For example, airport operators determine the boundaries  for the security-restricted areas of their airport based on the physical  layout of the airport and in accordance with TSA requirements. As of the end of fiscal year 2015, TSA conducted JVAs at 81 (about  19 percent) of the 437 airports since fiscal year 2009. TSA Has Not Updated Its Risk Assessment of Airport Perimeter and Access Control Security or Shared Updated Risk Information with Stakeholders

While TSA released its Risk Assessment of Airport Security in May 2013,  it has not updated this assessment to reflect changes in the airport  security risk environment or routinely shared updated national risk  information with airports or other stakeholders. According to both TSA and the FBI, the insider threat is one of aviation  security’s most pressing concerns. As such, updating the Risk Assessment of Airport Security  with TSSRA information that reflects this current, pressing threat as well  as with findings from JVAs already conducted, future Special Emphasis  Assessments, and any other TSA risk assessment activities would better  ensure TSA is basing its risk management decisions on current  information and focusing its limited resources on the highest-priority risks  to airport security. TSA Has Not Assessed Vulnerability of Airports System-wide

TSA has not comprehensively assessed the vulnerability of airports  system-wide through its JVA process—its primary measure for assessing  vulnerability at commercial airports. TSA officials stated that they are limited in the number of JVAs they  conduct because of resource constraints. While  we recognize that conducting JVAs at all or a statistically representative  sample of the approximately 440 commercial airports in the United States  may not be feasible given budget and resource constraints, other  approaches to assessing vulnerability may allow TSA to assess  vulnerability at airports system-wide. TSA officials stated that PARIS—TSA’s system of record for  security events—is a data repository, among other things. TSA Developed a National Strategy to Guide Oversight of Airport Security, but Has Not Updated It to Reflect Changes in Its Risk Assessment of Airport Security and Other Actions

TSA has not updated its September 2012 National Strategy for Airport  Perimeter and Access Control Security (Strategy) to reflect actions it has  subsequently taken to assess the airport security risk environment,  oversee and facilitate airport security, and address Strategy goals and  objectives. The Strategy, which TSA developed in response to our 2009  recommendation, defines how the agency seeks to secure the  perimeters and controlled areas of the nation’s commercial airports. Updating the Strategy to reflect changes in the airport security risk  environment as well as new and enhanced activities TSA has taken to  facilitate airport security would help TSA to better inform management  decisions and focus resources on the highest-priority risks, consistent  with its strategic goals. Recommendations for Executive Action

To help ensure TSA’s actions in overseeing and facilitating airport  security are based on the most recent available risk information that  assesses vulnerabilities system-wide and evaluates security events, and  that these actions are orchestrated according to a strategic plan that  reflects the agency’s goals and objectives and its progress in meeting  those goals, we recommend that the Administrator of TSA take the  following six actions:
Update the Risk Assessment of Airport Security to reflect changes to  its risk environment, such as those updates reflected in TSSRA and  JVA findings, and share results of this risk assessment with  stakeholders on an ongoing basis. With regard to the third recommendation that TSA develop and implement  a method for conducting a system-wide assessment of airport  vulnerability, DHS concurred and stated that TSA has begun to take steps  to develop methods that will provide a more comprehensive  understanding of airport security vulnerabilities. More  specifically, our objectives were to examine (1) the extent to which TSA  has assessed the components of risk—threat, vulnerability, and  consequence—related to commercial airport perimeter and access  control security since 2009; (2) the extent to which TSA has taken actions  since 2009 to oversee and facilitate airport perimeter and access control  security; and (3) the actions selected commercial airports have taken, if  any, to strengthen perimeter and access control security since 2009.
Why GAO Did This Study

Incidents of aviation workers using access privileges to smuggle weapons and drugs into security-restricted areas and onto planes has heightened awareness about security at commercial airports. TSA, along with airport operators, has responsibility for securing the nation's approximately 440 commercial airports.
GAO was asked to review TSA's oversight of airport perimeter and access control security since GAO last reported on the topic in 2009. This report examines, for airport security, (1) the extent to which TSA has assessed the components of risk and (2) the extent to which TSA has taken actions to oversee and facilitate security, among other objectives.
GAO examined TSA documents related to risk assessment and security activities; analyzed relevant TSA security event data from fiscal years 2009 through 2015; obtained information from TSA and industry association officials as well as from a nongeneralizable sample of 11 airports, selected based on factors such as size.

What GAO Found

The Department of Homeland Security's (DHS) Transportation Security Administration (TSA) has made progress in assessing the threat, vulnerability, and consequence components of risk to airport perimeter and access control security (airport security) since GAO last reported on the topic in 2009, such as developing its Comprehensive Risk Assessment of Perimeter and Access Control Security (Risk Assessment of Airport Security) in May 2013. However, TSA has not updated this assessment to reflect changes in the airport security risk environment, such as TSA's subsequent determination of risk from the insider threat—the potential of rogue aviation workers exploiting their credentials, access, and knowledge of security procedures throughout the airport for personal gain or to inflict damage. Updating the Risk Assessment of Airport Security with information that reflects this current threat, among other things, would better ensure that TSA bases its risk management decisions on current information and focuses its limited resources on the highest-priority risks to airport security. Further, TSA has not comprehensively assessed the vulnerability—one of the three components of risk—of TSA-regulated (i.e., commercial) airports system-wide through its joint vulnerability assessment (JVA) process, which it conducts with the Federal Bureau of Investigation (FBI), or another process. From fiscal years 2009 through 2015, TSA conducted JVAs at 81 (about 19 percent) of the 437 commercial airports nationwide. TSA officials stated that they have not conducted JVAs at all airports system-wide because of resource constraints. While conducting JVAs at all commercial airports may not be feasible given budget and resource constraints, other approaches, such as providing all commercial airports with a self-vulnerability assessment tool, may allow TSA to assess vulnerability at airports system-wide.
Since 2009, TSA has taken various actions to oversee and facilitate airport security; however, it has not updated its national strategy for airport security to reflect changes in its Risk Assessment of Airport Security and other security-related actions. TSA has taken various steps to oversee and facilitate airport security by, among other things, developing strategic goals and evaluating risks. For example, in 2012 TSA developed its National Strategy for Airport Perimeter and Access Control Security (Strategy), which defines how TSA seeks to secure the perimeters and security-restricted areas of the nation's commercial airports. However, TSA has not updated its Strategy to reflect actions it has subsequently taken, including results of the 2013 Risk Assessment and new and enhanced security activities, among other things. Updating the Strategy to reflect changes in the airport security risk environment and new and enhanced activities TSA has taken to facilitate airport security would help TSA to better inform management decisions and focus resources on the highest-priority risks, consistent with its strategic goals.
This is a public version of a sensitive report that GAO issued in March 2016. Information that TSA deems “Sensitive Security Information” has been removed.

What GAO Recommends

GAO is making six recommendations, including that TSA update its Risk Assessment of Airport Security, develop and implement a method for conducting a system-wide assessment of airport vulnerability, and update its National Strategy for Airport Perimeter and Access Control Security . DHS concurred with the recommendations and identified planned actions to address the recommendations.