For example, DHS’s  Transportation Security Administration (TSA) manages the entire  Transportation Worker Identification  Credential (TWIC) qualification  process including enrollment, background checks, and credential  issuance. Similarly, NRC issues regulations related to access control requirements,  which are to be implemented by commercial nuclear power plants, and  DOD owns and operates U.S. military installations and facilities and uses  the Common Access Card (CAC) as one method to facilitate access to  semi-restricted areas within the installations. Workers who need access to multiple types of critical infrastructure to  realize their livelihoods—such as truck drivers and carpenters—often  encounter different access control efforts. Selected Federal Access Control Efforts have Similar Processes, but Three Key Factors Had an Impact on Stakeholders

		Access Control Efforts Follow Similar Processes, but Specific Characteristics of the Efforts Vary

While the six selected federally administered access control efforts we  reviewed had varying purposes, standards, or agency responsibilities,  they generally included the following process components or phases of  DHS’s credentialing lifecycle as depicted in Figure 1. Although the six efforts we reviewed generally follow similar processes,  certain characteristics within these efforts can vary. Access Control Efforts Have Different Impacts on Stakeholders Due to Varying Interests

As previously mentioned, federally-administered access control efforts  generally involve two groups of stakeholders: users and operators. Users  are individuals who require access to critical infrastructure as an essential  function of their job. Operators are individuals or groups who own or  are responsible for managing facilities, such as airports, seaports, and  chemical facilities, which may be privately owned, but can also include  other government-owned facilities such as military installations. Based on our interviews with stakeholder groups and associations, the  issues mentioned that had an impact on users and operators included (1)  operators may add access requirements to vetting and background  checks already conducted for federally administered programs; (2)  credentials that cannot be used within and across critical infrastructure  sectors; and (3) enrollment information that has to be entered multiple  times for the same user for similar purposes. During our interviews with users and operators we found that on-site  operators across multiple infrastructure types have considered additional  disqualifying offenses beyond federal baseline requirements. Partnership Structures Provide Opportunities for Harmonization of Access Control Efforts across Critical Infrastructure Sectors

According to NPPD senior officials, DHS voluntary partnership structures  exist to discuss a variety of issues that have an impact on critical  infrastructure security, but DHS has not used these structures to identify  opportunities to harmonize regulated screening and credentialing efforts. As of October 2016, DHS does not have a  dedicated partnership structure that allows for users to share their  experiences in navigating through federal access control efforts. SCO Has Taken Actions to Harmonize DHS Access Control Efforts, but Has Not Updated Its Goals and Objectives to Support Its Strategic Framework

		SCO Goals and Actions to Harmonize DHS Access Control Efforts

A role of SCO, according to DHS Office of Policy officials, is to serve as a  department-wide policy advocate for coordination and harmonization of  credentialing and screening efforts within DHS. SCO Has Not Updated Its Goals and Objectives to Support its Strategic Framework for Department-wide Access Control Harmonization

In its early years, SCO operated under the direction of the strategic policy  vision and implementation plans laid out in the 2006 CIR and the 2008  CFI; however, since then, SCO has not updated the goals and objectives  outlined in the implantation plans. SCO officials stated that the  implementation plans are no longer relevant to SCO’s current role in the  department. Conclusions

Balancing the need to secure critical infrastructure while promoting a  harmonized screening and credentialing process to access critical  infrastructure continues to pose challenges for stakeholders—users and  operators—because their interests vary and are not necessarily aligned  with each other. Recommendations for Executive Action

To enhance its ability to fulfill its role as the facilitator of cross-sector  collaboration and best-practices sharing, we recommend that the  Secretary of Homeland Security direct the Assistant Secretary of  Infrastructure Protection, Office of Infrastructure Protection, take the  following action:  Explore with key critical infrastructure partners, whether and what  opportunities exist to harmonize federally-administered screening  and credentialing access control efforts across critical  infrastructure sectors. For example, in regards to exploring whether and what  opportunities exist to harmonize federally-administered screening and  credentialing access control efforts across critical infrastructure sectors,  DHS noted that they are working to harmonize access control efforts  across critical infrastructure as much as practical and remain committed  to working towards that end with interagency partners. In regards to establishing goals and objectives to support the Screening  Coordination Office’s (SCO) broader strategic framework for  harmonization, DHS identified actions to direct SCO to establish updated  goals and objectives to support the broader strategic framework for more  efficient and effective vetting. Appendix I: Life Cycle Characteristics for Selected Access Control Efforts

To address the research question related to describing key characteristics  of selected federal access control efforts, we distributed a standard set of  questions to three federal agencies—Department of Homeland Security  (DHS), Nuclear Regulatory Commission (NRC) and the Department of  Defense (DOD).
Why GAO Did This Study

Critical infrastructure protection access controls limit access to those with a legitimate need. DHS is the lead federal agency for coordinating critical infrastructure protection efforts with other federal agencies, and partnering with nonfederal stakeholders. The National Defense Authorization Act of 2016 included a provision for GAO to review critical infrastructure access control efforts.
This report examines (1) key characteristics of selected federally-administered critical infrastructure access control efforts and factors that have an impact on stakeholders' use of them; (2) the extent to which DHS has taken actions to harmonize efforts across critical infrastructure sectors; and (3) the extent to which DHS's SCO has taken actions to harmonize access control efforts across DHS. GAO examined six federally-administered access control efforts across three federal departments. Efforts were selected, among other things, to represent a range of efforts that groups of users—such as truck drivers—may encounter while accessing multiple facilities. GAO interviewed DHS, NRC, and DOD officials and users and operators affected by the efforts and reviewed relevant documents.

What GAO Found

The six selected federally-administered critical infrastructure access control efforts GAO reviewed generally followed similar screening and credentialing processes. Each of these efforts applies to a different type of infrastructure. For example, the Transportation Security Administration's Transportation Worker Identification Credential controls access to ports, the Department of Defense (DOD) Common Access Card controls access to military installations, and the Nuclear Regulatory Commission (NRC) regulates access to commercial nuclear power plants. GAO found that selected characteristics, such as whether a federal agency or another party has responsibility for vetting or what types of prior criminal offenses might disqualify applicants, varied across these access control efforts. In addition, these access control efforts generally affect two groups of stakeholders—users and operators—differently depending on their specific roles and interests. Users are individuals who require access to critical infrastructure as an essential function of their job; while, operators own or manage facilities, such as airports and chemical facilities. Regardless of infrastructure type, users and operators that GAO interviewed reported some common factors that can present challenges in their use of these access controls. For example, both users and operators reported that applicants requiring access to similar types of infrastructure or facilities may be required to submit the same background information multiple times, which can be costly and inefficient.
The Department of Homeland Security (DHS) relies on partnership models to support collaboration efforts among federal and nonfederal critical infrastructure stakeholders, but has not taken actions to harmonize federally-administered access control efforts across critical infrastructure sectors. According to DHS officials, these partnerships have not explored harmonization of access control efforts across sectors, because this has not been raised as a key issue by the members and because DHS does not have a dedicated forum that would engage user groups in exploring these issues and identifying potential solutions. DHS's partnership models offer a mechanism by which DHS and its partners can explore the challenges users and operators may encounter and determine opportunities for harmonizing the screening and credentialing processes to address these challenges.
DHS's Screening Coordination Office (SCO) has taken actions to support harmonization across DHS access control efforts, but it has not updated its goals and objectives to help guide progress toward the department's broader strategic framework for harmonization. SCO's strategic framework is based on two screening and credentialing policy documents—the 2006 Credentialing Initiative Report and 2008 Credentialing Framework Initiative. According to SCO officials, they continue to rely on these documents to provide their office with a high-level strategic approach, but GAO found that the goals and objectives outlined in the two documents are no longer current or relevant. In recent years, SCO has helped the department make progress toward its harmonization efforts by responding to and assisting with department-wide initiatives and DHS component needs, such as developing new programs or restructuring existing ones. However, without updated goals and objectives, SCO cannot ensure that it is best supporting DHS-wide screening and credentialing harmonization efforts.

What GAO Recommends

GAO recommends that (1) DHS work with partners to identify any opportunities to harmonize access control efforts across critical infrastructure sectors and (2) SCO establish goals and objectives to support its broader strategic framework for harmonization. DHS concurred with both recommendations.