The ISC was established by Executive Order 12977 following the 1995 bombing of the Alfred P. Murrah Federal Building in Oklahoma City, Oklahoma. Aside from certain intelligence-related exceptions, the Executive Order requires executive branch departments and agencies to cooperate and comply with ISC’s policies and recommendations, including any standards that it sets. ISC’s mandate is to develop and evaluate security standards for federal facilities, develop a strategy for ensuring compliance with these standards, and oversee the implementation of appropriate protective security measures in federal facilities, among other things. ISC member agencies develop and draft ISC policies and standards through participation in sub-committees and working groups. In addition, all ISC member agencies have an opportunity to review and comment on ISC draft standards, and the 21 primary member agencies vote to approve final ISC standards. From 2008 through 2013, ISC issued a series of standards to assist federal agencies in developing and implementing physical security programs at federal facilities, including standards for facility risk assessment methodologies. In August 2013, ISC combined six existing ISC standards—including The Design Basis Threat, Facility Security Level Determinations for Federal Facilities, and Physical Security Criteria for Federal Facilities—into a single standard, The Risk Management Process for Federal Facilities (RMP). According to ISC, the RMP is intended to provide agencies with an integrated, single source of physical security information and guidance. The RMP also outlines the risk management process federal agencies must follow to determine which protective measures—such as identification badges, blast resistant windows, and intrusion detection systems—should be in place at their facilities (see fig. 1). The protective measures included in the RMP are intended to mitigate federal facilities’ vulnerabilities to specific undesirable events that ISC has identified as generally applicable to all federal facilities. To determine which undesirable events pose the greatest risk to their facilities and, therefore, which protective measures should be in place, the RMP requires agencies to conduct risk assessments for each of their facilities. Based on the results of a risk assessment, agencies can customize (i.e., add or eliminate) the protective measures included in the RMP to adequately reflect the assessed level of risk. Because risk assessments play a key role in ISC’s risk management framework, the RMP includes standards for agencies’ facility risk assessment methodologies. Specifically, the RMP requires that agencies’ risk assessment methodologies must: (1) consider all of the 31 undesirable events in the RMP, and (2) assess the threat, consequences, and vulnerability to specific undesirable events. While the sources vary, agencies might obtain threat information through intelligence analyses, vulnerability information from facility site visits, and consequence information from interviews with tenants and facility managers. In their basic form, risk assessment methodologies involve assigning ratings to each of the three component parts of risk—threat, vulnerability, and consequence—and combining these ratings—such as through multiplication—to produce an overall estimate of risk for each identified undesirable event. In our hypothetical risk assessment example shown in figure 2, each component of risk is assigned a rating between 1 (Very Low) and 5 (Very High) based on the facility’s conditions; these ratings are then multiplied to produce an overall estimate of risk for each undesirable event. This hypothetical assessment identified the “vehicle- borne explosive device” undesirable event as the highest risk to the facility and “kidnapping” as the lowest risk. Facility managers can use this and other information resulting from a risk assessment to make security- related decisions and direct resources to address any unmitigated risk. Three of the nine selected agencies’ risk assessment methodologies we reviewed (DOE, DOJ, and State) fully align with ISC’s RMP standard, but six (NRC, OPM, FEMA, FPS, VA, and DOI) do not, as shown in table 1. As a result, these six agencies may not have a complete understanding of the risks facing their approximately 52,000 federal facilities and may be less able to allocate security resources cost-effectively either at the individual facility level or across their portfolio of facilities. ISC’s risk assessment standards require that federal agencies’ risk assessment methodologies (1) consider all of the undesirable events in the RMP and (2) assess the threat, consequences, and vulnerability to specific undesirable events. We found that DOE, DOJ, and State have a risk assessment methodology that meets these standards. DOJ’s methodology, which was also adopted by State, documents that all of the undesirable events in the RMP were considered. It also assesses the threat, consequences, and vulnerability to each undesirable event. Specifically, each undesirable event in the RMP—such as vehicle-borne explosive device—is initially assigned a baseline rating for each component of risk. These baseline ratings —which range from 1 (lowest) to 5 (highest)—are based on information and analysis from the RMP. For example, DOJ uses the facility’s facility security level (FSL) as the baseline consequence rating for each undesirable event. As a result, if a facility’s FSL is determined to be a Level 3, then all of the undesirable events listed in the RMP are initially given a consequence rating of 3. A DOJ official explained that assessors then adjust the baseline ratings up or down as necessary to reflect the facility’s actual conditions. In addition, DOJ officials informed us that the reasoning behind any adjustments to the baseline ratings must be documented as part of the assessment. The final risk scores for each undesirable event reflect the adjusted ratings, if any. DOE’s methodology also considers all undesirable events in the RMP and assesses the threat, consequences, and vulnerability to specific undesirable events. DOE officials explained that they combine the RMP’s baseline threat ratings for each undesirable event—such as aircraft as a weapon, hostile surveillance, and kidnapping—with consequence ratings to determine a “significance rating” for each undesirable event. Each event also then receives a vulnerability assessment and score, but DOE conducts more comprehensive vulnerability assessments for undesirable events with higher significance ratings. DOE subsequently multiplies all three ratings (threat, consequence, and vulnerability) to obtain an overall estimate of risk for each undesirable event. The remaining six agencies we reviewed—NRC, OPM, FEMA, FPS, VA, and DOI—do not have a risk assessment methodology that fully aligns with ISC’s standards because as shown in table 1, they contain one or more of the following limitations: they do not consider all of the undesirable events in the RMP, and they do not assess threat, consequences, and/or vulnerability to specific undesirable events. Three agencies’ methodologies we reviewed (OPM, VA, and DOI) do not consider all of the undesirable events included in the RMP. According to an ISC official, an agency’s methodology must include, as a starting point or baseline, all of the undesirable events listed in the RMP; however, agencies have the flexibility to omit events they determine are not applicable to their facilities (or a particular facility) or add events that are not included in the RMP as long as these changes are documented. For example, although OPM’s methodology includes some of the RMP’s undesirable events—such as arson, assault, and kidnapping—others are omitted, such as aircraft as a weapon and coordinated or sequential attack. An OPM official informed us that their methodology lacks some of the RMP’s undesirable events because it was developed before ISC issued its risk assessment standards in 2010. However, the official also informed us that they are modifying their methodology to include all of the undesirable events in the RMP. VA’s methodology also does not consider all the undesirable events in the RMP; instead, it incorporates VA’s list of undesirable events: assaults, physical threats of violence, illegal weapons, suicidal behavior, thefts and vandalism, and explosive devices. Officials from VA said that they do not use all of the undesirable events in the RMP because they find it more practical to focus on fewer events and these six events are indicative of a facility’s overall safety and security. Because these agencies do not consider all of the undesirable events in the RMP, they may not have a complete understanding of the risks facing their facilities. Five agencies’ methodologies we reviewed (NRC, FEMA, FPS, VA, and DOI) do not assess one or more of the three components of risk required by ISC. In other words, these agencies’ methodologies do not rate or score specific undesirable events for all three components of risk (threat, consequences, and vulnerability). As shown in table 1, DOI’s methodology does not align with any of ISC’s risk assessment standards. DOI officials told us that the department’s methodology does not align with ISC standards, in part, because of challenges presented by its broad and diverse missions and a lack of resources and expertise to conduct risk assessments. Although the other four agencies’ methodologies we reviewed (NRC, FEMA, FPS, and VA) are consistent with some aspects of ISC’s risk assessment standards, they lack an assessment of one or more of the components of risk. For instance, as we have previously reported, FPS’s current methodology does not assess consequences. FPS stated that it intends to eventually incorporate consequence into its risk assessment methodology and is exploring ways to do so. NRC’s methodology also does not assess the consequences of specific undesirable events. According to NRC officials, the agency does not believe it is necessary to conduct a consequence analysis for each undesirable event. However, NRC’s vulnerability assessment approach aligns with ISC’s risk assessment standards. Specifically, for each undesirable event in the RMP, NRC calculates a percentage-based vulnerability score that represents the number of protective measures that are currently in place and applicable to that undesirable event.