The National Mall in Washington, D.C., is one of the most recognizable landscapes in the United States and serves as both the public setting for our nation’s Capital as well as home to some of the most visited museums in the world. Along the National Mall are numerous monuments and memorials to our nation’s history and heritage. According to the Park Service, approximately 24-million people visit the National Mall each year. Various federal entities are responsible for the physical security of the National Mall which includes conducting risk assessments of the National Mall’s assets and implementing measures to protect those assets, employees, and the visiting public. The open spaces of the National Mall, along with the Washington Monument and the Jefferson and Lincoln Memorials, are administered and maintained by Interior’s Park Service and patrolled by the Park Police. The Park Police is responsible for protecting the three icons as well as the other monuments and memorials, and Park Police officers have law enforcement jurisdiction on the National Mall and its environs. One of the Park Police’s specialized units is its Icon Protection Unit, which is comprised of personnel who possess specialized training and knowledge of the icons. Among Interior’s other offices, OLES (located within the Office of the Secretary) oversees Interior’s security efforts across the department. The Smithsonian and the National Gallery also have a number of museums and galleries on the National Mall, and each is responsible for the physical security of its respective facilities. The Smithsonian was created by an act of Congress in 1846 and is considered the world’s largest museum and research complex. It consists of 19 museums and galleries, 12 of which are on the National Mall; the National Zoological Park; and 9 research facilities. The Smithsonian’s Office of Protection Services oversees security at the Smithsonian, which includes policing its assets and grounds; screening individuals who enter its facilities; responding to undesirable events; and assessing its physical security risks and implementing countermeasures to minimize, monitor, and control the probability that an undesirable event might occur. In 2016, the Smithsonian’s 12 museums and galleries on the National Mall had almost 23-million visits, and the Smithsonian employed about 5,800 employees, volunteers, fellows, and researchers on the National Mall as of December 31, 2016. Conceived of by financier Andrew W. Mellon, the National Gallery was created by a joint resolution of Congress in 1937, and it maintains two facilities on the National Mall—known as the East and West Buildings—and a 6-acre outdoor sculpture garden. As with the Smithsonian, the National Gallery also has an Office of Protection Services that serves as its primary security and risk-management office responsible for protecting the National Gallery’s assets, employees, and the visiting public. The National Gallery’s East and West buildings had almost 3 million visits during 2016, and it employed about 1,400 employees and volunteers at the end of 2016. Risk management is a continuous process of managing—through a series of mitigating actions—the likelihood of an undesirable event and its negative impact. Our past work has shown that risk management approaches generally involve identifying potential threats, assessing vulnerabilities, identifying the assets that are most critical to protect in terms of mission and significance, and evaluating mitigation alternatives to assess their effectiveness. With this information, federal entities can then decide how to allocate their resources to address risks. Risk management principles acknowledge that while risk cannot always be eliminated, steps can be taken to reduce it. ISC, an interagency organization chaired by DHS, has developed physical security standards for nonmilitary federal facilities in the United States. One of the primary ISC standards is known as the RMP, and it defines the criteria and process federal entities should follow to assess risks to their facilities and determine which countermeasures—such as blast resistant windows and intrusion detection systems—should be in place to reduce risk to an acceptable level. The RMP was not written with the application to the Washington Monument and the Jefferson and Lincoln Memorials in mind. However, ISC has noted that the risk management methodology upon which the RMP is based can be used for such structures. In addition, while only executive branch departments and agencies are required to cooperate and comply with ISC policies and recommendations, ISC has noted that the RMP is intended to be applied to all buildings in the United States occupied by federal employees for nonmilitary activities. As shown in figure 2, the risk management process that ISC has set forth for federal facilities begins with determining the Facility Security Level (FSL), which is a categorization that ranges from Level I (lowest risk) to Level V (highest risk) based on the analysis of security-related factors, such as symbolism, population (e.g., employees and visitors), and size. That categorization serves as the basis for identifying security enhancements or countermeasures that should be implemented at federal facilities to reduce the level of risk to an acceptable level. Because risk assessments play a key role in the risk management process, ISC has developed standards for these assessments. For example, ISC requires that risk assessments consider the likelihood of certain undesirable events (which range from theft to active shooter), and the RMP provides