To help provide a safe operating environment for airlines, the Code of Federal Regulations (C.F.R.) title 14, part 107 requires that U.S. airports control access to secured areas. Such controls are intended to ensure that only authorized persons have access to aircraft, the airfield, and certain airport facilities. Other security measures include requiring that airport and airline employees display identification badges and that airlines screen persons and carry-on baggage for weapons and explosives. In January 1989, FAA made 14 C.F.R. part 107 more stringent by mandating that access controls to the secured areas of certain airports meet four broad requirements. Under the amendment—14 C.F.R. 107.14—access control systems must (1) ensure that only authorized persons gain access to secured areas, (2) immediately deny access to persons whose authorization is revoked, (3) differentiate between persons with unlimited access to the secured area and persons with only partial access, and (4) be capable of limiting access by time and date. According to FAA, these requirements are intended to prevent individuals, such as former airline employees, from using forged, stolen, or noncurrent identification or their familiarity with airport procedures to gain unauthorized access to secured areas. All U.S. airports where airlines provide scheduled passenger service using aircraft with more than 60 seats must meet the requirements of 14 C.F.R. 107.14. Beginning in August 1989, each of these airports had to develop an access control system plan for FAA field security officials to review and approve. Following approval, FAA gives airports up to 2-1/2 years to comply with the regulation, depending on the number of persons screened annually or as designated by FAA on the basis of its security assessment. FAA expects airports to maintain and modernize their systems to keep them in regulatory compliance. As of August 1994, 258 airports were subject to FAA’s access control requirements. Appendix I lists these airports. Access control systems are eligible for AIP funds. FAA administers the AIP and provides funds for airport planning and development projects, including those enhancing capacity, safety, and security. FAA’s AIP Handbook (Order 5100.38A) provides policies, procedures, and guidance for making project funding decisions. According to the handbook’s section on safety, security, and support equipment (section 7), only those system components and facilities necessary to meet the requirements of 14 C.F.R. 107.14 are eligible for AIP funds. The airports themselves must fund any additional equipment or software capability that exceeds these requirements. FAA airport programming officials approve AIP funding requests. Airports have installed various systems—mostly computer-controlled—to meet FAA’s four access control requirements. With FAA’s approval, airports have taken the following approaches: Airports have placed the equipment for their access control systems in different locations. For example, some airports screen persons at checkpoints, while other airports have installed controls on doors beyond such checkpoints. Also, some airports have installed controls on both sides of doors leading into and out of secured areas. Airports have installed different types of equipment. For example, to secure doors and gates, several airports use magnetic stripe card readers while others use proximity card readers. One airport installed a reader that scans an individual’s hand to determine the person’s identity. Also, we visited one airport that has an “electronic fence” to segregate the commercial and general aviation operations areas; another has a guard gate and magnetic stripe card reader to separate passenger and cargo operations areas. Additionally, some airports have mounted closed-circuit television cameras at doors and gates, while other airports have chosen not to install such technology. According to FAA’s data, most of the 258 regulated airports have now completed installing their systems, but they will need to modernize these systems in the future. Modernization is necessary when equipment wears out, additional equipment is needed, or equipment or software no longer has the capacity to meet security-related demands. For example, in September 1994, FAA provided one airport that had an approved system with over $3 million in AIP funding to purchase closed-circuit television cameras, help construct a communications center, and make other system modifications to meet additional security needs. The costs for access control systems are over three times greater than FAA expected. FAA initially estimated that the costs to install, operate, maintain, and modernize systems at all regulated airports would total $211 millionfrom 1989 through 1998. However, updated data provided by FAA show that actual and projected costs for the same period totaled about $654 million. This amount includes $327 million in AIP funds, or 50 percent of total costs over the 10-year period. As of August 1994, 177 (69 percent) of the 258 regulated airports received AIP funding to help pay for their access control systems. Furthermore, on the basis of the updated information, FAA projects that costs for systems in 1999 through 2003 will total an additional $219 million, half of which would be federally funded. Appendix II shows actual and projected