TSA assumed primary responsibility for implementing and overseeing the security of the nation’s civil aviation system following the terrorist attacks of September 11, 2001. This includes regulating and providing guidance for airports’ and air carriers’ actions and performing its own actions to maintain and improve the security of their perimeters and access controls as well as establishing and implementing measures to reduce the security risks posed by aviation workers. As of March 2015, TSA had 80 FSDs who oversee the implementation of, and adherence to, TSA requirements at approximately 440 commercial airports nationwide. As the regulatory authority for civil aviation security, TSA inspects airports, air carriers, and other regulated entities to ensure they are in compliance with federal aviation security regulations, TSA-approved airport security programs, and other requirements. For a list of federal requirements pertaining to perimeter and access control security, see appendix II. TSA oversees security operations at airports through compliance inspections, covert testing, and vulnerability assessments to analyze and improve security, among other activities. In general, TSA funds its perimeter and access control security-related activities out of its annual appropriation. TSA also does not generally provide funds directly to airport operators for perimeter and access control security efforts. Funding to address perimeter and access control security needs may, however, be made available to airport operators through other sources, including the Federal Aviation Administration’s (FAA) Airport Improvement Program. Airport operators have direct responsibility for implementing security requirements in accordance with their TSA-approved airport security programs. Airport security programs generally cover the day-to-day aviation operations and implement security requirements for which commercial airports are responsible, including the security of perimeters and access controls protecting security-restricted areas. Among other things, these security programs include procedures for performing background checks on aviation workers and applicable training programs for these workers. Further, airport security programs must also include descriptions of the security-restricted areas—that is, areas of the airport identified in their respective security programs for which access is controlled and the general public is generally not permitted entry— including a map detailing boundaries and pertinent features of the security-restricted areas. Although, pursuant to regulatory requirements, the components of airport security programs are generally consistent across airports, the details of these programs and their implementation can differ widely based on the individual characteristics of airports. TSA generally characterizes airport perimeter security at commercial airports to include protection of the fence line—or perimeter barriers— vehicle and pedestrian gates, maintenance and construction gates, and vehicle roadways, as well as general aviation areas. Access control security generally refers to security features that control access to security-restricted areas of the airport that may include baggage makeup areas, catering facilities, cargo facilities, and fuel farms. Specifically, airport perimeter and access control security measures are designed to prevent unauthorized access onto the airport complex and into security- restricted areas. For example, airport operators determine the boundaries for the security-restricted areas of their airport based on the physical layout of the airport and in accordance with TSA requirements. Security programs for commercial airports generally identify designated areas that have varying levels of security, known as secured areas, security identification display area (SIDA), Air Operations Area (AOA), and sterile areas (referred to collectively in this report as “security-restricted areas”). For example, passengers are not permitted unescorted access to secured areas, SIDAs, or the AOA, which typically encompass baggage loading areas, areas near terminal buildings, and other areas close to parked aircraft and airport facilities, as illustrated in figure 1. Aviation workers may access the sterile area through the security checkpoint (at which time they undergo screening similar but not identical to that experienced by a passenger) or through other access points secured by the airport operator in accordance with its security program. Airport operators are responsible for safeguarding their perimeter barriers, preventing and detecting unauthorized entry, and conducting background checks of workers with unescorted access to secured areas. Methods used by airports to control access through perimeters or into security-restricted areas vary because of differences in the design and layout of individual airports, but all access controls must meet minimum performance standards in accordance with TSA requirements. These methods typically involve the use of one or more of the following: pedestrian and vehicle gates; keypad access codes using personal identification numbers, magnetic stripe cards and readers; biometric (e.g., fingerprint) readers; turnstiles; locks and keys; and security personnel (e.g., guards). TSA requires FSDs or their designees to report security events that occur both at the airports for which they are responsible and on board aircraft destined for their airports. TSA collects airport security event data from airports and stores that information in numerous systems. In addition to PARIS, TSA uses the Security Incident Reporting Tool (SIRT)—a