FPS was created in 1971 and located within GSA until, under the Homeland Security Act of 2002, it was transferred to DHS and placed within ICE, effective March 1, 2003. Under the act, FPS is authorized to protect the buildings, grounds, and property that are under the control and custody of GSA and the persons on the property. FPS is authorized to enforce federal laws and regulations aimed at protecting GSA buildings and persons on the property and to investigate offenses against these buildings and persons. DHS and GSA developed an MOA to set forth roles, responsibilities, and operational relationships between FPS and GSA concerning the security of GSA buildings. In accordance with the MOA, FPS inspectors are responsible for performing a range of law enforcement and security duties at GSA buildings, including patrolling the building perimeter, responding to incidents and demonstrations, completing risk assessments for buildings and space that GSA is participating in meetings with GSA property managers and tenant overseeing contract guard operations. The level of physical protection services FPS provides at each of the 9,000 GSA buildings varies depending on the building’s security level. To determine a building’s security level, FPS uses the Department of Justice (DOJ) vulnerability assessment guidelines, which categorize federal buildings into security levels I through V based on factors such as building size and number of employees. The DOJ standards recommend minimum security measures for each of the five levels and FPS uses these standards and other information to recommend countermeasures. The DOJ standards also require FPS to complete BSAs every 2 to 4 years, depending on the security level of the building. For example, a BSA is to be completed every 2 years for a level IV building and every 4 years for a level I building. As part of each assessment, the inspector is required to conduct an on-site physical security analysis using FPS’s risk assessment tool, known as Federal Security Risk Manager, and interview tenant agency security representatives, GSA realty specialists, site security supervisors, and building managers. After completing their assessments, inspectors make recommendations to GSA and tenant agencies for building security countermeasures, including security equipment and security fixtures. Tenant agencies decide whether to fund countermeasures recommended for security equipment and FPS is responsible for acquiring, installing, and maintaining approved equipment. GSA and tenant agencies determine whether to fund recommended security fixtures and GSA is responsible for acquiring, installing, and maintaining approved fixtures. In some cases, and in accordance with its policies, FPS has delegated the protection of buildings to tenant agencies, which may have their own law enforcement authority or may contract separately for guard services. FPS is a fully reimbursable agency—that is, its services are fully funded by security fees collected from tenant agencies. FPS charges each tenant agency a basic security fee per square foot of space occupied in a GSA building. In fiscal year 2009, the basic security fee is 66 cents per square foot and covers services such as patrolling the building perimeter, monitoring building perimeter alarms, dispatching law enforcement officers through its control centers, conducting criminal investigations, and performing BSAs. FPS also collects an administrative fee that it charges tenant agencies for building-specific security services, such as controlling access to building entrances and exits and checking employees and visitors. In fiscal year 2009, the fee rate for building-specific expenses is 8 percent. In addition to these security services, FPS provides tenant agencies with additional services upon request, which are funded through reimbursable security work authorizations (SWA) for which FPS charges an administrative fee. For example, tenant agencies fund FPS’s security equipment countermeasure recommendations that they approve through SWAs. In fiscal year 2009, the SWA fee rate is 8 percent. Since transferring to DHS, FPS’s mission has expanded beyond solely protecting GSA buildings to include homeland security activities, such as implementing homeland security directives, and providing law enforcement, security, and emergency response services during natural disasters and special events. For example, FPS serves as the sector- specific agency for the Government Facilities critical infrastructure sector under Homeland Security Presidential Directive 7 (HSPD-7). Additionally, DHS has authority under the Homeland Security Act to engage FPS in activities DHS deems necessary to enhance homelandsecurity. For example, FPS can be called upon to assist the Federal Emergency Management Agency in responding to natural disasters, a provide backup to other DHS law enforcement units during special events, such as political demonstrations. According to FPS, it is reimbursed fo these supportive services. We have previously identified challenges that raised concerns about FPS’s protection of GSA buildings and tenants. In 2004, we reported on the challenges FPS faced in transitioning from GSA to DHS, including issues related to expanding responsibilities and funding. In June 2008, we reported on a range of operational and funding challenges facing FPS. We found that the operational challenges we identified hampered FPS’s ability to accomplish its mission of protecting GSA buildings and the actions it took may not have fully resolved the challenges. For example, the number of FPS staff decreased by about 20 percent between fiscal year 2004 and fiscal year 2007. We found that FPS managed these decreases in staffing resources in a way that diminished security and increased the risk of crime and terrorist attacks at many GSA buildings. We further reported that the actions FPS took to address its funding challenges had some adverse implications. For example, during fiscal years 2005 and 2006, FPS’s projected expenses exceeded its collections, and DHS had to transfer funds to make up the difference. We also found that although FPS had developed output measures, it lacked outcome measures to assess the effectiveness of its efforts to protect GSA buildings. Moreover, FPS lacked a reliable data management system for accurately tracking performance measures. “Nothing in this chapter may be construed to affect the functions or authorities of the Administrator of General Services with respect to the operation, maintenance, and protection of buildings and grounds owned or occupied by the Federal Government and under the jurisdiction, custody, or control of the Administrator. Except for the law enforcement and related security functions transferred under section 203(3) of this title, the Administrator shall retain all powers, functions, and authorities vested in the Administrator under chapter 1, except section 121(e)(2)(A), and chapters 5 to 11 of Title 40, and other provisions of law that are necessary for the operation, maintenance, and protection of such buildings and grounds.” In response to a 2005 GAO recommendation and to enhance coordination with FPS, GSA established the Building Security and Policy Division within the Public Buildings Service (PBS)—where FPS once resided—in 2006. This division has three primary branches: Building Security Policy—develops GSA security policies. Building Security Operations—interfaces with FPS and monitors the services FPS provides to GSA and tenant agencies. Physical Security—provides physical security expertise, training, and guidance to GSA leadership, regional staff, and tenant agencies. During 2006, the division developed the Regional Security Network, which consists of several staff per GSA region to further enhance coordination with FPS at the regional and building levels, and to carry out GSA security policy in collaboration with FPS and tenant agencies. In 1995, Executive Order 12977 established the ISC to enhance the quality and effectiveness of security in, and protection of, nonmilitary buildings occupied by federal employees in the United States. ISC has representation from all federal cabinet-level departments and other agencies and key offices, including GSA and FPS. Furthermore, ISC was established as a permanent body to address continuing government security issues for federal buildings. Under the order, ISC became responsible for developing policies and standards, ensuring compliance and overseeing implementation, and sharing and maintaining information. Executive Order 13286 transferred the ISC Chair from GSA to DHS. In 2004, we assessed ISC’s progress in fulfilling its responsibilities. We have identified a set of key facility protection practices from the collective practices of federal agencies and the private sector to provide a framework for guiding agencies’ protection efforts and addressing challenges. We focused on the following three key practices for this report: (1) allocating resources using risk management; (2) leveraging technology; and (3) information sharing and coordination. We have used the key practices to evaluate the efforts of the Smithsonian Institution to protect its assets, of DHS to protect its facilities, and of federal entities to protect icons and facilities on the National Mall. Moreover, ISC is using our key facility protection practices as key management practices to guide its priorities and work activities. For example, ISC established subcommittees for technology best practices and training, and working groups in the areas of performance measures and strategic human capital management. ISC also issued performance measurement guidance in 2009. FPS is limited in its ability to influence the allocation of resources using risk management because security funding decisions are the responsibility of GSA and tenant agencies. Moreover, FPS uses an outdated risk assessment tool, a subjective approach, and a time-consuming process to conduct BSAs. GSA and tenant agencies have concerns about the quality and timeliness of FPS’s risk assessment services and in some cases, are assuming these responsibilities. Although FPS is taking steps to implement a new risk management program, it is unclear when all program components—such as risk assessment tools—will be fully implemented as FPS has extended initial implementation from fiscal year 2009 into fiscal year 2010. FPS’s new risk management program could help GSA and tenant agencies refine their resource allocation decisions if risk assessments are enhanced and FPS can help GSA and tenant agencies prioritize risks among all buildings. Until the risk management program is implemented, FPS will continue to use its current approach, which may leave some buildings and tenants vulnerable to terrorist attacks and crime. FPS’s ability to influence the allocation of resources based on the results of its risk assessments is constrained because GSA and tenant agencies must agree to fund recommended countermeasures, and we found