access control costs in 1989 through 2003, including AIP funding. According to FAA officials, FAA’s initial cost projection was low primarily because more access points were secured and more sophisticated and expensive equipment was installed than the agency’s analysis considered. For example, FAA’s analysis assumed that the largest airports would secure 128 access points on average. However, we found that these airports had initially secured about 390 points on average. Appendix III compares FAA’s initial cost figures with the agency’s updated actual and projected costs of access control systems. Over the next several years, many access control systems will need to be modernized. FAA can help ensure that modernization is implemented in a cost-effective manner by providing detailed guidance and facilitating the development of standards explaining how to meet the requirements of 14 C.F.R. 107.14. Without detailed guidance, many airports initially spent funds to secure access points that FAA later determined did not need to be secured to meet the agency’s requirements. Also, without standards to guide the design of systems, some airports purchased systems that did not meet FAA’s requirements. Additionally, without guidance and standards to serve as criteria, it was difficult for FAA to ensure that AIP funds were used only for the system components needed to meet the agency’s access control requirements as directed by its AIP funding policy. FAA and the industry have several initiatives under way that could address these deficiencies and help ensure that systems are cost-effective. FAA has not developed detailed guidance and standards to explain how systems could meet its four access control requirements in a cost-effective manner. Detailed guidance could help airports determine where equipment should be located. Standards could explain what functions equipment and software should perform and how quickly and reliably these functions should be done. For example, one of FAA’s four access control requirements is that systems grant secured-area access only to authorized persons. Detailed guidance for computer-controlled access control systems could include the following: Additional equipment beyond a card reader, such as lights that flash when the door is not secured, should be used only if the access point is in a low-traffic area. Closed-circuit television cameras should be used only at access points where an analysis shows that it is less expensive to have the camera than to have security personnel respond to an alarm. Standards for computer-controlled access control systems could include the period of time that a secured door or gate can remain open before security personnel are notified, the period of time that can elapse before a terminated employee’s access code is invalidated, the percentage of time that the system is expected to be operable, and the frequency at which the system can misread a card. Although developing guidance and standards for access control systems is a complex undertaking, FAA has provided airports and airlines with guidance and standards explaining how to meet other agency requirements that are similarly complex. For example, FAA has planning and design guidance explaining how terminals can be configured to accommodate the expected flow of passengers. The guidance recognizes that each airport has its own combination of individual characteristics that must be considered. FAA’s standards for equipment include those to design, construct, and test lift devices for mobility-impaired airline passengers and vehicles for aircraft rescue and fire fighting. Such standards do not specify what equipment airports should use, but rather how a vendor’s equipment should perform to meet FAA’s requirements. For software, FAA has developed standards for the software used in the Traffic Alert and Collision Avoidance System that it requires on most commercial passenger aircraft. FAA requires that airports use its guidance and standards in order to receive AIP funds. In some cases, FAA certifies that equipment and software from certain manufacturers meet its standards, as it has done for the equipment used to screen persons and the Traffic Alert and Collision Avoidance System. However, similar standards and certifications do not exist for access control systems. When FAA issued 14 C.F.R. 107.14 in January 1989, the agency did not conduct tests that could have provided the necessary knowledge to establish detailed guidance and standards for computer-controlled systems. Although airports and airlines suggested that FAA conduct tests at selected airports, the agency determined that nationwide implementation of the new requirements should proceed immediately. According to FAA officials, the Office of the Secretary of Transportation attached a very high priority to implementing improved airport access controls. As a result, FAA decided not to delay implementing the new access control requirements by testing and evaluating systems. According to security experts and airport and airline representatives,detailed guidance and standards would help airports know which systems satisfy FAA’s access control requirements in a cost-effective manner. Without detailed guidance and standards, it is difficult to determine if the many different systems installed at a wide range of costs are cost-effective.