This is the accessible text file for GAO report number GAO-10-901 entitled 'Homeland Security: Addressing Weaknesses with Facility Security Committees Would Enhance Protection of Federal Facilities' which was released on August 5, 2010. This text file was formatted by the U.S. Government Accountability Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products' accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. Report to Congressional Requesters: United States Government Accountability Office: GAO: August 2010: Homeland Security: Addressing Weaknesses with Facility Security Committees Would Enhance Protection of Federal Facilities: GAO-10-901: GAO Highlights: Highlights of GAO-10-901, a report to congressional requesters. Why GAO Did This Study: To accomplish its mission of protecting about 9,000 federal facilities, the Federal Protective Service (FPS) currently has a budget of about $1 billion, about 1,225 full-time employees, and about 15,000 contract security guards. However, protecting federal facilities and their occupants from a potential terrorist attack or other acts of violence remains a daunting challenge for the Department of Homeland Security’s (DHS) Federal Protective Service. GAO has issued numerous reports on FPS’s efforts to protect the General Services Administration’s (GSA) facilities. This report (1) recaps the major challenges we reported that FPS faces in protecting federal facilities and discusses FPS’s efforts to address them and (2) identifies an additional challenge that FPS faces related to the facility security committees (FSC), which are responsible for addressing security issues at federal facilities. This report is based primarily on our previous work and recent FPS interviews. What GAO Found: Since 2007, we have reported that FPS faces significant challenges with protecting federal facilities, and in response FPS has recently started to take steps to address some of them. In 2008, we reported that FPS does not use a risk management approach that links threats and vulnerabilities to resource requirements. Without a risk management approach that identifies threats and vulnerabilities and the resources required to achieve FPS’s security goals, there is limited assurance that programs will be prioritized and resources will be allocated to address existing and potential security threats in an efficient and effective manner. FPS recently began implementing a new system referred to as the Risk Assessment Management Program (RAMP). This system is designed to be a central database for capturing and managing facility security information, including the risks posed to federal facilities and the countermeasures that are in place to mitigate risk. FPS expects that RAMP will enhance its approach to assessing risk, managing human capital, and measuring performance. Our July 2009 report on FPS’s contract guard program also identified a number of challenges that the agency faces in managing its contract guard program, including ensuring that the 15,000 guards that are responsible for helping to protect federal facilities have the required training and certification to be deployed at a federal facility. In response to our report, FPS took a number of immediate actions with respect to contract guard management. For example, FPS has increased the number of guard inspections it conducts at federal facilities in some metropolitan areas and revised its guard training. We have not reviewed whether these actions are sufficient to fulfill our recommendations. Another area of continuing concern is that FPS continues to operate without a human capital plan and does not have an accurate estimate of its current and future workforce needs. In our July 2009 report, we recommended that FPS develop a human capital plan to guide its current and future workforce planning efforts. While FPS agreed with this recommendation, it has not yet fully developed or implemented a human capital plan. As we reported in 2009, FPS’s ability to protect GSA facilities is further complicated by the FSC structure. Each FSC includes FPS, GSA, and a tenant agency representative and is responsible for addressing security issues at its respective facility and approving the funding and implementation of security countermeasures recommended by FPS. However, there are several weaknesses with the FSC. First, FSCs have operated since 1995 without procedures that outline how they should operate or make decisions, or that establish accountability. Second, the tenant agency representatives to the FSC generally do not have any security knowledge or experience but are expected to make security decisions for their respective agencies. Third, many of the FSC tenant agency representatives also do not have the authority to commit their respective organizations to fund security countermeasures. No actions have been taken on these issues since our 2009 report, and thus these weaknesses continue to result in ad hoc security and increased risk at some federal facilities. What GAO Recommends: GAO recommends that the Secretary of DHS direct the Director of FPS to work in consultation with other representatives of the FSC to develop and implement procedures that, among other things, outline the committees’ organization structure, operations, and accountability. DHS concurred with GAO’s recommendation. View [hyperlink, http://www.gao.gov/products/GAO-10-901] or key components. For more information, contact Mark Goldstein at (202) 512- 2834 or goldsteinm@gao.gov. [End of section] Contents: Letter: FPS Faces Challenges in Protecting Federal Facilities and Is Taking Some Actions to Address Them: Facility Security Committee Structure Hampers Protection of Federal Facilities: Conclusions: Recommendation for Executive Action: Agency Comments and Our Evaluation: Appendix I: Status of GAO Recommendations to the Federal Protective Service: Appendix II: Comments from the Department of Homeland Security: Appendix III: GAO Contacts and Staff Acknowledgments: Abbreviations: DHS: Department of Homeland Security: FPS: Federal Protective Service: FSA: facility security assessment: FSC: facility security committee: GSA: General Service Administration: ICE: Immigration and Customs Enforcement: ISC: Interagency Security Committee: NIPP: National Infrastructure Protection Plan: NPPD: National Protection and Programs Directorate: RAMP: Risk Assessment Management Program: [End of