The United States has approximately 360 commercial sea and river ports. While no two ports in the United States are exactly alike, many share certain characteristics that make them vulnerable to terrorist attacks: they are sprawling, easily accessible by water and land, close to crowded metropolitan areas, and interwoven with complex transportation networks designed to move cargo and commerce as quickly as possible (see fig 1). They contain not only terminals where goods bound for import or export are unloaded or loaded onto vessels, but also other facilities critical to the nation’s economy, such as refineries, factories, and power plants. To reduce the opportunity for terrorists to exploit port vulnerabilities, port stakeholders are taking mitigation steps. For example, port stakeholders have installed fences, hired security guards, and purchased cameras to reduce the potential for unauthorized entry and help prevent vulnerabilities from being exploited. To help defray some of the costs of implementing security at ports around the United States, the PSGP was established in January 2002 when the Transportation Security Administration (TSA) was appropriated $93.3 million to award grants to critical national seaports. In November 2002, the Maritime Transportation Security Act (MTSA), which codified the program, was enacted. Since the supplemental appropriations act for fiscal year 2002, the appropriations acts have provided annual appropriations for the PSGP. FEMA is responsible for designing and operating the administrative mechanisms needed to implement and manage the grant program. The Coast Guard—which is generally the lead federal agency for port security—provides subject matter expertise for the maritime industry and participates in project award decisions. From fiscal year 2002 through fiscal year 2011, nearly $2.5 billion has been allocated to the PSGP, as shown in table 1. In recent years, we, the Congress, the President, the Secretary of Homeland Security, and others have endorsed risk management as a way to direct finite resources to areas that are most at risk of terrorist attack. Risk management is a continuous process that includes the assessment of threats, vulnerabilities, and consequences to determine what actions should be taken to reduce one or more of these elements of risk. One way in which DHS has applied risk management principles to the PSGP is through the use of a risk model to assess the relative risk posed to ports throughout the nation and to help determine PSGP eligibility and funding levels. The PSGP risk methodology is similar to the methodology used to determine funding eligibility for other DHS state and local grant programs. The model consists of three variables: threat (the relative likelihood of an attack occurring), vulnerability (the relative exposure to an attack), and consequence (the relative expected impact of an attack). Data for each of these variables are collected from offices and components throughout DHS, as well as from other data sources, and then, using the model, each port is ranked against one another and assigned a relative risk score. At the recommendation of the Coast Guard, DHS considers some ports as a single cluster—known as a port area—due to geographic proximity, shared risk, and a common waterway. Based on risk, each port area is placed into one of three funding groups— Ports not identified in Group I, II, or III are Group I, Group II, or Group III.eligible to apply for funding as part of the “All Other Port Areas” Group.Figure 2 below shows the location of port areas for groups I and II—the two highest risk groups that receive the bulk of grant funding. To promote a regional approach to risk management in the highest risk port areas, FEMA required—beginning with the fiscal year 2007 supplemental guidance—that all Group I and II port areas—the highest risk port areas—develop and implement a Portwide Risk Mitigation Plan (PRMP). The primary goal of a PRMP is to provide a port area with a mechanism for considering its entire port system strategically as a whole, and to identify and execute a series of actions designed to effectively mitigate risks to the system’s maritime critical infrastructure. DHS creates PSGP grant guidance annually which provides the funding amounts for each group, eligible applicants, and the application materials for funding under the program. As shown in figure 3, there are three stages of the PSGP grant cycle: allocation, award, and distribution. Each port area’s allocation is driven by the results of the PSGP risk analysis model. However, the allocation process varies among groups as described below. Groups I and II: The risk model determines the port areas at high risk of a terrorist attack and DHS places them in either Group I (highest risk group) or Group II (next highest risk group). In fiscal year 2011, there were 7 port areas in Group I and 48 port areas in Group II. Each port area in these groups is allocated a specific amount of funding based on its risk score. Group III: Group III ports represent the next risk grouping of port areas based on the risk model scores. For fiscal year 2011, there were 35 port areas in Group III. However, unlike Groups I and II, these port areas