As a DHS component, TSA follows the department’s policies and procedures for managing its acquisition programs. DHS has established policies and procedures for acquisition management, test and evaluation, and resource allocation. The department uses these policies and procedures to deliver systems that are intended to close critical capability gaps and enable DHS to execute its missions and achieve its goals. DHS’s policies govern TSA’s acquisition programs and are primarily set forth in DHS Acquisition Management Directive 102-01 (AD 102). DHS acquisition policy establishes that an acquisition decision authority shall review the program through the acquisition life cycle phases. Under this directive, an important aspect of an acquisition decision authority’s review and approval of acquisition programs is to ensure that key acquisition documents are completed, including (1) a life cycle cost estimate, which provides an exhaustive and structured accounting of all resources and associated cost elements required to develop, produce, deploy, and sustain a program, and (2) the acquisition program baseline, which establishes a program’s cost, schedule, and performance parameters. When an acquisition program exceeds cost, schedule, or performance thresholds, it is considered to be in breach. TSA’s acquisition policies, which supplement DHS policies, generally designate roles and responsibilities and identify the procedures that TSA is to use to implement the requirements in DHS policies. For example, a TSA policy designates an official to ensure TSA’s acquisition programs comply with AD 102, including the review and approval of key acquisition program management documents and determining required acquisition documentation for TSA programs. In addition, a TSA policy guide provides the procedures that TSA is to use to meet the acquisition review and reporting requirements defined in AD 102. TSA has policies and procedures that address TSARA’s requirements for justifying acquisitions, including a security-related technology acquisition. TSA had implemented most of these procedures prior to TSARA’s enactment because they were required by existing DHS and TSA policy. For acquisition justifications, TSARA provides that before TSA implements any security-related technology acquisition the agency must, in accordance with DHS policies and directives, conduct an analysis to determine whether the acquisition is justified, or whether the benefits exceed the cost of the acquisition. TSA’s policies and procedures address this requirement. One change resulting from TSARA is the requirement that TSA notify Congress at least 30 days preceding contract awards for new security-related technology acquisitions exceeding $30 million, which TSA addressed by developing new procedures. See appendix I for our detailed analysis on the status of TSA’s efforts to implement all TSARA requirements. TSA policies and procedures address TSARA provisions related to justifying acquisitions by requiring the development and approval of specific acquisition documents, including a concept of operations and an analysis of alternatives, prior to the implementation of an acquisition. The concept of operations is to include identifying scenarios of transportation security risk and assessing how the use of the proposed acquisition would help improve transportation security. The analysis of alternatives is to include identifying different security solutions, including technology and non-technology solutions, and an analysis of the operational effectiveness, cost, and benefits of each viable solution. Regarding the requirement that congressional notification be made in advance of obtaining acquisitions of more than $30 million, TSA amended its policies to include the 30-day notification for contracts exceeding $30 million awarded after TSARA’s enactment. TSA also developed a template for a notification letter to Congress that is to include a certification by the TSA Administrator. Consistent with TSARA, TSA is to provide 5-day notice for contract awards that exceed $30 million to facilitate a rapid response if there is a known or suspected imminent threat to transportation security. TSA officials stated they will continue to provide 5-day notice for all individual task order awards or delivery order awards exceeding $1 million or more based on policies in effect prior to TSARA’s enactment. According to TSA officials, TSA has not yet awarded a contract for security-related technology in excess of $30 million since TSARA’s enactment. These officials also said that there have been no acquisitions related to a known or suspected imminent threat to transportation security that would require TSA to immediately notify Congress since TSARA’s enactment. TSA has policies and procedures in place that address TSARA’s requirements to establish acquisition baselines and review whether acquisitions are meeting these requirements. These policies and procedures were largely established prior to TSARA’s enactment. For example, TSA acquisition policies require that TSA prepare an acquisition program baseline, a risk management plan, and the acquisition program office staffing requirements before obtaining an acquisition. According to TSARA, TSA must report a breach if there is a cost overrun of more than 10 percent, a delay in actual or planned schedule for delivery of more than 180 days, or a failure to meet any performance milestone that directly affects security effectiveness. TSA’s TSARA Implementation Strategy Memorandum addresses TSARA’s requirements for reporting breaches to Congress. Specifically, the memorandum designates the Office of Acquisition as being responsible for implementing TSARA breach requirements and includes procedures that outline the steps TSA should take to notify DHS and Congress about breaches. According to TSA’s TSARA Implementation Strategy Memorandum, TSA had existing policies that require breach memorandums and remediation plans when breaches occur. The procedures state that in the event of a breach, TSA