Our preliminary results indicate that, in the absence of RAMP, FPS currently is not assessing risk at the over 9,000 federal facilities under the custody and control of GSA in a manner consistent with federal standards such as NIPP’s risk management framework, as FPS originally planned. According to this framework, to be considered credible a risk assessment must specifically address the three components of risk: threat, vulnerability, and consequence. As a result, FPS has accumulated a backlog of federal facilities that have not been assessed for several years. According to FPS data, more than 5,000 facilities were to be assessed in fiscal years 2010 through 2012. However, we were not able to determine the extent of the FSA backlog because we found FPS’s FSA data to be unreliable. Specifically, our analysis of FPS’s December 2011 assessment data showed nearly 800 (9 percent) of the approximately 9,000 federal facilities did not have a date for when the last FSA was completed. We have reported that timely and comprehensive risk assessments play a critical role in protecting federal facilities by helping decision makers identify and evaluate potential threats so that countermeasures can be implemented to help prevent or mitigate the facilities’ vulnerabilities. Although FPS is not currently assessing risk at federal facilities, FPS officials stated that the agency is taking steps to ensure federal facilities are safe. According to FPS officials, its inspectors (also referred to as law enforcement security officers) monitor the security posture of federal facilities by responding to incidents, testing countermeasures, and conducting guard post inspections. In addition, since September 2011, FPS’s inspectors have collected information—such as location, purpose, agency contacts, and current countermeasures (e.g., perimeter security, access controls, and closed-circuit television systems) at over 1,400 facilities—which will be used as a starting point to complete FPS’s fiscal year 2012 assessments. However, FPS officials acknowledged that this approach is not consistent with NIPP’s risk management framework. Moreover, several FPS inspectors told us that they received minimal training or guidance on how to collect this information, and expressed concern that the facility information collected could become outdated by the time it is used to complete an FSA. We reported in February 2012 that multiple federal agencies have been expending additional resources to conduct their own risk assessments, in part because they have not been satisfied with FPS’s past assessments. These assessments are taking place even though, according to FPS’s Chief Financial Officer, FPS received $236 million in basic security fees from federal agencies to conduct FSAs and other security services in fiscal year 2011. For example, officials we spoke with at the Internal Revenue Service, Federal Emergency Management Agency, Environmental Protection Agency and the U.S. Army Corps of Engineers stated that they conduct their own risk assessments. GSA is also expending additional resources to assess risk. We reported in October 2010 that GSA officials did not always receive timely FPS risk assessments for facilities GSA considered leasing. GSA seeks to have these assessments completed before it takes possession of a property and leases it to tenant agencies. However, our preliminary work indicates that as of June 2012, FPS has not coordinated with GSA and other federal agencies to reduce or prevent duplication of its assessments. In September 2011, FPS signed an interagency agreement with Argonne National Laboratory for about $875,000 to develop an interim tool for conducting vulnerability assessments by June 30, 2012. According to FPS officials, on March 30, 2012, Argonne National Laboratory delivered this tool, called the Modified Infrastructure Survey Tool (MIST), to FPS on time and within budget. MIST is an interim vulnerability assessment tool that FPS plans to use until it can develop a permanent solution to replace RAMP. According to MIST project documents and FPS officials, among other things, MIST will: allow FPS’s inspectors to review and document a facility’s security posture, current level of protection, and recommend countermeasures; provide FPS’s inspectors with a standardized way for gathering and recording facility data; and allow FPS to compare a facility’s existing countermeasures against the Interagency Security Committee’s (ISC) countermeasure standards based on the ISC’s predefined threats to federal facilities (e.g., blast-resistant windows for a facility designed to counter the threat of an explosive device) to create the facility’s vulnerability report. According to FPS officials, MIST will provide several potential improvements over FPS’s prior assessment tools, such as using a standard way of collecting facility information and allowing edits to GSA’s facility data when FPS inspectors find it is inaccurate. In addition, according to FPS officials, after completing a MIST vulnerability assessment, inspectors will use additional threat information gathered outside of MIST by FPS’s Threat Management Division as well as local crime statistics to identify any additional