TSA is the primary federal agency responsible for overseeing the security of surface transportation systems, including developing a national strategy and implementing security programs. However, several other agencies, including DHS’s Federal Emergency Management Agency (FEMA) and the Department of Transportation’s (DOT) Federal Transit Administration (FTA) and Federal Railroad Administration (FRA), also play a role in helping to fund and secure these systems. Since it is not practical or feasible to protect all assets and systems against every possible terrorist threat, DHS has called for using risk-informed approaches to prioritize its security-related investments and for developing plans and allocating resources in a way that balances security and commerce. In June 2006, DHS issued the National Infrastructure Protection Plan (NIPP), which established a six-step risk management framework to establish national priorities, goals, and requirements for Critical Infrastructure and Key Resources protection so that federal funding and resources are applied in the most effective manner to deter threats, reduce vulnerabilities, and minimize the consequences of attacks and other incidents. The NIPP, updated in 2009, defines risk as a function of three elements: threat, vulnerability, and consequence. Threat is an indication of the likelihood that a specific type of attack will be initiated against a specific target or class of targets. Vulnerability is the probability that a particular attempted attack will succeed against a particular target or class of targets. Consequence is the effect of a successful attack. In May 2007, TSA issued the Transportation Systems Sector-Specific Plan (TS-SSP), which documents the risk management process to be used in carrying out the strategic priorities outlined in the NIPP. As required by Executive Order 13416, the TS-SSP also includes modal implementation plans or modal annexes that detail how TSA intends to achieve the sector’s goals and objectives for each of the six transportation modes using the systems- based risk management approach. To address the objectives and goals laid out in the TS-SSP, TSA uses various programs to secure transportation systems throughout the country, including Visible Intermodal Prevention and Response (VIPR) teams and Surface Transportation Security Inspectors (STSI). VIPR teams employ a variety of tactics to deter terrorism, including random high- visibility patrols at mass transit and passenger rail stations using, among other things, behavior-detection officers, canine detection teams, and explosive-detection technologies. STSIs, among other things, conduct on- site inspections of U.S. rail systems—including mass transit, passenger rail, and freight rail systems—to identify best security practices, evaluate security system performance, and discover and correct deficiencies and vulnerabilities in the rail industry’s security systems. In August 2007, the Implementing Recommendations of the 9/11 Commission Act (9/11 Commission Act) was signed into law, which included provisions that task DHS and other public and private stakeholders with security actions related to surface transportation security. Among other things, these provisions include mandates for developing and issuing reports on TSA’s strategy for securing public transportation, conducting and updating comprehensive security assessments for public transportation agencies, and ensuring that transportation modal security plans include threats, vulnerabilities, and consequences for transportation infrastructure assets including mass transit, railroads, highways, and pipelines. In March 2009, we reported that TSA has taken some actions called for by the NIPP’s risk management process, but has not conducted comprehensive risk assessments across aviation and four major surface transportation modes. In 2007, TSA initiated but later discontinued an effort to conduct a comprehensive risk assessment for the entire transportation sector, known as the National Transportation Sector Risk Analysis. Consequently, we recommended that TSA conduct comprehensive risk assessments for the transportation sector to produce a comparative analysis of risk across the entire transportation sector, which the agency could use to guide current and future investment decisions. DHS and TSA concurred with our recommendation, and in April 2010 TSA identified planned actions, including integrating the results of risk assessments into a comparative risk analysis across the transportation sector. TSA officials stated in April 2010 that the agency has revised its risk management framework, TS-SSP, and modal annexes. They added that these documents are undergoing final agency review. In addition, we have previously reported that while TSA has collected information related to threat, vulnerability, and consequence within the surface transportation modes, it has not conducted risk assessments that integrate these three components for individual modes. For example, we reported in June 2009 that TSA had not conducted its own risk assessment of mass transit and passenger rail systems that combined all three risk elements, as called for by the NIPP. Thus, we recommended that TSA conduct a comprehensive risk assessment that combines threat, vulnerability, and consequence. DHS concurred with this recommendation, and in February 2010, DHS officials said that TSA had undertaken a Transportation Systems Sector Risk Assessment that would incorporate