Interior is responsible for the safety and security of more than 67,000 employees, 280,000 volunteers, 1 million daily visitors, and 500 million acres of public lands that include national icons and parks. After September 11, the Secretary of the Interior took steps to address serious organizational and management problems in the law enforcement and security components of the department. Of particular concern, according to the Interior IG, was the lack of coordination among these components and the absence of a meaningful single point of contact that the Secretary and senior managers could depend upon for reliable information and advice. The Secretary approved a Deputy Assistant Secretary for Law Enforcement and Security in July 2002, and established OLES to oversee the department’s law enforcement and security efforts and ensure their consistent application across Interior’s bureaus and offices. Specific to icon protection, in 2003, Homeland Security Presidential Directive 7 (HSPD-7) designated Interior as the sector-specific agency for the National Monuments and Icons critical infrastructure sector, and Interior selected OLES to carry out sector responsibilities. To fulfill its duties, OLES officials developed a national monuments and icons sector-specific plan in which they defined national icons as: (1) monuments, physical structures, or objects; (2) recognized both nationally and internationally as representing the nation’s heritage, traditions, and/or values or are recognized for their national, cultural, religious, historical, or political significance; and (3) serve the primary purpose of memorializing or representing significant aspects of our nation’s heritage, traditions, or values and serve as points of interest for visitors and educational activities. In accordance with its assigned duties, OLES officials also developed a uniform risk assessment and ranking methodology to quantify risk, identify needed security enhancements, and measure risk-reduction benefits at icons. OLES officials used this methodology to assess risks at the icons during 2004 and 2006. OLES has also issued sector annual reports and established a sector government coordinating council. The Park Service’s mission is the unimpaired preservation of the natural and cultural resources and values of the national park system. The Park Service is responsible for managing the national icons and the national park system. In 2008, the Park Service welcomed almost 275 million visitors to its nearly 400 national park units throughout the United States, American Samoa, Guam, Puerto Rico, and the Virgin Islands. Within the Visitor and Resource Protection division of the Park Service, the Law Enforcement, Security, and Emergency Services branch provides policy formulation, oversight, support services, guidance, and leadership to assist park managers and law enforcement staff in accomplishing the Park Service’s visitor protection goals and objectives. This branch is led by a chief and has one position dedicated to security and intelligence management. Park superintendents and rangers manage and provide security and law enforcement services at icons and parks throughout the United States in conjunction with their other duties. These other duties include the management of public use, dissemination of scientific and historical information, and protection and management of natural and cultural resources. The Park Police, which is a Park Service component, provides law enforcement and security services for national icons and parks in Washington, D.C.; New York City; and San Francisco. The Park Police has also staffed law enforcement specialists in four of seven Park Service regions including the National Capital, Northeast, Intermountain, and Pacific West regions. We have identified a set of six key protection practices from the collective practices of federal agencies to provide a framework for guiding agencies’ protection efforts and addressing challenges. The following are the key practices we used for this review: Allocation of resources using risk management: Identify threats, assess vulnerabilities, and determine critical assets to protect; use information on these and other elements to develop countermeasures; and prioritize the allocation of resources as conditions change. Leveraging of technology: Select technologies to enhance asset security through methods like access control, detection, and surveillance systems. This involves not only using technology, but ensuring that there are positive returns on investment in the form of reduced vulnerabilities. Information sharing and coordination: Establish means of coordinating and sharing security and threat information internally, within large organizations, and externally, with other government entities and the private sector. Performance measurement and testing: Use metrics, such as implementation timelines, and active testing, such as unannounced on-site assessments, to ensure accountability for achieving program goals and improving security at facilities. Strategic management of human capital: Manage human capital to maximize government performance and assure accountability in asset protection through, for example, recruitment of skilled staff, training, and retention. We have used the key practices to evaluate the efforts of the Smithsonian to protect its assets, DHS to protect its facilities, and federal agencies to protect icons and facilities on the National Mall. For example, in 2007, we found that while the Smithsonian follows key practices to protect its assets, it faces challenges related to ensuring that museum and facility directors are aware of information on security and funding constraints. Similarly, in 2005, we found that federal agencies on the