Multiple DHS offices, components, and agencies have roles and responsibilities in DHS’s development of CBRN risk assessments, response plans, and capabilities. Specifically: S&T is responsible for the development of DHS’s CBRN risk assessments—the TRAs and MTAs. CFO’s PA&E unit is responsible for developing resource allocation decisions for capability investments through DHS’s Planning, Programming, Budgeting and Execution system. OHA is responsible for leading DHS’s biological and chemical defense activities and provides medical and public health expertise to support the department’s efforts. OPS is responsible for coordinating DHS’s operational activities for incident response, including for CBRN incidents. POLICY is responsible for advising the Secretary of Homeland Security in the development of DHS’s policies for CBRN plans and capabilities. NPPD’s RMA is responsible for leading DHS’s approach to risk management and the application of risk information to departmental activities. DNDO is responsible for domestic radiological and nuclear detection efforts and integration of federal nuclear forensics programs. FEMA is responsible for leading the nation’s effort for preparing to respond to emergencies and disasters. DHS engages in risk management activities to help ensure the nation’s ability to protect against and respond to incidents using CBRN agents. DHS’s Risk Lexicon provides the following definitions for risk-related terms: Risk—potential for an adverse outcome assessed as a function of threats, vulnerabilities, and consequences associated with an incident, event, or occurrence. Risk Assessment—product or process which collects information and assigns values to risks for the purpose of informing priorities, developing or comparing courses of action, and informing decision making. Risk Management—process of identifying, analyzing, assessing, and communicating risk and accepting, avoiding, transferring, or controlling it to an acceptable level considering associated costs and benefits of any actions taken. The department’s 2010 Quadrennial Homeland Security Review notes the importance of incorporating information from risk assessments into departmental decision making, one aspect of the department’s homeland security risk management process. According to DHS doctrine, risk management applications include the use of risk information to inform, among others, strategic and operational planning and resource decisions. This report focuses on DHS’s use of the third step of its risk management process—risk assessment—and the application of risk assessment results to inform CBRN response plans and capabilities. DHS notes that risk information is usually one of many factors—not necessarily the sole factor—that decision makers consider when deciding which strategies to pursue for managing risk. These additional factors may include strategic and political considerations, among others. See figure 1 for a graphic depiction of DHS’s risk management process. DHS is responsible for assessing the risks posed by various CBRN agents, as directed by the Project BioShield Act of 2004 and Homeland Security Presidential Directives 10 – Biodefense for the 21st Century, 18 – Medical Countermeasures against Weapons of Mass Destruction, and 22 – National Domestic Chemical Defense. To this end, S&T develops CBRN TRAs and MTAs. Each TRA assesses the relative risks posed by multiple CBRN agents based on variable threats, vulnerabilities, and consequences. Since 2006, DHS has developed eight TRA reports: Biological Terrorism Risk Assessments (BTRA) in 2006, 2008, and Chemical Terrorism Risk Assessments (CTRA) in 2008 and 2010; Radiological/Nuclear Terrorism Risk Assessment (R/NTRA) in 2011; and Integrated CBRN Terrorism Risk Assessments (ITRA) in 2008 and 2011. Each MTA assesses the threat posed by a given, individual CBRN agent or class of agents and the potential number of human exposures in plausible, high-consequence scenarios. Since 2004, DHS has developed 17 MTA reports. DHS uses the MTAs to determine which CBRN agents pose a material threat sufficient to affect national security. The Project BioShield Act describes specific ways in which the MTAs may be used in efforts to procure certain medical countermeasures. However, the various presidential directives note that while the TRAs may be used to inform decision making, they are not specific as to when or how these risk assessments should be used by DHS officials to inform CBRN response planning or capability investments. (U) We identified CBRN-specific interagency response plans among three families of interagency plans developed by DHS that are designed for responding to CBRN incidents. These families of plans include plans developed under (1) Executive Order 13527 – Establishing Federal Capability for the Timely Provision of Medical Countermeasures Following a Biological Attack (Executive Order 13527) and (2) Homeland Security Presidential Directive 8 Annex I – National Planning (HSPD 8 Annex I), and as a part of (3) the National Response Framework’s (NRF) CBRN- specific incident annexes.reviewed. Since the first DHS CBRN risk assessments were developed in 2004, DHS used the risk assessments to varying degrees to directly or indirectly inform development of 9 of the 12 CBRN-specific