TSA inspects airports, air carriers, and other regulated entities to ensure that they are in compliance with federal aviation security regulations, TSA-approved airport security programs, and other requirements, including requirements related to controlling airport employee access to secure areas of an airport. Airport operators have direct responsibility for implementing security requirements in accordance with their TSA- approved airport security programs. In general, secure areas of an airport are specified in the airport operator’s security programs and include the sterile area, which is the area of an airport that provides passengers access to boarding aircraft and to which access is generally controlled by TSA or a private screening entity under TSA oversight, and the security identification display area (SIDA), which is a portion of an airport in which security measures are carried out and where appropriate identification must be worn by aviation workers. For example, aviation workers that require access to the aircraft movement and parking areas for the purposes of their employment duties must display appropriate identification to access these areas. Airport operators are to perform background checks on individuals prior to granting them unescorted access to secure areas of an airport and TSA relies on airport operators to collect and verify applicant data, such as name, place of birth, and country of citizenship, for individuals seeking credentials. Background checks for individuals applying for credentials to allow unescorted access to secure areas of commercial airports include (1) a security threat assessment from TSA, including a terrorism check; (2) a fingerprint-based criminal history records check; and (3) evidence that the applicant is authorized to work in the United States. The criminal history records check also determines whether the applicant has committed a disqualifying criminal offense in the previous ten years. TSA and airport operators have oversight responsibilities for the identification badges that are issued. For example, airport operators must account for all badges through control procedures, such as audits, specified in TSA’s security directives and in an airport’s security program. TSA assesses airports’ compliance with its security directives and federal regulations through inspections conducted in alternating years of, among other things, the airport operator’s documents related to issuing and controlling identification badges and by randomly screening aviation workers. The Transportation Security Administration (TSA) has generally made progress addressing the 69 applicable requirements within the Aviation Security Act of 2016 (2016 ASA). As of June 2017, TSA officials stated it had implemented 48 of the requirements; it plans no further action on these. For 18 requirements, TSA officials took initial actions and plans further action. TSA officials stated they have yet to take action on 2 requirements and plan to address them in the near future. TSA officials took no action on 1 requirement regarding access control rules because it plans to address this through mechanisms other than formal rulemaking, such as drafting a national amendment to airport operator security programs. Appendix I presents the details of each requirement, the progress made by TSA, and the status of TSA’s plans for further actions. A summary of TSA’s progress in implementing the requirements in each section of the Act is presented below. Conduct a Threat Assessment (Section 3402) TSA made progress on the 11 requirements in Section 3402 of the 2016 ASA. TSA plans no further action for 9 requirements and plans further action for 2 requirements, as shown in appendix I. For example, section 3402(a) requires TSA to conduct a threat assessment that considers the seven factors stated in the law and 3402(b) requires TSA to submit a report to the appropriate congressional committees on the results of the assessment. Consistent with these sections, TSA conducted a threat assessment on the level of risk individuals with unescorted access to the secure area of an airport pose to the domestic air transportation system and submitted a report on it to the appropriate congressional committees in May 2017. In conducting the threat assessment, TSA also considered all seven required factors. For example, TSA considered recent security breaches at domestic and foreign airports by analyzing access-control related incidents from December 2013 through February 2017. TSA also considered the vulnerabilities associated with unescorted access authority granted to foreign airport operators and air carriers, and their workers, by reviewing the vulnerability of incoming flights to the United States for four international regions. The threat assessment noted several recommendations under consideration, such as enhancing relationships with the FBI and U.S. Drug Enforcement Administration, among other law enforcement entities, to ensure TSA is more fully aware of insider threats within the domestic transportation system. TSA officials stated they plan to use the threat assessment to, among other things, expand the use of vulnerability assessments and insider threat-related inspections at all commercial airports. Thus, TSA plans no further action for the 9 requirements related to the threat assessment. Enhance Oversight Activities (Section 3403) TSA generally made progress in addressing