Protecting U.S. airspace has changed over the years. During the Cold War, DOD focused its air defense operations to protect U.S. airspace from air threats originating from the former Soviet Union. Today, several DOD organizations are involved in air defense and ASA operations, which have expanded to include the defense of U.S. airspace from air threats originating from within the United States. Because ASA operations are considered the last line of defense against air threats, it is crucial for this capability to be functioning. During the Cold War, NORAD positioned fighter aircraft across the United States and Canada to protect North America from a strategic attack by Soviet bombers. Alert fighter aircraft were manned by a dedicated force that was not assigned to other missions, and aircraft were armed, fueled, and ready at all times. As many as 5,800 aircraft were on alert in 1958, but the number of aircraft diminished over the years, as did the number of designated alert sites. By 1997 officials had suggested a “four corners” defense, maintaining alert sites in Massachusetts, Oregon, California, and Florida. By September 11, 2001, only 14 interceptor aircraft were sitting alert in the United States. According to DOD’s 2008 National Defense Strategy and its 2005 Strategy for Homeland Defense and Civil Support, protecting the U.S. homeland from direct attack is DOD’s highest priority. After the events of September 11, 2001, DOD initiated Operation NOBLE EAGLE, which shifted NORAD’s responsibilities to include protecting U.S. airspace from air threats originating from within the United States. NORTHCOM is the military command responsible for executing DOD’s homeland defense and civil support mission within its area of responsibility—including the continental United States, Alaska, and territorial waters. The commander of NORTHCOM also commands NORAD. The NORAD commander is responsible for the command and control of homeland air defense and delegates much of this command and control function to one of its three regional commanders. Although neither NORAD nor the Secretary of Defense specifies which military service must provide fighter aircraft to conduct ASA operations, the Air Force is currently providing 100 percent of the fighter aircraft. The Air Force is responsible for organizing, training, and equipping Air Force units. With regard to ASA operations, the Air Force has delegated the responsibility of organizing, training, and equipping combat-ready forces to its major commands. Specifically, Air Combat Command is responsible for providing air defense forces to NORAD and Pacific Air Forces Command is responsible for providing air defense forces to Hawaii. Alert forces deployed in Alaska are provided by PACOM. NORAD has established a binational subcommand under the leadership of a general officer who is responsible for both NORAD and PACOM activities. The commander of First Air Force is also the commander of the Continental NORAD Region and the Air Forces Northern Command. In each of these capacities, the commander has different responsibilities with regard to ASA operations. For example, as a numbered Air Force commander (i.e., First Air Force), the commander has the responsibility of ensuring the readiness of forces for air sovereignty and air defense of the continental United States. As the commander of the Continental NORAD Region, the commander is responsible for providing airspace surveillance and control and directing all air sovereignty activities for the continental United States. The role and responsibilities of being the commander of Air Forces Northern Command include air component planning, execution, and assessment of support to civil authorities (e.g., air operations during hurricane recovery) and command of air forces in support of NORTHCOM homeland defense missions. While the First Air Force, Continental NORAD Region, and Air Forces Northern Command have these responsibilities, the ASA units that conduct ASA operations are assigned to different numbered Air Forces within the Air Force’s Air Combat Command, Air Education and Training Command, or Pacific Air Force Command for their expeditionary missions. There are currently 20 units at 18 designated steady-state alert sites in the United States, as shown in figure 3. The ANG provides the personnel and equipment at 16 of the 18 ASA sites while the active duty Air Force provides the personnel and equipment at the remaining 2 sites. ANG units fulfilling different roles are potentially subject to different authorities under the United States Code and state laws. ANG units conduct ASA operations in a Title 32 status, meaning that they are under the command and control of the governor of the state but federally funded. However, pilots and aircraft of the same unit engage in an actual airborne air defense operation in a Title 10 status, because they are performing a federal mission under the command and control of NORAD. Active duty units are always in a Title 10 status, but command and control of pilots and aircraft conducting ASA operations passes from the local commander to NORAD when performing air defense operations, as shown in figure 4. Because ASA units are dual tasked for their expeditionary missions and ASA operations, other units fill in to conduct ASA