further, officials at another contract guard company in a different FPS region stated that, according to their records, 78 of 295 (about 26 percent) guards deployed under their contract have never received FPS’s x-ray and magnetometer training. These officials stated that FPS’s regional officials were informed of the problem, but allowed guards to continue to work under this contract, despite not having completed required training. Because FPS is responsible for this training, according to guard company officials no action was taken against the company. Consequently, some guards deployed to federal facilities may be using x- ray and magnetometer equipment that they are not qualified to use ─thus raising questions about the ability of some guards to execute a primary responsibility to properly screen access control points at federal facilities. We were unable to determine the extent to which FPS’s guards have received screener training. FPS agreed with our recommendation that they take immediate steps to determine which guards have not received screener training and provide it to them. In our September 2013 report, we found that FPS continues to lack effective management controls to ensure that guards have met training and certification requirements. For example, although FPS agreed with our 2010 and 2012 recommendations to develop a comprehensive and reliable system for contract guard oversight, it still does not have such a system. Without a comprehensive guard management system, FPS has no independent means of ensuring that its contract guard companies have met contract requirements, such as providing qualified guards to federal facilities. Instead, FPS requires its guard companies to maintain files containing guard-training and certification information and to provide it with a monthly report containing this information. In our September 2013 report, we found that 23 percent of the 276 guard files we reviewed (maintained by 11 of the 31 guard companies we interviewed) lacked required training and certification documentation.some guard files lacked documentation of basic training, semi-annual firearms qualifications, screener training, the 40-hour refresher training (required every 3 years), and CPR certification. Risk assessments help decision-makers identify and evaluate security risks and implement protective measures to mitigate the potential undesirable effects of these risks. ISC’s risk assessment standards state that agencies’ facility risk assessment methodologies must: consider all of the undesirable events identified by ISC as possible risks to federal facilities, and assess the threat, vulnerability, and consequence of specific undesirable events. Preliminary results from our ongoing review of nine federal agencies’ risk assessment methodologies indicate that several agencies, including FPS, do not use a methodology that aligns with ISC’s risk assessment standards to assess federal facilities. Most commonly, agencies’ methodologies are not consistent with ISC’s standards because agencies do not assess their facilities’ vulnerabilities to specific undesirable events. For example, officials from one agency told us that their vulnerability assessments are based on the total number of protective measures in place at a facility, rather than how vulnerable the facility is to specific undesirable events, such as insider attacks or vehicle bombs. Because agencies’ risk assessment methodologies are inconsistent with ISC’s risk assessment standards, these agencies may not have a complete understanding of the risks facing approximately 57,000 federal facilities located around the country—including the 9,600 protected by FPS and several agencies’ headquarters facilities. Moreover, because risk assessments play a critical role in helping agencies tailor protective measures to reflect their facilities’ unique circumstances and risks, these agencies may not allocate security resources effectively, i.e., they may provide too much or too little protection at their facilities. Providing more protection at a facility than is needed may result in an unnecessary expenditure of government resources, while providing too little protection may leave a facility and its occupants vulnerable to attacks. For example, if an agency does not know its facility’s potential vulnerabilities to specific undesirable events, it cannot set priorities to mitigate them. In addition, we reported in 2012 that although federal agencies pay FPS millions of dollars to assess risk at their facilities, FPS’s interim facility assessment tool—the Modified Infrastructure Survey Tool (MIST)—was not consistent with federal risk assessment standards and had other limitations. Specifically, FPS’s risk assessment methodology was inconsistent with ISC’s risk assessment standards because it did not assess the consequence of possible undesirable events (i.e., the level, duration, and nature of loss resulting from undesirable events). FPS officials told us that MIST was not designed to assess consequence, and that adding this component would have required additional testing and validation. However, without a risk assessment tool that includes all three components of risk—threat, vulnerability, and consequence—as we have recommended, FPS has limited assurance that facility decision-makers can efficiently and effectively prioritize programs and allocate resources Furthermore, because to address existing and potential security risks.MIST also was not designed to compare risks across facilities, FPS has limited assurance that it prioritizes and mitigates critical risks within the agency’s portfolio of more than 9,600 federal facilities. This concludes our testimony. We are pleased to answer any questions you, Ranking Member Barber, and members of the Subcommittee might have. For further information on this testimony, please contact Mark Goldstein at (202) 512-2834 or by email at GoldsteinM@gao.gov. Individuals making key contributions to this testimony include Tammy Conquest, Assistant Director; Antoine Clark; Colin Fallon; Geoff Hamilton; Katherine Hamer; Sara Ann Moessbauer; Jaclyn Nidoh; and Travis Thomson. Federal Protective Service: Challenges with Oversight of Contract Guard Program Still Exist, and Additional Management Controls Are Needed. GAO-13-694. Washington, D.C.: September 2013. Facility Security: Greater Outreach by DHS on Standards and Management Practices Could Benefit Federal Agencies. GAO-13-222. Washington, D.C.: January 2013. Federal Protective Service: Actions Needed to Assess Risk and Better Manage Contract Guards at Federal Facilities. GAO-12-739. Washington, D.C.: August 2012. Homeland Security: Protecting Federal Facilities Remains a Challenge for the Department of Homeland Security’s Federal Protective Service. GAO-11-813T. Washington, D.C.: July 13, 2011. Federal Facility Security: Staffing Approaches Used by Selected Agencies. GAO-11-601. Washington, D.C.: June 2011. Homeland Security: Preliminary Observations on the Federal Protective Service’s Workforce Analysis and