section] United States Government Accountability Office: Washington, DC 20548: August 5, 2010: Congressional Requesters: Protecting federal facilities and their occupants from a potential terrorist attack or other acts of violence remains a daunting challenge for the Department of Homeland Security's (DHS) Federal Protective Service (FPS). Since 2008, our work has shown that FPS has experienced significant operational, management, and funding challenges that have hampered its ability to protect the 9,000 federal facilities under the control and custody of the General Services Administration (GSA). We have made numerous recommendations to help FPS address these challenges, and while DHS agreed with our recommendations, the majority of them have not yet been fully implemented. See appendix I for a complete list of our recommendations and their current status. To assist Congress in its oversight of FPS, this report (1) recaps the major challenges we reported that FPS faces in protecting federal facilities and discusses actions FPS is taking to address them and (2) identifies an additional challenge FPS faces related to the facility security committees (FSC). Each FSC consists of representatives from each of the tenant agencies in the federal facility and is responsible for addressing security issues at their respective facility and approving the implementation of security countermeasures recommended by FPS. This report is based primarily on our previous work and recent interviews with FPS officials to obtain the current status of planned initiatives.[Footnote 1] We conducted our work from January 2010 through July 2010 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. FPS Faces Challenges in Protecting Federal Facilities and Is Taking Some Actions to Address Them: FPS Has Begun to Develop a Risk Management Approach to Protecting Federal Facilities: In 2008, we reported that FPS does not use a comprehensive risk management approach that links threats and vulnerabilities to resource requirements.[Footnote 2] Without a risk management approach that identifies threats and vulnerabilities and the resources required to achieve FPS's security goals, there is only limited assurance that programs will be prioritized and resources will be allocated to address existing and potential security threats in an efficient and effective manner. FPS uses a facility-by-facility approach to risk management. Under this approach, FPS assumes that all facilities with the same security level have the same risk regardless of their location. For example, a level IV facility in a metropolitan area is generally treated the same as one in a rural area.[Footnote 3] We also reported in 2008 that FPS's approach does not include a process for examining comprehensive risk across the entire portfolio of GSA's facilities. Both our and DHS's risk management frameworks include processes for assessing comprehensive risk across assets in order to prioritize countermeasures based on the overall needs of the system. FPS's building-by-building approach, however, prevents it from comprehensively identifying and prioritizing vulnerabilities and making countermeasure recommendations at a strategic level.[Footnote 4] Over the years we have advocated the use of a risk management approach that links threats and vulnerabilities to resource requirements and allocation. A risk management approach entails a continuous process of managing risk through a series of actions, including setting strategic goals and objectives, assessing risk, allocating resources based on risk, evaluating alternatives, selecting initiatives to undertake, and implementing and monitoring those initiatives. Risk assessment, an important element of a risk management approach, helps decision makers identify and evaluate potential risks so that countermeasures can be designed and implemented to prevent or mitigate the effects of the risks. In response to our recommendations in this area, FPS began developing a new system referred to as the Risk Assessment Management Program (RAMP). This system is designed to be a central database for capturing and managing facility security information, including the risks posed to federal facilities and the countermeasures in place to mitigate risk. FPS also anticipates that RAMP will allow inspectors to obtain information from one electronic source, generate reports automatically, enable FPS to track selected countermeasures throughout their life cycle, address some concerns about the subjectivity inherent in facility security assessments (FSA), and reduce the amount of time inspectors and managers spend on administrative work.[Footnote 5] FPS designed RAMP so that it will produce risk assessments that are compliant with Interagency Security Committee (ISC) standards, which, among other things, require risk assessment methodologies to be credible, reproducible, and defensible and for FSAs to be done every 3 to 5 years.[Footnote 6] According to FPS, RAMP is also compatible with the risk management framework set forth by the National Infrastructure Protection Plan (NIPP), and consistent with the business processes outlined in the memorandum of agreement with GSA.[Footnote 7] According to FPS, RAMP will support all components of the FSA process, including gathering and reviewing building information; conducting and recording interviews; assessing threats, vulnerabilities, and consequences to develop a detailed risk profile; recommending appropriate countermeasures; and producing FSA reports. FPS also plans to use RAMP to track and analyze certain workforce data, contract guard program data, and other performance data, such as the types and definitions of incidents and incident response times. Currently, FPS is in the process of implementing the first phase of RAMP and plans to have it fully implemented by the end of 2011. We are reviewing the design and implementation of RAMP and will provide Congress with a final report next year. FPS Has Taken Some Steps to Improve Oversight of the Contract Guard Program: We reported in July 2009 and April 2010 that FPS faces challenges in ensuring that many of the 15,000 contract security guards that FPS relies on to help protect federal facilities have the required training and certification to be deployed at federal facilities.