DHS Faces Challenges Managing Its Efforts to Conduct Security Surveys and Vulnerability Assessments on High- Priority Assets

DHS conducted about 2,800 security surveys and vulnerability  assessments during fiscal years 2009 through 2011. We also identified an additional 106  security surveys and 23 vulnerability assessments that were potential  matches with assets on the NCIPP lists of priority assets, but we could  not be certain that the assets were the same because of inconsistencies  in the way the data were recorded in the two different databases. These officials acknowledged that the two  databases do not match and explained that they have had to match the  data manually because of the inconsistencies. However, DHS did not  provide milestones and time frames for completing these efforts. This creates a big credibility  problem for me with my stakeholders who are looking for the results.” The  NIPP states that in order to have an effective environment for information  sharing, CIKR partners need to be provided with timely and relevant  information that they can use to make decisions. DHS Could Better Measure Security Survey and Vulnerability Assessment Results to Improve Program Management

DHS has taken actions to determine whether asset owners or operators  have made security improvements based on the results of security  surveys. Consistent with the standards for project  management, by having a road map with time frames and milestones for  revisiting these time frames, IP could be better positioned to provide a  more complete picture of its overall progress making these decisions and  a basis for determining what, if any, additional actions need to be taken or  data inputs need to be made. DHS could  also use this opportunity to consider how it can capture key information  that could be used to understand why certain improvements were or were  not made by assets owners and operators that have received surveys  and assessments. Additional information on the  cost of improvements made and the reasons why improvements were or  were not made could also assist DHS in understanding the trade-offs  asset owners and operators face when making decisions to address  vulnerabilities identified as a result of DHS security surveys and  enhancements. Further, developing a road map with milestones and time frames  for (1) taking and completing actions needed to resolve issues associated  with data inconsistencies and matching data on the list of high-priority  assets with data used to track the conduct of security surveys and  vulnerability assessments, (2) completing protocols to systematically  collect data on the reasons why some owners and operators declined to  participate in the voluntary surveys and assessments, and (3) improving  the timely delivery of the results of security surveys and vulnerability  assessments could better position DHS to target high-priority assets and  provide them with the information they need to make decisions related to  security and resiliency. Recommendations for Executive Action

To better ensure that DHS’s efforts to promote security surveys and  vulnerability assessments among high-priority CIKR are aligned with  institutional goals, that the information gathered through these surveys  and assessments meet the needs of stakeholders, and that DHS is  positioned to know how these surveys and assessments could be  improved, we recommend that the Assistant Secretary for Infrastructure  Protection, Department of Homeland Security, take the following seven  actions: develop plans with milestones and time frames to resolve issues  associated with data inconsistencies and matching data on the list of  high-priority assets with data used to track the conduct of security  surveys and vulnerability assessments;  institutionalize realistic performance goals for appropriate levels of  participation in security surveys and vulnerability assessments by  high-priority assets to measure how well DHS is achieving its goals; design and implement a mechanism for systematically assessing why  owners and operators of high-priority assets decline to participate and  a develop a road map, with time frames and milestones, for  completing this effort; develop time frames and specific milestones for managing DHS’s  efforts to ensure the timely delivery of the results of security surveys  and vulnerability assessments to asset owners and operators;  revise its plans to include when and how SSAs will be engaged in  designing, testing, and implementing DHS’s web-based tool to  address and mitigate any SSA concerns that may arise before the tool  is finalized; develop a road map with time frames and specific milestones for  reviewing the information it gathers from asset owners and operators  to determine if follow-up visits should remain at 180 days for security  surveys and whether additional follow-ups are appropriate at intervals  beyond the follow-ups initially performed; and  consider the feasibility of expanding the follow-up program to gather  and act upon data, as appropriate, on (1) security enhancements that  are ongoing and planned that are attributable to DHS security surveys  and vulnerability assessments and (2) factors, such as cost and  perceptions of threat, that influence asset owner and operator  decisions to make, or not make, enhancements based on the results  of DHS security surveys and vulnerability assessments. The National  Infrastructure Protection Plan (NIPP) outlines the roles and  responsibilities of the Department of Homeland Security (DHS) and its  partners—including other federal agencies. We  obtained and analyzed DHS data on the conduct of voluntary programs  for fiscal years 2009 through 2011—which are maintained in DHS’s Link  Encrypted Network System (LENS) database and compared those  records with the National Critical Infrastructure Prioritization Program  (NCIPP) list of the high-priority CIKR assets—to determine the extent to  which DHS performed security surveys and vulnerability assessments at  high-priority assets. The facility does not have time or resources to participate. 30. Information Sharing: DHS Should Take Steps to Encourage More  Widespread Use of Its Program to Protect and Share Critical  Infrastructure Information.
Why GAO Did This Study

