The general purpose of facility security is to protect people, property, and the facility itself by deterring, detecting, and responding to potentially criminal and dangerous acts and people. Threats to facility security may include theft, unauthorized access, natural disasters, and terrorism, among others. An organization’s need to balance security with open and public access can make facility security more challenging, including at facilities such as medical centers, commercial office buildings, and gaming facilities. Organizations’ efforts to provide facility security are more extensive than simply assigning an individual to “stand guard.” Key functions of facility security generally include facility access, patrol and law enforcement, and security management (see table 1). As part of facility security management, organizations conduct risk assessments—or facility security assessments—that include identifying threats, vulnerabilities, and consequences to determine overall risk and what means, or countermeasures, are best suited to secure the facility. Organizations use a variety of countermeasures to provide facility security, including the use of security equipment, building-design specifications, and security personnel. Nonmilitary federal facilities are categorized into five facility security risk levels that are based on five factors: mission criticality, symbolism, facility population, facility size, and threat to tenant agencies. Private companies make individual determinations on how they want to mitigate facility security risks and must ensure their security workforces meet the specific needs of their industry. For example, security guards in the hospital industry protect employees, patients, visitors, and hospital equipment, and also may provide specialized assistance to ensure the safety of people with particular medical needs. To carry out facility security functions, organizations may rely on in-house security personnel; for federal agencies, those personnel are classified into several specific general schedule (GS) job series. Federal guidance provides broad parameters for the duties associated with each job position within its assigned OPM job series, but each agency is able to further refine its specific position descriptions within those parameters. The following provides the five job series used for the security personnel at the agencies we reviewed and a summary of the key security duties associated with each job series according to OPM guidance: GS-0085 Security Guard—generally performs protective services work involving guarding, protecting, and controlling access to federal facilities; GS-0083 Police—generally performs law enforcement work involving protecting the peace, investigating crimes, and arresting violators; GS-0080 Security Administration—generally performs or manages facility security work involving developing risk assessments, implementing security procedures, and overseeing security staff; GS-1811 Criminal Investigation—generally performs or supervises work involving planning and conducting investigations related to violations of federal laws; and GS-1802 Compliance Inspection—generally performs work involving conducting inspections to ensure compliance with federal laws (e.g., inspection of airline passengers and baggage). In addition to in-house facility security personnel, organizations may also use contract security personnel to secure their facilities. Organizations generally contract for a certain number of hours of security service to be fulfilled by contracting companies, rather than specifying the number of contract security personnel. Contracting companies recruit, hire, train, and pay their own security staff and typically charge an organization an hourly rate for their services. Titles for these contract security personnel may vary by organization. For example, FPS calls them protective security officers, while the Army more simply calls them contract security guards. In the federal government, DHS is designated under the Homeland Security Act of 2002 as the primary agency authorized to enforce federal laws and regulations aimed at protecting federal facilities and persons on the property. Within DHS, FPS is the security provider for GSA-owned or - controlled facilities. FPS’s federal workforce consists of about 675 law enforcement security officers (LESO), also known as inspectors, who are responsible for law enforcement and security duties, including: patrolling building perimeters, responding to incidents, completing risk assessments for buildings, recommending security countermeasures, and overseeing the contract security workforce. FPS also relies on about 14,000 contract security guards to control access, operate security equipment, observe the environment for suspicious activity, and respond to emergency situations involving the safety and security of the facility. We previously identified several vulnerabilities and weaknesses in the oversight of both FPS’s federal and contract workforces, and FPS is currently undertaking efforts to address these weaknesses and improve management of its security workforce. In addition to FPS, other federal agencies are responsible for securing and protecting their own facilities. Table 2 shows the facilities protected by the other agencies included in our review. Eight of the nine federal agencies selected for our review currently use a combination of both in-house and contract security personnel to secure their facilities, and the distribution of in-house and contract staff vary significantly (see fig. 1). VHA almost exclusively uses federal employees to secure its hospitals. Three of the selected agencies have statutory requirements that determine their use of federal and contract staff: the Army, Air Force, and