will provide a report to Congress that includes the cause and type of breach and a corrective action plan. In addition, TSA officials have briefed acquisition program staff about TSARA’s breach notification requirement changes. Prior to TSARA’s enactment, TSA followed DHS’s acquisition policies that defines breaches against an acquisition program baseline as performance failures, schedule delays, or cost overruns of up to 15 percent, and did not mandate reporting breaches to congressional committees. As required by TSARA, TSA established procedures to notify Congress within 30 days of schedule delays, cost overruns, or performance failures constituting a breach against acquisition program baselines. As of December 2015, TSA reported that it had not experienced such breaches in any existing acquisitions since TSARA’s enactment. TSA’s policies and procedures address TSARA requirements for managing inventory related to, among other things, (1) using existing units before procuring more equipment; (2) establishing policies and procedures to track the location, use, and quantity of security-related equipment in inventory; and (3) providing for the exception from using just-in-time logistics, a process that involves delivering equipment directly from manufacturers to airports to avoid the need to warehouse equipment. For example, TSA’s Security Equipment Management Manual describes the policies and procedures that require TSA to use equipment in its inventory if, for example, an airport opens a new terminal or it recapitalizes security-related technology at the end of its life cycles. Additionally, the current TSA system tracks the location, utilization status, and quantity of security-related equipment in inventory. Further, TSA’s policies and procedures describe TSA’s system of internal controls in place prior to TSARA’s enactment to conduct reviews, which require reporting and following up on corrective actions. TSA’s Security Equipment Management Manual provides for two exemptions from just- in-time logistics that are applicable if just-in-time logistics would (1) inhibit planning needed for large-scale equipment delivery to airports or other facilities or (2) reduce TSA’s ability to respond to a terrorist threat. In accordance with TSARA, TSA must execute its acquisition-related responsibilities in a manner consistent with and not duplicative of, the FAR and DHS policies and directives. TSA policy documents state that TSA is required to ensure that its policies and directives are in accordance with the FAR and DHS acquisition and inventory policies and procedures. According to TSA’s TSARA Implementation Strategy Memorandum, TSA was able to address this requirement. For example, TSA formed a working group, chaired by TSA Executive Secretariat staff, as part of an effort to ensure that TSA implemented TSARA in a manner that was consistent with the FAR and DHS policies and directives. DHS officials further reported that TSA’s actions towards implementation of TSARA requirements is part of DHS’s Acquisition Review Board process and has not led to any duplication or inconsistency with the FAR or AD 102. TSA submitted a Strategic Five-Year Technology Investment Plan (the Plan) to Congress that generally addresses TSARA-mandated elements. For example, the Plan that TSA submitted to Congress identifies capability gaps and security-related technology acquisition needs and procedures. Specifically, the Plan describes TSA’s test, evaluation, modeling, and simulation capabilities, and identifies security- related technologies that are at or near the end of their life cycles. In addition, the Plan identifies TSA’s efforts to provide the private sector with greater predictability and clarity about TSA’s security-related technology needs and acquisition procedures by sharing testing documents and plans. TSA also took steps to ensure that the Plan adhered to TSARA by (1) consulting with DHS officials and an advisory committee, (2) obtaining approval of the Secretary of Homeland Security prior to publishing the Plan, (3) incorporating private sector input on the Plan, and (4) identifying the nongovernment persons who contributed to writing the Plan. TSARA required TSA to submit a report to congressional committees on TSA’s performance record in meeting its published small business contracting goals during fiscal year 2014. In April 2015, TSA reported for fiscal year 2014 that it fell 1.5 percent short of its small business contracting goal of 23 percent, and 1.6 percent short of its Historically Underutilized Business Zones (HUBZone) program goal of 3 percent of its total contracts. To meet its small business contracting goal, TSA would have had to award an additional $22 million in contracts to small businesses of its $1.5 billion in total contracts. According to TSA officials, small businesses’ limited ability to support security-related technology acquisition and TSA’s existing large scale prime contract awards to large businesses for human resources and information technology are part of the challenges that it faces in meeting its small business goals. TSARA provides that if the small business contracting goals are not met, or if the agency’s performance is below the published DHS small business contracting goals, TSA’s report is to include a list of challenges that contributed to TSA’s performance and an action plan, prepared after consultation with other federal departments and agencies. The report submitted by TSA includes an action plan for integrating small business concerns into the acquisition planning procedures and enhancing outreach to disabled, women-owned and HUBZone businesses. TSA’s small business officials also said that they attend monthly meetings with officials from other DHS components’ small business units and conduct outreach events with small businesses. To develop the action plan, TSA did not consult with the Secretary of Defense and the heads of federal departments and agencies that met their small business goals as required by TSARA. However, TSA