[Footnote 8] We also identified substantial security vulnerabilities related to FPS's guard program. Each time they tried, in April and May 2009, our investigators successfully passed undetected through security checkpoints monitored by FPS's guards, with the components for an improvised explosive device concealed on their persons at 10 level IV facilities in four major metropolitan areas. FPS also took a number of immediate actions to address concerns raised about contract guard management in our July 2009 contract guard report. For example, since July 2009, FPS has increased its penetration tests in some regions and the number of guard inspections it conducts at federal facilities in some metropolitan areas. FPS currently requires its inspectors to complete two guard inspections a week at level IV facilities. Prior to this new requirement, FPS did not have a national requirement for guard inspections, and each region we visited had requirements ranging from no inspections to five inspections per month per FPS inspector. FPS is also in the process of providing additional X-ray and magnetometer training in response to our July 2009 testimony. FPS anticipates that guards will be fully trained by the end of 2010. Under FPS's revised training program, inspectors must receive 30 hours of X-ray and magnetometer training and guards must receive 16 hours. Prior to this revision, guards needed 8 hours of training on X-ray and magnetometer machines. However, despite these changes, we remain concerned about FPS's oversight of the contract guard program and made recommendations for additional improvements in our April 2010 report. For example, we reported that despite FPS's recent actions, guards were continuing to neglect or inadequately perform their assigned responsibilities. We also remained concerned that FPS had not acted diligently in ensuring the terms of its guard contract and taken enforcement action when noncompliance occurred. Thus, we recommended, among other things, that FPS identify other approaches that would be cost-beneficial for protecting federal facilities. FPS agreed with this recommendation but has not yet implemented it. DHS Transferred FPS to NPPD: We have reported on several issues related to locating FPS within DHS's Immigration and Customs Enforcement (ICE). For example, we reported in 2008 that some of FPS's operational and funding challenges stemmed from it being part of ICE. In October 2009, to enable FPS to better focus on its primary facility protection mission, the Secretary of Homeland Security transferred FPS from ICE to the National Protection and Programs Directorate (NPPD). According to DHS, transferring FPS to NPPD will enhance oversight and efficiency while maximizing the department's overall effectiveness in protecting federal buildings across the country. We are reviewing the transition of FPS into NPPD and will provide Congress with a final report in 2011. Several Key Workforce Issues Remain Unresolved: FPS has yet to fully ensure that its recent move to an inspector-based workforce does not hinder its ability to protect federal facilities. In 2007, FPS essentially eliminated its police officer position and moved to an all-inspector-based workforce. FPS also decided to place more emphasis on physical security activities, such as completing FSAs, and less emphasis on law enforcement activities, such as proactive patrol. We reported in 2008 that these changes may have contributed to diminished security and increases in inspectors' workload. Specifically, we found that when FPS is not providing proactive patrol at some federal facilities, there is an increased potential for illegal entry and other criminal activity. For example, in one city we visited, a deceased individual had been found in a vacant GSA facility that was not regularly patrolled by FPS. Under its inspector-based workforce approach, FPS will rely more on local police departments to handle crime and protection issues at federal facilities. However, at about 400 federal facilities across the United States, the federal government has exclusive jurisdiction, and it is unclear if local police have the authority to respond to incidents inside those facilities. Additionally, FPS has not entered into any memorandums of agreement for increased law enforcement assistance at federal facilities. In most of the cities we visited, local law enforcement officials said they would not enter into any agreements with FPS that involve increased responsibility for protecting federal facilities because of liability concerns, existing shortages of staff, and the need to respond to crime in their cities that would make it difficult to divert resources from their primary mission. For example, local law enforcement officials from one location we visited said they are significantly understaffed and overburdened with their current mission and would not be able to take responsibility for protecting federal facilities. We believe that it is important that FPS ensure that its decision to move to an inspector- based workforce does not hamper its ability to protect federal facilities. We recommended in 2008 that FPS clarify roles and responsibilities of local law enforcement agencies in responding to incidents at GSA facilities. While FPS agreed with this recommendation, FPS has decided not to pursue agreements with local law enforcement officials, in part because of reluctance on the part of local law enforcement officials to sign such agreements. In addition, FPS believes that the agreements are not necessary because 96 percent of the properties in its inventory are listed as concurrent jurisdiction facilities where both federal and state governments have jurisdiction over the property. Nevertheless, we continue to believe that these agreements would, among other things, clarify roles and responsibilities of local law enforcement agencies when responding to crime or other incidents. While FPS has recently increased the size of its workforce as mandated by Congress, we reported in our 2009 report that FPS has operated without a human capital plan.