DOD issued a directive signed by the Deputy Secretary of Defense that provides DOD’s antiterrorism policy and assigns responsibilities to DOD organizations for implementing antiterrorism initiatives. This directive places responsibility for developing antiterrorism policy and guidance with the Office of the Assistant Secretary of Defense for Special Operations and Low-Intensity Conflict. In this capacity, the Assistant Secretary of Defense issued an instruction that established 31 antiterrorism standards that DOD organizations, including the services, are required to implement.8, These standards address antiterrorism planning, training requirements, physical security measures, and related issues. The office also issued a handbook containing additional detailed guidance on antiterrorism policies and practices, including guidance on assessment methodology. The Joint Staff has also issued an installation- planning template to help installations prepare their antiterrorism plans.Additionally, each of the services has issued regulations, orders and instructions to implement the DOD guidance and establish its own specific policies and standards. DOD and the services have recently revised some of these key guidance documents, and others are now under revision. DOD Instruction 2000.16, DOD Antiterrorism Standards, June 14, 2001. The services assign responsibility for protecting installations from terrorist attacks to installation commanders, who identify and prioritize antiterrorism requirements. Installation commanders are to compose a prioritized list of antiterrorism requirements from annual assessments of threat, vulnerability, and the criticality of assets, which they submit to their respective major commands. The major commands merge the antiterrorism requirements from all of their installations, prioritize them, and forward their integrated list to the service’s headquarters. Similarly, the services merge and prioritize the antiterrorism requirements of their major commands, and the consolidated list is then used as a basis for funding decisions. The required assessments of threat, vulnerability, and criticality of assets form the foundation of each installation’s antiterrorism plan and support a risk management approach to resource allocation. These three assessments are designed to assess (1) the threats to the installation, (2) the installation’s vulnerabilities, and (3) the installation’s critical assets. The threat assessment identifies and evaluates potential threats on the basis of such factors as the threats’ capabilities, intentions, and past activities. This assessment represents a systematic approach to identify potential threats before they materialize. However, this assessment might not adequately capture some emerging threats, even in cases where the assessment is frequently updated. The risk management approach therefore uses vulnerability and asset criticality assessments as additional inputs to the risk management decision-making process. A vulnerability assessment identifies weaknesses that may be exploited by identified threats and suggests options that address those weaknesses. For example, a vulnerability assessment might reveal weaknesses in an installation’s access control system, its antiterrorism awareness training, or how mission-critical assets such as fuel storage sites and communications centers are protected. Teams of multidisciplinary experts skilled in such areas as structural engineering, physical security, and installation preparedness conduct these assessments. A criticality assessment evaluates and prioritizes assets and functions to identify which assets and missions are relatively more important to protect from attack. For example, important communications facilities, utilities, or major weapons systems might be identified as critical to the execution of U.S. military war plans, and therefore receive additional protection. Criticality assessments provide information in order to prioritize resources while at the same time, reducing the potential application of resources on lower-priority assets. The critical elements of a results-oriented management framework are not being used by the services to guide their antiterrorism efforts. In results-based management, program effectiveness is measured in terms of outcomes or impact rather than outputs (i.e., activities and processes). Results-oriented principles and elements, which we have derived from the Government Performance and Results Act, are presented in table 1. Benefits from a results-based management approach depend upon the combined use of all eight of the critical elements that appear in the table. These elements, when combined with effective leadership can provide a management framework to guide major programs and activities. The critical elements of a results-oriented management framework were largely absent in the antiterrorism efforts of three services’ headquarters and at six of the eight commands we examined. Specifically, the services have not published and disseminated unambiguous results-based, strategic and performance goals for their antiterrorism efforts. Some service antiterrorism officials did articulate broadly stated goals—such as protecting personnel and material assets against terrorist attack, and defeating terrorism—but these goals have not been endorsed and disseminated by service headquarters as servicewide goals nor have the services described how these goals will be achieved or how they intend to evaluate results in terms of the goals. The Air Force, however, has taken some steps toward a results-based management framework. For example, it has published long-term goals and established service-level working groups to evaluate the effectiveness of its antiterrorism program and identify