entities with an integrated, single source of information on physical security enhancements that entities should implement to effectively minimize risk and meet baseline levels of protection. To determine whether a facility meets recommended baseline levels of protection, the RMP includes criteria, which vary by FSL, in the following categories: Site: facility perimeter, exterior areas and assets, and parking. Structure: structural hardening, façade, windows, and building systems. Facility entrance: employee and visitor entrances and exits, loading docks, and other openings in the building envelope. Interior: space planning and security of specific interior spaces. Security systems: intrusion-detection, access control, and closed- circuit television (CCTV) camera systems. Security operations and administration: management and decision- making and the handling and receiving of mail. The RMP also notes that performance measurement data are essential to appropriate decision-making and provides guidance on implementing a comprehensive performance measurement and testing program. According to ISC, performance measures should be based on an entity’s goals and objectives. Examples of performance measures for physical security programs include the number and types of security incidents, the time it takes to respond to security incidents, and the percentage of countermeasures deployed within a given time frame. In addition, the RMP notes that testing can be useful in assessing how well countermeasures are performing. Testing can include operational efforts, such as determining whether equipment is calibrated properly, determining if security guards are knowledgeable about procedures, and determining if intrusion detection systems are activating properly. Testing can also include procedures to test emergency response or planned exercises to breach security to ensure that existing countermeasures are capable of securing a facility. Interior, the Smithsonian, and the National Gallery are assessing the physical security risks to the icons, museums, and galleries on the National Mall. Conducting risk assessments is a key component of a risk management approach, and over the years we have advocated the use of a risk management approach as an analytical tool to help address various national security and terrorism issues. Our prior work has shown that taking a risk management approach provides federal entities with useful information to make security-related decisions and direct resources to address any unmitigated risk. By assessing the risk to the National Mall’s assets, Interior, the Smithsonian, and the National Gallery are demonstrating that they are taking a risk management approach to meet the demands of a complex security environment. Interior assesses the physical security risks to the icons on the National Mall using a departmental policy that reflects government-wide homeland- security objectives for critical infrastructure. As discussed above, the RMP was not written with application to the Washington Monument and the Jefferson and Lincoln Memorials in mind; accordingly, Interior does not follow the RMP when assessing the physical security risks to the icons. Rather, Interior’s offices and bureaus are to follow requirements specified in a departmental policy related to the security of national critical infrastructure and other key resources. Interior issued this policy in 2006 in response to The National Strategy for the Physical Protection of Critical Infrastructure and Key Assets and Homeland Security Presidential Directive 7, which provided federal agencies with guidance on assessing risks to critical infrastructure. Among other things, Interior’s policy establishes minimum security requirements for safeguarding critical infrastructure such as the icons and includes requirements for the following: Security personnel: assignments, coverage, locations, and available equipment, such as having an armed security force on site 24 hours a day. Perimeter security: physical barriers and CCTV monitoring, such as having a physical perimeter with barriers to prevent unauthorized vehicular access. Access control security: the entry of persons, mail, packages, and vehicles, such as using high security locks and securing door hinges. Interior security: prevention of criminal or terrorist activity, such as securing utility areas and having back-up power for critical systems such as alarms. Security planning: security planning and coordination, such as reviewing construction projects for security enhancements. To ensure the department’s minimum security requirements for critical infrastructure are met, Interior requires OLES to conduct periodic compliance assessments. For the icons on the National Mall, OLES and the Park Police jointly conduct these assessments, which involve interviews with security personnel and onsite inspections of physical security systems and operational procedures. The Smithsonian assesses security risks to its museums and galleries by following the RMP as well as its own internal security-design standards. Executive Order 12977 applies only to executive branch departments and agencies. For the purposes of Executive Order 12977, the Smithsonian is not treated as an executive branch department or agency required to follow the RMP. However, Smithsonian officials told us they view the RMP as a best practice and voluntarily follow the RMP when assessing the physical security risks to their facilities on the National Mall. To conduct these assessments, officials with the Smithsonian’s Office of Protection Services review past security-incident