[Footnote 9] We recommended that FPS develop a human capital plan to guide its current and future workforce planning efforts. We have identified human capital management as a high-risk issue throughout the federal government, including within DHS. Without a long-term strategy for managing its current and future workforce needs, including effective processes for hiring, training, and staff development, FPS will be challenged to align its personnel with its programmatic goals. FPS concurred with this recommendation and has drafted a workforce analysis plan but has not yet fully developed or implemented a human capital plan. Appropriate Funding Mechanism Has Not Been Determined: FPS's primary means of funding its operations--the basic security fee charged to some federal agencies--does not account for a building's level of risk, the level of service provided, or the cost of providing those services. We reported in 2008 that this issue raises questions about whether some federal agencies are being overcharged by FPS.[Footnote 10] FPS also does not have a detailed understanding of its operational costs, including accurate information about the cost of providing its security services at federal facilities with different risk levels. Without this type of information, FPS has difficulty justifying the rate of the basic security fee to its customers. We have found that by having accurate cost information, an organization can demonstrate its cost-effectiveness and productivity to stakeholders, link levels of performance with budget expenditures, provide baseline and trend data for stakeholders to compare performance, and provide a basis for focusing an organization's efforts and resources to improve its performance. In addition, FPS's fee-based funding system has not always generated sufficient revenue to cover its operational costs. In 2007 we reported that FPS's collections fell short of covering its projected operational costs, and the steps it took to address the projected shortfalls reduced staff morale, increased attrition rates, and diminished security at some GSA facilities. FPS has yet to evaluate whether its fee-based system or an alternative funding mechanism is most appropriate for funding the agency as we recommended in our 2008 report. FPS agreed with our recommendation and has taken some action, including the development and implementation of an Activity Based Cost framework. We are assessing FPS's efforts in this area as part of our ongoing review of FPS's fee-base structure and will provide Congress with a final report in 2011. FPS Faces Limitations in Assessing Its Performance: We have reported that FPS is limited in its ability to assess the effectiveness of its efforts to protect federal facilities.[Footnote 11] To determine how well it is accomplishing its mission to protect federal facilities, FPS has identified some output measures. These measures include determining whether security countermeasures have been deployed and are fully operational, the amount of time it takes to respond to an incident, and the percentage of FSAs completed on time. While output measures are helpful, outcome measures are also important because they can provide FPS with broader information on program results, such as the extent to which its decision to move to an inspector-based workforce will enhance security at federal facilities or help identify the security gaps that remain at federal facilities and determine what action may be needed to address them. In addition, FPS does not have a reliable data management system that will allow it to accurately track these measures or other important measures such as the number of crimes and other incidents occurring at GSA facilities. Without such a system, it is difficult for FPS to evaluate and improve the effectiveness of its efforts to protect federal employees and facilities, allocate its limited resources, or make informed risk management decisions. For example, weaknesses in one of FPS's countermeasure tracking systems make it difficult to accurately track the implementation status of recommended countermeasures such as security cameras and X-ray machines. Without this ability, FPS has difficulty determining whether it has mitigated the risk of federal facilities to crime or a terrorist attack. FPS concurred with our recommendations and states that its efforts to address them will be completed in 2012 when its automated information systems are fully implemented. Facility Security Committee Structure Hampers Protection of Federal Facilities: FPS's ability to protect federal facilities under the control or custody of GSA is further complicated by the FSC structure. The Department of Justice's 1995 Vulnerability Assessment of Federal Facilities guidelines directed GSA to establish a FSC in each federal facility under its control. FSCs have experienced several issues that may have increased the risk at some federal facilities. For example, FSCs have operated since 1995 without guidelines, policies, or procedures that outline how they should operate, make decisions, or establish accountability. This results in ad hoc security that undermines effective protection of individual facilities as well as the entire facilities' portfolio. Each FSC consists of a representative from each of the tenant agencies in the facility and is responsible for addressing security issues at its respective facility and approving the implementation of security countermeasures recommended by FPS. After completing its FSAs, FPS makes recommendations to GSA and tenant agencies for building security countermeasures. For example, tenant agencies decide whether to fund countermeasures for security equipment, and FPS is responsible for acquiring, installing, and maintaining approved security equipment. However, we reported in November 2009 that the tenant agency representatives generally do not have any security knowledge or experience but are expected to make security decisions for their respective agencies. We also reported that some of the FSC tenant agency representatives also do not have the authority to commit their respective organizations to fund security countermeasures. Thus, when funding for security countermeasures is needed, each federal tenant agency representative that does not have funding authority must obtain approval from his or her headquarters office. According to some FSC members, in some instances funding for security countermeasures is not always available because the request for funding is generally made after the budget is formulated. In addition, while FPS, GSA, and tenant agencies are responsible for some aspects of protecting federal facilities, it is unclear who is the final arbiter or accountable for final decisions. We reported in November 2009 that the FSC structure may not contribute to effective protection