DHS Is Developing a Resilience Policy, but an Implementation Strategy Could Help Ensure Consistency and Accountability

		High-Level Documents Promote Resilience, and DHS Has Begun to Develop a Resilience Policy

National high-level documents currently promote resilience as a key  national goal. Specifically, two key White House documents emphasize  resilience on a national level—Presidential Policy Directive 8 (PPD-8) and  the National Strategy for Global Supply Chain Security. Since 2009, DHS has also emphasized the concept of resilience through  two high-level documents—the NIPP and QHSR. The NIPP identifies resilience as a national objective for critical  infrastructure protection and defines resilience as the ability to resist,  absorb, recover from, or successfully adapt to adversity or a change  in conditions. DHS took steps to foster departmentwide resilience initiatives  by creating two internal entities—the Resilience Integration Team (RIT)  and the Office of Resilience Policy (ORP). Specifically, ORP saw a  need to establish a policy that provides component agencies with a  single, consistent, departmentwide understanding of resilience; clarifies  and consolidates the concepts from the four high-level guiding documents  discussed above; and helps components understand how their activities  address DHS’s proposed resilience objectives. The policy is currently in  draft status, and ORP officials hope to have an approved policy in place  later this year. Developing a Strategy Could Help Guide Components’ Efforts in Implementing DHS’s Resilience Policy

Although DHS is developing a policy to establish a departmentwide  resilience framework, DHS officials stated that they currently have no  plans to develop an implementation strategy for DHS’s resilience policy. An implementation strategy that defines goals, objectives, and activities  could help ensure that the policy is adopted consistently and in a timely  manner by components, and that all components share common priorities  and objectives. As DHS implements its resilience policy, an implementation strategy with  these characteristics could provide ORP with a clear and more complete  picture of how DHS components are implementing this policy, as well as  how the various programs and activities are helping to enhance critical  infrastructure resilience in their areas of responsibility. The Coast Guard and IP Have Addressed Some Aspects of Critical Infrastructure Resilience, but Could Better Coordinate to Promote Portwide Resilience

		The Coast Guard Works with Stakeholders to Address Aspects of Resilience

The Coast Guard works with asset owners and operators to assess and  enhance various aspects of port critical infrastructure resilience—such as  security protection, port recovery, and risk analysis efforts, as described  in table 1. RRAP. These assessments are conducted to assess vulnerability to  help improve resilience and allow for an analysis of infrastructure  “clusters” and systems in various regions. For example,  an RRAP review could involve compiling information from reviews of  critical infrastructure assets—such as electricity providers and  transport companies—to form an overall assessment of a key  transportation and energy corridor within a state. DHS Components Have Opportunities to Collaborate and Leverage Existing Tools to Assess Port Resilience

While the Coast Guard and IP have collaborated on some regional  resilience assessments, there may be opportunities for further  collaboration and use of existing tools to conduct portwide resilience  assessment efforts. For example, IP and the Coast Guard could leverage  some of the expertise and tools discussed above—such as the RRAP  approach—to develop assessments of the overall resilience of one or  more specific port areas. Identifying  opportunities to leverage tools and resources to collaboratively conduct  portwide resilience assessments could enhance stakeholders’  understanding of interdependencies with other port partners, and help to  focus scarce resources to enhance resilience for the port area. Conclusions

DHS has taken initial steps to emphasize the concept of resilience among  its components by developing a resilience policy. Developing an implementation strategy for this new policy is  the next key step that could help strengthen DHS’s resilience efforts. At the port level, U.S. ports, waterways, and vessels are part of a major  economic engine, and a significant disruption to this system could have a  widespread impact on the U.S. economy, as well as global shipping,  international trade, and the global economy. Coast Guard and IP actions  have addressed some aspects of critical infrastructure resilience, but the  Coast Guard and IP could take additional action to enhance their  collaboration and use existing tools and resources to promote portwide  resilience. Having  relevant agencies collaborate and leverage one another’s resources to  conduct joint portwide resilience assessments could further all  stakeholders’ understanding of interdependencies with other port  partners, and better direct scarce resources to enhance port resilience.
Why GAO Did This Study