officials said that they met with the Department of Defense Office of Small Business Programs after they developed the action plan and the agency plans to fully comply with TSARA’s small business requirements in the future. DHS and TSA officials reported that to date TSA has not identified any efficiencies, cost savings, or delays from its implementation of TSARA. TSA officials further stated that because many of their current policies and procedures that met the provisions of the law were in place prior to TSARA’s enactment, it was unlikely for TSARA to result in major cost savings, efficiencies, or delays. TSA officials reported that they recently developed a mechanism to track its progress in implementing follow-on actions identified in the Plan, such as ongoing stakeholder engagement, as well as to track progress and identify challenges and best practices in implementing TSARA requirements to help update the Plan. We provided a draft of this report to DHS for review and comment. DHS did not provide formal comments but provided technical comments from TSA which we incorporated as appropriate. We are sending copies of this report to the appropriate congressional committees and the Secretary of Homeland Security. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-7141 or groverj@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix II. In the following tables, we identify the status of Transportation Security Administration (TSA) efforts to address requirements of the Transportation Security Acquisition Reform Act (TSARA). Jennifer A. Grover, (202) 512-7141 or groverj@gao.gov. In addition to the contact named above, Glenn Davis (Assistant Director), Nima Patel Edwards (Analyst-in-Charge), David Alexander, Rodney Bacigalupo, Richard Hung, Thomas Lombardi, Luis E. Rodriguez, Tovah Rom, Carley Shinault, and Edith Sohna made key contributions to this report.

Summary: Within DHS, TSA is the federal agency with primary responsibility for preventing and defending against terrorist and other threats to domestic transportation systems. From fiscal years 2002 through August 2015, TSA obligated $13.4 billion to acquire security-related technologies such as through the Electronic Baggage Screening Program and the Passenger Screening Program. However, GAO and the DHS Office of Inspector General have reported that TSA did not fully follow DHS policies in deploying Advanced Imaging Technology systems to screen passengers and in estimating costs to screen checked baggage, and faced challenges in managing inventory. Enacted in December 2014, TSARA specifies measures that TSA must take to improve transparency and accountability in acquiring security-related technologies. TSARA contains a provision that GAO report to Congress on TSA's progress in implementing TSARA. This report examines TSA's actions taken toward addressing TSARA. GAO is not fully evaluating the extent to which TSA is implementing the act at this time because TSA has not undertaken an acquisition of security-related technology subject to the requirements of the act since its enactment. Pursuant to TSARA, GAO will report again on TSA's implementation of the act in approximately 3 years. TSA provided technical comments on a draft of this report which GAO incorporated as appropriate. DHS did not provide formal comments. The Transportation Security Administration (TSA) in the Department of Homeland Security (DHS) has policies and procedures that generally address requirements of the December 2014 Transportation Security Acquisition Reform Act (TSARA). Specifically, TSA policy and procedures address TSARA requirements for justifying acquisitions, establishing baselines, managing inventory, and submitting plans, among other requirements. Justifying Acquisitions TSA had taken action toward addressing most TSARA requirements related to justifying acquisitions prior to TSARA's enactment because they were required by existing DHS and TSA acquisition policies. Consistent with TSARA, TSA amended its policies to notify Congress within 30 days of awarding contracts exceeding $30 million for the acquisition of security-related technology. According to agency officials, TSA has not made any such new acquisitions since the enactment of TSARA. Acquisition Baselines TSA policies require that it prepare an acquisition program baseline, risk management plan, and staffing requirements before acquiring security-related technology. Consistent with TSARA, TSA established policies to notify Congress within 30 days of making a finding of performance failures, schedule delays, or cost overruns constituting a breach against acquisition program baselines. TSA reported that it had not experienced breaches in any existing acquisitions (i.e., those in place prior to December 2014) since the enactment of TSARA. Managing Inventory TSA's policies and procedures address TSARA requirements for using existing units before procuring more equipment; tracking the location, use, and quantity of security-related equipment in inventory; and using just-in-time delivery to avoid warehousing equipment. Submitting Plans TSA submitted its Technology Investment Plan and Small Business Report to Congress as required by TSARA. The Technology Investment Plan addresses required elements such as identifying security gaps and security-related technology needs and processes. The Small Business Report includes an action plan for integrating the concerns of small businesses into acquisition processes and increasing outreach to targeted small businesses. DHS and TSA officials said that TSA has not yet identified any efficiencies, cost savings, or delays from its implementation of TSARA. They added that because many of the policies and procedures that meet the provisions of the act were in place prior to the enactment of TSARA, it was unlikely for TSARA to result in major efficiencies, cost savings, or delays. According to TSA officials, TSA has developed mechanisms to monitor various aspects of TSARA, such as tracking progress in implementing planned technology programs.