the 10 requirements in Section 3403 of the 2016 ASA. Of the 10 requirements, TSA plans no further action for 4 requirements. TSA plans further action for 5 requirements, but has yet to begin implementing 1 of these 5 requirements. In addition, TSA took no action on one requirement because they plan to address this requirement through other means, as shown in appendix I. Section 3403(a) requires TSA to update rules on access controls, and as part of this update, to consider, among other things best practices for airport operators that report missing more than three percent of credentials for unescorted access to the SIDA of any airport. In accordance with this requirement, TSA developed a list of measures for airport operators to perform—such as an airport rebadging if the percent of unaccounted for badges exceeds a certain threshold— and published them on DHS’s Homeland Security Information Network (HSIN) for airport operators to access. In addition, TSA officials stated they developed a fine structure for non-category X airport operators that have more than five percent and for category X airports that have more than three percent of credentials missing for unescorted access to the SIDA of an airport. TSA plans to take additional action to address this and other requirements related to updating the rules on access controls. For example, it plans to propose a national amendment to airport operator security programs for airport operators to report to TSA when an airport exceeds a specified threshold for unaccounted identification badges. TSA plans no further action under section 3403(a)(2)(F) to consider a method of termination by the employer of any airport worker who fails to report in a timely manner missing credentials for unescorted access to any SIDA of an airport. TSA officials stated they considered developing such a method; however, they plan no further action because TSA does not have authority over employment determinations made by airport operators or other employers. Further, section 3403(b) stated that TSA may encourage the issuance of temporary credentials by airports and aircraft operators of free one-time, 24-hour temporary credentials for aviation workers who report their credentials as missing but not permanently lost. Officials stated they plan no further action on this requirement because temporary credentials conflict with a current federal regulation that requires airport operators to ensure that only one identification badge is issued to an individual at one time. TSA has yet to take action on one requirement and took no action on another requirement in section 3403(a) of the 2016 ASA. First, TSA stated they plan to consider section 3403(a)(2)(E) to increase fines and direct enforcement action for airport workers and their employers who fail to timely report missing credentials, but have yet to do so. In addition, TSA took no action to update the rules on access controls. TSA officials stated that that they are taking other actions, such as drafting a proposed national amendment to airport security programs, to address this requirement. Update Airport Employee Credential Guidance (Section 3404) TSA generally made progress in addressing the 4 requirements in Section 3404 of the 2016 ASA. Of the 4 requirements, TSA took action and plans no further action for 2 requirements, plans further actions for 1 requirement, and has yet to take action on 1 requirement. For example, section 3404(a) requires TSA to issue guidance to airport operators regarding the placement of an expiration date on airport identification badges issued to non-U.S. citizens that is not longer than the period of time during which such non-U.S. citizens are lawfully authorized to work in the United States. In accordance with this requirement, TSA issued guidance that states that airport operators should match an identification badge’s expiration date to an individual’s immigration status, published this guidance to airport operators in fiscal year 2016 on the HSIN, and plans to issue a security directive to further address this requirement. TSA has no plans for further action to address section 3404(b)(1), which requires TSA to issue guidance for its inspectors to annually review the procedures of airport operators and carriers for individuals seeking unescorted access to the SIDA and to make information on identifying suspicious or fraudulent identification materials available to airport operators and air carriers. For example, TSA officials stated that Transportation Security Inspector guidance is updated yearly to incorporate additional inspection guidelines, as is TSA’s Compliance Manual, which includes updated methods for inspections and additional airport access control measures to be tested. The update for fiscal year 2017 changed the number of required tests related to insider threats and has new inspection techniques related to individuals seeking unescorted access to the SIDA. Additionally, officials stated that TSA made information available on the HSIN on identifying fraudulent documentation. TSA officials have yet to take action on section 3404(b)(2), which requires that the guidance to airport operators regarding the placement of an expiration date on airport identification badges issued to non-U.S. citizens include a comprehensive review background checks and employment authorization documents issues by the United States Citizenship and Immigration Services.