reports, crime statistics, and each facility’s site and floor plans. Officials also conduct on-site inspections and interview security personnel and facility managers to identify their security concerns. These assessments are conducted in conjunction with an internal assessment that the Office of Protection Services performs to assess each facility’s compliance with its own internal security-design standards—an assessment that provides an additional layer of guidance on mitigating risks associated with cultural property protection, common crime, terrorist attacks, and other threats. Information from both of these assessments is captured in a database that allows the Smithsonian to document its risk management decisions and analyze data across its facilities on the National Mall and elsewhere. For example, using this database, Smithsonian’s Office of Protection Services is able to document any security deficiencies it discovers and then to analyze, aggregate, and prioritize future projects to address those deficiencies. Regarding the National Museum of African American History and Culture (which opened in September 2016), the Smithsonian took steps to identify potential risks to the site—which is located at the southwest corner of Constitution Avenue and 14th Street, west of the National Museum of American History and across from the Washington Monument—and address those risks during the facility’s design and construction. Specifically, when the museum was in the initial stages of design, a contractor conducted a risk assessment of the site which included determining its FSL and providing recommendations based on the requirements included in the RMP. According to the Smithsonian’s Office of Protection Services, the findings and recommendations from this assessment were the primary resource they drew from in addressing the National Museum of African American History and Culture’s physical security needs as it was constructed. Like the Smithsonian, the National Gallery also assesses security risks to its galleries by voluntarily following the RMP. Prior to 2016, the National Gallery engaged a security contractor to assess its compliance with the RMP. However, during the course of our review, and, in response to our inquiries, the National Gallery sent staff to receive training on ISC’s risk management process, thereby enabling the National Gallery to conduct its own assessments. While the National Gallery is taking steps to assess its security risks, we found that it does not have complete documentation of its risk management decisions. Documenting risk management decisions is important for several reasons. The RMP states that the threat to federal facilities is significant and that decisions to accept risk could have serious consequences. To that end, the RMP requires that risk management decisions be documented. In addition, we have previously reported that risk management, as it pertains to facility protection, relies heavily on having accurate and timely information. Documentation is also a necessary part of an effective internal control system, and federal internal control standards state that federal entities should complete and document corrective actions to remediate internal control deficiencies on a timely basis. Without documentation, decision makers may not effectively understand the rationale behind decisions—or, in the case of risk management—make important security-related decisions and direct resources to address unmitigated risks. During the initial inquiries of our work conducting the sensitive aspects of this review, officials told us that due to a lack of complete documentation they had limited institutional knowledge of the National Gallery’s risk management decisions as they relate to physical security. Because of a lack of documentation, we received inconsistent or incomplete information throughout that review. While National Gallery officials agreed to address concerns we raised to them, we believe there is an opportunity for the National Gallery to address gaps in its institutional knowledge and help ensure more informed decision-making—specifically, by developing a process to document its risk management decisions. Interior, the Smithsonian, and the National Gallery each collect information on various aspects of the performance of their physical security programs; however, each is at a different stage of developing goals and linking performance measures to these goals. While measuring the performance of physical security programs can be challenging, we have reported that monitoring and evaluating actions taken against strategic objectives and performance measures is part of the “loop” of risk management and helps ensure that an entity’s objectives are being accomplished. A key part of performance measurement is setting meaningful goals and measuring progress toward those goals, according to our prior work. Establishing goals helps an entity focus on what it is trying to achieve. Accordingly, goals should be objective, measurable, and quantifiable. Once an entity has defined its goals, we have reported that developing performance measures that are linked to those goals can help it assess progress. In addition, the RMP, which the Smithsonian and National Gallery voluntarily follow, states that federal entities should use performance measurement to assess and document the effectiveness of their physical security programs, and it notes that performance measures should be linked to goals. According to the RMP, an example of a goal could be to ensure that facilities are compliant with the RMP within a given time period, and