that tenant agencies were sometimes unwilling to fund recommended security equipment. We have reported that a risk management approach to building protection generally involves identifying potential threats, assessing vulnerabilities, and evaluating mitigation alternatives for their likely effect on risk and their cost. Incorporating information on these elements, a strategy for allocating security-related resources is developed, implemented, and reevaluated over time as conditions change. Through the risk assessment process, FPS inspectors make recommendations for security fixtures and equipment which they include in BSA executive summaries that FPS is required to share with GSA and tenant agencies. GSA and tenant agencies determine whether to fund recommended security fixtures and GSA is responsible for acquiring, installing, and maintaining approved fixtures. Tenant agencies determine whether to fund recommended security equipment and FPS is responsible for acquiring, installing, and maintaining security equipment. However, tenant agencies may be unwilling to approve FPS’s security equipment countermeasure recommendations, in which case FPS views them as choosing to accept the risk. According to officials we spoke with from FPS, GSA, and tenant agencies, tenant agencies may not approve FPS’s security equipment countermeasure recommendations for several reasons: Tenant agencies may not have the security expertise needed to make risk-based decisions. Tenant agencies may find the associated costs prohibitive. The timing of the BSA process may be inconsistent with tenant agencies’ budget cycles. Consensus may be difficult to build among multiple tenant agencies. Tenant agencies may lack a complete understanding of why recommended countermeasures are necessary because they do not receive BSAs in their entirety. For example, in August 2007, FPS recommended a security equipment countermeasure—the upgrade of a surveillance system shared by two locations that, according to FPS officials, would cost around $650,000. While members of one BSC told us they approved spending between $350,000 and $375,000 to fund their agencies’ share of the countermeasure, they said that the BSC of the other location would not approve funding; therefore, FPS could not upgrade the system it had recommended. In November 2008, FPS officials told us that they were moving ahead with the project by drawing on unexpended revenues from the two locations’ building-specific fees and the funding that was approved by one of the BSCs. In May 2009, FPS officials told us that all cameras had been repaired and all monitoring and recording devices had been replaced, and that the two BSCs had approved additional upgrades and that FPS was implementing them. As we reported in June 2008, we have found other instances in which recommended security countermeasures were not implemented at some of the buildings we visited because BSC members could not agree on which countermeasures to implement or were unable to obtain funding from their agencies. Complicating the issue of FPS’s limitations in influencing risk-based resource allocation decisions, FPS inspectors use an outdated risk assessment tool, known as Federal Security Risk Manager, to produce BSAs which are also vulnerable to inspector error and subjectivity and can take a considerable amount of time to complete. GSA originally developed the risk assessment tool in the late 1990s when FPS was a part of GSA and updated it in 2002, and it moved with FPS when it was transferred to DHS in 2003. FPS has identified problems with the risk assessment tool and overall approach to developing BSAs, including The risk assessment tool contributes to BSA subjectivity because it lacks a rigorous risk assessment methodology. For example, the tool does not incorporate ISC standards or the National Infrastructure Protection Plan (NIPP) framework, therefore, inspectors must apply ISC standards during their reviews of BSAs produced from the risk assessment tool and modify these reports in accordance with the standards. Inspectors’ compliance with BSA policies and procedures is inconsistent and inspectors must search for risk information from different sources and perform duplicative data entry tasks making it difficult for inspectors to focus fully on the needs of GSA and tenant agencies. Additionally, inspectors record risk assessment findings on paper-based forms and then transfer data to the risk assessment tool and other systems manually, potentially introducing errors during the transfer. We concur with FPS’s findings and also believe the discretion given to inspectors in FPS’s risk assessment approach provides less assurance that vulnerabilities are being consistently identified and mitigated. Without consistent application of risk assessment procedures, FPS cannot assure GSA and tenant agencies that expenditures to implement its recommendations are necessary. Furthermore, FPS’s reliance on an outdated risk assessment tool provides less assurance that risks and mitigation strategies are adequately identified. We have previously reported on other concerns about FPS’s risk assessment tool. For example, the tool does not allow FPS to compare risks from building to building so that FPS, GSA, and tenant agencies can prioritize security improvements among the nearly 9,000 buildings within GSA’s inventory. The ability to compare risks among all buildings is important because it could allow FPS, GSA, and tenant agencies to comprehensively identify and prioritize risks and countermeasure recommendations at a national level and direct resources toward alleviating them. We also reported that the risk assessment tool does not allow FPS to further refine security improvement priorities based on more precise risk categories—rather than the high, medium, or low categories FPS inspectors use under the current system. Furthermore, we reported that the risk assessment tool does not allow FPS to track the implementation status of security recommendations based on assessments. Without this ability, FPS has difficulty determining the extent to which identified vulnerabilities at GSA buildings have been mitigated. Considering the steps involved, it can also take several months for FPS to complete a BSA. Some of these steps include conducting an on-site physical security survey, interviewing representatives from GSA and tenant agencies (an inspector may need to visit a site multiple times to meet with all pertinent officials), entering survey and interview results into the risk assessment tool and other systems such as the Security Tracking System, producing a BSA document that undergoes several layers of review and briefing representatives of tenant agencies and GSA on the BSA results and distributing the executive summary to them. An FPS supervisory officer told us that it took an average of 3 months to complete a BSA. The officer explained that it may take 2 to 5 weeks for an inspector to complete a security survey, interviews, and a BSA document. The officer gave an example that for one of the buildings within the region, an inspector must interview representatives from 30 tenant agencies. In another example, we found that an FPS inspector had completed a BSA report for one location in April 2008, but at the time of our visit in August 2008 the document was still undergoing supervisory review and tenant agency representatives and GSA had not yet been briefed on the results or received a copy of the executive summary. Furthermore, inspectors are responsible for conducting BSAs for multiple buildings. The inspectors we interviewed were each responsible for conducting BSAs and overseeing security operations at between 1 and 20 buildings. GSA security officials at the national and regional levels that we met with were concerned about the quality and timeliness of the risk assessment services that FPS provides. Officials explained that GSA created the current risk assessment tool hastily following the 1995 bombing of the Alfred P. Murrah Federal Building and that FPS inherited a flawed tool when it moved to DHS. GSA security officials expressed concerns over the quality of FPS’s BSAs. For example, GSA regional security officials told us that an FPS inspector recommended that GSA remove a structure from a building, because the inspector thought it blocked the view of the security guards. However, according to these officials, FPS had not cited this blocked view as a vulnerability or recommended the structure’s removal in previous BSAs, and to their knowledge, there had been no significant changes in identified threats, the space, or the building’s tenant composition. GSA security officials also told us that they have had difficulties receiving timely risk assessments from FPS for space that GSA is considering leasing. These risk assessments must be completed before GSA can take possession of the property and lease it to tenant agencies. An inefficient risk assessment process for new lease projects can add costs for GSA and create problems for both GSA and tenant agencies that have been planning for a move. ICE officials told us that there are many occasions where FPS is not notified by GSA of the need for a new lease assessment and in some cases, tenants have moved into leased space without FPS’s knowledge. GSA is updating a tool —the Risk Assessment Methodology Property Analysis and Ranking Tool (RAMPART)—that it began developing in 1998, but has not recently used, to better ensure the timeliness and comprehensiveness of these risk assessments. GSA expects to test and implement the system during fiscal year 2009. GSA security officials told us that they may use RAMPART for other physical security activities, such as conducting other types of risk assessments and determining security countermeasures for new facilities. The tenant agency officials we spoke with at the five sites did not raise concerns about FPS’s risk assessment process, but all of them told us that at the national level, their agencies were taking steps to pursue their own risk assessments for the exterior of their buildings, even though they pay FPS for this service. GSA security officials said they have seen an increase in the number of tenant agencies conducting their own risk assessments. They told us that they are aware of at least nine tenant agencies that are taking steps to acquire risk assessments for the exterior of their buildings. Additionally, we have previously reported that some tenant agencies had told us that they were using or planned to find contractors to complete additional risk assessments because of concerns about the quality and timeliness of FPS’s BSAs. We also reported that several DHS components and other tenant agencies were taking steps to acquire their own risk assessments because FPS’s assessments were not always timely or adequate. Similarly, we also found that many facilities had received waivers from FPS to enable the agencies to complete their own risk assessments. While tenant agencies have typically