	Background

The National Mall in Washington, D.C., is one of the most recognizable  landscapes in the United States and serves as both the public setting for  our nation’s Capital as well as home to some of the most visited  museums in the world. Along the National Mall are numerous monuments  and memorials to our nation’s history and heritage. As with the  Smithsonian, the National Gallery also has an Office of Protection  Services that serves as its primary security and risk-management  office responsible for protecting the National Gallery’s assets,  employees, and the visiting public. ISC, an interagency organization chaired by DHS, has developed  physical security standards for nonmilitary federal facilities in the United  States. The RMP was not written  with the application to the Washington Monument and the Jefferson and  Lincoln Memorials in mind. Federal Entities Are Assessing Security Risks to the Icons, Museums, and Galleries on the National Mall

Interior, the Smithsonian, and the National Gallery are assessing the  physical security risks to the icons, museums, and galleries on the  National Mall. By assessing the risk to the National  Mall’s assets, Interior, the Smithsonian, and the National Gallery are  demonstrating that they are taking a risk management approach to meet  the demands of a complex security environment. Interior’s Risk Assessments Reflect Strategic Security Requirements for National Critical Infrastructure

Interior assesses the physical security risks to the icons on the National  Mall using a departmental policy that reflects government-wide homeland- security objectives for critical infrastructure. Among other things, Interior’s policy establishes minimum security requirements for safeguarding critical  infrastructure such as the icons and includes requirements for the  following:
Security personnel: assignments, coverage, locations, and available  equipment, such as having an armed security force on site 24 hours a  day. While the National Gallery is taking steps to assess its security risks, we  found that it does not have complete documentation of its risk  management decisions. Documenting risk management decisions is  important for several reasons. The RMP states that the threat to federal  facilities is significant and that decisions to accept risk could have serious  consequences. National Mall Entities Vary in Their Use of Goals, Performance Measures, and Testing to Assess Their Security Programs

		Federal Entities Have Identified Goals and Related Performance Measures to Varying Degrees

Interior, the Smithsonian, and the National Gallery each collect  information on various aspects of the performance of their physical  security programs; however, each is at a different stage of developing  goals and linking performance measures to these goals. As discussed above,  documenting activities is also part of an effective internal control system  and helps to ensure that goals are met. Interior, the Smithsonian, and the National Gallery have taken steps to  incorporate aspects of performance measurement into their physical  security programs, and each plans to improve how it measures  performance, specifically:
The Park Police uses information it collects to manage its physical  security program and has identified goals and performance measures  to assess the effectiveness of its efforts; however, its efforts align with  a strategic plan that has not been updated in more than 10 years and  does not specifically document how performance measures are linked  to goals. Linking performance measures and goals could help these entities  monitor and evaluate their efforts, which is an essential part of risk  management. National Mall Entities Vary in Their Use of Security Testing and Could Benefit from Seeking Assistance to Enhance Efforts

Interior, the Smithsonian, and the National Gallery each test aspects of  their physical security programs, and although they have reached out to  other entities to help improve their overall programs, they have not made  testing a focus of their outreach efforts. Interior, the Smithsonian, and the  National Gallery recognize these limitations and are taking steps to  assess physical-security risks. Drawing on the knowledge and practices of other federal  entities could help Interior, the Smithsonian, and the National Gallery  enhance their testing programs. We recommend that the Director of the National Gallery of Art direct the  Office of Protection Services to take the following three actions: develop a process for documenting risk management decisions; ensure that program goals and performance measures linked to those  goals are included as part of the master security plan and develop a  timeline for completion of this plan; and  seek additional input from federal entities with expertise regarding  ways to enhance testing of the physical security program. We also received  an e-mail from the Smithsonian’s Office of Government Relations stating  that the Smithsonian was not providing written comments, but that it  agreed with our recommendations and will take steps to address them.
Why GAO Did This Study

The National Mall is one of the most recognizable landscapes in the United States. It is home to memorials to our nation's history and some of the most visited museums in the world. Threats to these assets—whether acts of terrorism, violence, or vandalism or theft of artifacts or art—could result not only in the loss of life but also the loss of iconic monuments or irreplaceable items from the Smithsonian's or National Gallery's collections.
GAO was asked to review the steps Interior, the Smithsonian, and the National Gallery are taking to protect U.S. assets, employees, and the visiting public. This report examines: (1) the extent to which these entities assess physical security risks and (2) the extent to which the entities use goals, measures, and testing to assess their physical security programs. This is a public version of a sensitive report that GAO issued in May 2017.
GAO reviewed applicable federal requirements; Interior-, Smithsonian-, and National Gallery-specific policies and related documents; and interviewed officials.

What GAO Found

Federal entities on the National Mall are assessing the physical security risks to their respective U.S. assets. In doing so, they are demonstrating that they are taking a risk management approach to meet the demands of a complex security environment, specifically:
To assess the risks to the icons—the Washington Monument and the Jefferson and Lincoln Memorials—the Department of the Interior (Interior) follows a departmental policy that reflects government-wide homeland security objectives for critical infrastructure. Among other things, Interior's policy establishes minimum security requirements for safeguarding critical infrastructure such as the icons.
To assess the risks to the museums and galleries on the National Mall, the Smithsonian Institution (Smithsonian) and the National Gallery of Art (National Gallery) voluntarily follow government-wide standards set forth by the Interagency Security Committee (ISC)—an interagency organization chaired by the Department of Homeland Security (DHS). These standards are designed to minimize risk to federal facilities and help nonmilitary federal entities meet recommended levels of protection. Interior's, the Smithsonian's, and the National Gallery's adherence to these policies and standards, and the related steps that the entities follow, shows the considerable extent to which these entities use risk assessments as an analytical tool in their physical security programs. Nonetheless, the threat to federal facilities is significant, and ISC standards require the documentation of risk management decisions—such as decisions to defer actions to mitigate risk due to cost or other factors. Documenting risk management decisions is also a necessary part of an effective internal-control system and important in order to retain institutional knowledge and inform decision-making. GAO found that the National Gallery, which follows ISC standards voluntarily, lacked such documentation.
Interior, the Smithsonian, and the National Gallery collect information on various aspects of the performance of their physical security programs and are making efforts to use goals, measures, and testing to assess the performance of their physical security programs; however, each could benefit from taking additional steps. ISC and GAO have reported that it is necessary to establish goals and link performance measures to those goals to assess progress. While Interior, the Smithsonian, and the National Gallery intend to link performance measures to goals, they have not done so yet or established firm time frames for completing these efforts. Ensuring that plans include both goals and performance measures linked to those goals, as well as developing timelines for completion, could help these entities develop a more strategic view of their physical security programs and better position them to prioritize their needs. These entities also test aspects of their physical security programs, such as to ensure that security systems are operational and that guards are attending to their duties. While the entities have reached out to others to improve their overall programs, they did not focus on testing as part of that outreach. Seeking input from others with expertise is consistent with key practices GAO has identified for physical security and could help these entities target where their testing efforts need improvement.

What GAO Recommends

In the sensitive report, GAO recommended that (1) the National Gallery document its risk management decisions and that (2) Interior, the Smithsonian, and the National Gallery link performance measures with security goals and seek input to enhance their testing programs. Interior, the Smithsonian, and the National Gallery agreed with GAO's recommendations and indicated they will begin taking steps to address them.