do not receive a specific allocation based on risk. Instead, DHS allocates a set amount of funding to Group III as a whole and port areas within Group III compete against each other for this funding based on risk and project effectiveness. All Other Port Areas: Port areas not evaluated using the risk model, but which operate under an Area Maritime Security Plan (AMSP),are eligible to compete for funding with the All Other Port Areas Group––in a manner similar to Group III, but without using risk scores as a factor in project selection. After DHS announces the allocation amounts for all of the groups through the release of the grant guidance, applicants must apply for funding–– either through the fiduciary agent or directly to FEMA––within 45 days of the release of the grant guidance. Applicants are entities within a port area—such as port authorities, facility operators, and state and local government agencies—that provide port security services. During the award process, DHS and the U.S. Department of Transportation (DOT) evaluate the port areas’ projects and determine which projects to fund. Before the projects reach DHS and DOT for review they are vetted locally. The local evaluation process––known as field-level review––for Groups I and II differs from that of Group III and All Other Port Areas Group as described below. Groups I and II: Beginning with the fiscal year 2007 supplemental guidance, port areas in Groups I and II received a single direct funding allocation based on risk. Once the allocation is made, stakeholders in the port area then undergo a collaborative process to determine the projects to fund with the grant allocation. To help manage the new direct allocation process, DHS introduced the use of fiduciary agents to help manage the PSGP at the local level and ensure that all port partners were incorporated into the planning and grant allocation processes. For Group I and II port areas, FEMA awards the port area allocation to each port area’s selected fiduciary agent. According to the grant guidance, while the fiduciary agent acts as the principal point of contact with FEMA for application, management, and administration of the Group I and II grant awards, the fiduciary agent is not the sole decision maker regarding the use of the PSGP grants. Instead, a field-level review process is conducted by the applicable Coast Guard Captain of the Port (COTP) in coordination with DOT, the Maritime Administration, and appropriate personnel from the Area Maritime Security Committee (AMSC) including federal, state, and local agencies. At the completion of the field-level review process, the COTP—through the fiduciary agent— submits to FEMA a prioritized list of projects for funding ranked from highest to lowest in terms of their contributions to risk reduction and cost effectiveness. Once the COTP submits this information, DHS begins its national review process for Group I and II port areas. Group III and All Other Port Areas: Unlike Groups I and II, grant projects in Group III and the All Other Port Areas Group are determined through a competitive process. Port entities in these two groups submit their project proposals directly to DHS for review. DHS reviews the projects for eligibility, and approved projects are grouped by port area and sent to the corresponding COTP for further review. At this point, the process mirrors the Group I and II process. Before grant awards are finalized, project proposals undergo a national review process conducted by the National Review Panel (NRP), a group of subject matter experts from DHS and DOT. During the national review process, the NRP reviews all submitted projects for eligibility, and makes a final funding recommendation to the Secretary of Homeland Security. PSGP funds cannot be distributed to grantees to begin projects until DHS ensures the grantee’s compliance with federal grant management requirements. FEMA’s GPD is responsible for ensuring that all grant projects adhere to federal grant requirements, including all EHP requirements. For example, the National Environmental Policy Act requires DHS to analyze the possible environmental impacts of each project funded by a DHS grant. In addition to federal requirements, DHS also directs all applicants to provide detailed budgets for the requested funds at the time of application. Until FEMA is satisfied that all requirements have been met, no grant funding can be distributed to begin projects—rather the grant funding is considered “unavailable.” Once FEMA makes funds available to grantees, port entities must complete the grant project within the designated 3-year performance period. For example, for fiscal year 2009 projects, the performance period began on June 1, 2009. During this grant period, the City of Houston received approval for the second phase of a radio system project. By the time the project cleared local and federal review and funds were made available it was March 16, 2011––leaving the city about 14 months to implement the project before the performance period end date of May 31, 2012. For fiscal years 2010 and 2011, DHS allocations of PSGP funds were based on DHS’s risk model and implementation decisions, and were made largely in accordance with risk.