taken responsibility for assessing risk and securing the interior of their buildings, assessing exterior risks will require additional expertise and resources. This is an inefficient approach considering that tenant agencies are paying FPS to assess building security. However, ICE officials stated that in many cases, the agencies that are pursuing risk assessments are doing so to include both GSA and non-GSA buildings that they occupy, and that in other instances, agencies must adhere to other physical security standards and thus conduct their own assessments. FPS recognizes the inadequacies of its risk assessment tool, methodology, and process and is taking steps to develop a new risk management program. Specifically, FPS is developing the Risk Assessment and Management Program (RAMP) to improve the effectiveness of FPS’s risk management approach and the quality of BSAs. According to FPS, RAMP will provide inspectors with the information needed to make more informed and defensible recommendations for security countermeasures. FPS also anticipates that RAMP will allow inspectors to obtain information from one electronic source, generate reports automatically, enable FPS to track selected countermeasures throughout their life cycle, address some concerns about the subjectivity inherent in BSAs, and reduce the amount of time inspectors and managers spend on administrative work. Additionally, FPS is designing RAMP so that it will produce risk assessments that are compliant with ISC standards, compatible with the risk management framework set forth by the NIPP, and consistent with the business processes outlined in the MOA with GSA. FPS expects that the first phase of RAMP will include BSA and countermeasure management tools, among other functions. According to FPS, RAMP will support all components of the BSA process, including gathering and reviewing building information; conducting and recording interviews; assessing threats, vulnerabilities, and consequences to develop a detailed risk profile; recommending appropriate countermeasures; and producing BSA reports. According to FPS, RAMP’s countermeasure lifecycle management activities will include countermeasure design, review, recommendation, approval, implementation, acceptance, operation, testing, and replacement. FPS began designing RAMP in early 2007 and expects to implement the program in three phases, completing its implementation by the end of fiscal year 2011. However, it is unclear whether FPS will meet the implementation goals established in the program’s proposed timeline. In June 2008, we reported that FPS was going to implement a pilot version of RAMP in fiscal year 2009, but in May 2009, FPS officials told us they intend to implement the first phase in the beginning of fiscal year 2010. FPS officials also told us that RAMP training for inspectors will begin in October 2009 and conclude in December 2009. Until RAMP components are fully implemented, FPS will continue to rely on its current risk assessment tool, methodology, and process, potentially leaving GSA and tenant agencies dissatisfied. GSA security officials are aware that RAMP’s development and implementation have run behind schedule and are concerned about when improvements to FPS’s risk assessment processes will be made. Under the 2006 MOA, FPS and GSA recognized that revisions and enhancements would need to be made to the risk assessment process, and FPS agreed it would work in consultation with GSA on any modifications to risk assessment tools. FPS shared RAMP plans with GSA in 2007 and solicited feedback, yet GSA security officials told us they think collaboration could have been stronger and have concerns about RAMP’s ability to meet their physical security needs. For example, as stated earlier, GSA relies on FPS to provide it with risk assessments for buildings that it wants to lease, but because FPS does not provide these assessments in a timely manner GSA is taking steps to implement its own risk assessment tool by the end of fiscal year 2009. According to FPS, RAMP will include a risk assessment tool for new lease projects, but it did not include this component in the first development phase and instead, this tool is scheduled for rollout at the end of fiscal year 2010. FPS officials told us that as they move forward with RAMP, they intend to ask GSA and tenant agencies what risk assessment information they need from BSA reports. Also, FPS officials told us they are reassessing building security levels using ISC’s updated facility security level standards and a specialized calculator tool. The updated ISC standards take factors other than a building’s size and population into account, including mission criticality, symbolism, threats to tenant agencies, and other factors such as proximity to a major transportation hub. FPS is trying to meet ISC’s target date of September 30, 2009, for finalizing updated building security levels for nearly 9,000 GSA buildings. According to FPS, inspectors began reassessing building security levels during June 2008 and as of May 2009, FPS officials told us that inspectors had determined preliminary security levels for all buildings, and finalized security levels for 3,100 buildings. FPS officials told us inspectors have been following ISC guidance in reassessing the facility security levels which require that the tenant agencies make the final security level determination. However, GSA security officials at the national office told us they were receiving feedback from GSA security officials in the regions that some FPS inspectors were presenting the updated security levels as mandatory and final, not as preliminary results to be discussed. Risk management practices provide the foundation of a comprehensive protection program. Hence, efforts in the other key practice areas— leveraging technology and information sharing and coordination—are diminished if they are not part of a risk management approach which can be the vehicle for using these tools. It is critical that FPS—which is responsible for assessing risk for nearly 9,000 GSA buildings and properties that GSA may lease—replace its outdated, subjective, and time- consuming risk assessment tool and approach with the new program it has been developing since fiscal year 2007, especially as the results of its risk analyses lay the foundation for FPS, GSA, and tenant agencies’ security efforts. DHS is the nation’s designated leader of critical infrastructure protection efforts; therefore, it is critical that RAMP be developed in an expeditious manner so that DHS can fulfill this mission with regard to federal facilities that FPS protects. Furthermore, department level attention in ensuring that FPS achieves success through regular updates to the Secretary is warranted. This added oversight would enhance the department’s ability to monitor RAMP development and make FPS accountable for results, given the delays that RAMP has already experienced. FPS’s approach to leveraging technology does not ensure that the most cost-effective technologies are being selected to protect GSA buildings. Individual inspectors make technology decisions with limited training and guidance, giving GSA and tenant agencies little assurance that vulnerabilities have been systematically mitigated within and among all buildings as cost-effectively as possible. Although FPS is developing a program for technology acquisition, its implementation has been delayed and it does not include an evaluative component to ensure cost- effectiveness. As previously discussed, FPS inspectors recommend security fixtures to GSA and security equipment to tenant agencies through the BSA process. However, the training, guidance, and standards that FPS provides to inspectors for selecting technologies are limited. As a result, GSA and tenant agencies have little assurance that the countermeasures inspectors recommend are cost-effective and the best available alternative. We have previously reported that by efficiently using cost-effective technology to supplement and reinforce other security measures, agencies can more effectively apply the appropriate countermeasures to vulnerabilities identified through the risk management process, and that linking the chosen technology to countermeasures identified as part of the risk management process provides assurance that factors such as purpose, cost, and expected performance have been addressed. Furthermore, we have recognized that having a method that allows for cost-effectively leveraging technology to supplement and reinforce other measures represents an advanced application of the key practice. Through the BSA process, FPS recommends security fixtures to GSA, and GSA has policies and procedures in place to guide its decisions about the recommended investments and to identify and acquire cost-effective fixtures through established contracts with vendors. FPS inspectors also recommend technology-related security equipment through the BSA process and acquire, install, and maintain the security equipment that tenant agencies approve for purchase. FPS does not have a comprehensive approach for identifying, acquiring, and assessing the cost-effectiveness of the security equipment that its inspectors recommend. Instead, individual FPS inspectors identify equipment for its purchase, installation, and maintenance. FPS officials told us that inspectors make technology decisions based on the initial training they receive, personal knowledge and experience, and contacts with vendors. FPS inspectors receive some training in identifying and recommending security technologies as part of their initial FPS physical security training. Since FPS was transferred to DHS in 2003, its refresher training program for inspectors has primarily focused on law enforcement. Consequently, inspectors lack recurring technology training. Supervisory officers and inspectors from two of the five sites we visited told us that they learn about security technologies on their own by reviewing industry publications and by attending trade shows and security conferences but inspectors must have the time and funding to attend. A supervisory officer from one FPS region told us the region has sent some inspectors to security conferences sponsored by ASIS International. Additionally, FPS does not provide inspectors with specialized guidance and standards for cost-effectively selecting technology. In the absence of specific guidance, inspectors follow the DOJ minimum countermeasure standards and other relevant ISC standards but these standards do not assist users in selecting cost-effective technologies. FPS’s devolution of responsibility for selecting technology to individual inspectors, whose knowledge of existing and emerging technologies varies because it is built on limited training and personal experience, results in subjective equipment selection decisions. Additionally, the acquisition process can be time-consuming for inspectors—many of whom have other law enforcement and security duties for multiple