The federal government’s vast real property portfolio is used for all aspects of operations and includes buildings such as warehouses, office space, dormitories, and hospitals. Agencies’ physical security programs address how agencies approach aspects of physical security for these buildings, such as conducting risk assessments to identify threats and vulnerabilities, determining which countermeasures to implement, and coordinating security efforts within the agency and with other agencies. We have previously reported that because of the considerable differences in types of federal facilities and the variety of risks associated with each of them, there is no single, ideal approach to physical security. For example, in some instances, an agency’s component offices—which are subordinate entities such as bureaus, administrations, or other operating divisions—have their own physical security programs for the facilities they use. In other instances, an agency’s regions or districts play a role in physical security. ISC was created by Executive Order 12977 in 1995, after the bombing of the Alfred P. Murrah federal building in Oklahoma City, to address physical security across federal facilities occupied by federal employees for nonmilitary activities. ISC’s mandate is to enhance the quality and effectiveness of security in and protection of federal facilities. To accomplish this, Executive Order 12977 directs the ISC to, among other things, develop and evaluate security standards for federal facilities, develop a strategy for ensuring compliance with such standards, and oversee the implementation of appropriate security measures in federal facilities. Executive Order 12977 also directs each executive agency and department to cooperate and comply with ISC policies and recommendations issued pursuant to the order. The order, as amended, gives the Secretary of Homeland Security the responsibility to monitor federal agency compliance with ISC policies and recommendations. Prior to the creation of ISC, there was no federal body responsible for developing government-wide physical security standards. Consequently, ISC became the government’s central forum for exchanging information and disseminating standards and guidance on physical security at federal facilities. ISC’s standards are intended to help agencies integrate security into the operations, planning, design, and construction of federal facilities and are intended to be customized to address facility-specific conditions. ISC has developed the following security standards and guidance, among others:9, 10 Physical Security Criteria for Federal Facilities establishes a process for determining the baseline set of physical security measures to be applied at a federal facility and provides a framework for the customization of security measures to address unique risks at a facility. Design-Basis Threat establishes a profile of the type, composition, and capabilities of adversaries. It is designed to correlate with the countermeasures contained in the Physical Security Criteria for Federal Facilities. Facility Security Level Determinations defines the criteria and process to be used in determining the facility security level of a federal facility, a categorization that then serves as the basis for implementing ISC standards. Use of Physical Security Performance Measures directs all federal agencies to assess and document the effectiveness of their physical security programs through performance measurement and testing. For a complete listing of ISC standards and guidance, see www.dhs.gov/interagency- security-committee-standards-and-best-practices. Accessed January 22, 2013. ISC officials said that they are in the process of consolidating and streamlining several of their physical security standards into a single document, which they believe will help facilitate agencies’ use of the standards. This standard provides guidance on how to establish and implement a comprehensive measurement and testing program. Security Specialist Competencies provides the range of core competencies federal security specialists should possess to perform their basic duties and responsibilities. ISC’s 51 member agencies meet quarterly to promote information sharing on physical security. Members serve on working groups and subcommittees to develop and update physical security standards and guidance, including those listed above. ISC also engages with industry and other government stakeholders to advance best practices and provides training on its standards to federal facility security professionals and other stakeholders. Leadership for the ISC is provided by DHS’s Assistant Secretary for Infrastructure Protection, who is the chair of the ISC; an Executive Director; and eight standing subcommittees that identify long- and short-term priorities and oversee strategic initiatives. Agencies draw upon a variety of information sources in developing and continually refining aspects of their physical security programs, such as how and when to conduct risk assessments, what skills security staff should have, and how to determine which countermeasures to implement at their facilities. Sources can include an agency’s institutional knowledge or subject matter expertise in physical security, federal statutes and regulations, physical security standards issued by ISC, and state or local regulations, among others, as shown in figure 1. Characteristics such as agencies’ missions and the type, use, and location of their facilities can affect which of these sources agencies use. For example, a facility may adhere to local building codes that affect aspects of physical