threats and generate a threat assessment report. FPS plans to provide the facility’s threat and vulnerability reports along with any countermeasure recommendations to the federal tenant agencies. In May 2012, FPS began training inspectors on MIST and how to use the threat information obtained outside MIST and expects to complete the training by the end of September 2012. According to FPS officials, inspectors will be able to use MIST once they have completed training and a supervisor has determined, based on professional judgment, that the inspector is capable of using MIST. At that time, an inspector will be able to use MIST to assess level I or II facilities. According to FPS officials, once these assessments are approved, FPS will subsequently determine which level III and IV facilities the inspector may assess with MIST. Our preliminary analysis indicates that in developing MIST, FPS increased its use of GAO’s project management best practices, including alternatives analysis, managing requirements, and conducting user acceptance testing. For example, FPS completed, although it did not document, an alternatives analysis prior to selecting MIST as an interim tool to replace RAMP. It appears that FPS also better managed MIST’s requirements. Specifically, FPS’s Director required that MIST be an FSA- exclusive tool and thus helped avoid changes in requirements that could have resulted in cost or schedule increases during development. In March 2012, FPS completed user acceptance testing of MIST with some inspectors and supervisors, as we recommended in 2011.FPS officials, user feedback on MIST was positive from the user acceptance test, and MIST produced the necessary output for FPS’s FSA process. However, FPS did not obtain GSA or federal tenant agencies’ input in developing MIST’s requirements. Without this input, FPS’s customers may not receive the information they need to make well- informed countermeasure decisions. FPS has yet to decide what tool, if any, will replace MIST, which is intended to be an interim vulnerability assessment tool. According to FPS officials, the agency plans to use MIST for at least the next 18 months. Consequently, until FPS decides what tool, if any, will replace MIST and RAMP, it will still not be able to assess risk at federal facilities in a manner consistent with NIPP, as we previously mentioned. Our preliminary work suggests that MIST has several limitations: Assessing Consequence. FPS did not design MIST to estimate consequence, a critical component of a risk assessment. Assessing consequence is important because it combines vulnerability and threat information to evaluate the potential effects of an adverse event on a federal facility. Three of the four risk assessment experts we spoke with generally agreed that a tool that does not estimate consequences does not allow an agency to fully assess the risks to a federal facility. However, FPS officials stated that incorporating consequence information into an assessment tool is a complex task. FPS officials stated that they did not include consequence assessment in MIST’s design because it would have required additional time to develop, validate, and test MIST. As a result, while FPS may be able to identify a facility’s vulnerabilities to different threats using MIST, without consequence information, federal tenant agencies may not be able to make fully informed decisions about how to allocate resources to best protect federal facilities. FPS officials do not know if this capability can be developed in the future, but they said that they are working with the ISC and DHS’s Science and Technology Directorate to explore the possibility. Comparing Risk across Federal Facilities. FPS did not design MIST to present comparisons of risk assessment results across federal facilities. Consequently, FPS cannot take a comprehensive approach to managing risk across its portfolio of 9,000 facilities to prioritize recommended countermeasures to federal tenant agencies. Instead, FPS takes a facility by facility approach to risk management where all facilities with the same security level are assumed to have the same security risk, regardless of their location. We reported in 2010 that FPS’s approach to risk management provides limited assurance that the most critical risks at federal facilities across the country are being prioritized and mitigated.such a comprehensive approach to its FSA program when it developed RAMP and FPS officials stated that they may develop this capability for the next version of MIST. FPS recognized the importance of having Measuring Performance. FPS has not developed metrics to measure MIST’s performance, such as feedback surveys from tenant agencies. Measuring performance allows organizations to track progress toward their goals and, gives managers critical information on which to base decisions for improving their programs. This is a necessary component of effective management, and should provide agency Without such managers with timely, action-oriented information. metrics, FPS’s ability to improve MIST will be hampered. FPS officials stated that they are planning to develop performance measures for MIST, but did not give a time frame for when they will do so.