Planning Efforts. GAO-10-802R. Washington, D.C.: June 14, 2010. Homeland Security: Federal Protective Service’s Use of Contract Guards Requires Reassessment and More Oversight. GAO-10-614T. Washington, D.C.: April 14, 2010. Homeland Security: Federal Protective Service’s Contract Guard Program Requires More Oversight and Reassessment of Use of Contract Guards. GAO-10-341. Washington, D.C.: April 13, 2010. Homeland Security: Ongoing Challenges Impact the Federal Protective Service’s Ability to Protect Federal Facilities. GAO-10-506T. Washington, D.C.: March 16, 2010. Homeland Security: Greater Attention to Key Practices Would Improve the Federal Protective Service’s Approach to Facility Protection. GAO-10-142. Washington, D.C.: October 23, 2009. Homeland Security: Federal Protective Service Has Taken Some Initial Steps to Address Its Challenges, but Vulnerabilities Still Exist. GAO-09-1047T. Washington, D.C.: September 23, 2009. Homeland Security: Federal Protective Service Should Improve Human Capital Planning and Better Communicate with Tenants. GAO-09-749. Washington, D.C.: July 30, 2009. Homeland Security: Preliminary Results Show Federal Protective Service’s Ability to Protect Federal Facilities Is Hampered by Weaknesses in Its Contract Security Guard Program. GAO-09-859T. Washington, D.C.: July 8, 2009. Homeland Security: The Federal Protective Service Faces Several Challenges That Raise Concerns About Protection of Federal Facilities. GAO-08-897T. Washington, D.C.: June 19, 2008. Homeland Security: The Federal Protective Service Faces Several Challenges That Raise Concerns About Protection of Federal Facilities. GAO-08-914T. Washington, D.C.: June 18, 2008. Homeland Security: The Federal Protective Service Faces Several Challenges That Hamper Its Ability to Protect Federal Facilities. GAO-08-683. Washington, D.C.: June 11, 2008. Homeland Security: Preliminary Observations on the Federal Protective Service’s Efforts to Protect Federal Property. GAO-08-476T. Washington, D.C.: February 8, 2008. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: As part of the Department of Homeland Security (DHS), FPS is responsible for protecting federal employees and visitors in approximately 9,600 federal facilities under the control and custody of the General Services Administration (GSA). Recent incidents at federal facilities demonstrate their continued vulnerability to attacks or other acts of violence. To help accomplish its mission, FPS conducts facility risk assessments and provides oversight of approximately 13,500 contract security guards deployed to federal facilities. This testimony is based on the results of our September 2013 report (released by the Subcommittee today), previous reports, and preliminary results of work GAO conducted for a report that GAO plans to issue to the Chairman later this year. GAO discusses (1) challenges FPS faces in ensuring contract security guards deployed to federal facilities are properly trained and certified and (2) the extent to which FPS and select federal agencies' facility risk assessment methodologies align with standards issued by the ISC. To perform this work, GAO reviewed FPS and guard company documentation and interviewed officials about oversight of guards. GAO also reviewed FPS's and eight federal agencies' risk assessment documentation and compared it to ISC's standards. These agencies were selected based on their missions and types of facilities. The Federal Protective Service (FPS) faces challenges ensuring that contract guards have been properly trained and certified before being deployed to federal facilities around the country. In a September 2013 report, GAO found that providing active-shooter-response and screener training is a challenge for FPS. For example, according to officials at five guard companies, their contract guards have not received training on how to respond during incidents involving an active-shooter. Without ensuring that all guards receive this training, FPS has limited assurance that its guards are prepared for such a threat. Similarly, officials from one of FPS's contract guard companies stated that 133 (about 38 percent) of its approximately 350 guards have never received screener training. As a result, those guards may be using x-ray and magnetometer equipment at federal facilities that they are not qualified to use, raising questions about their ability to properly screen access control points at federal facilities--one of their primary responsibilities. We were unable to determine the extent to which FPS's guards have received active-shooter-response and screener training. FPS agreed with GAO's 2013 recommendation that they take steps to identify guards that have not had required training and provide it to them. GAO also found that FPS continues to lack effective management controls to ensure its guards have met its training and certification requirements. For instance, although FPS agreed with GAO's 2010 and 2012 recommendations that it develop a comprehensive and reliable system for managing information on guards' training, certifications, and qualifications, it still does not have such a system. Additionally, 23 percent of the 276 guard files GAO examined (maintained by 11 of the 31 guard companies we interviewed) lacked required training and certification documentation. Examples of missing items include documentation of initial weapons and screener training and firearms qualifications. GAO's preliminary results indicate that several agencies, including FPS, do not use a methodology to assess risk at their facilities that aligns with the Interagency Security Committee's (ISC) risk assessment standards. Risk assessments help decision-makers identify and evaluate security risks and implement protective measures to mitigate the risk. ISC's standards state that agencies' facility risk assessment methodologies must: 1) consider all of the undesirable events identified by ISC as possible risks to federal facilities, and 2) assess the threat, vulnerability, and consequence of specific undesirable events. Most commonly, agencies' methodologies that GAO reviewed are inconsistent with ISC's standards because they do not assess facilities' vulnerabilities to specific undesirable events. If an agency does not know its facilities' potential vulnerabilities to specific undesirable events, it cannot set priorities to mitigate these vulnerabilities. In addition, as GAO reported in August 2012, although federal agencies pay FPS millions of dollars to assess risk at their facilities, FPS's risk assessment tool is not consistent with ISC's risk assessment standards because it does not assess consequence (i.e., the level, duration, and nature of loss resulting from undesirable events). As a result, FPS and the other non-compliant agencies GAO reviewed may not have a complete understanding of the risks facing approximately 57,000 federal facilities located around the country (including the 9,600 protected by FPS). DHS and FPS agreed with GAO's recommendations in its September 2013 report.