buildings—because they must search for equipment and vendors and facilitate the establishment of installation and maintenance contracts. FPS’s process for acquiring, installing, and maintaining technologies provides GSA and tenant agencies with little assurance that they are getting the highest-quality, most cost- effective technology security solutions and that common vulnerabilities are being systematically mitigated across all buildings. For example, an explosives detection dog was used at one location to screen mail that is distributed elsewhere. In 2006, FPS had recommended, based on the results of its risk analysis, the use of this dog and an X-ray machine, although at the time of our visit only the dog was being used. Moreover, the dog and handler work 12-hour shifts Monday through Friday when most mail is delivered and shipped, and the dog needs a break every 7 minutes. The GSA regional security officials we spoke with questioned whether this approach was more effective and efficient than using an on- site enhanced X-ray machine that could detect biological and chemical agents as well as explosives and could be used anytime. In accordance with its policies, FPS conducted a BSA of the site in 2008 and determined that using an enhanced X-ray machine and an explosives detection dog would bring the projected threat rating of the site down from moderate to low. FPS included estimated one-time installation and recurring costs in the BSA and executive summary, but did not include the estimated cost and risk of the following mail screening options: (1) usage of the dog and the additional countermeasure; (2) usage of the additional countermeasure only; and (3) usage of the dog only. Consequently, tenant agency representatives would have to investigate the cost and risk implications of these options on their own to make an informed resource allocation decision. FPS is taking steps to implement a more systematic approach to technology acquisition by developing a National Countermeasures Program, which could help FPS leverage technology more cost-effectively. According to FPS, the program will establish standards and national procurement contracts for security equipment, including X-ray machines, magnetometers, surveillance systems, and intrusion detection systems. FPS officials told us that instead of having inspectors search for vendors to establish equipment acquisition, installation, and maintenance contracts, inspectors will call an FPS mission support center with their countermeasure recommendations, and the center will procure the services through standardized contracts. According to FPS, the program will also include life-cycle management plans for countermeasures. FPS officials explained that the National Countermeasures Program establishes contractual relationships through GSA Schedule 84 to eliminate the need for individual contracting actions when requirements for new equipment or services are identified. FPS officials told us they worked closely with GSA’s Federal Acquisition Service (FAS) to develop the program and FAS officials concurred stating, for example, that the two agencies have collaborated to ensure that GSA Schedule 84 has a sufficient number of vendors to support FPS requirements for physical security services. FPS officials said they established an X-ray machine contract through the schedule and that future program contracts will also explore the use of the schedule as a source for national purchase and service contracts. According to FPS, the National Countermeasures Program should provide the agency with a framework to better manage its security equipment inventory; meet its operational requirement to identify, implement, and maintain security equipment; and respond to stakeholders’ needs by establishing nationwide resources, streamlining procurement procedures, and strengthening communications with its customers. FPS officials told us they believe this program will result in increased efficiencies because inspectors will not have to spend their time facilitating the establishment of contracts for security equipment because these contracts will be standardized nationwide. Additionally, FPS officials told us that they participate in the research and development of new technologies with DHS’s Science and Technology Directorate. Although the National Countermeasures Program includes improvements that may enhance FPS’s ability to leverage technology, it does not establish tools for assessing the cost-effectiveness of competing technologies and countermeasures and implementation has been delayed. Security professionals are faced with a multitude of technology options offered by private vendors, including advanced intrusion detection systems, biotechnology options for screening people, and sophisticated video monitoring. Having tools and guidance to determine which technologies most cost-effectively address identified vulnerabilities is a central component of the leveraging technology key practice. FPS officials told us that the National Countermeasures Program will enable inspectors to develop countermeasure cost estimates that can be shared with GSA and tenant agencies. However, incorporating a tool for evaluating the cost- effectiveness of alternative technologies into FPS’s planned improvements in the security acquisition area would represent an enhanced application of this key practice. Another concern is that FPS had planned to implement the program throughout fiscal year 2009, but extended implementation into fiscal year 2010 and thus it is not clear whether FPS will meet the program’s milestones in accordance with updated timelines. For example, FPS had anticipated that the X-ray machine and magnetometer contracts would be awarded by December 2008, and that contracts for surveillance and intrusion detection systems would be awarded during fiscal year 2009. In May 2009, FPS officials told us that the X-ray machine contract was awarded on April 30, 2009, and that they anticipated awarding the magnetometer contract in the fourth quarter of fiscal year 2009 and an electronic security services contract for surveillance and intrusion detection systems during the second quarter of fiscal year 2010. FPS had planned to test the program in one region before implementing it nationwide, but after further consideration, FPS management decided to forgo piloting the program in favor of rolling it out nationally. Until the National Countermeasures Program is fully implemented, FPS will continue to rely on individual inspectors to make technology decisions. It would be beneficial for FPS to establish a process for determining the cost-effectiveness of technologies considering the cost and risk implications for the tenant agencies that determine whether they will implement FPS’s countermeasure recommendations. FPS, GSA, and tenant agencies share information and coordinate in a variety of ways at the national, regional, and building levels; however, FPS inspectors do not meet regularly with GSA property managers and tenant agencies, FPS and GSA disagree over what threat and risk information should be shared, and FPS faces technical obstacles to communicating directly with other law enforcement agencies when responding to incidents. At the national level, FPS and GSA share information and coordinate in a variety of ways. We have reported that information sharing and coordination among organizations is crucial to producing comprehensive and practical approaches and solutions to address terrorist threats directed at federal buildings. FPS and the Building Security and Policy Division within GSA’s PBS hold two biweekly teleconferences—one to discuss building security issues and priorities and the other to discuss the status of GSA contractor security background checks. FPS officials stated that this regular contact with GSA has made their relationship more productive and promotes coordination. GSA security officials also recognize the importance of these teleconferences, although they would like more involvement from FPS such as having better follow-through on meeting action items. Additionally, FPS and GSA are both members of ISC and serve together on various subcommittees and working groups. The FPS Director and the Director of the PBS Building Security and Policy Division participate in an ISC executive steering committee, which sets the committee’s priorities and agendas for ISC’s quarterly meetings. These activities could enhance FPS’s and GSA’s collaboration in implementing ISC’s security standards and potentially lead to greater efficiencies. According to FPS and ISC, FPS has consistently participated in ISC working groups, but the staff assigned to some of the groups changed from meeting to meeting. GSA security officials also cited limitations with FPS’s staffing of ISC working groups. FPS and GSA have also established an Executive Advisory Council to enhance the coordination and communication of security strategies, policies, guidance, and activities with tenant agencies in GSA buildings. As the council’s primary coordinator, FPS convened the group for the first time in August 2008, and 17 agencies attended. According to FPS, it intends to hold semiannual council meetings, and as of May 2009, FPS had not held a second formal meeting. This council could enhance communication and coordination between FPS and GSA, and provide a vehicle for FPS, GSA, and tenant agencies to work together to identify common problems and devise solutions. Furthermore, FPS and GSA are renegotiating the 2006 MOA between DHS and GSA to, among other things, improve communication. However, officials told us that this process has been time-consuming and the two parties have different views on the outcomes. FPS and GSA began renegotiating the MOA during fiscal year 2008 and expected to finalize it during fiscal year 2009. However, in May 2009, FPS officials told us they do not have an estimated date for finalizing the MOA and GSA officials told us they do not anticipate reaching an agreement until fiscal year 2010. FPS and GSA recognize that the renegotiation can serve as an opportunity to discuss service concerns and develop mutual solutions. While FPS and GSA concur that the MOA should be used as an accountability tool, FPS thinks the document should offer general guidelines on the services it provides, but GSA wants a more prescriptive agreement. Overall, FPS and GSA regional officials told us that FPS shares some information with GSA and that collaboration between the two agencies has improved. However, the agencies’ satisfaction with this situation differs. The FPS regional officials we spoke with said the agencies’ information sharing and coordination procedures work well, while GSA regional security officials told us that communication should be more frequent and the quality of the information shared needs to be improved. Moreover, according to the GSA officials, FPS’s sporadic and restricted sharing of threat information limits GSA’s ability to protect its properties. We have