National Mall— the Park Service, Smithsonian, National Gallery of Art, Department of Agriculture, and U.S. Botanic Garden—were using five of the six key practices to implement security enhancements. Also, in 2007, we reported that DHS had taken actions intended to improve the security of its facilities, but its efforts fell short in certain key areas, such as DHS components not fully implementing risk management. Moreover, the ISC—a body that addresses the quality and effectiveness of security requirements for federal facilities through developing and evaluating security standards for federal facilities—is using our key protection practices as key management practices to guide its priorities and work activities. For example, ISC established subcommittees for technology best practices and training, and working groups in the areas of performance measures and strategic human capital management. ISC also issued performance measurement guidance in 2009. While the Park Service, with the assistance of OLES, has assessed risks at the icons and southwest border parks, it has not adopted a servicewide approach to risk management, including policies, guidance, and tools to support risk assessments at the remaining parks. Furthermore, although icon and park officials have acquired a variety of technologies to enhance security, they do not have guidance to evaluate the cost-effectiveness of proposed or actual countermeasures. We have reported that most risk management approaches generally involve identifying the assets that are most critical to protect in terms of mission and significance, identifying potential threats, assessing vulnerabilities, and evaluating mitigation alternatives for their likely effect on risk and their cost. The Park Service and OLES generally employed such an approach in identifying five icons as critical assets to protect, assessing risks, and implementing countermeasures. Specifically, OLES conducted its first round of icon risk assessments during 2004, through which it identified vulnerabilities that the icons shared. Officials at the icons worked on implementing the assessments’ recommendations; therefore OLES’s 2006 icon risk assessments and 2007 compliance reviews noted significant security improvements, including new surveillance and monitoring equipment, some barriers installed to protect against vehicle explosions, and enhanced visitor screening stations and procedures. In addition to prioritizing icon security, during 2008 the Secretary of the Interior directed the Park Service to focus on border park security through its “Safe Borderlands” initiative, and as a result, the Park Service has also taken steps to balance security and public access at southwest border parks. About 41 percent of the land along the U.S. southwest border is under the control and custody of Interior’s land management bureaus, including five parks that are under the Park Service. These border parks face security challenges related to drug smuggling and other unlawful activities in the area, which have also caused significant environmental damage. The Safe Borderlands initiative aims to strengthen Interior’s— including the Park Service’s—law enforcement capabilities, improve its radio communications, and lessen the environmental impact of illegal activities. The Park Service and other Interior bureaus have assessed risks and increased staffing along the southwest border, and have installed security features, such as vehicle barricades and sensors at certain border locations, in an effort to prevent illegal aliens and drug smugglers from entering. According to Park Service officials from the Intermountain Region, all border parks in their region have ground sensors to detect illegal traffic and some have alarm systems. Despite the significant improvements made in icon security, we noted some cases in which recommended security countermeasures were not implemented and vulnerabilities remain. Park officials at the Statue of Liberty told us that the icon security plan had not been updated since its creation in 2002; however, later in our review, Park Police officials told us they updated this plan during 2008. Park officials at the Gateway Arch have also made notable security improvements, such as moving the dispatch center away from the arch. However, vulnerabilities still exist at the park, and security breaches have occurred. Officials from both icons told us that, while they identify and prioritize security needs, security projects compete with other operational needs, and these officials must prioritize and balance competing interests as best they can. Park Service officials at the national, regional, icon, and park levels told us that security awareness has increased throughout the organization, largely because of Interior’s initiative to assess security risks at the icons, and the resources the Park Service has allocated to address these concerns; yet the Park Service has not formally applied risk management principles for the rest of its national parks inventory. We have reported that allocating resources using risk management is a systematic and analytical process to consider the likelihood that a threat will endanger an asset—structure, individual, or function—and identify, evaluate, select, and implement actions that reduce the risk or mitigate the consequences of an event. However, the Park Service does not require that other parks undergo risk assessments and therefore there has been no comprehensive servicewide assessment, prioritization, and mitigation of vulnerabilities. Instead, Park Service officials use their discretion to request risk assessments from the Park Service or another entity, and as a result, risk assessments can vary in their scope and methodology from park to park.