of federal facilities for several reasons. [Footnote 12] * Some FSC members may not have the security expertise needed to make risk-based decisions. * They may find the associated costs prohibitive. * Tenant agencies may lack complete understanding of why recommended countermeasures are necessary because they do not receive an adequate amount of information from FPS. Moreover, we found some instances in 2008 and 2009 where the FSC structure contributed to increased risk at some federal facilities. For example, an FPS official in a major metropolitan area stated that over the last 4 years inspectors have recommended 24-hour coverage at one high-risk facility located in a high-crime area multiple times; however, the FSC was not able to obtain approval from all its members. In addition, several FPS inspectors stated that their regional managers have instructed them not to recommend security countermeasures in FSAs if FPS would be responsible for funding the measures because there is not sufficient funding in regional budgets to purchase and maintain the security equipment. Moreover, at a different location, members of a FSC told us that they met as needed, although even when they hold meetings, one of the main tenant agencies typically does not participate. GSA officials commented that this tenant adheres to its agency's building security protocols and does not necessarily follow GSA's tenant policies and procedures, which GSA thinks creates security risks for the entire building. ISC recently began to develop guidance for FSC operations, which may address some of these issues. The committee, however, has yet to announce an anticipated date for issuance of this guidance. Conclusions: In response to our many recommendations, FPS has a number of ongoing improvements that, once fully implemented, should enhance its ability to protect the over 1 million federal government employees and members of the public who visit federal facilities each year. In addition, FSCs have a significant role in ensuring the effective protection of federal facilities; however, they face a number of issues in carrying out their security responsibilities. For example, they have operated without any procedures since their creation in 1995, and efforts to develop guidance are incomplete. Without specific guidance or procedures, FSCs have operated in an ad hoc manner, and there is a lack of assurance that federal facilities under the control and custody of GSA are effectively protected by FPS. Moreover, no actions have been taken on these issues since we identified them in our November 2009 report. As such, these weaknesses continue to result in ad hoc security and increased risk at some federal facilities. Therefore, we are making a recommendation for the Secretary of DHS to address this matter. Recommendation for Executive Action: GAO recommends that the Secretary of DHS direct the Under Secretary of NPPD and the Director of FPS to work in consultation with GSA and ISC to develop and implement procedures that, among other things, outline the FSCs' organizational structure, operations, decision-making authority, and accountability. Agency Comments and Our Evaluation: We provided a draft of this report to DHS for review and comment. DHS concurred with the recommendation in this report. Regarding the status of our recommendations listed in appendix I, FPS commented that it is actively pursuing initiatives and implementing measures to address the nine recommendations that we reported as not implemented. We believe our characterization of FPS's efforts to address our recommendations reflects the data provided by FPS. We are also concerned that the steps FPS described in its documents are not comprehensive enough to address the recommendations that we reported as not implemented. For example, regarding our recommendation to identify other approaches and options that would be most beneficial and financially feasible for protecting federal facilities, FPS states that it most recently coordinated with DHS's Science and Technology Directorate to better define requirements for the next generation of security technology. However, we continue to believe that given the challenges FPS faces with managing its contract guard program, among other things, FPS needs to undertake a comprehensive review of how it protects federal facilities. FPS has not provided us with this type of analysis or information. We are also concerned about the reliability of the preliminary data FPS used to evaluate whether its fee-based system or an alternative funding mechanism is appropriate to fund the agency. We are currently reviewing the reliability of FPS's Activity Based Costing framework and will reassess FPS's efforts to address this recommendation at the end of our review. DHS's comments are presented in appendix II. DHS also provided technical clarifications, which we incorporated into the report as appropriate. We are sending copies of this report to appropriate congressional committees, the Secretary of Homeland Security, and other interested parties. In addition, the report will be available at no charge on GAO's Web site at [hyperlink, http://www.gao.gov]. If you have any questions about this report, please contact me at (202) 512-2834 or goldsteinm@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix III. Signed by: Mark L. Goldstein: Director, Physical Infrastructure Issues: List of Requesters: The Honorable Joseph I. Lieberman: Chairman: The Honorable Susan M. Collins: Ranking Member: Committee on Homeland Security and Governmental Affairs: United States Senate: The Honorable Daniel K. Akaka: Chairman: The Honorable George V. Voinovich: Ranking Member: Subcommittee on Oversight of Government Management, the Federal Workforce and the District of Columbia: Committee on Homeland Security and Governmental Affairs: United States Senate: The Honorable Bennie G. Thompson: Chairman: The Honorable Peter T. King: Ranking Member: Committee on Homeland Security: House of Representatives: The Honorable James L. Oberstar: Chairman: Committee on Transportation and Infrastructure: House of Representatives: The Honorable Eleanor Holmes Norton: Chairwoman: Subcommittee on Economic Development, Public Buildings, and Emergency Management: Committee on Transportation and Infrastructure: House of Representatives: [End of section] Appendix I: Status of GAO Recommendations to the Federal Protective