examples of performance measures for monitoring progress toward that goal could be the number of completed risk assessments and the number of countermeasures implemented. As discussed above, documenting activities is also part of an effective internal control system and helps to ensure that goals are met. Interior, the Smithsonian, and the National Gallery have taken steps to incorporate aspects of performance measurement into their physical security programs, and each plans to improve how it measures performance, specifically: The Park Police uses information it collects to manage its physical security program and has identified goals and performance measures to assess the effectiveness of its efforts; however, its efforts align with a strategic plan that has not been updated in more than 10 years and does not specifically document how performance measures are linked to goals. According to officials, the Park Police’s goals are defined in a strategic plan that covers fiscal years 2006-2009. This plan contains several goals and action steps needed to implement these goals; however, it has not been updated since 2006. One of the goals included in this plan is to ensure that the icons and visitors are protected from harm, and the plan includes steps that should be taken to implement that goal, such as maintaining sustainable and effective patrol coverage and enhancing equipment and training of security guards assigned to the icons. In addition, the Park Police monitors a variety of performance measures on a monthly basis. While officials described to us how some of these performance measures were connected to a goal about protecting the icons—such as the number of security incidents that pose a threat to the icons and the percentage of security patrols that pass inspection—the connection between their performance measures and goals are not documented as part of their strategic plan. As a result, it is not clear how all of these performance measures link to the Park Police’s goals. Further, officials told us that both their goals and performance measures need to be updated. The Park Police intends to develop a new strategic plan this summer. According to Park Police officials, that plan will include updated goals and performance measures linked to those goals. The Smithsonian uses performance measures to monitor various aspects of its physical security program, and while it plans to link these performance measures to overall program goals, it has not yet identified these goals. For example, the Smithsonian has analyzed its security staffing levels to identify the numbers and types of staff needed to secure its facilities and collections, and it conducts ongoing monitoring of its staffing levels. The Smithsonian has a variety of performance measures and has defined performance targets for some of them—such as compliance rates with the RMP and its own security design criteria, security staffing levels, the frequency with which risk assessments are conducted, and actions taken in response to security alarms—but it has not identified overall goals for its physical security program. Smithsonian officials told us that they have focused on other priorities for their security program in the past, such as managing day-to-day concerns and addressing needed upgrades. However, these officials told us they recognize the importance of establishing program-wide goals and plan to address this need as part of an effort they are currently undertaking to develop a strategic plan for security. Smithsonian officials noted that they are in the early stages of this effort and do not know when it will be completed and that efforts to develop their strategic plan for security have been delayed in the past due to other priorities. Smithsonian officials told us they also intend to link their performance measures to program goals but noted that this effort would be separate from the strategic plan, and they have not identified where they would document this linkage. The National Gallery uses information to monitor its physical security program and is starting to link performance measures and goals as part of several ongoing efforts. National Gallery officials told us that their past priorities have been fire-safety upgrades and projects in their Master Facilities Plan, but they have recognized the need to link performance measures and goals. As part of a new National Gallery- wide risk-management process, officials have identified two goals related to security—protecting the landmark buildings and ensuring the safety of the staff and the visiting public. Further, the National Gallery has documented plans to develop goals and performance measures. Officials anticipate that the National Gallery’s leadership will approve the goals, and they plan to submit performance measures for approval to the National Gallery’s leadership by September 2017. In a parallel effort, the National Gallery is also developing a master security plan, and as part of this plan officials intend to develop goals and performance measures. However, this plan is still in draft form and time frames for implementation are unclear because the plan would need leadership approval and some steps outlined in the plan will require approval for additional funding. The Park Police, the Smithsonian, and the National Gallery have opportunities to take a more strategic approach to performance measurement—specifically, by developing goals where they are needed and linking their performance measures to these goals, so that they can better assess the effectiveness of their physical security programs. Each of these