Section 550 of the DHS appropriations act for fiscal year 2007 requires DHS to issue regulations establishing risk-based performance standards for the security of facilities that the Secretary determines to present high levels of security risk, among other things. The CFATS rule was published in April 2007 and Appendix A to the rule, published in November 2007, listed 322 chemicals of interest and the screening threshold quantities for each.including assessing potential risks and identifying high-risk chemical facilities, promoting effective security planning, and ensuring that final high- risk facilities meet the applicable risk-based performance standards through site security plans approved by DHS. ISCD is managed by a Director and a Deputy Director and operates five branches that are, among other things, responsible for information technology operations, policy and planning, and providing compliance and technical support. From fiscal years 2007 through 2012, DHS dedicated about $442 million to the CFATS program. During fiscal year 2012, ISCD was authorized 242 full-time- equivalent positions. For fiscal year 2013, DHS’s budget request for the CFATS program was $75 million and 242 positions. Our review of the ISCD memorandum and discussions with ISCD officials showed that the memorandum was developed during the latter part of 2011 and was developed primarily based on discussions with ISCD staff and the observations of the ISCD former Director in consultation with the former Deputy Director. In November 2011, the former Director and Deputy Director provided the Under Secretary with the ISCD memorandum entitled “Challenges Facing ISCD, and the Path Forward.” These officials stated that the memorandum was developed to inform leadership about the status of ISCD, the challenges it was facing, and the proposed solutions identified to date. In transmitting a copy of the memorandum to congressional stakeholders following the leak in December 2011, the NPPD Under Secretary discussed caveats about the memorandum, including that it had not undergone the normal review process by DHS’s Executive Secretariat and contained opinions and conclusions that did not reflect the position of DHS. The former ISCD Director stated that the memo was intended to begin a dialog about the program and challenges it faced. The former Director confirmed that she developed the memorandum by (1) surveying division staff to obtain their opinions on program strengths, challenges, and recommendations for improvement; (2) observing CFATS program operations, including the security plan review process; and (3) analyzing an internal DHS report on CFATS operations, which, according to the former Director served as a basis for identifying some administrative challenges and corrective action. The senior ISCD and NPPD officials we contacted said that they generally agreed with the material that they saw, but noted that they believed the memorandum was missing context and balance. For example, one NPPD official stated that that the tone of the memorandum was too negative and the problems it discussed were not supported by sound evaluation. However, the official expressed the view that the CFATS program is now on the right track. The ISCD memorandum discussed numerous challenges that, according to the former Director, pose a risk to the program. The former Director pointed out that, among other things, ISCD had not approved any site security plans or carried out any compliance inspections on regulated facilities. The former Director attributed this to various management challenges, including a lack of planning, poor internal controls, and a workforce whose skills were inadequate to fulfill the program’s mission, and highlighted several challenges that have had an impact on the progress of the program. In addition, the memorandum provided a detailed discussion of the issues or problems facing ISCD, grouped into three categories: (1) human capital management, such as poor staffing decisions; (2) mission issues, such as the lack of an established inspection process; and (3) administrative issues, such as a lack of infrastructure and support, both within ISCD and on the part of NPPD and IP. ISCD is using an action plan to track its progress addressing the challenges identified in the memorandum, and, according to senior division officials, the plan may be helping them address some legacy issues that staff were attempting to deal with before the memorandum was developed. The January 2012 version of the proposed action plan listed 91 actions to be taken categorized by issue—human capital management issues, mission issues, or administrative issues—that, according to the former ISCD Director, were developed to be consistent with the ISCD memorandum. However, the January 2012 version of the action plan did not provide information on when the action was started or to be finished. Eleven of the 12 ISCD managers (other than the former Director and Deputy Director) assigned to work as the coordinators of the individual action items told us that even though they were not given the opportunity to view the final version of the ISCD memorandum, the former Director provided them the sections of the action plan for which they were responsible to help them develop and implement any corrective actions. They said that they agreed that actions being taken in the plan were needed to