For example, tenant agencies fund FPS’s security  equipment countermeasure recommendations that they approve through  SWAs. Building Security Operations—interfaces with FPS and monitors the  services FPS provides to GSA and tenant agencies. We have identified a set of key facility protection practices from the  collective practices of federal agencies and the private sector to provide a  framework for guiding agencies’ protection efforts and addressing  challenges. FPS’s Risk Management Approach Is Inadequate, but Improvements Are in Development

FPS is limited in its ability to influence the allocation of resources using  risk management because security funding decisions are the responsibility  of GSA and tenant agencies. Moreover, FPS uses an outdated risk  assessment tool, a subjective approach, and a time-consuming process to  conduct BSAs. GSA and tenant agencies have concerns about the quality  and timeliness of FPS’s risk assessment services and in some cases, are  assuming these responsibilities. FPS’s Ability to Influence Resource Allocation Based on Risk is Limited

FPS’s ability to influence the allocation of resources based on the results  of its risk assessments is constrained because GSA and tenant agencies  must agree to fund recommended countermeasures, and we found that  tenant agencies were sometimes unwilling to fund recommended security  equipment. It is critical that FPS—which is  responsible for assessing risk for nearly 9,000 GSA buildings and  properties that GSA may lease—replace its outdated, subjective, and time- consuming risk assessment tool and approach with the new program it has  been developing since fiscal year 2007, especially as the results of its risk  analyses lay the foundation for FPS, GSA, and tenant agencies’ security  efforts. Although FPS is developing a  program for technology acquisition, its implementation has been delayed  and it does not include an evaluative component to ensure cost- effectiveness. Additionally, FPS does not provide inspectors with  specialized guidance and standards for cost-effectively selecting  technology. Consequently, tenant agency  representatives would have to investigate the cost and risk implications of  these options on their own to make an informed resource allocation  decision. FPS and GSA Disagree Over Sharing Informatio from the BSA

While FPS and GSA acknowledge that the two organizations are partners  in protecting and securing GSA buildings, FPS and GSA fundamentally  disagree over how much of the information in the BSA should be shared Per the MOA, FPS is required to share the BSA executive summary with  GSA and FPS believes that this document contains sufficient information for GSA to make decisions about purchasing and implementing FPS’s  recommended countermeasures. As a result, communication among these  entities is limited. FPS officials at one location told us that their radios are not  interoperable with those of the local police department. Reach consensus with GSA on what information contained in the BSA  is needed for GSA to fulfill its responsibilities related to the protection  of federal buildings and occupants, and accordingly, establish internal  controls to ensure that shared information is adequately safeguarded;  guidance for employees to use in deciding what information to protect  with SBU designations; provisions for training on making designations,  controlling, and sharing such information with GSA and other entities;  and a review process to evaluate how well this information sharing  process is working, with results reported to the Secretary regularly on  a mutually agreed-to schedule. Until the cost-analysis component of  RAMP is implemented, it will be important for inspectors to have guidance  they can use to make cost-effective countermeasure recommendations so  that GSA and tenant agencies can be assured that their investments in  FPS-recommended technologies and other countermeasures are cost- effective, consistent across buildings, and the best available alternatives. Appendix I: Objectives, Scope, and Methodology

The objective of this report was to determine whether the Federal  Protective Service’s (FPS) approach to security for buildings under the  control and custody of the General Services Administration (GSA) reflects  key facility protection practices. We used the following key practices as criteria:  allocating resources using risk management; leveraging technology; and  information sharing and coordination.
Why GAO Did This Study

There is ongoing concern about the security of federal buildings and their occupants. The Federal Protective Service (FPS) within the Department of Homeland Security (DHS) is responsible for providing law enforcement and related security services for nearly 9,000 federal buildings under the control and custody of the General Services Administration (GSA). In 2004, GAO identified a set of key protection practices from the collective practices of federal agencies and the private sector that included: allocating resources using risk management, leveraging technology, and information sharing and coordination. As requested, GAO determined whether FPS's security efforts for GSA buildings reflected key practices. To meet this objective, GAO used its key practices as criteria, visited five sites to gain firsthand knowledge, analyzed pertinent DHS and GSA documents, and interviewed DHS, GSA, and tenant agency officials.

What GAO Found

FPS's approach to securing GSA buildings reflects some aspects of key protection practices, and FPS has several improvements underway such as a new risk assessment program and a countermeasure acquisition program. While FPS's protection activities exhibit some aspects of the key practices, GAO found limitations in each of the areas. FPS assesses risk and recommends countermeasures to GSA and tenant agencies; however, FPS's ability to influence the allocation of resources using risk management is limited because resource allocation decisions are the responsibility of GSA and tenant agencies, which may be unwilling to fund FPS's countermeasure recommendations. Moreover, FPS uses an outdated risk assessment tool and a subjective, time-consuming process. As a result, GSA and tenant agencies are uncertain whether risks are being mitigated. Concerned with the quality and timeliness of FPS's risk assessment services, GSA and tenant agencies are pursuing some of these activities on their own. Although FPS is developing a new risk management program, full implementation is not planned until the end of fiscal year 2011 and has already experienced delays. With regard to leveraging technology, FPS inspectors have considerable latitude for selecting technologies and countermeasures that tenant agencies fund, but FPS provides inspectors with little training and guidance for making cost-effective choices. Additionally, FPS does not provide tenant agencies with an analysis of alternative technologies, their cost, and associated reduction in risk. As a result, there is limited assurance that the recommendations inspectors make are the best available alternatives and tenant agencies must make resource allocation decisions without key information. Although FPS is developing a program to standardize security equipment and contracting, the program has run behind schedule and lacks an evaluative component for assessing the cost-effectiveness of competing technologies and countermeasures. FPS has developed information sharing and coordination mechanisms with GSA and tenant agencies, but there is inconsistency in the type of information shared and the frequency of coordination. Lack of coordination through regular contact can lead to communication breakdowns. For example, during a construction project at one location, the surveillance equipment that FPS was responsible for maintaining was removed from the site during 2007. FPS and tenant agency representatives disagree over whether FPS was notified of this action. Furthermore, FPS and GSA disagree over what building risk assessment information can be shared. FPS maintains that the sensitive information contained in the assessments is not needed for GSA to carry out its mission. However, GSA maintains that restricted access to the risk assessments constrains its ability to protect buildings and occupants.