reported that by having a process in place to obtain and share information on potential threats to federal buildings, agencies can better understand the risks they face and more effectively determine what preventive measures should be implemented. Additionally, we have reported that sharing terrorism-related information that is critical to homeland security protection is important, and agencies need to develop mechanisms that support this type of information sharing. The 2006 MOA between DHS and GSA requires FPS to provide GSA with quarterly briefings at the regional level. However, GSA regional security officials told us that they were not receiving related threat information as part of these updates until October 2008, when the FPS Director—in response to feedback from GSA—instructed regional personnel to share threat information. The FPS Director advised Regional Directors to meet quarterly with their respective GSA regional administrators, regional commissioners, or security representatives to discuss and share information on regional security issues. The Director further stated that briefings should include unclassified intelligence information concerning threats against GSA buildings and updates to the regional threat assessment, as well as information and analysis on protecting the regions’ most vulnerable facilities. Moreover, in its strategic plan, FPS recognizes the importance of ensuring that policies and procedures are being established and followed consistently across the country, and asserts that effective communication between headquarters and regional personnel at all levels will aid in this effort. GSA officials also told us that they are taking steps to replicate headquarters structures in their regions to ensure consistent applications of policies and to standardize communication practices. While FPS’s action to share threat information is a positive step, GSA security officials at the national office told us they received feedback from security staff in the regions that threat briefings were not uniform across regions and varied in their usefulness. The majority of the briefings, the officials said, communicated information about crime incidents and did not, in their view, provide threat information. In May 2009, FPS officials told us that regions gave briefings during the second quarter of fiscal year 2009, but GSA security officials told us that some regions reported that they had not received these second quarter briefings. To improve information sharing and coordination at the regional level, FPS standardized its quarterly threat briefing format. FPS officials told us that they partnered with GSA to create a sensitive but unclassified (SBU) facility-specific companion document to the BSA called the “Facility Security Assessment Threat Summary.” According to FPS, this quarterly threat briefing will contain facility-specific information on security performance measures, criminal activity, unclassified intelligence regarding threats, significant events, special FPS law enforcement operations, and potential threats, demonstrations, and other events. FPS officials told us that this quarterly threat briefing format is a positive step in providing a briefing document that GSA can use in evaluating threat information that is germane to its property portfolio. FPS officials told us that they finalized the briefing format and that the Director signed the General Services Administration Threat Briefing Policy directive in June 2009. In contrast, in June 2009, GSA security officials told us that they believe they had little involvement in developing FPS’s threat briefing format explaining that although FPS asked GSA to comment on its proposed format—which, according to GSA, it did in March 2009—FPS had not discussed GSA’s comments with them or updated GSA on the content or status of the format. GSA security officials told us they have representation on an ISC working group that is developing a standardized design basis threat template to support risk assessment threat ratings. According to the 2006 MOA, FPS is to meet with GSA property managers and tenant agency representatives when it discusses the results of its BSAs. Depending on the building’s security level, the BSA may occur every 2 to 4 years. Apart from these briefings, FPS, GSA, and tenant agencies choose how frequently they will all meet. An information sharing best practice that we have reported on is holding regularly scheduled meetings during which participants can, for example, share security management practices, discuss emerging technologies, and create committees to perform specific tasks, such as policy setting. It is critical that FPS, as the provider of law enforcement and related security services for GSA buildings, and GSA, as the manager of these properties, have well- established lines of communication with each other and with tenant agencies to ensure that all parties are aware of the ever-changing risks in a dynamic threat environment and that FPS and GSA are taking appropriate actions to reduce vulnerabilities. Nevertheless, we identified information sharing gaps at all the sites we visited, and found that in some cases these deficiencies led to decreased security awareness and increased risk. At one location, we observed during our interview with the building security committee (BSC) that the committee members were confused about procedures for screening visitors who are passengers in employees’ cars that enter the building via the parking garage. One of the tenants recounted an incident in which a security guard directed the visitor to walk through the garage to an appropriate screening station. According to the GSA property manager, this action created a safety hazard. The GSA property manager knew the appropriate screening procedure, but told us there was no written policy on the procedure that members could access. Additionally, BSC members told us that the committee met as needed. At one location, FPS had received inaccurate square footage data from GSA and had therefore overcharged the primary tenant agency for a guard post that protected space shared by all the tenants. According to the GSA property manager, once GSA was made aware of the problem, the agency obtained updated information and worked with the tenant agencies to develop a cost-sharing plan for the guard post, which made the primary tenant agency’s security expenses somewhat more equitable. BSC members told us that the committee met regularly. At one location, members of a BSC told us that they met as needed, although even when they hold meetings, one of the main tenant agencies typically does not participate. GSA officials commented that this tenant adheres to its agency’s building security protocols and does not necessarily follow GSA’s tenant policies and procedures which GSA thinks creates security risks for the entire building. At one location, tenant agency representatives and officials from FPS told us they met regularly, but GSA officials told us they were not invited to these meetings. GSA officials at this location told us that they invite FPS to their property management meetings for that location, but FPS does not attend. GSA officials also said they do not receive timely incident information for the site from FPS and suggested that increased communication among the agencies would help them be more effective managers of their properties and provide tenants with better customer service. At one location, GSA undertook a major renovation project beginning in April 2007. FPS, GSA, and tenant agency representatives did not all meet together regularly to make security preparations or manage security operations during construction. FPS officials told us they had not been invited to project meetings, although GSA officials told us that they had invited FPS and that FPS attended some meetings. In May 2008, FPS discovered that specific surveillance equipment had been removed. As of May 2009, FPS officials told us they did not know who had removed the equipment and were working with tenant agency representatives to recover it. However in June 2009, tenant agency representatives told us that they believed FPS was fully aware that the equipment had been removed in December 2007. To improve information sharing and coordination at the building level, FPS and GSA plan to implement ISC’s facility security committee standards at all multitenant and single-tenant buildings and campuses after ISC issues them. FPS and GSA could leverage these standards to establish consistent communications and designate the roles and responsibilities of FPS, GSA, and tenant agencies. FPS and GSA have had representation on the ISC working group that is developing the standards. ISC intends to issue the standards in the first quarter of fiscal year 2010, but it is unclear when FPS and GSA will implement them. GSA security officials also told us that FPS does not consistently or comprehensively inform GSA of changes to services or provide GSA with contingency plans when FPS deploys inspectors and other personnel to provide law enforcement, security, and emergency response services for special events in support of broader homeland security goals. For example, GSA security officials cited some instances in which FPS reduced its services during the 2009 Presidential Inauguration. They noted, for example, that FPS inspectors did not attend BSC meetings and said that FPS did not inform GSA of all service changes. FPS’s response to special events and critical incidents is governed by the FPS Interim Critical Incident Response Plan issued by the Director in September 2007. This plan does not include procedures for notifying GSA and tenant agencies of expected service changes, restrictions, and modifications at the national, regional, and building levels. FPS officials told us that FPS notified tenant agencies in the National Capital Region of expected servi changes, restrictions, and modifications during the 2009 inauguration. Officials also said that, when possible, inspectors personally contacted GSA building managers and tenant agency representatives in the region. However, FPS personnel were deployed from all regions in accordance with the critical incident response plan and FPS officials did not tell us that regions other than the National Capital Region were notified. Becau GSA and tenant agencies rely on FPS to provide critical law enforcement and security services and tenant agencies pay for these services, we believe it is important for FPS to notify these entities in advance of se changes and provide for interim coverage. While FPS and GSA acknowledge that the two organizations are partners in protecting and securing GSA buildings, FPS and GSA fundamentally disagree over how much of the information in the BSA should be shared Per the MOA, FPS is required to share the BSA executive summary with GSA and FPS believes that this document contains sufficient information for GSA to make decisions about purchasing and implementing FPS’s recommended