Terrorists have targeted federal facilities several times over the past 10 years. After the 1995 bombing of the Alfred P. Murrah Federal Building in Oklahoma City, the Department of Justice created minimum-security standards for federal facilities. In October 1995, the President signed Executive Order 12977, which established ISC. ISC was expected to enhance the quality and effectiveness of security in, and protection of, facilities in the United States occupied by federal employees for nonmilitary activities and to provide a permanent body to address continuing governmentwide security issues for federal facilities. ISC is expected to have representation from all the major federal departments and agencies, as well as a number of key offices. ISC’s specific responsibilities under the executive order generally relate to three areas: developing policies and standards, ensuring compliance and overseeing implementation, and sharing and maintaining information. Related to policies and standards, the executive order specifically states that ISC is to establish policies for security in and protection of federal facilities; develop and evaluate security standards for federal facilities; assess technology and information systems as a means of providing cost-effective improvements to security in federal facilities; develop long-term construction standards for those locations with threat levels or missions that require blast-resistant structures or other specialized security requirements; and evaluate standards for the location of, and special security related to, day care centers in federal facilities. In the area of compliance and oversight, ISC is to develop a strategy for ensuring compliance with facility security standards and oversee the implementation of appropriate security measures in federal facilities. And, related to sharing and maintaining information, ISC is to encourage agencies with security responsibilities to share security related intelligence in a timely and cooperative manner and assist with developing and maintaining a centralized security database of all federal facilities. Since September 11, the focus on protecting the nation’s critical infrastructure has been heightened considerably. The Homeland Security Act of 2002 and other administration policies assigned DHS specific duties associated with coordinating the nation’s efforts to protect critical infrastructure, and Homeland Security Presidential Directive Number 7 (HSPD-7) stated that DHS’s Secretary was responsible for coordinating the overall national effort to identify, prioritize, and protect critical infrastructure and key resources. Under the Homeland Security Act of 2002, the Federal Protective Service (FPS) was transferred from GSA to DHS and, as a result of this transfer, DHS assumed responsibility for ISC in March 2003. In September 2002, we reported that ISC was having limited success in fulfilling its responsibilities. Specifically, ISC had made little or no progress in areas including developing and establishing policies for security in and protection of federal facilities and developing a strategy for ensuring compliance with security standards. In January 2003, we designated federal property as a high-risk area, in part due to the threat of terrorism against federal facilities. As the government’s security efforts continue to intensify, and real property-holding agencies employ such measures as searching vehicles that enter federal facilities, restricting parking, and installing concrete bollards, important questions continue to be raised regarding the level of security needed to adequately protect federal facilities and how the security community should proceed. Figure 1 shows bollards installed at the Jacob Javits Federal Building in New York, New York. Additionally, questions concerning the cost-effectiveness and impact of various practices have emerged as the nation faces a protracted war on terrorism. ISC has made progress in coordinating the government’s facility protection efforts and has been given a prominent role in reviewing agencies’ physical security plans for the administration since we last reported on this issue. In September 2002, we reported that ISC, at that time, had made little or no progress in key elements of its responsibilities, such as developing policies and standards for security at federal facilities; ensuring compliance with security standards and overseeing the implementation of appropriate security in federal facilities; and related to information, developing a centralized security database of all federal facilities. Agency representatives identified several factors that they believe contributed to ISC’s limited progress. These factors included (1) the lack of consistent and aggressive leadership by GSA, (2) inadequate staff support and funding for ISC, and (3) ISC’s difficulty in making decisions. Nonetheless, there were areas where we observed some progress over its then 7-year existence. For example, ISC had developed and issued security design criteria and minimum standards for building access procedures; disseminated information to member agencies on entry security technology for buildings needing the highest security levels; and, through its meetings and working groups, provided a forum for federal agencies to discuss security-related issues and share information and ideas. In commenting on the September 2002 report, GSA, which at the time had responsibility for chairing ISC, agreed to take action to address the shortcomings we identified. In March 2003, in accordance with the Homeland Security Act of 2002, FPS was transferred from GSA to DHS. As a result, DHS assumed responsibility for chairing