operations when an ASA unit deploys. ANG units can, on their own, find replacements. Finding replacement for a unit’s ASA operation can entail finding personnel and aircraft from multiple units. GAO has previously reported that a risk-based management approach helps policymakers make informed decisions and prioritize resource investments. Risk-based management is a widely endorsed strategy for helping decision makers make decisions about allocating finite resources and taking action under conditions of uncertainty. We have previously recommended a five-phase approach to risk-based management as shown in table 1. The framework should be considered a starting point, and the entire cycle of risk-based management activities should be viewed as a goal. The process is dynamic and new information can be entered at any phase. The framework can be used to inform agency officials and decision makers of the basic components of a risk-based management system or can be used as a stand-alone guide. The risk-based management approach as outlined above is designed to be flexible, in that the approach may be applied at various organizational levels from a department or a multiagency organization down to specific projects or operations such as ASA operations. As we previously reported, because there is no one uniformly accepted approach to risk-based management, terms and activities may differ across applications. In addition, any approach that omits the substance of the steps may result in resources that are not targeted to the highest security needs. We also reported that failing to monitor the implementation of countermeasures, including those implemented by other agencies, may result in a misallocation of resources. Similarly, failing to conduct routine or periodic assessments of programs or operations could result in missed opportunities to increase their efficiency and effectiveness. We identified three NORAD assessments of ASA operations; however, NORAD did not perform these assessments—or conduct other actions that would be part of a risk-based management approach—on a routine basis. According to our prior work, an ongoing risk-based management approach is a best practice that enhances an organization’s decision making, including determining operational requirements, and helps to guide the use of limited resources. A critical phase of implementing a risk-based management approach is the risk assessment phase, which helps decision makers identify and evaluate potential risks facing key assets or missions so that countermeasures can be designed and implemented to prevent or mitigate the effects of the risks. In addition to the risk assessment phase, alternatives to current requirements are evaluated while considering cost and other factors in the alternatives evaluation phase. Rather than performing these assessments as part of an adopted comprehensive management approach to manage risk or determine ASA operational requirements, NORAD performed these assessments in response to individual DOD leadership inquiries about ASA operations. While NORAD is not required to conduct risk assessments on a routine basis, doing so could allow it to enhance its ability to determine the appropriate level and types of resources—including units, personnel, and aircraft—for ASA operations. In the first assessment we identified, after the terrorist attacks of September 11, 2001, NORAD, in working with other U.S. government agencies, developed a list of what it believed to be the most critical locations and infrastructure across the United States requiring its protection. We determined this assessment could be considered as part of the risk assessment phase of the overall risk management approach in which vulnerabilities and critical assets are evaluated. NORAD has not reevaluated this list since it created it in 2001 even though according to experts in the intelligence community, the type of threat has and continues to evolve, and other U.S. agencies have taken a number of measures to mitigate against aviation threats. We identified a second assessment that NORAD conducted in 2005 that we considered could be part of the alternatives evaluation phase in which alternatives are considered. Specifically, NORAD’s air component—First Air Force—provided input to the 2005 BRAC process regarding which sites it would prefer to conduct ASA operations. First Air Force measured how long it would take a fighter plane to respond to a threat over a specific location—both from the current ASA site and from the proposed alternative sites—and the level of risk that would be posed under each alternative. After the BRAC decisions were made in 2005, First Air Force assessed the impact of the commission’s decisions on ASA operations. For example, the commission recommended that ASA operations at Selfridge, Michigan, be transferred to Toledo, Ohio. First Air Force evaluated the impact of response times to cover high population centers and infrastructure in the area. In the third assessment we identified, in 2006 the Office of the Secretary of Defense, requested that NORAD and other commands evaluate costs and identify measures to reduce Operation NOBLE EAGLE costs. We considered this assessment could also be included in the alternatives evaluation phase of a risk management approach.