response plans we identified. Our analysis showed that 2 of the 12 plans were directly informed by the risk assessments, while DHS officials told us that 7 of the 12 plans were indirectly informed by the risk assessments. However, we could not independently verify this for these 7 plans because DHS officials could not document how the risk assessments influenced information contained in the plans. Three of the response plans were not informed by the risk assessments, according to DHS officials. Our analysis of a limited set of planning assumptions in the plans compared to information contained in the risk assessments showed general consistency between the plans and the risk assessments. DHS’s guidelines state that response plans should be informed by risk assessment information to supplement risk-related information contained in the National Planning Scenarios (NPS) used for developing emergency response plans. DHS’s 2009 Integrated Planning System (IPS) also identifies risk assessments as one source of information that should be used to inform response plan development. This guidance, however, does not define what it means for response plans to be informed by risk assessments or how planners should use specific types of risk assessments, such as DHS’s TRAs and MTAs, when developing or revising related plans. Of the 12 CBRN response plans developed by DHS that we reviewed, none of the plans were developed solely in response to a given CBRN threat agent being identified as high risk in DHS’s CBRN risk assessments. Rather, these plans were developed in response to requirements in an executive order and as part of families of plans developed in response to provisions in presidential directives.table 3 for a list of the CBRN response plans and whether each plan was directly, indirectly, or not informed by DHS’s CBRN risk assessments during its development. Since 2004, DHS’s use of its CBRN risk assessments to inform its CBRN- specific capability investments has varied, from directly impacting its capabilities to not being used at all. Six of the seven CBRN capabilities we examined were informed by DHS’s CBRN risk assessments to some extent, according to program officials, DHS documents, and our analysis (see table 4).was directly informed by the risk assessments, while our analysis showed or DHS officials told us that five of the seven capabilities were partially Our analysis showed that one of the seven capabilities informed by the risk assessments. However, we could not independently verify this for three of these five capabilities because DHS officials could not document how the risk assessments influenced the capabilities. DHS has developed policies and guidance on the use of risk information for the department’s activities, but DHS has not issued guidance to program managers that specifies when or how they should use the CBRN risk assessments to inform CBRN capabilities (this is discussed in the third objective of this report). The DHS Strategic Plan for 2008-2013 states that resource decisions should be informed by relevant risk assessments, but does not provide specific guidance on when or how such decisions should be informed by the department’s CBRN risk assessments. Additionally, the Secretary of Homeland Security’s March 2011 Management Directive stated that DHS policy is to use risk information and analysis to inform decision making and instructs DHS components to establish mission-appropriate risk management capabilities. See table 4 for a summary of the CBRN capabilities and whether each capability was directly, partially, or not informed by DHS’s CBRN risk assessments. Our analysis showed that the extent to which the CBRN capabilities we examined were informed by DHS’s CBRN risk assessments varied, but DHS officials described reasons for this variance, as discussed below. In addition, DHS officials noted that basic scientific differences between chemical, biological, and radiological/nuclear threat agents and materials also provide explanations about the differences in how the CBRN risk assessments are used to inform capabilities. For example, DHS officials told us that the relative risk rankings amongst biological agents may be more meaningful than the ranking amongst radiological materials because there are greater differences associated with detecting biological agents, as well as their consequences. DHS program managers used the risk assessments to partially inform the program management of the RDCDS and the CSAC, as described below. The Director of the CSAC told us that because there are over 13 million possible chemicals that could be considered threat agents, it is impossible to come up with a relative risk ranking of all the chemicals. Therefore, the results of the CTRA are designed to be representative of the highest risk chemical agents and used as a guide—not a definitive resource—for informing capability and planning decisions related to such agents. Additionally, certain chemical compounds have similar enough compositions to be considered together when developing capabilities and response plans. Rapidly Deployable Chemical Detection System (RDCDS). The OHA Chemical Defense Program used the CTRA to partially inform its RDCDS, according to our analysis as well as DHS officials and documentation.