Service: Report number: GAO-10-341: Recommendation: 1; Identify other approaches and options that would be most beneficial and financially feasible for protecting federal facilities; Status: Not implemented. Recommendation: 2; Rigorously and consistently monitor guard contractors' and guards' performance and step up enforcement against contractors that are not complying with the terms of the contract; Status: In process. Recommendation: 3; Complete all contract performance evaluations in accordance with FPS and FAR requirements; Status: In process. Recommendation: 4; Issue a standardized record-keeping format to ensure that contract files have required documentation; Status: Not implemented. Recommendation: 5; Develop a mechanism to routinely monitor guards at federal facilities outside metropolitan areas; Status: In process. Recommendation: 6; Provide building-specific and scenario-based training and guidance to its contract guards; Status: In process. Recommendation: 7; Develop and implement a management tool for ensuring that reliable, comprehensive data on the contract guard program are available on a real-time basis; Status: In process. Recommendation: 8; Verify the accuracy of all guard certification and training data before entering them into the Risk Assessment Management Program (RAMP), and periodically test the accuracy and reliability of RAMP data to ensure that FPS management has the information needed to effectively oversee its guard program; Status: In process. Report number: GAO-10-142: Recommendation: 1; Provide the Secretary with regular updates, on a mutually agreed-to schedule, on the status of RAMP and the National Countermeasures Program, including the implementation status of deliverables, clear timelines for completion of tasks and milestones, and plans for addressing any implementation obstacles; Status: In process. Recommendation: 2; In conjunction with the National Countermeasures Program, develop a methodology and guidance for assessing and comparing the cost-effectiveness of technology alternatives; Status: Not implemented. Recommendation: 3; Reach consensus with GSA on what information contained in the facility security assessment is needed for GSA to fulfill its responsibilities related to the protection of federal buildings and occupants, and accordingly, establish internal controls to ensure that shared information is adequately safeguarded; guidance for employees to use in deciding what information to protect with sensitive but unclassified designations; provisions for training on making designations, controlling, and sharing such information with GSA and other entities; and a review process to evaluate how well this information sharing process is working, with results reported to the Secretary regularly on a mutually agreed-to schedule; Status: Not implemented. Report number: GAO-09-749: Report number: 1; Recommendation: 1; Improve how FPS headquarters collects data on its workforce's knowledge, skills, and abilities to help it better manage and understand current and future workforce needs; Status: In process. Recommendation: 2; Use these data in the development and implementation of a long-term strategic human capital plan that addresses key principles for effective strategic workforce planning, including establishing programs, policies, and practices that will enable the agency to recruit, develop, and retain a qualified workforce; Status: Not implemented. Recommendation: 3; Collect and maintain an accurate and comprehensive list of all facility-designated points of contact, as well as a system for regularly updating this list; Status: In process. Recommendation: 4; Develop and implement a program for education and outreach to all customers to ensure they are aware of the current roles, responsibilities, and services provided by FPS; Status: Not implemented. Report number: GAO-08-683: Recommendation: 1; Develop and implement a strategic approach to manage FPS's staffing resources that, among other things, determines the optimum number of employees needed to accomplish its facility protection mission and allocate these resources based on risk management principles and the agency's goals and performance measures; Status: In process. Recommendation: 2; Clarify roles and responsibilities of local law enforcement agencies in regard to responding to incidents at GSA facilities; Status: Not implemented. Recommendation: 3; Improve FPS's use of the fee-based system by developing a method to accurately account for the cost of providing security services to tenant agencies and ensuring that its fee structure takes into consideration the varying levels of risk and service provided at GSA facilities; Status: Not implemented. Recommendation: 4; Evaluate whether FPS's current use of a fee-based system or an alternative funding mechanism is the most appropriate manner to fund the agency; Status: Not implemented. Recommendation: 5; Develop and implement specific guidelines and standards for measuring its performance, including outcome measures to assess its performance and improve the accountability of FPS; Status: In process. Recommendation: 6; Improve how FPS categorizes, collects, and analyzes data to help it better manage and understand the results of its efforts to protect GSA facilities; Status: In process. Source: GAO. [End of table] [End of section] Appendix II: Comments from the Department of Homeland Security: U.S. Department of Homeland Security: Washington, DC 20528: July 27, 2010: Mr. Mark L. Goldstein: Director, Physical Infrastructure Issues: U.S. Government Accountability Office: 441 G Street, NW: Washington, DC 20548: Dear Mr. Goldstein: Subject: Draft Report GA0-10-901, Homeland Security: Addressing Weaknesses with Facility Security Committees Would Enhance Protection of Federal Facilities (Job Code 543250): The National Protection and Programs Directorate (NPPD)/Federal Protective Service (FPS) appreciates the opportunity to respond to the above referenced draft report (technical comments have been provided under separate cover). As described in the draft report, there is work to be done, but we are pleased to note the report's positive acknowledgment of the recent actions taken to address previous recommendations, including development of the Risk Assessment and Management Program (RAMP), increased penetration testing, increased frequency of guard inspections, more focused guard