Section 707 of the Homeland Security Act of 2002, as amended by the 9/11 Commission Act, requires a review of the nation’s homeland security every four years. Under the 9/11 Commission Act, DHS is responsible for developing the QHSR and for submitting a report that is to include multiple elements, such as: a description of the threats to the assumed or defined national homeland security interests of the United States; the national homeland security strategy, including a prioritized list of the critical homeland security missions of the United States; an assessment of the organizational alignment of DHS with the applicable national homeland security strategy and the homeland security mission areas outlined; and a discussion of the status of cooperation among federal agencies in the effort to promote national homeland security, among other elements. The Department initiated the second QHSR in summer 2012. Led by SPAR within the Office of Policy, the department reviewed the homeland security strategic environment as well as the DHS missions and goals. In 2013, DHS issued its terms of reference outlining the framework for conducting the second quadrennial review and identified threats and assumptions to be used in conducting the review. The QHSR was conducted in four phases, as shown in figure 1, and released in June of 2014. Based on the assessments conducted in the preparation phase, DHS leadership directed five QHSR studies, as shown above. Each study group was composed of officials from across DHS offices and components, led by a DHS SPAR official, and facilitated by an independent subject matter expert from the Homeland Security Studies and Analysis Institute. These study groups conducted their analysis over a 6 month period and shared their work products, such as outline missions and assumptions, with other stakeholder groups in order to develop goals and objectives for each homeland security mission. At the end of the study group period, DHS senior leadership, including the Deputy Secretary of Homeland Security, the Office of General Counsel, and office and component heads, met multiple times to review and discuss the study group recommendations. DHS SPAR consolidated the study groups’ recommendations into a draft QHSR report and obtained and incorporated feedback on the draft report from other federal agencies and stakeholder groups, including stakeholders listed in the 9/11 Commission Act with which DHS was to consult in conducting the 2014 QHSR review. DHS solicited input from various stakeholder groups in conducting the second QHSR. The 9/11 Commission Act specifically required DHS to consult with the heads of seven federal agencies. DHS consulted with these agencies and also sought input from a range of other stakeholders, including its directorates, offices, and components; other federal departments and agencies; and nonfederal governmental and nongovernmental entities and representatives, such as state, local and tribal governmental associations, members of Congress, private sector representatives, academics, and other policy experts. DHS SPAR consulted with the Office of Intergovernmental Affairs and the Office of State and Local Law Enforcement to identify and contact relevant stakeholder organizations. We, Congress, the 9/11 Commission, and others have recommended that federal agencies with homeland security responsibilities use a risk management approach to help ensure that finite resources are dedicated to assets or activities considered to have the highest security priority. In its Risk Management Fundamentals and other guidance, DHS articulates a risk management framework to guide its homeland security planning, preparation, and execution of its missions. DHS states that risk management is the process for identifying, analyzing, and communicating risk and accepting, avoiding, transferring, or controlling it to an acceptable level. The National Infrastructure Protection Plan (NIPP) also defines DHS’s risk management framework and includes key principles for an effective risk assessment. Specifically, a risk assessment should be complete, documented, reproducible, and defensible, as defined in table 1. DHS uses a planning, programming, budgeting, and execution (PPBE) process to allocate resources. DHS’s PPBE process produces the multi- year funding plans presented in the Future Years Homeland Security Program (FYHSP). According to DHS guidance, at the outset of the annual PPBE process, the department’s Office of Policy and the Chief Financial Officer (OCFO) should provide planning and fiscal guidance, respectively, to the department’s 16 component agencies. In accordance with this planning and fiscal guidance, the components should produce 5- year funding plans—called Resource Allocation Plans—that are submitted to the CFO and reviewed by DHS’s senior leaders. DHS senior leadership is expected to modify the plans in accordance with their priorities and assessments and submit them to the Office of Management and Budget (OMB), which uses the plans to inform the President’s annual budget request. DHS guidance establishes approximate timelines for when guidance is provided to components and when budget plans are due, as shown below in figure 3. The 2014 QHSR outlines the same five missions set forth in the first QHSR in 2010, but the 2014 review refined the missions to reflect evolving threats. The five missions are to (1) Prevent Terrorism and Enhance Security, (2) Secure and Manage