U.S. diplomatic missions have faced numerous attacks in recent years, resulting in legal and policy changes. According to DS, between January 1998 and December 2013, there were 336 attacks against U.S. personnel and facilities. Several of those attacks resulted in the deaths of U.S. personnel, destruction of U.S. facilities, or both including recent attacks in Benghazi, Libya, in September 2012, and in Ankara, Turkey, and Herat, Afghanistan, in 2013. Pub. L. No. 99-399 (codified at 22 U.S.C. § 4801 et seq). The Omnibus Diplomatic Security and Antiterrorism Act of 1986 requires that the Secretary of State (in consultation with the heads of other federal agencies) develop and implement policies and programs, including funding levels and standards, to provide for the security of U.S. government diplomatic operations abroad. State’s policies are detailed in the FAM and corresponding FAH; these include the Overseas Security Policy Board (OSPB) standards and the Physical Security Handbook specifications to guide implementation of the standards. In June 1991, State adopted new security-related construction standards, which are included in the FAH and have continued to evolve. Responsibility for diplomatic facility security falls principally on two State bureaus, DS and OBO. DS is responsible for, among other things, establishing and operating security and protective procedures at posts, developing and implementing posts’ physical security programs, and chairing the interagency process that sets security standards. In addition, at posts, it is the DS agents known as Regional Security Officers (RSOs), including Deputy RSOs and Assistant RSOs, that are responsible for protection of personnel and property, documenting threats and facility vulnerabilities, and identifying possible mitigation efforts to address those vulnerabilities, among other duties. OBO is responsible for the design, construction, acquisition, maintenance, and sale of U.S. government diplomatic property abroad, establishing construction programs—including those for most facility and security-related construction—and providing direction and guidance on construction matters abroad to State regional bureaus and other agencies. State’s overseas posts also play a role in setting post-specific security measures and funding some physical security upgrades, with approval from DS. In addition, M/PRI manages State’s implementation of ARB recommendations and State’s Bureau of Administration coordinates State’s clearance process regarding updates to the FAM and FAH. (See fig. 2 for an organizational chart of the key State offices responsible for physical security.) USAID maintains its own Office of Security, which is responsible for the physical security of its facilities and coordinating with DS. According to OBO, State maintains approximately 1,600 work facilities, which includes offices and warehouses, at 275 diplomatic posts— embassies, consulates, and missions—worldwide under chief-of-mission authority. A significant number of State’s embassies and consulates predate the June 1991 construction standards. State constructed approximately 475 of the work facilities, including over 120 new embassy and consulate compounds and annex facilities built to the newer construction standards. In addition, State acquired—purchased or leased—over 1,125 work facilities. According to State officials, State has a limited number of temporary work facilities, mostly in high-risk locations such as Afghanistan. In addition, USAID maintains over 25 independently leased facilities. In fiscal years 2009 through 2014, State allotted about $8.3 billion directly to construction of new secure facilities and physical security upgrades to existing and acquired facilities (see table 1). While DS has a few small programs to provide physical security upgrades to facilities abroad, most of the allotted funds were managed by OBO. DS and OBO have detailed the conditions under which each bureau is responsible for funding security construction and upgrades. In general, OBO is responsible for constructing new facilities and funding upgrades to owned facilities and leased office facilities, while DS is responsible for funding physical security upgrades to leased residential facilities. State runs other programs, such as OBO’s major rehabilitation program and DS’s technical field support efforts, which may include physical security upgrades; however, we did not include funding from these sources in table 1. USAID has also allotted about $0.03 billion to directly support physical security upgrades. To manage risk to overseas facilities under chief-of-mission authority, State conducts a range of ongoing activities (see fig. 3), and after the September 2012 attacks, it took additional steps to improve risk management activities. Nonetheless, we found problems with facility categorization and data reliability that may affect State’s ability to accurately track facilities and rank them by the risks they face. State conducts several key activities to manage risk to overseas facilities: OBO tracks facilities in a property inventory database, and OBO and other bureaus rely on the information in this database to inform a number of security-related decisions. DS uses security-related questionnaires completed by officials at each post to assess and determine