training and, significantly, the transfer of FPS to NPPD from Immigration and Customs Enforcement. Recommendation: GAO recommends that the Secretary of the Department of Homeland Security (DHS) direct the Under Secretary of NPPD and the Director of FPS to work in consultation with the General Services Administration (GSA) and the Interagency Security Committee (ISC) to develop and implement procedures that, among other things, outlines the Federal Security Committees' (FSCs') organizational structure, operations, decision making authority, and accountability. No other recommendations are made. Response: NPPD concurs with the recommendation. FPS and GSA currently co-chair an ISC Facility Security' Committee working group that is charged with developing and presenting an ISC Standard titled Facility Security Committees. The standard, among other things, addresses FSC duties and procedures, organizational structure, decision making processes, and accountability. The working group anticipates that the standard will be submitted to the ISC membership by December 31, 2010. Draft Report Discussion: With respect to the draft report itself, while we are pleased that GAO acknowledged actions and progress made toward closing GAO recommendations, DHS would like to emphasize that FPS is actively pursuing, and has reported its progress on, the closure of all open recommendations. In a March 30, 2010, update to GAO, and in the FPS response to Draft Report GA0-10-341, Federal Protective Service's Contract Guard Program Requires More Oversight and Reassessment of Use of Contract Guards. FPS provided evidence to support closure of seven open recommendations and to demonstrate substantial progress that has been made toward closure of all remaining open recommendations. DHS offers the following evidence that FPS is actively pursuing initiatives and implementing measures to address recommendations for which GAO indicated in the draft report there has been no activity. The draft report shows (Appendix I) nine recommendations as "not implemented." As indicated and documented in the March 30, 2010, update and the response to the GA0-10-341 draft report, FPS considers all of the open recommendations listed in Appendix I as "in process." In April, GAO recommended in its Draft Report GAO-10-341 that "FPS identify other approaches that would be cost-beneficial for protecting federal facilities," but noted that FPS had not yet implemented the recommendation. On the contrary, FPS notified GAO of progress made toward meeting this recommendation in the response to that draft report. Specifically, FPS informed GAO that since its creation in 1971, FPS has consistently examined past actions, best practices, and available resources and technology to determine the best available means to protect federal facilities. FPS added that largely due to resource constraints, FPS' approaches and options to protecting federal facilities have focused on providing more robust and analytical risk assessments, enhancing the training and oversight of protective security officers, and streamlining the implementation of countermeasures through the use of national contract vehicles. FPS also described its recently increased interaction with the research and development community, through the OHS Science and Technology Directorate, to better define requirements for the next generation of security technology. FPS explained that it is simultaneously testing new developments in countermeasures to assess their maximum effectiveness as part of the integrated set of countermeasures. GAO asserts that, "FPS has yet to evaluate whether its fee-based system or an alternative funding mechanism is most appropriate for funding the agency as we recommended in our 2008 report." However, in the March 30, 2010 update to GAO open recommendations, FPS reported that it had used preliminary data obtained from the recently deployed Activity Based Costing Framework (ABC) and risk-based workforce performance metrics to initiate an analysis of the current fee-based system and complete a study of alternative funding strategies that may better support the security and protection mission of the FPS within DHS. FPS' evaluation of the fee-based system currently used has concluded that fee collections have not been sufficient to cover projected operational costs in recent years, and the agency has faced shortfalls related to providing basic security services. Therefore, FPS conducted an Alternative Funding Model analysis with three primary objectives: (1) ensure that FPS security charges are appropriate, are aligned with operational costs, and do not result in further budgetary shortfalls; (2) possess sufficient flexibility to account for risks associated with specific buildings; and (3) clearly demonstrate the link between security charges to the customer agencies and underlying security costs. This analysis resulted in the identification and consideration of the following three alternatives, which are still being evaluated: (1) a direct FPS appropriation; (2) a more thorough review of the current fee-based system (four methodologies for assessing charges are proposed); and (3) the utilization of GSA services for billing and collection. GAO also refers to FPS' limited ability to assess the effectiveness of its efforts to protect federal facilities. It adds that FPS has identified some output measures to determine how well it is accomplishing its mission to protect federal facilities, but that FPS needs to develop outcome measures. Again. in the March 30, 2010, update, FPS responded to the GAO recommendation pertaining to performance measures by including sample outcome performance measures that have been implemented and are being monitored by FPS. Moreover, in the update, FPS reported that it has developed and is using guidelines, standards, and templates to ensure that performance, both output and outcome measures, possess the attributes recommended by GAO. FPS also explained that these measures are part of an agency-wide effort to establish a robust performance management program in response to GAO recommendations and in accordance with the guidelines of the Government Performance and Results Act, the Office of Management and Budget, and the DHS Office of Program Analysis and Evaluation. FPS concluded the update to this recommendation by adding that continuing through FY2012, implementation of automated