entities has recognized the value of a more strategic approach and is currently taking steps to incorporate goals and related performance measures into the physical security programs. However, the three entities’ plans are all at an early stage, so they have not yet determined how they will document this linkage or identified time frames for completing their plans. Thus, it is too early to tell if the results of their efforts will include these linkages. Linking performance measures and goals could help these entities monitor and evaluate their efforts, which is an essential part of risk management. The information the entities can gain from performance measures that are aligned with goals could also provide these entities with a clearer view of the effectiveness of their physical security programs and better position them to prioritize security needs. Interior, the Smithsonian, and the National Gallery each test aspects of their physical security programs, and although they have reached out to other entities to help improve their overall programs, they have not made testing a focus of their outreach efforts. Testing—both covert and planned—can help determine whether security staff and equipment are adequate under real and simulated conditions, and the results of testing can provide insight into the effectiveness of efforts to mitigate potential vulnerabilities. We have found in past work that testing is a key practice for physical security programs and integral to performance measurement. The RMP states that nonmilitary federal entities should use testing to assess and document the effectiveness of their physical security programs, but it does not prescribe how this testing must be done, noting that its guidance is meant to assist federal entities and recognizing that the implementation of testing will differ depending on the entity. Conducting testing at the icons and facilities on the National Mall presents unique challenges, due to the open settings of the icons and the large numbers of people who visit the museums and galleries. Despite these challenges, Interior, the Smithsonian, and the National Gallery have each taken steps to incorporate testing into their physical security programs, more specifically: The Park Police currently conducts operational checks to ensure that security guards are following procedures, conducts daily security inspections of the icons to verify that guards are at their assigned locations and attending to their duties, and uses security managers from outside sources to perform covert operational checks on a random basis. The Smithsonian currently conducts periodic operational tests of its security systems and its access controls, with more frequent tests for higher risk areas such as perimeter doors and exhibition space, according to Smithsonian officials. In addition, an official told us that they began to review security screening at the entrances to their facilities in February 2017, in response to our questions about this topic. As part of these tests, Smithsonian assesses how well security guards follow prescribed guidelines. The National Gallery currently tests aspects of its physical security program and plans to expand its testing practices. Specifically, the National Gallery conducts periodic covert testing of access controls and uses the results of these tests to address failures and measure improvement. The National Gallery also tests whether its command center appropriately directs responses to alarm situations and plans to test its baggage-screening procedures. As Interior, the Smithsonian, and the National Gallery proceed with these efforts, there may be opportunities to draw on the expertise of others with knowledge in testing physical security initiatives. In our prior work we have identified information sharing and coordinating with other federal entities as a key practice for physical security. We have also found that federal agencies can enhance their collaborative efforts by identifying opportunities to leverage resources. ISC officials told us that ISC provides an interagency forum with multiple mechanisms for information sharing and that ISC members could share best practices for conducting testing. We have also reported that DHS’s Federal Protective Service (FPS) and the Department of Justice’s U.S. Marshals Service (Marshals Service), which has primary responsibility for the security of federal courthouses, have years of experience in testing security-screening efforts in federal buildings—places where balancing public access and security is an important factor. For example, in order to assess screening effectiveness, we have reported that FPS conducts covert tests of security screening at federal buildings and that the Marshals Service conducts intrusion tests that consist of attempts to circumvent the public- screening process and access federal courthouses with a prohibited item such as a weapon. A senior FPS official also told us that FPS could meet with entities to understand their existing program and share applicable lessons learned, and Marshals Service officials told us they would be willing to share their expertise in planning and conducting testing with entities on the National Mall. Interior, the Smithsonian, and the National Gallery have reached out to other federal entities to improve their physical security programs, but we found they have not made testing a focus of their outreach efforts, specifically: Park Police officials told us they have sought to enhance their physical security program by coordinating with internal and external partners. This coordination includes, for