Our Borders, (3) Enforce and Administer Our Immigration Laws, (4) Safeguard and Secure Cyberspace, and (5) Strengthen National Preparedness and Resilience. Changes to the DHS missions were primarily in Mission 4 to Safeguard and Secure Cyberspace. Specifically, the 2014 QHSR provides enhanced goals for cybersecurity protection that include leveraging technology and enhancing investigative capabilities, as shown in figure 4. DHS assesses and reports on progress for the 2014 QHSR mission goals in its Annual Performance Report, which provides suites of performance measures that assess progress for each QHSR mission goal area. The Annual Performance Report includes performance targets as well as information on agency priority goals, initiatives, and challenges. The performance results identified in the report are organized around the missions and goals outlined in the DHS Strategic Plan. The DHS Fiscal Year 2014-2018 Strategic Plan focuses on how DHS plans to implement the goals laid out in the 2014 QHSR. Specifically, the Strategic Plan describes the QHSR homeland security missions and goals and lists strategies to achieve the goals. For example, for Mission 1 (Prevent Terrorism and Enhance Security), to achieve Goal 1.1 (prevent terrorist attacks), one strategy listed in the Strategic Plan is to analyze, fuse, and disseminate terrorism information by sharing it with stakeholders across the homeland security enterprise. In addition, for Mission 4 (Safeguard and Secure Cyberspace), to achieve Goal 4.2 (secure the federal civilian government information technology enterprise), one strategy listed in the Strategic Plan is to ensure government-wide policies and standards are consistently and effectively implemented. See figure 5 for a list of additional strategies linked to homeland security missions and goals. Move mouse over goal to see the objectives. For a noninteractive version, see appendix IV. DHS conducted a risk assessment for the second QHSR, which it referred to as the Homeland Security Strategic Environment Assessment (HSSEA). According to DHS, the purpose of the HSSEA was to characterize those risks, threats, current and future trends, and critical uncertainties that will most affect homeland security in the 2015 to 2019 timeframe. The HSSEA is the product of several different assessments that DHS developed for this effort, including the Current Strategic Environment, Future Strategic Environment, Homeland Security Planning Threat Assessment, Homeland Security National Risk Characterization (HSNRC), and the System Mapping Initiative. All combined, DHS intended these documents to inform the QHSR’s narrative describing the homeland security strategic environment as well as informing the selection of priority strategic issues to study during the 2014 QHSR, among other goals as shown in figure 6. For the HSSEA, DHS evaluated threat information and assessed relative likelihood and consequences across various hazards that DHS determined to be significant, including intentional acts of terrorism, natural hazards, and technological accidents and infrastructure failures; however, DHS did not incorporate other key elements of a successful risk assessment into its risk assessment methodology. Specifically, DHS did not clearly document how its various analyses were synthesized to generate risk results; did not design an assessment that could produce comparable, repeatable results; and did not communicate the implications of any uncertainty in the results. DHS’s performance in each NIPP element—complete, documented, reproducible, defensible—is discussed in further detail below. The HSSEA generally follows the NIPP standard for a complete risk assessment in that it assesses consequence, vulnerability, and threat. Regarding threat information, DHS officials said that they relied on two primary sources—the classified Homeland Security Planning Threat Assessment, developed by DHS Intelligence and Analysis (I&A), and the publically available 2012 Worldwide Threat Assessment of the US Intelligence Community, which is prepared by the Office of the Director of National Intelligence (ODNI). The ODNI assessment discusses the rapid changes in the threat environment which ODNI states is now more diverse and interconnected than any other time in history. DHS officials said that they used the unclassified assessment as well as select assessments from the I&A Homeland Security Planning Threat Assessment so that they did not face classification challenges when sharing information with partners. DHS I&A reported using I&A and intelligence community data, as well as data from component-level intelligence units. Further, the ODNI-developed assessment had been vetted through the intelligence community, which DHS officials said added to its legitimacy. Regarding consequence and vulnerability, DHS primarily assessed these two factors in the Homeland Security National Risk Characterization (HSNRC), where it evaluated the likelihood and potential consequences of 40 hazards ranging from acts of terrorism to hurricanes. DHS compared the impacts of these hazards according to their direct economic impact, loss of life, and potential for injuries and illnesses in order to identify what the department referred to as standout risks—risks that DHS believed would result in substantial negative consequences— and to allow decision makers to evaluate risk management alternatives in terms of their effect on increasing or decreasing risk.