information systems will continue to support efforts to fully address this GAO recommendation. Chief among these are the RAMP, Post Tracking System (PTS), and the Computer Aided Dispatch and Information System (CADIS). As these systems are brought on line, they are expected to provide detailed and robust information, previously unavailable, to assess FPS performance in providing integrated security and law enforcement services for the Federal community. NPPD/FPS remains committed to continuous improvement, and we will provide progress reports to you on efforts to address the previous recommendations referenced in this report. Sincerely, Signed by: Jerald E. Levine: Director: Departmental GAO/OIG Liaison Office: [End of section] Appendix III GAO Contacts and Staff Acknowledgments: GAO Contact: Mark L. Goldstein, (202) 512-2834 or goldsteinm@gao.gov: Acknowledgments: In addition to the contact name above, Tammy Conquest, Assistant Director; Jennifer Clayborne; Delwen Jones; and Susan Michal-Smith made key contributions to this report. [End of section] Footnotes: [1] This report draws upon the following primary sources: GAO, Homeland Security: Federal Protective Service's Contract Guard Program Requires More Oversight and Reassessment of Use of Contract Guards, [hyperlink, http://www.gao.gov/products/GAO-10-341] (Washington, D.C.: Apr. 13, 2010); Homeland Security: Greater Attention to Key Practices Would Improve the Federal Protective Service's Approach to Facility Protection, [hyperlink, http://www.gao.gov/products/GAO-10-142] (Washington, D.C.: Oct. 23, 2009); Homeland Security: Preliminary Results Show Federal Protective Service's Ability to Protect Federal Facilities Is Hampered by Weaknesses in Its Contract Security Guard Program, [hyperlink, http://www.gao.gov/products/GAO-09-859T] (Washington, D.C.: July 8, 2009); Homeland Security: Federal Protective Service Should Improve Human Capital Planning and Better Communicate with Tenants, [hyperlink, http://www.gao.gov/products/GAO-09-749] (Washington, D.C.: July 30, 2009); and Homeland Security: The Federal Protective Service Faces Several Challenges That Hamper Its Ability to Protect Federal Facilities, [hyperlink, http://www.gao.gov/products/GAO-08-683] (Washington, D.C.: June 11, 2008). [2] [hyperlink, http://www.gao.gov/products/GAO-08-683]. [3] On March, 10, 2008, the Interagency Security Committee issued new standards for determining the security level of federal facilities that supersede the standards developed in the Department of Justice's 1995 Vulnerability Assessment Guidelines. These guidelines have five security levels. A level I facility is typically a small storefront- type operation such as a military recruiting office with 10 or fewer employees and a low volume of public contact. A level II facility has from 11 to 150 employees; a level III facility has from 151 to 450 employees and a moderate to high volume of public contact; a level IV facility has over 450 employees, a high volume of public contact, and includes high-risk law enforcement and intelligence agencies. FPS does not have responsibility for a level V facility such as the White House or the Central Intelligence Agency. [4] [hyperlink, http://www.gao.gov/products/GAO-10-142]. [5] An FSA, formerly referred to as a building security assessment, is a type of security evaluation conducted by FPS to determine how susceptible a facility is to various forms of threats or attacks. FSAs included countermeasure recommendations to mitigate threats and reduce vulnerabilities. [6] Following the Oklahoma City bombing, Executive Order 12977 called for the creation of an Interagency Security Committee to address the quality and effectiveness of physical security requirements for federal facilities by developing and evaluating security standards. ISC has representation from all major federal departments and agencies. In 2003, the Chair of the ISC moved from GSA to DHS. [7] The NIPP was founded through the Homeland Security Presidential Directive-7 and sets forth national policy on how the plan's risk management framework and sector partnership model are to be implemented by sector-specific agencies. FPS is the agency responsible for the government facilities sector. [8] [hyperlink, http://www.gao.gov/products/GAO-09-859T] and [hyperlink, http://www.gao.gov/products/GAO-10-341]. [9] [hyperlink, http://www.gao.gov/products/GAO-09-749]. [10] [hyperlink, http://www.gao.gov/products/GAO-08-683]. [11] [hyperlink, http://www.gao.gov/products/GAO-08-863] and [hyperlink, http://www.gao.gov/products/GAO-10-236T]. [12] [hyperlink, http://www.gao.gov/products/GAO-10-236T]. [End of section] GAO's Mission: The Government Accountability Office, the audit, evaluation and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO's commitment to good government is reflected in its core values of accountability, integrity, and reliability. Obtaining Copies of GAO Reports and Testimony: The fastest and easiest way to obtain copies of GAO documents at no cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each weekday, GAO posts newly released reports, testimony, and correspondence on its Web site. To have GAO e-mail you a list of newly posted products every afternoon, go to [hyperlink, http://www.gao.gov] and select "E-mail Updates." Order by Phone: The price of each GAO publication reflects GAO’s actual cost of production and distribution and depends on the number of pages in the publication and whether the publication is printed in color or black and white. Pricing and ordering information is posted on GAO’s Web site, [hyperlink, http://www.gao.gov/ordering.htm]. Place orders by calling (202) 512-6000, toll free (866) 801-7077, or TDD (202) 512-2537. Orders may be paid for using American Express, Discover Card, MasterCard, Visa, check, or money order. Call for additional information. To Report Fraud, Waste, and Abuse in Federal Programs: Contact: Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]: E-mail: fraudnet@gao.gov: Automated answering system: (800) 424-5454 or (202) 512-7470: Congressional Relations: Ralph Dawn, Managing Director, dawnr@gao.gov: (202) 512-4400: U.S. Government Accountability Office: 441 G Street NW, Room 7125: Washington, D.C. 20548: Public Affairs: Chuck Young, Managing Director, youngc1@gao.gov: (202) 512-4800: U.S. Government Accountability Office: 441 G Street NW, Room 7149: Washington, D.C. 20548: