PPD-21 directs DHS to, among other things, coordinate the overall  federal effort to promote the security and resilience of the nation’s critical  infrastructure. According to DHS officials, the current process for conducting a RRAP  project can take from 18 to 24 months from start to finish. The process  includes  selecting and scoping RRAP projects from proposals; assembling and preparing a RRAP team of federal, state and local  training the states via webinar (i.e., stakeholder awareness training);  conducting an introductory kickoff (i.e., outreach) meeting; gathering preliminary data and selecting sites to be included in the  scheduling meetings with asset owners or operators of the sites; conducting ongoing analyses using data derived from performing the aforementioned vulnerability and security assessments at facilities;conducting stakeholders’ meetings for training purposes and to  discuss regional resilience issues; preparing a draft report for state review;   incorporating the state’s feedback into a final report; and establishing a process to follow up with stakeholders to, among other  things, periodically update their progress making RRAP-related  enhancements. DHS Has Developed Criteria to Identify RRAP Project Candidates, but Does Not Fully Document Its Project Recommendation and Selection Process

PSCD has developed criteria that consider various factors when selecting  possible locations and sectors for RRAP projects. However, PSCD officials do not fully  document why certain project candidates are or are not recommended for  selection by the IP Assistant Secretary. Second, IP officials developed nine point selection criteria to identify lists  of potential RRAP project candidates. The standards further call for all  transactions and significant events to be clearly documented, and readily  available for examination to inform decision making. DHS Has Taken Action to Work with States to Improve the RRAP Process, and Has Begun to Engage CI Partners to Ascertain Their Resilience Information Needs

Since 2011, IP has worked with states to improve the RRAP process, and  IP officials said these efforts are viewed favorably by primary  stakeholders. For example, IP officials said they have had specific  discussions with CI partners concerning state resilience information  needs, and they are considering this input as they begin to develop a  resilience product or products. IP gathers data from individual facilities, including those that participated  in RRAP projects, with the intent of measuring the efforts of those  facilities to make enhancements arising out of security surveys and  vulnerability assessments performed during RRAP projects. DHS Faces Challenges Measuring the Effect of RRAP Projects

IP has considered how it intends to measure results associated with  RRAP projects—not just facilities within projects— but faces challenges  doing so. The RRAP Findings Tracker is intended to cover, among other  things: developments that demonstrate project relevance since the RRAP  project was initiated, for instance, news reports, speeches, or studies  that demonstrate the ongoing relevance of the project’s focus; partnership building and information sharing, to include developments  that relate to how project stakeholders—whether state, regional,  federal, or private sector—have enhanced interaction, awareness,  communication, and information sharing; any action taken concerning the RRAP report’s key findings,  particularly with regard to enhancement options specified in the RRAP  report; and activities at specific individual assets assessed during the RRAP and  their efforts to enhance resilience, including the percentage of  assessed assets that have made an improvement or planned to make  an improvement after 6 and 12 months. Therefore,  the ability to develop measures that represent assets in a region could  hinge on the willingness of CI stakeholders, including facility owners and  operators, to participate. We recognize that developing performance measures among and across  RRAP projects could be challenging moving forward. However, DHS could better position itself to gain  insights into a project’s effects if it were to develop a mechanism to  assess whether changes made at individual facilities are linked to or  influenced by participation in a RRAP project. One approach for doing so  could entail IP revising its security survey and vulnerability assessment  follow-up process at individual facilities, including follow-ups at facilities  that participated in RRAP projects to gather and analyze data on the  extent to which participation in a RRAP project influenced owners and  operators to make related resilience enhancements. Recommendations for Executive Action

To help ensure that DHS is taking steps to strengthen the management of  RRAP projects and the program in general, we recommend that the  Assistant Secretary for Infrastructure Protection, Department of  Homeland Security, take the following two actions: document decisions made with regard to recommendations about  individual RRAP projects to provide insights into why one project was  recommended over another and assurance that recommendations  among equally feasible proposals are defensible, and develop a mechanism to assess the extent to which individual projects  influenced participants to make RRAP related enhancements, such as  revising the security and vulnerability assessment follow-up tool to  query facilities that participated in RRAP projects on the extent to  which any resilience improvements made are due to participation in  the RRAP. DHS also raised two concerns with the report. As noted in the report, IP has taken  important actions to (1) standardize the selection process for RRAP  project locations, (2) work with state stakeholders to better communicate  the scope of projects and consider how it can share resilience information  with CI partners, and (3) gather information on CI partner actions to  enhance resilience after the RRAP project is completed. Washington, D.C.: September 11, 2012. GAO-10-296. Information Sharing: DHS Should Take Steps to Encourage More  Widespread Use of Its Program to Protect and Share Critical  Infrastructure Information.
Why GAO Did This Study