tool designed for root cause analysis, among other things—to record security event information in the field (e.g., at airports). Events that TSA reports to these systems may include a range of occurrences, such as an inebriated driver crashing through a perimeter fence or a baggage handler using his access to smuggle drugs to outbound passengers. In October 2012, TSA updated its operations directive related to reporting security events. While TSA redefined some event categories and expanded the overall number of event categories, these event categories are not specific for events that relate to perimeter or access control. As a result, the number of events that directly relate to perimeter and access control security may be over- or under-represented in any analysis. Figure 2 shows the estimated number of events potentially related to perimeter and access control security from fiscal years 2009 through 2015, by fiscal year. Since it is not feasible to protect all assets and systems against every possible threat, DHS uses a risk management approach to prioritize its investments, develop plans, and allocate resources in a risk-informed way that balances security and commerce. Risk management calls for a cost-effective use of resources and focuses on developing and implementing protective actions that offer the greatest mitigation of risk for any given expenditure. A risk management approach entails a continual process of managing risk through a series of actions, including setting goals and objectives, assessing risk, evaluating alternatives, selecting initiatives to undertake, and implementing and monitoring those initiatives. DHS developed the NIPP, which establishes a risk management framework to help its critical infrastructure stakeholders determine where and how to invest limited resources. In accordance with the Homeland Security Act of 2002 and Homeland Security Presidential Directive/HSPD-7, DHS released the NIPP in 2006, which it later updated in 2009 and 2013. The NIPP risk management framework includes setting goals and objectives, identifying infrastructure, assessing and analyzing risks, implementing risk management activities, and measuring effectiveness. This framework constitutes a continuous process that is informed by information sharing among critical infrastructure partners. See figure 3 for these elements of critical infrastructure risk management. The NIPP sets forth risk management principles that include a comprehensive risk assessment process that requires agencies to consider all elements of risk—threat, vulnerability, and consequence. These elements are defined as the following: Threat is a natural or manmade occurrence, individual, entity, or action that has or indicates the potential to harm life, information, operations, the environment, and/or property. For the purpose of calculating risk, the threat of an intentional hazard is generally estimated as the likelihood of an attack being attempted by an adversary. The threat likelihood is estimated based on the intent and capability of the adversary. Vulnerability is a physical feature or operational attribute that renders an entity open to exploitation or susceptible to a given hazard. In calculating the risk of an intentional threat, a common measure of vulnerability is the likelihood that an attack is successful, given that it is attempted. Consequence is the negative effect of an event, incident, or occurrence. Since 2009, TSA has made progress in assessing all three components of risk—threat, vulnerability, and consequence—partly in response to our 2009 recommendations. Specifically, in May 2013, TSA developed its Comprehensive Risk Assessment of Perimeter and Access Control Security (Risk Assessment of Airport Security). This assessment was based primarily on information from other TSA efforts to assess airport security risks or components of risk, such as the TSSRA TSA issued in 2013, JVAs TSA conducted with the FBI at select airports in fiscal year 2011, and a Special Emphasis Assessment conducted in September 2012. The TSSRA, TSA’s annual report to Congress on transportation security, establishes risk scores and assesses threat, vulnerability, and consequence for various attack scenarios to all modes within the transportation sector, including domestic aviation. TSA’s Office of Law Enforcement/Federal Air Marshal Service (OLE/FAMS) conducts JVAs every 3 years at commercial airports in the United States identified as high risk (referred to as “triennial” airports) and on a case-by-case basis for other commercial airports. TSA’s Office of Security Operations led the Special Emphasis Assessment—a national assessment of a particular aviation security area of emphasis—specifically for the Risk Assessment of Airport Security. For each component of risk, TSA has taken the following broad assessment actions that include actions related to airport perimeter and access control security: Threat. TSA has assessed threats of various attack scenarios for domestic aviation through the TSSRAs, the latest version of which TSA released to Congress in July 2015. In this version of the TSSRA, TSA identified numerous attack scenarios related to domestic aviation, including airport security. These scenarios include threat scores, which TSA estimated on the basis of intent and capability of al-Qaeda, its affiliates, and its adherents as the expected adversary. In addition, as part of the JVA process, the FBI produces a threat intelligence report. According to FBI officials, they provide this report to the airports’ FSDs and make the reports available to the JVA teams prior to the scheduled JVA. Vulnerability.