countermeasures. However, GSA officials at all levels ci limitations with the BSA executive summary saying, for example, that it does not contain enough contextual information on threats and vulnerabilities to support FPS’s countermeasure recommendatio justify the expenses that GSA and tenant agencies would incur by installing additional countermeasures. Moreover, GSA security officials told us that FPS does not consistently share BSA executive summaries across all regions. Instead, GSA wants to receive BSAs in their entirety s that it can better protect its buildings and the tenants who occupy them. The BSA executive summary includes . a brief description of the building; an overview of the risk assessment methodology; types of threats that the building is exposed to and their risk ratings; countermeasure recommendations, estimated installation and gs after countermeasure implementation. In contrast, a complete BSA includes a detailed description of the physic al features of the building and its terviewees and contact information; a profile of occupants and agency missions; recent losses, crimes, and security violations previous security surveys, inspections, and rela investigations, and studies; descriptions of threats and risk ratings; installation and recurring costs; and projected threat ratings after counter measure implementation. When FPS was housed within GSA and PBS, GSA security officials that FPS shared BSAs in their entirety with GSA, but now at the national level, GSA can request full BSAs from FPS, and FPS makes determinations on a case-by-case basis by following and interpreting DHS information sharing policies. However, GSA security officials told us that the process for requesting BSAs is informal and that FPS has not been responsive to these requests overall. Furthermore, considering there are nearly 9,000 buildings in GSA’s inventory, this may be an inefficient approach to obtain key facility protection information. We have found that information sharing and coordination are important at the individual building level and that protecting federal buildings requires building security managers to told us involve multiple organizations to effectively coordinate and share information to prevent, detect, and respond to terrorist attacks. According to GSA, building protection functions are an integral part of its property preservation, operation, and management responsibilities. In 2000, when FPS was still a part of GSA, Congress considered removing FPS from PBS. At that time, GSA opposed such action asserting that it would divorce security from other federal building functions when security considerations needed to be integrated into decisions about the location, design, and operation of federal buildings. GSA was concerned that separating FPS from PBS would create an organizational barrier between protection experts and PBS asset managers, planners, project managers, and building managers who set PBS budgets and policies for the GSA inventory as a whole and oversaw day-to-day operations in GSA buildings. However, Congress did not remove FPS from PBS, and FPS remained within GSA and PBS until it was transferred to DHS and ICE under the Homeland Security Act of 2002. Prior to the creation of DHS, we expressed concern about separating security from other real property portfolio functions, such as site location, design, and construction for new federal buildings, because decisions on these factors have implications for what types of security will be necessary and effective. We concluded that if DHS was given the responsibility for securing GSA facilities, the role of integrating security with other real property functions would be an important consideration, especially since GSA would still be the caretaker of these buildings. Under the Homeland Security Act of 2002, FPS was transferred to DHS and retained responsibilities for law enforcement and related security functions for GSA buildings and grounds. However, except for law enforcement and related security functions transferred to DHS, under the act, GSA retained all powers, functions, and authorities in law, related to the operation, maintenance, and protection of its buildings and grounds. As a result of the act, GSA and DHS both have protection responsibilities for GSA-controlled buildings and grounds. DHS and GSA developed an MOA to address roles, responsibilities, and operational relationships between FPS and GSA concerning the security of GSA-controlled space. Through this agreement, DHS and GSA determined that FPS would continue to conduct BSAs for GSA. GSA security officials told us that GSA staff at the national, regional, and building levels need the information contained in the BSA to cost-effectively manage their buildings to ensure that they are secure and that their customers, or tenant agencies, are adequately protected. Because GSA personnel do not receive the entire BSA, they must decide on the basis of incomplete information how to use funds to implement countermeasures and mitigate vulnerabilities. Furthermore, GSA property managers are responsible for coordinating and maintaining emergency management plans, such as evacuation and continuity of operations plans, and when a safety or security incident arises at a GSA building, GSA assumes a lead role in the incident command. Without complete risk information, GSA is challenged to maintain appropriate situational awareness and preparedness to protect buildings, especially during emergencies. Although the Director of FPS recognizes that FPS and GSA have common interests in protecting GSA buildings and the federal employees who work in them, the Director has determined that GSA does not meet the standards under which FPS shares BSAs and maintains that BSA executive summaries provide GSA with sufficient information. FPS designates the SBU information contained in BSAs as “law enforcement sensitive” (LES) in accordance with DHS and ICE policies. FPS considers the BSA to be an LES document because it incorporates all aspects of a location’s physical security into one document whose release outside of the law enforcement arena could adversely impact the conduct of law enforcement programs. According to FPS, the BSA can include LES information such as: information, details, or criminal intelligence data indicating why a threat is deemed credible; information and details relating to any ongoing criminal investigations, law enforcement operations, or both; and detailed analysis of why the lack or inadequacy of a countermeasure creates an exploitable vulnerability. According to FPS, LES information is safeguarded and determinations to disseminate LES information are made in accordance with a DHS information safeguarding management directive and an ICE directive for safeguarding LES information. FPS maintains that GSA does not need to know the LES information that is contained in the BSA and that if the BSA is released to GSA, the risk of unscrupulous or criminal use of the information would increase significantly. According to FPS, the information contained in the BSA is not critical to GSA’s performance of its authorized, assigned mission. FPS further maintains that GSA retains no legal responsibility for the physical protection and law enforcement operations within GSA buildings because the Homeland Security Act of 2002 transferred FPS’s law enforcement and related security functions from GSA to DHS and that under the act it is responsible for protecting the buildings, grounds, and property under GSA’s control or custody. We have reported on the importance of sharing terrorism-related information that is critical to homeland security protection and have identified a need for agencies to develop mechanisms that support this information sharing. Other federal agencies have found ways to share sensitive information with other entities. For example, in response to a GAO recommendation, the Transportation Security Administration established regulations that allow for sharing sensitive security information with persons covered by the regulations who have a need to know, including airport and aircraft operators, foreign vessel owners, and Transportation Security Administration employees. The ICE directive for safeguarding LES information states that an information sharing and access agreement in the form of a memorandum of understanding or agreement may formalize LES information exchanges between DHS and an external entity. Moreover, according to standard language in FPS’s BSAs, a security clearance is not required for access to LES information; a criminal history check and a national fingerprint check—performed in accordance with Homeland Security Presidential Directive 12 (HSPD-12) investigative requirements—is required. According to GSA, it follows these requirements. Moreover, GSA has an information safeguarding policy in place to protect SBU building information which can include: the location and details of secure functions or space in a building such as secure routes for prisoners and judges inside courthouses; the location and details of secure functions or secure space such as security and fire alarm systems; the location and type of structural framing for the building including any information regarding structural analysis, such as counterterrorism methods used to protect the building and occupants; and risk assessments and information regarding security systems or strategies of any kind. In the 2006 MOA, FPS and GSA agreed that shared SBU information would be handled in accordance with each agency’s information safeguarding policies. Furthermore, one of FPS’s strategic goals is to foster relationships to increase the proactive sharing of information and intelligence. In its strategic plan, FPS states that it will use efficient information sharing and information protection processes based on mutually beneficial, trusted relationships to ensure the implementation of effective, coordinated, and integrated infrastructure protection programs and activities. When we spoke with FPS and GSA officials in 2008, they thought the MOA renegotiation could serve as a platform for determining what BSA information should be shared. However, when we spoke with FPS and GSA officials in 2009, they did not know when the MOA would be renegotiated and FPS determined it would not change BSA sharing procedures during the renegotiation. Therefore, GSA will continue to receive BSA executive summaries and the individual BSAs that FPS approves for sharing, but it will not have access to other BSA information that it could use to make risk-based decisions to protect its buildings, the federal employees who work in them, and visitors to these buildings. In a post-September 11 era, it is crucial that federal agencies work together to share information to advance homeland security and critical infrastructure protection efforts. Information is a crucial tool in fighting terrorism, and the timely dissemination of that information to the appropriate government agency is