Assess risks: Evaluate risk as a function of threat, vulnerability, and  consequence. PSD Has Developed a Pipeline Risk Assessment Model, but Could Strengthen Data in the Model and Better Prioritize Security Reviews and Inspections

		PSD Identified the Most Critical Pipeline Systems and Developed a Risk Model, but Some Model Components Could be Strengthened

PSD identified the 100 most critical pipeline systems in the United States,  consistent with the NIPP, and developed a pipeline risk assessment model  to generate a risk score for those systems; however, some components of  PSD’s model are incomplete. Within its risk assessment  model, PSD uses the annual energy throughput of a pipeline system to  help measure the possible adverse economic impact of a terrorist  attack or other event on a pipeline system, but does not take into  account other possible adverse impacts, such as on public health and  safety. This suggests that a system’s risk ranking was not the  primary consideration in scheduling these reviews. PSD Has Taken Actions to Implement Agency Guidance and 9/11 Commission Act Requirements, but Lacks a System for Following Up on Its Recommendations to Operators

		PSD Established a Program for Reviewing Pipeline Security Plans

PSD established an on-site CSR program in April 2003 that has been  evolving in response to, and consistent with, agency guidance— specifically, DOT’s September 2002 Pipeline Security Information Circular  (the 2002 circular)—and the 9/11 Commission Act. Standard practices for project  management call for developing a plan that includes defined approaches  as well as start dates for activities. PSD officials agreed that by following up  more frequently on whether operators are implementing the  recommendations PSD makes as a result of its CSRs and developing a  process for following up on the recommendations it makes as a result of  its CFIs, they could be better informed of the state of the nation’s pipeline  security, including whether their recommendations have been  implemented. PSD Has Taken Steps to Measure Its Performance, but Could Better Measure and More Reliably Report Industry Improvements

PSD has initiated efforts to measure its performance in helping strengthen  the security of pipeline systems, but could improve its performance  measures to better evaluate and reliably report on the extent of security  improvements in the pipeline industry. The vulnerability gap focuses on what PSD  measures through its CSR program—primarily improvements in pipeline  operators’ security planning and preparedness—but provides limited  information on improvements in other areas, such as physical security. PSD officials explained that they are in the early stages of performance  measurement and have not yet developed additional outcome measures or  established time frames for doing so. In addition, documenting a  methodology for scheduling CSRs and CFIs that includes a pipeline  system’s risk ranking as the primary criteria, while recognizing other  considerations that can affect scheduling, could help PSD ensure it  prioritizes its oversight of pipeline systems that are most at risk. However, PSD’s dependence on a single outcome measure  hinders its ability to evaluate the extent of improvements related to all of  its pipeline security objectives. To ensure that PSD is managing risk effectively,    Develop a plan with time frames and milestones for improving the data  in the pipeline risk assessment model by, for example, adding more  data to the consequence component. Document a methodology for scheduling Corporate Security Reviews  (CSR) and Critical Facility Inspections (CFI) that considers a pipeline  system’s risk ranking as the primary scheduling criteria and balances it  with other practical considerations. To help PSD maximize its CSR and CFI efforts and keep its knowledge of  the security posture of the pipeline industry current,    Develop a plan that includes a defined approach and time frame for  how and when PSD intends to begin transmitting CSR  recommendations in writing to pipeline operators. DHS concurred with our seventh recommendation that TSA develop  additional outcome measures that are directly linked to sector goals and  modal objectives and track progress towards its stated pipeline security  objectives. However, to fully address the  intent of our recommendation, TSA should ensure that its performance  measurement guidance calls for outcome measures to be directly linked to  sector goals and modal objectives. Appendix I: Objectives, Scope, and Methodology

	Objectives

You requested that we review the Transportation Security Administration’s  (TSA) efforts to help ensure pipeline security. To what extent has PSD taken actions to implement agency guidance  and requirements of the Implementing Recommendations of the 9/11  Commission Act of 2007 (9/11 Commission Act) regarding the security  of hazardous liquid and natural gas pipeline systems? Scope and Methodology