In October 2012, Hurricane Sandy caused widespread damage across multiple states. Further, threats to CI are not limited to natural disasters, as demonstrated by the terrorist attacks of September 11, 2001. In 2009, DHS initiated the RRAP, a voluntary program intended to assess regional resilience of CI. RRAP projects are to analyze a region's ability to adapt to changing conditions, and prepare for, withstand, and rapidly recover from disruptions.
GAO was asked to examine DHS's efforts to manage the program. GAO assessed the extent to which DHS (1) developed criteria for identifying RRAP project locations, (2) worked with states to conduct RRAP projects and share information with CI partners to promote resilience, and (3) is positioned to measure results associated with RRAP projects.
GAO reviewed applicable laws, DHS policies and procedures, and all 17 RRAP reports completed since the program inception in 2009. GAO also interviewed officials from 10 states with issued RRAP reports, DHS officials who conducted 20 RRAP projects from 2009 through 2012, and other federal officials representing nine departments and agencies involved in RRAP projects. While the results of the interviews are not generalizable, they provided insight.

What GAO Found

The Department of Homeland Security (DHS) has developed nine criteria that consider various factors--including the willingness of various stakeholders, such as asset owners and operators, to participate and concentrations of high-risk critical infrastructure--when identifying possible locations for Regional Resiliency Assessment Program (RRAP) projects. According to DHS officials, final project selections are then made from a list of possible locations based on factors including geographic distribution and DHS priorities, among other considerations. However, it is unclear why some RRAP projects are recommended over others because DHS does not fully document why these decision are made. Federal internal control standards call for agencies to promptly record and clearly document transactions and significant events. Because DHS's selection process identifies a greater number of potential projects than DHS has the resources to perform, documenting why final selections are made would help ensure accountability, enabling DHS to provide evidence of its decision making.
DHS has worked with states to improve the process for conducting RRAP projects and is considering an approach for sharing resilience information with its critical infrastructure (CI) partners, including federal, state, local, and tribal officials. Since 2011, DHS has worked with states to improve the process for conducting RRAP projects, including more clearly defining the scope of projects. According to DHS officials, these efforts have been viewed favorably by states. DHS is currently considering an approach to more widely share resilience lessons learned with its CI partners, including a possible resiliency product or products that draw from completed RRAP projects. DHS officials stated that they engage CI partners in meetings and conferences where partners' resilience information needs are discussed and have been incorporating this input into their efforts to develop a resilience information sharing approach.
DHS has taken action to measure efforts to enhance security and resilience among facilities that participate in the RRAP, but faces challenges measuring results associated with RRAP projects. DHS performs security and vulnerability assessments at individual CI assets that participate in RRAPs projects as well as those that do not participate. Consistent with the National Infrastructure Protection Plan, DHS also performs periodic follow-ups among asset owners and operators that participate in these assessments with the intent of measuring their efforts to make enhancements arising out of these surveys and assessments. However, DHS does not measure how enhancements made at individual assets that participate in a RRAP project contribute to the overall results of the project. DHS officials stated that they face challenges measuring performance within and across RRAP projects because of the unique characteristics of each, including geographic diversity and differences among assets within projects. GAO recognizes that measuring performance within and among RRAP projects could be challenging, but DHS could better position itself to gain insights into projects' effects if it were to develop a mechanism to compare facilities that have participated in a RRAP project with those that have not, thus establishing building blocks for measuring its efforts to conduct RRAP projects. One approach could entail using DHS's assessment follow-up process to gather and analyze data to assess whether participation in a RRAP project influenced owners and operators to make related resilience enhancements.

What GAO Recommends

GAO recommends that DHS document final RRAP selections and develop a mechanism to measure whether RRAP participation influences facilities to make RRAP-related enhancements. DHS concurred with the recommendations.