example, sharing information about best practices, emerging threats, and new technology through a variety of venues, such as by visiting other sites, such as the Statute of Liberty National Monument; and by participating in a variety of working groups, such as the Mall Security Working Group. While these efforts are valuable, testing has not been the primary focus. According to Park Police officials, they have considered implementing additional covert testing but found they lacked the capability to implement and sustain such efforts. Smithsonian officials said that additional testing would help them to assess the effectiveness of their physical security program but that they lacked the resources to conduct additional testing activities. According to these officials, they participate in the Mall Security Working Group and have collaborated with other entities to share practices for implementing testing. Apart from these efforts, officials said they have not reached out to other entities regarding testing because they have devoted time and resources to other efforts, such as conducting operational tests and managing day-to-day security concerns. National Gallery officials told us they have a collaborative relationship with other entities through the Mall Security Working Group and that they reach out to this group to discuss a variety of security initiatives and emerging issues. A senior official told us the National Gallery has reached out to this group to discuss testing of its screening procedures, which is a useful first step. However, a senior National Gallery official also noted that other aspects of the physical security program could benefit from the same kind of knowledge sharing. Moving forward, drawing on the knowledge and practices of others could help Interior, the Smithsonian, and the National Gallery enhance their respective testing programs, a process that could provide them with more information about what security procedures and investments are working and where improvements are needed. By not making testing a focus of outreach efforts, National Mall entities may be missing opportunities to leverage the knowledge of other entities that have experience in this area. Ensuring the physical security of the icons, museums, and galleries on the National Mall—as well as the federal employees who work there and the visiting public—is a complex and difficult task. Federal entities contend with a variety of challenges on the National Mall that can limit what they can do to enhance security. Interior, the Smithsonian, and the National Gallery recognize these limitations and are taking steps to assess physical-security risks. However, more could be done to better manage physical security risks on the National Mall. Because the National Gallery lacks complete documentation of its risk management decisions, there is an opportunity to enhance its risk management decision-making as it relates to physical security. Furthermore, Interior, the Smithsonian, and the National Gallery have opportunities to take a more strategic approach to performance measurement by developing goals for their programs and linking performance measures to those goals. Without taking a more strategic approach, these entities may have difficulty effectively assessing their progress. Lastly, although federal entities on the National Mall have reached out to others to improve their physical security programs, they have not made testing a focus of their outreach efforts. Drawing on the knowledge and practices of other federal entities could help Interior, the Smithsonian, and the National Gallery enhance their testing programs. We recommend that the Secretary of the Interior direct the Director of the National Park Service to take the following two actions: direct the U.S. Park Police to ensure that performance measures linked to program goals are included as part of its updated strategic plan and direct it to develop a timeline for completion of this plan, and direct the U.S. Park Police to seek additional input from federal entities with expertise regarding ways to enhance testing of its physical security program. We recommend that the Secretary of the Smithsonian Institution direct the Office of Protection Services to take the following two actions: develop program goals and ensure that performance measures linked to those goals are included as part of the strategic plan for security and develop a timeline for completion of this plan, and seek additional input from federal entities with expertise regarding ways to enhance testing of the physical security program. We recommend that the Director of the National Gallery of Art direct the Office of Protection Services to take the following three actions: develop a process for documenting risk management decisions; ensure that program goals and performance measures linked to those goals are included as part of the master security plan and develop a timeline for completion of this plan; and seek additional input from federal entities with expertise regarding ways to enhance testing of the physical security program. We provided a draft of the sensitive version of this report to DHS, Interior, the Smithsonian, and the National Gallery for review and comment. In an email, DHS’s liaison stated that DHS had no comments on the report. Interior and the National Gallery provided written comments, reproduced in appendixes I and II, respectively, stating that they agreed with our recommendations and will take steps to address them. We also received an e-mail from the Smithsonian’s Office of Government Relations stating that the Smithsonian was not providing written comments, but that it agreed with our recommendations and will take steps to address them. In addition, DHS and Interior provided technical comments, which we incorporated as appropriate. We are sending copies of this report to the Secretaries of Homeland Security, the Interior, and the Smithsonian Institution, and to the Director of the National Gallery of Art. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-2834 or rectanusl@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III. In addition to the contact above, key contributors to this report included David Sausville (Assistant Director); Luqman Abdullah; Patricia Donahue; Geoffrey Hamilton; Wesley A. Johnson; Kate Perl; Malika Rice; Jerry Sandau; Henry Smart, III; and Michelle Weathers.