absolutely critical to maintaining the security of our nation. The ability to share security-related information can unify the efforts of federal agencies in preventing or minimizing terrorist attacks. However, in the absence of comprehensive information-sharing plans, many aspects of homeland security information sharing can be ineffective and fragmented. In 2005, we designated information sharing for homeland security as a governmentwide high-risk area because of the significant challenges faced in this area—challenges that are still evident today. It is critical that FPS and GSA—which both have protection functions for GSA buildings, their occupants, and those who visit them— reach consensus on sharing information in a timely manner to support homeland security and critical infrastructure protection efforts. GSA raises strong arguments for having this information and FPS could do more to resolve this situation. FPS provides the law enforcement response for incidents at GSA buildings, during which it may need to communicate with other first responders. Additionally, DHS can call upon FPS to provide law enforcement and security services at natural disasters or special events such as political demonstrations, and FPS must then communicate with other federal, state, and local first responders. For these situations, having an interoperable communication system is desirable. However, first responders continue to use various, and at times incompatible, communications technologies, making it difficult to communicate with neighboring jurisdictions or other first responders to carry out the response. We noted during our review that FPS radios lack interoperability, meaning they are unable to communicate with the equipment used by other law enforcement agencies—federal, state, and local. Delayed communications with area first responders during emergencies could curtail the timeliness and effectiveness of FPS’s law enforcement services. FPS officials at one location told us that only new FPS vehicles have had radio upgrades, some FPS personnel have new hand-held radios, and other handheld radios have not been changed in 6 years. Changes in radio technology can inhibit interoperability among first responders who upgrade equipment as possible. FPS officials at one location told us that FPS can use the same radio frequency as the local police department, but the two organizations’ radio systems are not fully interoperable because the police use a digital system and FPS does not. Therefore, communication between these entities can be limited. FPS officials at one location told us that federal and local law enforcement agencies communicate with FPS via telephone or through the area FPS MegaCenter, instead of directly through radios, because the organizations’ radio systems are not interoperable. Therefore, communication among these entities can be limited. FPS officials at one location told us that FPS’s handheld radios are not interoperable with those of area federal and local law enforcement personnel, because FPS does not use the same radio band spectrum other federal law enforcement agencies use and instead uses its own ultra-high-frequency band. As a result, communication among these entities is limited. FPS officials at one location told us that their radios are not interoperable with those of the local police department. Therefore, communication between the two entities can be limited. FPS is exploring whether it can connect to the police department through a local interagency communications system. FPS is developing a National Radio Program that includes a component intended to make FPS’s radios interoperable with those of other federal, state, and local law enforcement organizations. FPS began planning this initiative in 2008, was working to fill the program manager position by the end of June 2009, and expects to achieve full implementation by 2013. According to FPS officials, they have established a branch under the FPS MegaCenter program specifically dedicated to enhancing and supporting the National Radio Program. Consistent with establishing this new branch, FPS officials said they are working to fill contract positions in each region for radio technicians to support the technical requirements associated with mobile radios, portable radios, programming, and the radio network infrastructure. According to FPS, they are working to contract for a survey and design team to coordinate with FPS’s regional offices, the National Radio Program, and the MegaCenter program to standardize and enhance the national radio infrastructure. According to FPS officials, the enhancements to FPS’s communications will provide solutions for newer technologies and will meet national communications standards and DHS standards for advanced encryption. FPS officials said they are beginning an internal evaluation of FPS’s existing communications capabilities, which should allow future enhancement efforts to be prioritized as part of an overall effort to enhance national radio coverage. FPS officials said they are working to procure, program, and issue more than 2,900 new radios that conform to new equipment standards and will eventually phase out older equipment used by FPS officers and guards. FPS officials said that all future radios issued will conform to updated standards to promote uniformity and enhanced support capabilities. While FPS officials think interoperability will be improved under this initiative, they cautioned that their law enforcement counterparts’ communication equipment must meet DHS’s advanced encryption standard which can be a challenge for state and local partners. FPS has a number of improvements planned or in development that, if fully incorporative of the key practices, will provide greater assurance that FPS is effectively protecting GSA buildings and maximizing security investment dollars. The key practices we examined vis-à-vis FPS— allocating resources using risk management, leveraging technology, and information sharing and coordination—are critical components to an effective and efficient physical security program. However, FPS’s application of these practices had limitations and as a result, there is a lack of assurance that federal buildings under the control and custody of GSA, the employees who work in them, and visitors to them are being adequately protected. Related to allocating resources using risk management, FPS’s assessment of risks at buildings is a critical responsibility considering the results lay the foundation by which GSA and tenants make resource allocation decisions. However, FPS’s current risk assessment process is inadequate and its efforts to improve it through the development of RAMP have been delayed. Related to leveraging technology, planned improvements to the way inspectors acquire security equipment through the National Countermeasures Program have also experienced delays and knowing the cost implications of different alternatives is the foundation of this key practice, although FPS is not directly addressing this critical element. Continued delays in the implementation of improvements in these critical areas—risk management and leveraging technology—are of concern and deserving of greater attention by DHS management. Furthermore, related to information sharing and coordination, FPS’s communications with GSA and tenants could benefit from more clearly defined parameters for consistency, frequency, and content, and issues related to interoperability with other law enforcement agencies surfaced as a concern that FPS is trying to address. Without a greater focus on the key practices, FPS will be ill- equipped to sufficiently manage security at GSA buildings, and assist with broader homeland security efforts as the security landscape changes and new threats emerge. We are making three recommendations to the Secretary of Homeland Security aimed at moving FPS toward greater use of the key practices we assessed. Specifically, we recommend that the Secretary instruct the Director of FPS, in consultation, where appropriate, with other parts of DHS, GSA, and tenant agencies to take the following three actions: 1. Provide the Secretary with regular updates, on a mutually agreed-to schedule, on the status of RAMP and the National Countermeasures Program, including the implementation status of deliverables, clear timelines for completion of tasks and milestones, and plans for addressing any implementation obstacles. 2. In conjunction with the National Countermeasures Program, develop a methodology and guidance for assessing and comparing the cost- effectiveness of technology alternatives. 3. Reach consensus with GSA on what information contained in the BSA is needed for GSA to fulfill its responsibilities related to the protection of federal buildings and occupants, and accordingly, establish internal controls to ensure that shared information is adequately safeguarded; guidance for employees to use in deciding what information to protect with SBU designations; provisions for training on making designations, controlling, and sharing such information with GSA and other entities; and a review process to evaluate how well this information sharing process is working, with results reported to the Secretary regularly on a mutually agreed-to schedule. We provided a draft of the sensitive but unclassified report to DHS and GSA for review and comment. DHS agreed with our assessment that greater attention to key practices would improve FPS’s approach to facility protection and agreed with the report’s recommendations. Furthermore, DHS stated that FPS will continue to work with key stakeholders to address other security issues that were cited in our report, for which specific recommendations were not made. With respect to the first recommendation—to provide the Secretary of Homeland Security with regular updates on the status of RAMP and the National Countermeasures Program—DHS stated that FPS will submit a consolidated monthly report to the Secretary. Although DHS agreed with our second and third recommendations, we are concerned that the steps it described are not comprehensive enough to address the intent of the recommendations. For the second recommendation—to develop a methodology and guidance for assessing and comparing the cost-effectiveness of technology alternatives—DHS commented that such efforts will be a part of FPS’s development of RAMP and that future phases of RAMP will include the ability to evaluate countermeasure alternatives based on cost and the ability to mitigate identified risks. However, RAMP has experienced delays and it is unclear when this future component of RAMP will be developed and implemented. Moreover, as we reported, FPS inspectors have considerable latitude in determining which technologies and other countermeasures to recommend, but receive little guidance to help them assess the cost- effectiveness of these technologies. Until the cost-analysis component of RAMP is implemented, it will be important for inspectors to have