To determine the extent to which PSD used a risk management process to  help strengthen the security of pipelines, we reviewed PSD’s efforts to (1)  identify critical pipeline systems, (2) assess risk, and (3) prioritize its  pipeline review and inspection efforts. We also compared PSD’s processes for transmitting and following up on  CSR and CFI recommendations with criteria in the Standards for Internal  Control in the Federal Government regarding the monitoring of  deficiencies found during evaluations.
Why GAO Did This Study

The United States depends on avast network of pipelines to transport energy. GAO was asked to review the Transportation Security Administration's (TSA) efforts to help ensure pipeline security. This report addresses the extent to which TSA's Pipeline Security Division (PSD) has (1) assessed risk and prioritized efforts to help strengthen pipeline security, (2) implemented agency guidance and requirements of the Implementing Recommendations of the 9/11 Commission Act of 2007 (9/11 Commission Act) regarding pipeline security, and (3) measured its performance in strengthening pipeline security. GAO reviewed PSD's risk assessment process and performance measures and observed 14 PSD reviews and inspections scheduled during the period of GAO's review. Although these observations are not generalizable, they provided GAO an understanding of how PSD conducts reviews and inspections.

What GAO Found

PSD identified the 100 most critical pipeline systems and developed a pipeline risk assessment model based on threat, vulnerability, and consequence, but could improve the model's consequence component and better prioritize its efforts. The consequence component takes into account the economic impact of a possible pipeline attack, but not other possible impacts such as public health and safety, as called for in the Department of Homeland Security's (DHS) risk management guidance. PSD plans to improve its model by adding more vulnerability and consequence data, but has no time frames for doing so. Establishing a plan with time frames, as called for by standard management practices, could help PSD enhance the data in, and use of, its risk assessment model. Also, PSD procedures call for scheduling Corporate Security Reviews (CSR)--assessments of pipeline operators' security planning--based primarilyon a pipeline system's risk, but GAO's analysis of CSR data suggests a system's risk was not the primary consideration. Documenting a methodology for scheduling CSRs that includes how to balance risk with other factors could help PSD ensure it prioritizes its oversight of systems at the highest risk. PSD has taken actions to implement agency guidance that outlines voluntary actions for pipeline operators and 9/11 Commission Act requirements for pipeline security, but lacks a system for following up on its security recommendations to pipeline operators. PSD established CSR and Critical Facility Inspection (CFI) Programs in 2003 and 2008, respectively, and has completed CSRs of the 100 most at-risk systems, started conducting second CSRs, and completed 224 of 373 one-time CFIs. Both programs result in recommendations, but PSD does not generally send CSR recommendations to operators in writing or follow up to ensure that CSR and CFI recommendations were implemented. Standard project management practices call for plans that define approaches and start dates and Standards for Internal Control in the Federal Government calls for monitoring to ensure review findings are resolved. Developing a plan for how and when PSD will begin transmitting CSR recommendations to operators, and following up on CSR and CFI recommendations could better inform PSD of the state of pipeline security and whether operators have addressed vulnerabilities. PSD has taken steps to gauge its progress in strengthening pipeline security, but its ability to measure improvements is limited. In its pipeline security strategy, PSD does not include performance measures or link them to objectives, which GAO previously identified as desirable in security strategies. In addition, PSD developed performance measures, including one outcome measure to gauge its efforts to help operators reduce vulnerabilities identified in CSRs. However, the outcome measure does not link to all three of PSD's objectives and provides limited information on improvements in areas such as physical security. According to DHS risk management guidance, outcome measures should link to objectives. Including measures linked to objectives in its strategy and developing more outcome measures directly linked to all of its objectives could help PSD improve accountability and assess improvements.

What GAO Recommends

GAO recommends that TSA, among other things, establish time frames for improving risk model data, document its method for scheduling reviews, develop a plan for transmitting recommendations to operators, follow up on its recommendations, include performance measures linked to objectives in its pipeline strategy, and develop more outcome measures. DHS concurred with the recommendations and discussed planned actions, but not all will fully address the recommendations, as discussed in the report.