security such as perimeter fencing, or a facility that is used to house radioactive waste may be subject to federal requirements on the storage of nuclear materials. Institutional knowledge in physical security and ISC’s physical security standards were the two sources that our survey results and case- study interviews showed to be the most influential in guiding agencies’ physical security programs. All 32 of the agencies we surveyed reported that institutional knowledge or subject matter expertise informs their physical security programs. This was the most widely used source cited in our survey, as shown in figure 1. For example, officials from three of the agencies we surveyed said that the knowledge, experience, and expertise that their security specialists have in physical security—which they consider institutional knowledge— is reflected in their physical security programs and policies. One of these officials said his agency contracts with a security company that has extensive knowledge and experience in providing security and law enforcement to high profile institutions across the federal government, and that this knowledge is used in managing the agency’s security program. Another agency official said that the knowledge gained from employees’ previous education, training, or work experiences, or historical knowledge of the agency has assisted in the development of several security policies and procedures within the agency. Agencies also rely heavily on institutional knowledge or subject matter expertise to inform specific aspects of their security programs, more so than any other source we asked about in our survey. As shown in figure 2, 26 agencies reported that institutional knowledge informs how they conduct risk assessments and determine appropriate countermeasures. For example, officials from two of our case-study agencies—DOE and USPS—said that they use institutional knowledge to inform how they conduct these activities. DOE headquarters officials told us that when developing and updating agency-wide physical security policies, which address topics such as risk assessments, they obtain input from DOE staff in their component offices, who have knowledge of the particular needs and constraints of their facilities based on their experience implementing security programs. In addition, USPS officials said that their security staff’s knowledge of the agency’s long-standing security program and their professional education in physical security helps them make decisions about security measures needed at their facilities, such as on the location of perimeter fencing and the appropriate brightness for security lights. Twenty-nine of 32 agencies surveyed reported that ISC standards inform their physical security programs, making it the second most-used source behind institutional knowledge, as shown in figure 1. Officials we interviewed from our case-study agencies said that they use ISC standards as one of many sources that inform what they include in their physical security programs. ISC has developed a number of government- wide physical security standards that address topics intended to help guide agencies’ physical security programs, including determining a facility’s risk level and identifying threats posed by potential adversaries, among other things. Agencies’ use of ISC standards can help ensure that physical security programs are effective government-wide. The standards are developed based on the collective knowledge and physical security expertise of ISC member agencies and, therefore, reflect leading practices in physical security. Every ISC member agency that we surveyed, as well as four agencies that are not ISC members, reported that they use ISC standards at least to some degree. The three agencies we surveyed that reported that they do not use ISC standards at all are not ISC members. According to our survey, ISC standards are most often used for conducting design-basis threat analysis of agency facilities, identifying aspects of facilities that need security measures, and determining appropriate countermeasures, as shown in figure 2. Although the majority of agencies we surveyed use ISC standards, the extent of their reliance varies—with some agencies using the standards extensively to inform their physical security programs and some using them in a more limited way. For example, 11 agencies reported that all of the physical security aspects shown in figure 2 are largely informed by ISC standards, whereas six agencies reported that none of these aspects are largely informed by ISC standards. Instead, these six agencies generally reported that these aspects are somewhat, minimally, or not informed by ISC standards. Among the six agencies that said none of these aspects are largely informed by ISC standards, three are primary ISC members, two are associate members, and one is not an ISC member. We found that agencies’ reasons for making limited use of ISC standards reflect a lack of understanding by some agencies regarding how the standards are intended to be used. For example, officials from the case- study agencies that we interviewed said that certain conditions at their agencies contribute to their limited use of the standards. Specifically, these agencies cited the suitability of the ISC standards to the agencies’ facilities and their own physical security requirements as contributing to their limited use of the standards. Suitability of standards. Officials we interviewed at our case-study agencies told us that they are selective in their use of ISC standards because the standards are not suitable for the types of facilities in their portfolio.