resolve challenges facing ISCD. Our discussions with these officials also showed that about 39 percent (37 of 94) of the items in the March and June 2012 action plans addressed some legacy issues that were previously identified and, according to these officials, corrective actions were already underway for all 37 of these items. Our analysis of the June 2012 version of the ISCD action plan showed that 40 percent of the items in the plan (38 of 94) had been completed. The remaining 60 percent (56 of 94) were in progress. Of the 38 completed items, we determined that 32 were associated with human capital management and administrative issues, including those involving culture and human resources, contracting, and documentation. The remaining 6 of 38 action items categorized by ISCD as completed were associated with mission issues. Figure 1 shows the status of action items by each of the three categories as of June 2012. For the remaining 56 items that were in progress as of June 2012, 40 involved human capital management and administrative issues. According to ISCD officials, these 40 issues generally involved longer- term efforts—such as organizational realignment—or those that require approval or additional action on the part of IP or NPPD. Sixteen of 56 remaining actions items in progress covered mission issues that will likely also require long-term efforts to address. As of August 2012, ISCD reported that it had completed another 21 action items, of which 8 were to address mission-related issues. We did not verify ISCD’s efforts to complete actions since June 2012. However, we have recently begun a follow-up review of CFATS at the request of this and other committees, which will focus on DHS’s efforts to address mission-related issues. We expect to report the results of these efforts early in 2013. Our analysis of the April and June versions of the plan shows that the division had extended the estimated completion dates for nearly half of the action items. Estimated completion dates for 52 percent (48 of 93 items) either did not change (37 items) or the date displayed in the June 2012 plan was earlier than the date in the April 2012 version of the plan (11 items). Conversely, 48 percent (45 of 93) of the items in the June 2012 version of the plan had estimated completion dates that had been extended beyond the date in the April 2012 plan. Figure 2 shows the extent to which action plan items were completed earlier than planned, did not change, or were extended, from April 2012 through June 2012, for the human capital management, mission, and administrative issues identified in the plan. ISCD officials told us that estimated completion dates had been extended for various reasons. For example, one reason for moving these dates was that the work required to address some items was not fully defined when the plan was first developed and as the requirements were better defined, the estimated completion dates were revised and updated. In addition, ISCD officials also stated that timelines had been adversely affected for some action items because staff had been reassigned to work on higher priority responsibilities, such as reducing the backlog of security plans under review. ISCD, through its action plan, appears to be heading in the right direction towards addressing the challenges identified, but it is too early to tell if the action plan is having the desired effect because (1) the division had only recently completed some action items and continues to work on completing more than half of the others, some of which entail long-term changes, and (2) ISCD had not yet developed an approach for measuring the results of its efforts. ISCD officials told us that they had not yet begun to plan or develop any measures, metrics, or other documentation focused on measuring the impact of the action plan on overall CFATS implementation because they plan to wait until corrective action on all items has been completed before they can determine the impact of the plan on the CFATS program. For the near term, ISCD officials stated that they plan to assess at a high level the impact of the action plan on CFATS program implementation by comparing ISCD’s performance rates and metrics pre-action plan implementation and post-action plan implementation. However, because ISCD will not be completing some action items until 2014, it will be difficult for ISCD officials to obtain a complete understanding of the impact of the plan on the program using this comparison only. In our July 2012 statement, we recommended that ISCD look for opportunities, where practical, to measure results of their efforts to implement particular action items, and where performance measures can be developed, periodically monitor these measures and indicators to identify where corrective actions, if any, are needed. The agency concurred with our recommendation and developed a new action item (number 95) intended to develop metrics for measuring, where practical, results of efforts to implement action plan items, including processes for periodic monitoring and indicators for corrective actions. This action item is in progress. According to ISCD officials, almost half of the action items included in the June 2012 action plan either require ISCD to collaborate with NPPD and IP or require NPPD and IP to take action to address the challenges identified in the ISCD memorandum.