U.S. ports are part of an economic engine handling more than $700 billion in merchandise annually, and a disruption to port operations could have a widespread impact on the global economy. DHS has broad responsibility for protection and resilience of critical infrastructure. Within DHS, the Coast Guard is responsible for the maritime environment, and port safety and security, and IP works to enhance critical infrastructure resilience. Recognizing the importance of the continuity of operations in critical infrastructure sectors, DHS has taken initial steps to emphasize the concept of resilience. GAO was asked to review port resilience efforts. This report addresses the extent to which (1) DHS has provided a road map or plan for guiding resilience efforts, and (2) the Coast Guard and IP are working with port stakeholders and each other to enhance port resilience. To address these objectives, GAO analyzed key legislation and DHS documents and guidance. GAO conducted site visits to three ports, selected based on geography, industries, and potential threats; GAO also interviewed DHS officials and industry stakeholders. Information from site visits cannot be generalized to all ports, but provides insights.

What GAO Found

The Department of Homeland Security (DHS) is developing a resilience policy, but an implementation strategy is a key next step that could help strengthen DHS resilience efforts. DHS defines resilience as the ability to resist, absorb, recover from, or adapt to adversity, and some high-level documents currently promote resilience as a key national goal. Specifically, two key White House documents emphasize resilience on a national level--the 2011 Presidential Policy Directive 8 and the 2012 National Strategy for Global Supply Chain Security. Since 2009, DHS has emphasized the concept of resilience and is currently in the process of developing a resilience policy, the initial steps of which have included creating two internal entities--the Resilience Integration Team and the Office of Resilience Policy (ORP). According to ORP officials, they saw a need to establish a policy that provides component agencies with a single, consistent, departmentwide understanding of resilience that clarifies and consolidates resilience concepts from high-level guiding documents, and helps components understand how their activities address DHS's proposed resilience objectives. ORP officials hope to have an approved policy in place later this year. However, DHS officials stated that currently there are no plans to develop an implementation strategy for this policy. An implementation strategy that defines goals, objectives, and activities; identifies resource needs; and lays out milestones is a key step that could help ensure that DHS components adopt the policy consistently and in a timely manner. For example, an implementation strategy with goals and objectives could provide ORP with a more complete picture of how DHS components are implementing this policy.
The Coast Guard and the Office of Infrastructure Protection (IP) work with stakeholders to address some aspects of critical infrastructure resilience, but they could take additional collaborative actions to promote portwide resilience. The Coast Guard is port focused and works with owners and operators of assets, such as vessels and port facilities, to assess and enhance various aspects of critical infrastructure resilience in ports--such as security protection, port recovery, and risk analysis efforts. In contrast, IP, through its Regional Resiliency Assessment Program (RRAP), conducts assessments with a broader regional focus, but is not port specific. An RRAP assessment is conducted to assess vulnerability to help improve resilience and allow for an analysis of infrastructure "clusters" and systems in various regions--for example, a regional transportation and energy corridor. The Coast Guard and IP have collaborated on some RRAP assessments, but there may be opportunities for further collaboration to conduct port-focused resilience assessments. For example, IP and the Coast Guard could collaborate to leverage existing expertise and tools--such as the RRAP approach--to develop assessments of the overall resilience of specific port areas. Having relevant agencies collaborate and leverage one another's resources to conduct joint portwide resilience assessments could further all stakeholders' understanding of interdependencies with other port partners, and help determine where to focus scarce resources to enhance resilience for port areas.

What GAO Recommends

GAO recommends that DHS develop an implementation strategy for its resilience policy and that the Coast Guard and IP identify opportunities to collaborate to leverage existing tools and resources to assess port resilience. DHS concurred with GAO's recommendations.