Summary: The National Mall is one of the most recognizable landscapes in the United States. It is home to memorials to our nation's history and some of the most visited museums in the world. Threats to these assets—whether acts of terrorism, violence, or vandalism or theft of artifacts or art—could result not only in the loss of life but also the loss of iconic monuments or irreplaceable items from the Smithsonian's or National Gallery's collections. GAO was asked to review the steps Interior, the Smithsonian, and the National Gallery are taking to protect U.S. assets, employees, and the visiting public. This report examines: (1) the extent to which these entities assess physical security risks and (2) the extent to which the entities use goals, measures, and testing to assess their physical security programs. This is a public version of a sensitive report that GAO issued in May 2017. GAO reviewed applicable federal requirements; Interior-, Smithsonian-, and National Gallery-specific policies and related documents; and interviewed officials. Federal entities on the National Mall are assessing the physical security risks to their respective U.S. assets. In doing so, they are demonstrating that they are taking a risk management approach to meet the demands of a complex security environment, specifically: To assess the risks to the icons—the Washington Monument and the Jefferson and Lincoln Memorials—the Department of the Interior (Interior) follows a departmental policy that reflects government-wide homeland security objectives for critical infrastructure. Among other things, Interior's policy establishes minimum security requirements for safeguarding critical infrastructure such as the icons. To assess the risks to the museums and galleries on the National Mall, the Smithsonian Institution (Smithsonian) and the National Gallery of Art (National Gallery) voluntarily follow government-wide standards set forth by the Interagency Security Committee (ISC)—an interagency organization chaired by the Department of Homeland Security (DHS). These standards are designed to minimize risk to federal facilities and help nonmilitary federal entities meet recommended levels of protection. Interior's, the Smithsonian's, and the National Gallery's adherence to these policies and standards, and the related steps that the entities follow, shows the considerable extent to which these entities use risk assessments as an analytical tool in their physical security programs. Nonetheless, the threat to federal facilities is significant, and ISC standards require the documentation of risk management decisions—such as decisions to defer actions to mitigate risk due to cost or other factors. Documenting risk management decisions is also a necessary part of an effective internal-control system and important in order to retain institutional knowledge and inform decision-making. GAO found that the National Gallery, which follows ISC standards voluntarily, lacked such documentation. Interior, the Smithsonian, and the National Gallery collect information on various aspects of the performance of their physical security programs and are making efforts to use goals, measures, and testing to assess the performance of their physical security programs; however, each could benefit from taking additional steps. ISC and GAO have reported that it is necessary to establish goals and link performance measures to those goals to assess progress. While Interior, the Smithsonian, and the National Gallery intend to link performance measures to goals, they have not done so yet or established firm time frames for completing these efforts. Ensuring that plans include both goals and performance measures linked to those goals, as well as developing timelines for completion, could help these entities develop a more strategic view of their physical security programs and better position them to prioritize their needs. These entities also test aspects of their physical security programs, such as to ensure that security systems are operational and that guards are attending to their duties. While the entities have reached out to others to improve their overall programs, they did not focus on testing as part of that outreach. Seeking input from others with expertise is consistent with key practices GAO has identified for physical security and could help these entities target where their testing efforts need improvement. In the sensitive report, GAO recommended that (1) the National Gallery document its risk management decisions and that (2) Interior, the Smithsonian, and the National Gallery link performance measures with security goals and seek input to enhance their testing programs. Interior, the Smithsonian, and the National Gallery agreed with GAO's recommendations and indicated they will begin taking steps to address them.