FPS Does Not Currently Assess Risks at Federal Facilities, but Multiple Agencies Are Conducting Their Own Assessments

		FPS Is Not Completing Risk Assessments

In the absence of RAMP, FPS currently is not assessing risk at the over  9,000 federal facilities under the custody and control of GSA in a manner  consistent with federal standards such as NIPP’s risk management  framework, as FPS originally planned. As a result, FPS has accumulated  a backlog of federal facilities that have not been assessed for several  years. According to FPS data, more than 5,000 facilities were to be  assessed in fiscal years 2010 through 2012. However, we were unable to  determine the extent of the FSA backlog because we found FPS’s FSA  data to be unreliable. In addition,  since September 2011, FPS’s inspectors have been collecting information  about federal facilities, such as location, purpose, agency contacts, and  current countermeasures (e.g., perimeter security, access controls, and  closed-circuit television systems). These assessments are taking place even though according to FPS’s  Chief Financial Officer, FPS received $236 million in basic security fees  from federal agencies to conduct FSAs and other security services in  fiscal year 2011. FPS Lacks Reliable FSA Data

In addition to not having a tool that allows it to conduct risk assessments,  FPS does not have reliable FSA data, which has hampered the agency’s  ability to manage its FSA program. FPS Efforts to Develop a Risk Assessment Tool Are Evolving, but Challenges Remain

		FPS Has Developed an Interim Vulnerability Assessment Tool

In September 2011, FPS signed an inter-agency agreement with Argonne  National Laboratory for about $875,000 to develop MIST by June 30,   According to FPS’s MIST documentation, MIST is an interim  2012.vulnerability assessment tool that FPS plans to use until it can develop a  permanent solution to replace RAMP. Three of the four risk assessment experts we spoke  with generally agreed that a tool that does not estimate consequences  does not allow an agency to fully assess the risks to a federal facility. In addition to conducting FSAs,  FPS developed RAMP as a comprehensive system to help oversee two  aspects of its contract guard program: (1) verifying that guards are trained  and certified to be on post in federal facilities and (2) conducting guard  post inspections. No Independent Verification of Contract Guard Information

FPS does not independently verify the guard training and certification  information provided by guard contractors. To verify the  guard companies’ reports, FPS conducts monthly audits. Most notably, FPS has  developed an interim vulnerability assessment tool that once  implemented, may allow it to resume assessing federal facilities, which it  has not done consistently for several years. Finally, FPS recently decided to not use RAMP to oversee its contract  guards, but still does not have a comprehensive and reliable system to  ensure that its approximately 12,500 contract guards have met training  and certification requirements, and that FPS’s guard post inspections are  occurring in accordance with the agency’s guidelines. Recommendations for Executive Action

Given the challenges that FPS faces in assessing risks to federal facilities  and managing its contract guard workforce, we recommend that the  Secretary of Homeland Security direct the Under Secretary of NPPD and  the Director of FPS to take the following five actions:  incorporate NIPP’s risk management framework—specifically in  calculating risk to include threat, vulnerability, and consequence  information—in any permanent risk assessment tool;  coordinate with GSA and other federal tenant agencies to reduce any  unnecessary duplication in security assessments of facilities under the  custody and control of GSA; address MIST’s limitations (assessing consequence, comparing risk  across federal facilities, and measuring performance) to better assess  and mitigate risk at federal facilities until a permanent system is  developed and implemented; develop and implement a new comprehensive and reliable system for  contract guard oversight; and  verify independently that FPS’s contract guards are current on all  training and certification requirements. We also visited 3 of FPS’s 11 regions and interviewed regional  managers, area commanders, and inspectors about how they are  completing FSAs in the absence of RAMP. We  examined FPS’s requirement and project documents to determine  whether in developing MIST, FPS complied with selected GAO and  industry project-management best practices, such as: conducting  alternative analysis, managing requirements, and conducting user  acceptance testing. To assess FPS’s effort to manage its contract guard workforce, we  reviewed FPS’s guard oversight policies and procedures and RAMP’s  September 30, 2011, post inspection data.
Why GAO Did This Study

FPS provides security and law enforcement services to over 9,000 federal facilities under the custody and control of the General Services Administration (GSA). GAO has reported that FPS faces challenges providing security services, particularly completing FSAs and managing its these challenges, FPS spent about $35 million and 4 years developing RAMPessentially a risk assessment and contract guard oversight tool. However, RAMP ultimately could not be used because of system problems.
GAO was asked to examine (1) the extent to which FPS is completing risk assessments; (2) the status of FPSs efforts to develop an FSA tool; and (3)FPSs efforts to manage its contract guard workforce. GAO reviewed FPS documents, conducted site visits at 3 of FPSs 11 regions, and interviewed FPS officials and inspectors, guard companies, and 4 risk management experts.

What GAO Found

The Department of Homeland Securitys (DHS) Federal Protective Service (FPS) is not assessing risks at federal facilities in a manner consistent with standards such as the National Infrastructure Protection Plans (NIPP) risk management framework, as FPS originally planned. Instead of conducting risk assessments, since September 2011, FPSs inspectors have collected information, such as the location, purpose, agency contacts, and current countermeasures (e.g., perimeter security, access controls, and closed-circuit television systems). This information notwithstanding, FPS has a backlog of federal facilities that have not been assessed for several years. According to FPSs data, more than 5,000 facilities were to be assessed in fiscal years 2010 through 2012. However, GAO was unable to determine the extent of FPSs facility security assessment (FSA) backlog because the data were unreliable. Multiple agencies have expended resources to conduct risk assessments, even though the agencies also already pay FPS for this service. FPS received $236 million in basic security fees from agencies to conduct FSAs and other security services in fiscal year 2011. Beyond not having a reliable tool for conducting assessments, FPS continues to lack reliable data, which has hampered the agencys ability to manage its FSA program.
FPS has an interim vulnerability assessment tool, referred to as the Modified Infrastructure Survey Tool (MIST), which it plans to use to assess federal facilities until it develops a longer-term solution. According to FPS, once implemented, MIST will allow it to resume assessing federal facilities vulnerabilities and recommend countermeasuressomething FPS has not done consistently for several years. Furthermore, in developing MIST, FPS generally followed GAOs project management best practices, such as conducting user acceptance testing. However, MIST has some limitations. Most notably, MIST does not estimate the consequences of an undesirable event occurring at a facility. Three of the four risk assessment experts GAO spoke with generally agreed that a tool that does not estimate consequences does not allow an agency to fully assess risks. FPS officials stated that they did not include consequence information in MIST because it was not part of the original design and thus requires more time to validate. MIST also was not designed to compare risks across federal facilities. Thus, FPS has limited assurance that critical risks at federal facilities are being prioritized and mitigated.
FPS continues to face challenges in overseeing its approximately 12,500 contract guards. FPS developed the Risk Assessment and Management Program (RAMP) to help it oversee its contract guard workforce by (1) verifying that guards are trained and certified, and (2) conducting guard post inspections. However, FPS faced challenges using RAMP, such as verifying guard training and certification information, for either purpose and has recently determined that it would no longer use RAMP. Without a comprehensive system, it is more difficult for FPS to oversee its contract guard workforce. FPS is verifying guard certification and training information by conducting monthly audits of guard contractor training and certification information. However, FPS does not independently verify the contractors information. Additionally, according to FPS officials, FPS recently decided to deploy a new interim method to record post inspections to replace RAMP.

What GAO Recommends

GAO recommends that FPS incorporate NIPPs risk management framework in any future risk assessment tool; coordinate with federal agencies to reduce any unnecessary duplication in FPSs assessments; address limitations with its interim tool to better assess federal facilities; develop and implement a comprehensive and reliable contract guard oversight system; and independently verify that its contract guards are current on all training and certification requirements. DHS concurred with GAOs recommendations.