TSA. DOD is generally prohibited from entering into a contract for the performance of firefighting or security guard functions at any military installation or facility. However, Congress authorized DOD to temporarily use contract security staff in fiscal year 2003 to address increased security needs at its facilities when numerous DOD employees were deployed overseas, but DOD is now required to discontinue the temporary use of contract security guards at the end of fiscal year 2012. TSA’s composition of mostly federal security employees, or airport passenger screeners, was dictated when the agency was created in the Aviation and Transportation Security Act of 2001. Others among our selected agencies generally have the discretion to determine the extent to which they use in-house staff or contract the facility security functions out to private contractors. For instance, PFPA primarily uses federal police officers to secure the Pentagon—a facility with a high risk for terrorist attack—and contract security guards to secure its lower-risk facilities. Federal agencies reported using a variety of in-house security positions (see table 3); however, one or two key positions may account for the majority of the agency’s in-house security staff. For example, while the Smithsonian reported that it uses four different types of federal security positions, almost 90 percent of its security employees are federal security guards. Agency officials reported that their in-house security staffs collectively perform a broader range of facility security functions than their contract staff. In-house security administration staff, police officers, and security guards, among others, perform a wide range of security functions. The most common security functions that in-house staff performed are law enforcement, post inspections, and risk assessments (see fig. 2). In contrast, seven of the eight agencies currently using contract security personnel reported their contract staff generally perform routine facility access control functions, including visitor screening and control center operations. FPS reported that its contract security guards performed a wider range of tasks, including some patrol and response duties. Officials from other agencies reported using contract security guards for what they consider to be lower-risk security posts, such as those providing visitor assistance. According to Air Force officials, their decisions of where to use contract staff are not predicated on facility or post risk levels, but on where staff are needed to replace deployed military personnel. Depending on the functions that are performed, each security position, whether in-house or contracted, generally has different training requirements that are specified by each individual agency’s needs. Training for federal and military police officers is generally more extensive than that required for federal and military security guards—two commonly used in-house security positions. While federal police officers receive training at a police academy, a federal law enforcement training facility, or a DOD-agency training facility, training for federal security guards is currently dictated by each agency’s individual needs. For example, Air Force officials told us that Air Force police officers receive 5 weeks of training and can perform all the job functions of security guards, in addition to broader law enforcement functions, while Air Force security guards receive 2 weeks of training to perform a more limited set of functions focused on facility access. Currently, no federal governmentwide training standards exist for contract security guards to work in federal facilities. Consequently, training requirements for contract security staff vary depending on the agency, as well as possible state requirements. Agencies specify in their contract statements of work the functions that contract staff are expected to perform, as well as the qualifications that are required for the staff. For instance, in addition to basic security training provided by the contractor, FPS contract security guards are required to have 16 hours of FPS-provided training, including certification on X-ray and magnetometer equipment, while the Air Force’s contract security guards receive 40 hours of government-provided training specific to the installation in which they are assigned. Selected agency officials told us that their decisions about staffing facility security functions—whether it be deciding between using in-house or contract staff or deciding the most appropriate type of in-house staff—are driven by multiple factors, such as their individual facility security requirements and costs. Federal facilities nationwide differ in their facility type, size, location, occupant mission, and risk level, among other factors. As we have previously reported, and security officials corroborated, there is no widely accepted formula to determine the size and makeup of a security workforce and no standard model can be applied for staffing because the risk level and specific building needs may differ. While some federal agencies may use in-house staff to secure their high-risk facilities, other agencies, such as JPS or USMS, may use contract security guards to protect their high-risk facilities. Over the years, we have advocated the use of a comprehensive risk management approach that links threats and vulnerabilities to resource requirements and allocations to address potential security threats. According to security officials from selected agencies, staffing for specific security positions is based on factors such as the risk level and specific needs of the facilities that are being protected. Staffing needs dictate the qualifications that agencies set for either their in-house or contract staff.