threat levels at each overseas post. Working through an interagency group, DS establishes security standards for facilities overseas, which vary depending on the threat levels at each post. Guided by the security standards, officials at posts periodically assess facilities to identify security deficiencies or vulnerabilities. DS analyzes information from OBO’s property inventory database, the threat assessments, and the vulnerability assessments to assess the risk faced by overseas facilities. DS then ranks facilities by the level of risk each facility faces to help OBO prioritize embassy and consulate construction plans. In addition to these ongoing activities to manage risk, State has taken steps to implement recommendations resulting from several post- Benghazi reports such as the ARB. OBO is responsible for maintaining records on all diplomatic residential and work facilities overseas in its property inventory database (hereafter referred to as OBO’s property database). According to OBO officials, OBO and other State bureaus rely on this database for data on over 1,600 work facilities. OBO’s property database includes data for facilities State or USAID owns or leases, including facilities located outside embassy and consulate compounds—such as office spaces and warehouses—and facilities outside both the work and residential categories—such as recreational facilities. OBO’s property database does not include host-government facilities where U.S. agencies may operate, such as laboratories supported by the Centers for Disease Control. According to OBO officials, OBO has undertaken several efforts since early 2012 to improve the quality of the information in its property database. For example, OBO hired additional staff to review the reliability of the data in the system, and these staff identified outdated records and missing information. In addition, in response to the Benghazi ARB report, OBO requested that all posts provide (1) a list of all facilities located off compound and (2) the number of desk positions at each facility. OBO intended to use this information to ensure that OBO’s property database contained records on all off-compound work facilities. According to OBO officials, the updated information from posts had been entered into its property database as of spring 2013. DS assesses six types of threats at each overseas post by evaluating the post’s security situation and assigning a corresponding threat level, which is used to determine the security standards required for facilities at that post. Published annually by State, the Security Environment Threat List documents each post’s threat levels for six threat categories, including political violence, terrorism, residential, and nonresidential crime. Each post is assigned one of four threat levels for each threat category. The levels are as follows: critical: grave impact on American diplomats; high: serious impact on American diplomats; medium: moderate impact on American diplomats; and low: minor impact on American diplomats. According to DS officials, the bureau develops the Security Environment Threat List threat levels for each post based on questionnaires filled out by post officials, and the final threat ratings are reviewed and finalized through an iterative process involving officials at overseas posts and in headquarters. DS, in conjunction with the interagency OSPB, reviews and issues uniform guidance on physical security standards for diplomatic work facilities overseas. Chaired by the Assistant Secretary of DS, OSPB includes representatives from approximately 20 U.S. agencies with personnel overseas, including intelligence, foreign affairs, and other agencies. State incorporates the OSPB’s physical security standards in the FAH for the six types of overseas work facilities, including embassy and consulate compounds. Facilities overseas, whether permanent, interim, or temporary, are required to meet the standards applicable to them. The OSPB standards vary by facility type, date of construction or acquisition, and threat level. If facilities do not meet all applicable standards, posts are required to request waivers to SECCA requirements, exceptions to OSPB standards, or both. Within State’s physical security standards, we identified six categories of key security requirements, to protect overseas work facilities against physical attacks and other dangers: (1) a 100-foot setback from the perimeter wall, (2) anti-climb perimeter walls and “clear zone,” (3) anti- ram protection, (4) hardened building exteriors, (5) controlled access to the compound or facility, and (6) a safe space for taking refuge during an attack (see fig. 4 for an illustration of the six categories at a notional embassy). In addition to the OSPB standards, State independently developed and continues to update the Physical Security Handbook, also published in the FAH, which provides detailed supporting information, such as construction specifications and diagrams, to help officials understand how to implement and meet the OSPB standards. State has supplemented the physical security standards found in the FAH with guidance found in other sources, such as OBO’s construction manuals or guidance sent out to posts. DS and State’s OIG periodically assess facility vulnerabilities to identify security deficiencies.