Real property is generally defined as facilities, land, and anything constructed on or attached to land. The federal government leases real property (referred to in this report as leased space) for a variety of purposes including office spaces, warehouses, laboratories, and housing. As the federal government’s landlord, GSA designs, builds, manages, and safeguards buildings to support the needs of other federal agencies. GSA is authorized to enter into lease agreements with tenant agencies for up to 20 years that the Administrator of GSA considers to be in the interest of the federal government and necessary to accommodate a federal agency. GSA uses its authority to lease space for many federal government agencies, and in fiscal year 2009 acquired more than 182 million square feet, the most leased space of any federal agency. In response to our 2005 recommendation and to enhance coordination with the FPS, GSA established the Building Security and Policy Division within the Public Buildings Service. The division developed the Regional Security Network, which consists of several security officials for each of GSA’s 11 regions, to further enhance coordination with FPS at the regional and building levels and to carry out GSA security policy in collaboration with FPS and tenant agencies. Some agencies have independent or delegated leasing authority which allow the agency to perform all necessary functions to acquire leased space without using GSA. In fiscal year 2009, VA, USDA, and DOJ, using GSA-delegated and/or independent leasing authority, leased a total of approximately 30 million of square feet to help meet their varying missions. Specifically, VA leased approximately 10 million square feet and has a large inventory of real property, including medical centers, outpatient facilities, and ambulatory care clinics. USDA leased approximately 17 million square feet. USDA uses leased space to administer programs which assist farmers and rural communities, oversee the safety of meat and poultry, provide low-income families access to nutritious food, and protect the nation’s forests, among other things. DOJ leased approximately 3 million square feet. DOJ is comprised of about 40 component agencies with wide-ranging missions, such as the U.S. Attorneys’ Offices, Drug Enforcement Agency (DEA), and the Federal Bureau of Investigation (FBI). The Homeland Security Act of 2002 established DHS to centralize the federal government’s efforts to prevent and mitigate terrorist attacks within the United States—including terrorism directed at federal facilities. Under the act, FPS was transferred from GSA to DHS. As of October 2009, FPS is organized within DHS’s National Protection and Programs Directorate. FPS is the primary federal agency responsible for protecting and securing GSA facilities, visitors, and over 1 million federal employees across the country. FPS’s basic security services include patrolling the building perimeter, monitoring building perimeter alarms, dispatching law enforcement officers through its control centers, conducting criminal investigations, and performing facility security assessments. FPS also provides building-specific security services, such as controlling access to building entrances and exits and checking employees and visitors. FPS is a fully reimbursable agency—that is, its services are fully funded by security fees collected from tenant agencies. FPS charges each tenant agency a basic security fee per square foot of space occupied in a GSA building (66 cents per square foot in fiscal year 2009), among other fees. ISC, established in 1995 by Executive Order 12977 after the bombing of the Alfred P. Murrah federal building in Oklahoma City, has representation from all the major property-holding agencies and a range of governmentwide responsibilities related to protecting nonmilitary facilities. These responsibilities generally involve developing policies and standards, ensuring compliance, and encouraging the exchange of security-related information. Executive Order 12977 called for each executive agency and department to cooperate and comply with the policies and recommendations of the Committee. DHS became responsible for chairing ISC, which, as of 2007, is housed in the Office of Infrastructure Protection within DHS’s National Protection and Programs Directorate. Executive Order 13286, which amended Executive Order 12977, calls for the Secretary of DHS to monitor federal agency compliance with the standards issued by ISC. The 2004 standards, in conjunction with the Facility Security Level Determinations for Federal Facilities—which ISC issued in 2008 to update standards issued by DOJ in 1995—prescribed administrative procedures and various countermeasures for perimeter, entry, and interior, and, as well as blast and setbacks for leased spaces based upon five different facility security levels ranging between levels I and V, with level I being the lowest risk level and level V being the highest. The 2004 standards were specifically developed in response to a perceived need for security standards that could be applied in a leased space environment. The Facility Security Level Determinations for Federal Facilities and its precursors established the criteria and process for determining the security level of a facility which serves as the basis for implementing the countermeasures prescribed within other ISC standards, including the 2004 standards. According to the 2004 standards, when an agency is seeking a new lease, a security official should determine the security