ISC, and the executive order establishing ISC was amended to reflect the transfer of this function from GSA to DHS. Transferring responsibility for ISC to DHS reflected the shift to having homeland security activities centralized under one cabinet- level department. Within DHS, the role of chairing ISC was subsequently delegated to the Director of FPS in January 2004. Since our 2002 report, ISC has made clear progress in developing policies and standards and maintaining and sharing information. Related to policies and standards, ISC issued security standards for leased space in July 2003, and OMB has approved them. These standards address security requirements for leased facilities and, according to an ISC official, are currently being used by ISC member agencies as a management tool. In June 2003, ISC issued guidance on escape hoods for federal agencies and, in October 2003, ISC issued an update to its May 2001 Security Design Criteria for New Federal Office Buildings and Major Modernization Projects. According to an FPS official, GSA is incorporating ISC’s Security Design Criteria in the construction of new facilities. More recently, ISC became involved with Homeland Security Presidential Directive Number 12 (HSPD-12), issued in August 2004, which seeks to standardize identification for federal employees and contractors. According to the directive, wide variations in the quality and security of forms of identification used to gain access to federal facilities, where there is a potential for terrorist attacks, need to be eliminated. ISC’s Executive Director informed us that he was asked to be a member of the White House Homeland Security Council Coordination Committee for HSPD-12. This ISC official would provide the leadership role for this committee and ensure that physical security requirements for the federal government, as they relate to the directive, are included and coordinated with ISC members. Related to its role in maintaining and sharing information, ISC has developed a Web site for posting policies and guidance and is developing a secure Web portal for member agencies to exchange security guidance and other information. Also, according to the Executive Director of ISC, standard operating procedures were approved by ISC members in June 2004 and were finalized in September 2004. These operating procedures are intended to improve the quality of information sharing among member agencies at its meetings by establishing standards for attendance and participation at ISC meetings. For example, each ISC agency representative is required to attend all meetings or delegate a person to attend to ensure full participation. Finally, DHS is developing a governmentwide facilities database that the ISC Executive Director believes will meet ISC’s responsibility to assist with developing and maintaining a centralized security database of all federal facilities. This database will list functions and services that are mission critical, map federal assets and their critical infrastructure, and identify key resources for both cyber and physical security protection. According to ISC’s Executive Director, ISC members are an integral part of this process and will ensure that the required support from within their departments and agencies is provided. Despite progress in its other areas of responsibility, ISC has not developed, as specified in its 1995 executive order, a strategy for ensuring compliance with security standards among agencies and overseeing the implementation of appropriate security measures in federal facilities. However, in July 2004, the administration made ISC responsible for annually reviewing and approving physical security plans that agencies are required to develop under a presidential homeland security policy directive. HSPD-7, issued in December 2003, establishes a national policy for federal departments and agencies to identify and prioritize critical infrastructure and key resources in the United States so that they can be protected from terrorist attacks. The directive makes DHS responsible for overseeing the implementation of the directive and outlines the roles and responsibilities of individual agencies. Among the roles and responsibilities delineated, HSPD-7 establishes an annual reporting cycle for agencies to evaluate their critical infrastructure and key resources protection plans for both cyber and physical security. ISC’s Executive Director informed us that in July 2004, the administration designated ISC as the oversight body for agencies’ physical security plans. According to ISC’s Executive Director, ISC’s role will be to review, approve, or disapprove each department or agency’s physical security plan. If ISC were to successfully fulfill its new responsibilities under HSPD-7, which would be done under the broader umbrella of the administration’s central planning and coordination efforts for homeland security, it would represent a major step toward meeting its responsibilities that relate to oversight and compliance monitoring, as specified in the 1995 executive order under which it was established. That is, the 1995 executive order that established ISC specified that ISC should develop a strategy for ensuring agencies’ compliance with governmentwide facility protection standards and oversee the implementation of appropriate security measures in federal facilities. By having a role in reviewing agencies’ physical security plans in relation to HSPD-7, ISC would have a vehicle for carrying out its existing responsibility related to compliance and oversight. Appendix III identifies each of ISC’s major responsibilities under the executive order and actions it has taken to date to fulfill them.