all three elements of risk. In April 2010, TSA stated that this risk assessment is under review. Similarly, the Administration’s Transborder Security Interagency Policy Committee (IPC) Surface Transportation Subcommittee’s recently issued Surface Transportation Security Priority Assessment recognized that assessing transportation assets and infrastructure and ranking their criticality would help target the use of limited resources. Consequently, this subcommittee recommended that TSA identify appropriate methodologies to evaluate and rank surface transportation systems and critical infrastructure. We have also identified other opportunities to improve TSA’s risk management efforts for surface transportation. For example, in April 2009, we reported that TSA’s efforts to assess security threats to freight rail could be strengthened. Specifically, we noted that while TSA had developed a freight rail security strategy, the agency had focused almost exclusively on rail shipments of toxic inhalation hazards (TIH), such as chlorine and anhydrous ammonia, which can be fatal if inhaled, despite other federal and industry assessments having identified additional potential security threats, such as risks to bridges, tunnels, and control centers. We reported that although TSA’s focus on TIH has been a reasonable initial approach given the serious public harm these materials potentially pose to the public, there are other security threats for TSA to consider and evaluate as its freight rail strategy matures, including potential sabotage to critical infrastructure. We recommended that TSA expand its efforts to include all security threats in its freight rail security strategy. DHS concurred with this recommendation and has since reported that TSA has developed a Critical Infrastructure Risk Tool to measure the criticality and vulnerability of freight railroad bridges. As of April 2010, the agency has used this tool to assess 39 bridges, some of which transverse either the Mississippi or Missouri Rivers, and intends to assess 22 additional bridges by the end of fiscal year 2010. Further, we reported in June 2009 that the Transit Security Grant Program (TSGP) risk model includes all three elements of risk, but can be strengthened by measuring variations in vulnerability. DHS has held vulnerability constant, which limits the model’s overall ability to assess risk and more precisely allocate funds to transit agencies. We also found that although TSA allocated about 90 percent of funding to the highest-risk agencies, lower-risk agency awards were based on other factors in addition to risk, such as project quality. For example, a lower-risk agency with a high-quality project was more likely to receive funding than a higher-risk agency with a low-quality project. We recommended that DHS strengthen its methodology for determining risk by developing a cost- effective method for incorporating vulnerability information in its TSGP risk model. DHS concurred with the recommendation, and in April 2010 TSA stated that it is reevaluating the risk model for the fiscal year 2011 grant cycle. Further, TSA is evaluating the feasibility of incorporating an analysis of the current state of an asset, including its vulnerability, in determining fiscal year 2011 grant funding. Additionally, we are currently conducting an assessment of TSA’s efforts to help ensure pipeline security; the resulting report will include an evaluation of the extent to which TSA uses a risk management approach to help strengthen pipeline security. Our preliminary observations found that TSA has identified the 100 most-critical pipeline systems in the United States and produced a pipeline risk assessment model, consistent with the NIPP. Furthermore, the 9/11 Commission Act requires that risk assessment methodologies be used to prioritize actions to the highest-risk pipeline assets, and we found that TSA’s stated policy is to consider risk when scheduling Corporate Security Reviews—assessments of pipeline operators’ security plans. However, we found a weak statistical correlation between a pipeline system’s risk rank and the time elapsed between a first and subsequent review. In addition, we found that among the 15 highest risk-ranked pipeline systems, the time between a first and second Corporate Security Review ranged from 1 to 6 years for those systems that had undergone a second review. Further, as of April 2010, 2 systems among the top 15 had not undergone a second review despite more than 6 years passing since their first review. TSA officials told us that although a pipeline system’s relative risk ranking is the primary factor driving the agency’s decision of when to schedule a subsequent Corporate Security Review, it is not the only factor influencing this decision. They explained they also consider the geographical proximity of Corporate Security Review locations to each other in order to reduce travel time and costs, as well as the extent to which they have worked with pipeline operators through other efforts, such as their Critical Facility Inspection Program. Better prioritizing its reviews based on risk could help TSA ensure its resources are more efficiently allocated toward the highest-risk pipeline systems. We expect to issue this report by the end of this year. TSA has developed several initiatives to improve coordination with its federal, state, and private sector stakeholders. However, we have previously reported that TSA’s coordination efforts could be improved.