level of the leased space based on an early risk assessment, which is performed prior to entering into a new lease. Requirements based on the designated facility security level, as outlined within the standards, are to be incorporated into a solicitation for offers (SFO), which is sent to potential lessors, as minimum requirements. These minimum requirements must be met, with the exception of blast and setback requirements in existing buildings. Potential lessors who are unwilling or unable to meet the requirements are deemed nonresponsive according to the standards and eliminated from the SFO process. After a lease is entered into, the Facility Security Level Determinations for Federal Facilities states that risk assessments, such as facility security assessments (FSA), be conducted on a periodic and timely basis, with the facility security level being determined or adjusted as part of each risk assessment. Specifically, risk assessments are to be conducted every 5 years for facilities classified as facility security level I or II, and every 3 years for facilities classified as facility security level III, IV, or V. We have previously identified, from the collective practices of federal agencies and the private sector, a set of key facility protection practices that provide a framework for guiding agencies’ physical security efforts and addressing challenges. Key facility protection practices as shown in figure 1 include the following: Information sharing and coordination establishes a means of communicating information with other government entities and the private sector to prevent and respond to security threats. Allocating resources using risk management involves identifying potential threats, assessing vulnerabilities, identifying the assets that are most critical to protect in terms of mission and significance, and evaluating mitigation alternatives for their likely effect on risk and their cost. Aligning assets to mission can reduce vulnerabilities by reducing the number of assets that need to be protected. Strategic human capital management ensures that agencies are well equipped to recruit and retain high-performing security staff. Leveraging technology supplements other countermeasures with technology in a cost-effective manner. Performance measurement and testing evaluates efforts against broader program goals and ensures that they are met on time and within budgeting constraints. Before a lease is signed, early risk assessments can help agencies allocate resources using a risk management approach, a key practice of facility protection. Through early risk assessments, security officials are able to collect key information about potential spaces, security risks, and needed countermeasures, which help leasing officials, in turn, identify the most appropriate space to lease and negotiate any needed countermeasures. Leasing officials primarily rely on security officials to supply information on physical security requirements for federally leased space. Some tenant agencies are able to supply leasing officials with key prelease information because they have developed the security expertise to conduct their own early risk assessments. For example, DEA has its own in-house security officials who work with leasing officials to conduct risk assessments early in the leasing process. This helps leasing officials assess risk and obtain space specific to DEA’s security needs. Similarly, VA has created internal policy manuals that describe agency security requirements which help guide leasing and security officials on how to assess risk and obtain appropriate space. These manuals are circulated to VA leasing, facilities, and security officials, and GSA leasing officials are made familiar with VA’s physical security requirements early in the leasing process for GSA- acquired space. Additionally, VA currently budgets $5 per net usable square foot for physical building security and sustainability requirements into all of its leases. At one site, VA officials are in the early stages of identifying space needs for the relocation of a community-based outpatient clinic. VA leasing officials and security officials, among others, are collaborating on decisions that integrate security with the function of the outpatient clinic that will help ensure funds are available to finance the security requirements. Despite the in-house expertise of some tenant agencies, leasing officials sometimes do not have the information they need to allocate resources using a risk management approach before a lease is signed because early risk assessments are not conducted for all leased space. Early risk assessments are absent for a significant portion of the GSA-acquired leased space portfolio because FPS does not uniformly conduct these assessments for spaces under 10,000 square feet—which constitute 69 percent of all GSA leases (see figure 2). While FPS is expected under the MOA to uniformly conduct early risk assessments for GSA-acquired space greater than or equal to 10,000 square feet, FPS and GSA officials agree that FPS is not expected to conduct early risk assessments for spaces under 10,000 square feet unless it has the resources to do so. As we have previously reported, FPS faces funding and workforce challenges, which may limit the resources available to conduct early risk assessments on spaces under 10,000 square feet. Further, FPS may lack incentive for prioritizing early risk assessments on smaller spaces, given that it receives payment on a square footage basis only after a lease has been signed.