guidance they can use to make cost-effective countermeasure recommendations so that GSA and tenant agencies can be assured that their investments in FPS-recommended technologies and other countermeasures are cost- effective, consistent across buildings, and the best available alternatives. Regarding the third recommendation—to reach consensus with GSA on what information contained in the BSA is needed for GSA to fulfill its protection responsibilities and to establish information sharing and safeguarding procedures—DHS responded that FPS is developing a facility security assessment template as a part of RAMP to produce reports that can be shared with GSA and other agencies. However, DHS did not explicitly commit to reaching consensus with GSA in identifying building security information that can be shared, or to the steps we outlined in our recommendation—steps that in our view comprise a comprehensive plan for sharing and safeguarding sensitive information. As we reported, FPS and GSA fundamentally disagree over what BSA information should be shared and FPS has decided not to discuss this matter with GSA as part of the MOA renegotiation. Furthermore, RAMP continues to experience delays and it is unclear when it will produce facility security assessments than can be shared with GSA. Therefore, it is important that FPS engage GSA in identifying what building security information can be shared and follow the information sharing and safeguarding steps we included in our recommendation to ensure that GSA acquires the information it needs to protect the 9,000 buildings under its control and custody, the federal employees who work in them, and those who visit them. GSA agreed with our findings concerning the challenges that FPS faces in delivering security services for GSA buildings. GSA indicated that it will continue to work closely with FPS to ensure the protection of GSA buildings, their tenants, and visitors to these buildings. GSA stated that it will work with FPS to address our recommendation that the two agencies reach a consensus on the sharing and safeguarding of information contained in BSAs. DHS also provided technical comments, which we incorporated where appropriate. DHS’s comments can be found in appendix II and GSA’s comments can be found in appendix III. As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies of this report to the Secretary of Homeland Security, the Acting Administrator of General Services, appropriate congressional committees, and other interested parties. In addition, the report will be available at no charge on GAO’s Web site at http://www.gao.gov. If you have any questions about this report, please contact me at (202) 512- 2834 or goldsteinm@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix IV. The objective of this report was to determine whether the Federal Protective Service’s (FPS) approach to security for buildings under the control and custody of the General Services Administration (GSA) reflects key facility protection practices. Through previous work, we identified a set of key practices from the collective practices of federal agencies and private sector entities that can provide a framework for guiding agencies’ protection efforts and addressing challenges. These key practices form the foundation of a comprehensive approach to building protection. We used our key facility protection practices as criteria to evaluate the steps that FPS has taken. We used the following key practices as criteria: allocating resources using risk management; leveraging technology; and information sharing and coordination. For the purposes of this review, we did not consider three other key practices for varying reasons: performance measurement and testing, because we reported on the limitations FPS faces in assessing its performance in 2008; aligning assets to mission, because GSA, not FPS, controls the asset inventory; and strategic management of human capital, because we are currently reviewing FPS’s management of human capital. To examine FPS’s application of key practices at the building level, we selected five sites, basing our selection on factors that included geographical diversity, high occupancy, the building’s designated security level, other potential security considerations such as new or planned building construction, and recent and ongoing work. Selected sites included three multitenant level IV buildings, one single-tenant level IV campus, and one single-tenant level III campus. Collectively, the sites we selected illustrate the range of building protection practices applied by FPS. At each site, we interviewed FPS, GSA, and tenant agency officials with primary responsibility for security implementation, operation, and management. We toured each site and observed the physical environment, the buildings, and the principal security elements to gain firsthand knowledge of the building protection practices. We collected documents, when available, that contained site- specific information on security risks, threats, budgets, and staffing for analysis. Because we observed FPS’s efforts to protect GSA buildings at a limited number of sites, our observations cannot be generalized to all the buildings that FPS is responsible for securing. To supplement these site visits, we interviewed FPS and GSA security officials from the four regions where we had visited buildings—regions 2, 4, 7, and 11. We also interviewed FPS and GSA security officials at the national level and collected supporting documentation on security plans, policies, procedures, budgets, and staffing for analysis. For example, we reviewed the 2006 Memorandum of Agreement between the Department of Homeland Security (DHS) and GSA that sets forth the security responsibilities of FPS and GSA at federal buildings. We also interviewed the executive director of the Interagency Security Committee (ISC), and we analyzed ISC’s Facility Security Level Determinations for Federal Facilities, Security Design Criteria for new Federal Office Buildings and Major Modernization Projects, and Security Standards for Leased Space. We also analyzed the facility security level standards and minimum security requirements set forth by the Department of Justice’s (DOJ) DOJ Vulnerability Assessment of Federal Facilities. We analyzed FPS planning documents, including FPS’s 2008-2011 Strategic Plan and the Risk Assessment and Management Program Concept of Operations. We analyzed laws that described FPS and GSA’s protection authorities including the Homeland Security Act of 2002, and Title 40 of the United States Code. We also analyzed laws and internal documents that govern FPS’s information safeguarding practices including DHS Management Directive 11042.1, Safeguarding Sensitive But Unclassified Information and ICE Directive 73003.1, Safeguarding Law Enforcement Sensitive Information. We conducted this performance audit from January 2008 to September 2009 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objective. In addition to the contact named above, David Sausville, Assistant Director; Denise McCabe, Analyst-in-Charge; Anne Dilger; Elizabeth Eisenstadt; Brandon Haller; Robin Nye; Susan Michal-Smith; and Adam Yu made key contributions to this report.

Summary: There is ongoing concern about the security of federal buildings and their occupants. The Federal Protective Service (FPS) within the Department of Homeland Security (DHS) is responsible for providing law enforcement and related security services for nearly 9,000 federal buildings under the control and custody of the General Services Administration (GSA). In 2004, GAO identified a set of key protection practices from the collective practices of federal agencies and the private sector that included: allocating resources using risk management, leveraging technology, and information sharing and coordination. As requested, GAO determined whether FPS's security efforts for GSA buildings reflected key practices. To meet this objective, GAO used its key practices as criteria, visited five sites to gain firsthand knowledge, analyzed pertinent DHS and GSA documents, and interviewed DHS, GSA, and tenant agency officials. FPS's approach to securing GSA buildings reflects some aspects of key protection practices, and FPS has several improvements underway such as a new risk assessment program and a countermeasure acquisition program. While FPS's protection activities exhibit some aspects of the key practices, GAO found limitations in each of the areas. FPS assesses risk and recommends countermeasures to GSA and tenant agencies; however, FPS's ability to influence the allocation of resources using risk management is limited because resource allocation decisions are the responsibility of GSA and tenant agencies, which may be unwilling to fund FPS's countermeasure recommendations. Moreover, FPS uses an outdated risk assessment tool and a subjective, time-consuming process. As a result, GSA and tenant agencies are uncertain whether risks are being mitigated. Concerned with the quality and timeliness of FPS's risk assessment services, GSA and tenant agencies are pursuing some of these activities on their own. Although FPS is developing a new risk management program, full implementation is not planned until the end of fiscal year 2011 and has already experienced delays. With regard to leveraging technology, FPS inspectors have considerable latitude for selecting technologies and countermeasures that tenant agencies fund, but FPS provides inspectors with little training and guidance for making cost-effective choices. Additionally, FPS does not provide tenant agencies with an analysis of alternative technologies, their cost, and associated reduction in risk. As a result, there is limited assurance that the recommendations inspectors make are the best available alternatives and tenant agencies must make resource allocation decisions without key information. Although FPS is developing a program to standardize security equipment and contracting, the program has run behind schedule and lacks an evaluative component for assessing the cost-effectiveness of competing technologies and countermeasures. FPS has developed information sharing and coordination mechanisms with GSA and tenant agencies, but there is inconsistency in the type of information shared and the frequency of coordination. Lack of coordination through regular contact can lead to communication breakdowns. For example, during a construction project at one location, the surveillance equipment that FPS was responsible for maintaining was removed from the site during 2007. FPS and tenant agency representatives disagree over whether FPS was notified of this action. Furthermore, FPS and GSA disagree over what building risk assessment information can be shared. FPS maintains that the sensitive information contained in the assessments is not needed for GSA to carry out its mission. However, GSA maintains that restricted access to the risk assessments constrains its ability to protect buildings and occupants.