Pipeline Security: TSA Has Taken Actions to Help Strengthen Security, but Could Improve Priority-Setting and Assessment Processes

In August 2010 we reported on the Transportation Security Administration's (TSA) efforts to help strengthen pipeline security. We found that TSA's Pipeline Security Division (PSD) developed a pipeline risk assessment model that assessed risk as a function of threat, vulnerability, and consequence. However, the consequence component of PSD's model is incomplete since it accounts for economic impact but not the impact on public health and safety. As a result, we recommended that PSD develop a plan for improving the risk model by, for example, adding more data to the consequence component. In response, DHS reported in October 2010 that PSD had added risk factors for High Consequence Areas and Highly Populated Areas to the consequence component and added a critical facility count to the vulnerability component of its model. As of May 2011, PSD had added such information to its pipeline risk assessment tool. These actions are consistent with our recommendation.

In August 2010 we reported on the Transportation Security Administration's (TSA) efforts to help strengthen pipeline security. We found that TSA's Pipeline Security Division (PSD) did not use a pipeline system's risk ranking as the primary consideration when scheduling Corporate Security Reviews (CSR) and Critical Facility Inspections (CFI). We recommended that PSD document a methodology for scheduling CSRs and CFIs that considers a pipeline system's risk ranking as the primary scheduling criteria and to balance that with other practical considerations. As a result, PSD revised its CSR Standard Operating Procedures, as documented in a copy dated May 20, 2011, to state that the primary criteria for scheduling CSR visits is the pipeline system's relative risk (i.e. risk ranking), although other factors and considerations, such as operator availability and geographic location will also play a role. In addition, PSD revised its Management Plan for the Inspection of Critical Facilities of the Top 100 U.S. Pipeline Systems to state that CFIs will be scheduled based primarily on a pipeline system's relative risk ranking and that other practical considerations will also be taken into account. These actions are consistent with our recommendation.

In August 2010 we reported on the Transportation Security Administration's (TSA) efforts to help strengthen pipeline security. We found that after each Corporate Security Review (CSR) that TSA's Pipeline Security Division (PSD) conducts, officials document review findings and the recommendations they make in an internal report and provide oral recommendations aimed at enhancing that operator's security planning and preparedness to the pipeline operator's security personnel and sometimes management. However, PSD does not communicate these recommendations to the operator in writing as a matter of practice. Therefore, we recommended that PSD develop a plan for how and when it intends to begin transmitting CSR recommendations in writing to pipeline operators. As a result of our recommendation, DHS reported in October 2010 that PSD had started sharing the CSR reports, including recommendations, with operators for those CSRs conducted in and after March 2010, and its May 2011 revision of its CSR Standard Operating Procedure (SOP) reflects the process for sharing written reports and recommendations with pipeline operators. These actions are consistent with our recommendation.

In August 2010, we reviewed and reported on TSA's efforts to help strengthen pipeline security. We found that TSA's Pipeline Security Division (PSD) did not have a database of the recommendations it makes to pipeline operators as a result of its Corporate Security Reviews (CSR) nor a process for following up on those recommendations. Therefore, we recommended that it establish such a database and follow up with the pipeline operators so it knows if its recommendations are being implemented and whether the state of pipeline security is improving. PSD developed a process for following up on its recommendations. Its May 2011 revision to its CSR Standard Operating Procedure states that CSR recommendations are to be entered into a CSR database for recording, tracking, and follow up with operators and further states that operators will be contacted about 12 months after the CSR to follow up with a written query regarding the status of actions taken to address the recommendations. In June 2011, PSD had begun developing and testing a CSR database. PSD completed putting CSR data into the database in March 2012. These actions are consistent with our recommendation.

In August 2010 we reported on the Transportation Security Administration's (TSA) efforts to help strengthen pipeline security. We found that TSA's Pipeline Security Division (PSD) did not have a database of the recommendations it makes to operators as a result of its Critical Facility Inspections (CFI) nor a process for following up on those recommendations. Therefore, we recommended that it establish such a database and develop a process for following up with operators on the implementation of those recommendations. As a result of our recommendation, DHS reported in October 2010 that a database had been developed to contain all the recommendations made on CFI visits as well as a process for following up on those recommendations. In addition, PSD's May 2011 revision of its Management Plan for Inspection of the Critical Facilities of the Top 100 U.S. Pipeline Systems itemized the CFI process to include populating the database with the recommendations made at each facility and established a follow up process. PSD has begun to populate the database with its recommendations. Its management plan also calls for PSD to send a letter to the operator requesting the status of action(s) taken on CFI recommendations approximately 12 months after an inspection, and notes that a follow-up visit to the facility in lieu of or in addition to the letter may also be conducted. These actions are consistent with our recommendation.

In August 2010, we reviewed and reported on TSA's efforts to help strengthen pipeline security. We found that the 2007 Pipeline Modal Annex to the Transportation Sector-Specific Plan--TSA's national strategy for pipeline systems--contained goals and objectives, but it did not incorporate the performance measures that TSA's Pipeline Security Division (PSD) used to evaluate the effectiveness of its security programs and activities. Therefore, we recommended that PSD revise future updates to the annex to incorporate performance measures for assessing PSD and pipeline industry progress and link those measures to pipeline security objectives. The 2010 Pipeline Modal Annex had already been drafted and submitted to the Department of Homeland Security in August 2010--the time when our report was issued--therefore PSD could not provide an update that included incorporating performance measures linked to pipeline security objectives. However, in August 2012, PSD issued an addendum to the 2010 Pipeline Modal Annex, which incorporated performance measures, and stated it would include the same performance measures in the 2014 Pipeline Modal Annex. These actions are consistent with our recommendation.

In August 2010, we reported on the Transportation Security Administration's (TSA) efforts to help strengthen pipeline security. We found that TSA's Pipeline Security Division's (PSD) ability to measure improvements in pipeline security was limited because it had not developed outcome measures that enabled it to fully assess improvements related to pipeline security as a whole or evaluate one of its pipeline security objectives--to increase the level of resiliency and robustness of pipeline systems. As such, we recommended that PSD develop additional outcome measures. In August 2012, PSD issued an addendum to the 2010 Pipeline Modal Annex, which included additional outcome measures that were linked to Pipeline Modal objectives. For example, PSD tracks the percentage of critical facilities of the top 100 pipeline systems that have had vulnerability assessments and links this to its goal of reducing the level of risk through implementation of security programs. PSD has begun to track progress towards its objectives on a quarterly basis. These actions are consistent with our recommendation.

In August 2010 we reported on the Transportation Security Administration's (TSA) efforts to help strengthen pipeline security. We found that baseline data TSA's Pipeline Security Division (PSD) used to measure improvements in reducing pipeline security vulnerabilities--the vulnerability gap--that relied on early (prior to mid-July 2004) Corporate Security Review (CSR) scores were reconstructed and might not be reliable. As such, we recommended that PSD establish reliable baseline data and refrain from using unreliable data in reporting on progress in closing the vulnerability gap. As a result of our recommendation, DHS reported in October 2010 that PSD had discontinued the use of reconstructed baseline data for all metric reporting. Further, PSD reported that as of May 24, 2011, all reconstructed Corporate Security Review data (the reliability of which we questioned in our report) will have been completely superseded with new CSR data, and this change was reflected in the Pipeline Relative Risk Ranking Tool. PSD provided a May 2011 risk ranking tool, which showed it was no longer using reconstructed baseline data. PSD's actions are consistent with our recommendation.