Natural disasters, such as Hurricane Katrina, and terrorist attacks, such as the 2005 bombings in London, highlight the importance of protecting CIKRassets and systems vital to the economy or health of the nation. DHS issued the NIPP in June 2006 (updated in 2009) to provide the approach for integrating the nations CIKR. Because the private sector owns most of the nations CIKRfor example, energy production facilitiesDHS encourages asset owners and operators to voluntarily participate in surveys or vulnerability assessments of existing security measures at those assets. This includes nationally significant CIKR that DHS designates as high priority. In response to a request, this report assesses the extent to which DHS has (1) taken action to conduct surveys and assessments among highpriority CIKR, (2) shared the results of these surveys and assessments with asset owners or operators, and (3) assessed the effectiveness of surveys and assessments and identified actions taken, if any, to improve them. GAO, among other things, reviewed laws, analyzed data identifying high-priority assets and activities performed from fiscal years 2009 through 2011, and interviewed DHS officials.

What GAO Found

The Department of Homeland Security (DHS) has conducted about 2,800 security surveys and vulnerability assessments on critical infrastructure and key resources (CIKR). DHS directs its protective security advisors to contact owners and operators of high-priority CIKR to offer to conduct surveys and assessments. However, DHS is not positioned to track the extent to which these are performed at high-priority CIKR because of inconsistencies between the databases used to identify these assets and those used to identify surveys and assessments conducted. GAO compared the two databases and found that of the 2,195 security surveys and 655 vulnerability assessments conducted for fiscal years 2009 through 2011, 135 surveys and 44 assessments matched and another 106 surveys and 23 assessments were potential matches for high-priority facilities. GAO could not match additional high-priority facilities because of inconsistencies in the way data were recorded in the two databases, for example, assets with the same company name had different addresses or an asset at one address had different names. DHS officials acknowledged that the data did not match and have begun to take actions to improve the collection and organization of the data. However, DHS does not have milestones and timelines for completing these efforts consistent with standards for project management. By developing a plan with time frames and milestones consistent with these standards DHS would be better positioned to provide a more complete picture of its progress.
DHS shares the results of security surveys and vulnerability assessments with asset owners or operators but faces challenges doing so. A GAO analysis of DHS data from fiscal year 2011 showed that DHS was late meeting its (1) 30-day time frameas required by DHS guidancefor delivering the results of its security surveys 60 percent of the time and (2) 60-day time frameexpected by DHS managers for delivering the results of its vulnerability assessmentsin 84 percent of the instances. DHS officials acknowledged the late delivery of survey and assessment results and said they are working to improve processes and protocols. However, DHS has not established a plan with time frames and milestones for managing this effort consistent with the standards for project management. Also, the National Infrastructure Protection Plan (NIPP), which emphasizes partnering and voluntary information sharing, states that CIKR partners need to be provided with timely and relevant information that they can use to make decisions. Developing a plan with time frames and milestones for improving timeliness could help DHS provide asset owners and operators with the timely information they need to consider security enhancements.
DHS uses a follow-up tool to assess the results of security surveys and assessments performed at CIKR assets, and are considering upgrades to the tool. However, DHS could better measure results and improve program management by capturing additional information. For example, key information, such as why certain improvements were or were not made by asset owners and operators that have received security surveys, could help DHS improve its efforts. Further, information on barriers to making improvementssuch as the cost of security enhancementscould help DHS better understand asset owners and operators rationale in making decisions and thereby help improve its programs. Taking steps to gather additional information could help keep DHS better informed for making decisions in managing its programs.

What GAO Recommends

GAO recommends that, among other things, DHS develop plans for its efforts to improve the collection and organization of data and the timeliness of survey and assessment results, and gather and act upon additional information from asset owners and operators about why improvements were or were not made. DHS concurred with the recommendations.