the actions needed to address or revise any unmet goals. Although the Air Force has taken these positive steps, Air Force officials acknowledge that the elements may not have been effectively articulated servicewide so that installations can understand the “big picture” and how all elements fit together. In fact, officials we contacted from Air Combat Command and Air National Guard were not aware of the service-level goals or performance-planning elements. At the command level, a results-oriented management framework was largely absent in the antiterrorism efforts of six of the eight major commands we reviewed. For example, the Air Combat Command did not have overarching antiterrorism goals for its 15 bases, although command officials said that they planned to develop them. Also, the Army National Guard has not issued antiterrorism goals for its 3,900 armories and 211 installations and has no plan to do so. Two of the commands—the Army’s Forces Command and the Navy’s Atlantic Fleet—adopted aspects of a results-oriented framework, and officials said that they did so on their own initiative and without direction from their parent service. The Army Forces Command management framework contained most of the critical management elements, such as quarterly reviews, long-term and annual goals, clear performance measures, and identification of resource requirements. Army Forces Command officials said that the results-based management approach enables its senior officers to monitor the command’s progress toward its short- and long-term goals and make necessary adjustments to the strategy and resource allocation to accomplish these goals. Forces Command officials attributed their management approach’s success, in large part, to the involvement of senior command officials and their endorsement of this management approach. According to Army headquarters antiterrorism officials, the Forces Command management framework has been an effective approach and may be useful as a model for other major commands. The Navy’s Atlantic Fleet Command also articulated long-term goals and strategies to accomplish its antiterrorism goals. For example, the fleet developed a plan of action to address security deficiencies that were identified through assessments by establishing a database to track deficiencies and identify trends. The fleet also linked resource requirements to accomplish these steps and developed metrics to measure results. According to the Atlantic Fleet officials we spoke with, however, these strategies are not currently being used by the fleet to shape its antiterrorism efforts because they are waiting for the Navy to issue servicewide antiterrorism goals. Atlantic Fleet officials stated they wanted to avoid having separate and different strategic plans for each command. The services and their major commands cite two primary reasons for not employing a results-based management framework to guide and implement their antiterrorism efforts. First, the services do not want to adopt goals and strategies that might prove inconsistent with DOD’s forthcoming, Department-wide antiterrorism strategy. As discussed earlier, the Department was in the process of developing an antiterrorism strategy, but suspended its efforts after the attacks on the World Trade Center and the Pentagon because of the pressing needs of the war on terrorism. DOD officials have indicated that they have reinitiated their efforts to develop a strategy but have not set a target date for their completion. The second reason cited by service officials for not employing a results-oriented management framework was that strategic planning and performance planning called for by the Results Act applies to agencies and not to specific efforts such as antiterrorism. We agree that the services and major commands are not required by the Results Act to prepare strategic plans and performance plans specific to their antiterrorism efforts. Nonetheless, the Results Act offers a model for developing an effective management framework to improve the likelihood of successfully implementing initiatives and assessing results. Without a results-based management approach to prioritize, integrate, and evaluate their efforts, it will be difficult for the services and their major commands to systematically plan and implement antiterrorism programs or assess their progress in reducing the likelihood and impact of terrorist attacks. It is crucial that the services identify and support those efforts that are most likely to achieve long-term antiterrorism goals because funding is not sufficient to eliminate or mitigate all identified vulnerabilities. The services and commands we reviewed are generally following prescribed guidance and regulations to use the DOD risk management approach in developing their installation antiterrorism requirements, but a significant weakness exists with the oversight of this process. Specifically, the services are not required to evaluate the thoroughness of all installations’ annual risk management assessments or whether installations used required methodologies to perform these assessments. As previously discussed, under DOD’s antiterrorism approach, three assessments (threat, vulnerability, and criticality) provide the installation commanders with the information necessary to manage the risk of a terrorist attack, and develop an antiterrorism program for the installation. It also provides guidance for completing these assessments;and it requires the military Departments, through the services, to oversee the antiterrorism efforts at their installations. In their oversight role, the military Departments, through the services, are required to ensure that installation antiterrorism efforts adhere to the antiterrorism standards established by DOD.