	Background

Creating effective security in the nation’s ports in the post-September 11  world is a challenging task. Data layers in a GIS can be extremely  varied. Our examination of the contractor’s initial  assessments identified additional shortcomings in the quality of the work  and the assessment approach. Stakeholders, such  as port authorities, and owners and operators of facilities and vessels  began conducting assessments in order to identify security vulnerabilities  of their assets or to meet application requirements for federal grants. In  some cases, initial assessments were performed shortly after the  September 11, 2001, terrorist attacks and were followed by more  comprehensive assessments conducted either on their own or by  contractors. Subsequent Revisions Incorporated the Use of a GIS and More Focused Assessments

While considering what changes needed to be made to the assessment  program, the Coast Guard also determined that it was essential to provide  local Coast Guard officials and certain members of the local Area Maritime  Security Committee a means to retrieve maritime security information and  display it for planning and response purposes at the ports. First, the centerpiece of the new approach, the GIS component, is being  developed without several key project management steps that are critical  to success in such projects. These requirements define what the system  will be expected to do for its users once it is developed and implemented. The Coast Guard’s approach for  addressing these requirements takes three main forms:    First, the Coast Guard is using the assessments being conducted at the   55 ports to identify requirements for the GIS it is developing. Adding to an existing system, however, does not obviate the need for  careful planning. Once all assessment reports of  the 55 strategic ports are completed—a task the Coast Guard expects to be  done by February 2005— the Coast Guard currently expects the  assessment of assessments component to be an ongoing effort that will be  updated by Coast Guard personnel as new assessment information  becomes available. However, the  Coast Guard risks producing a system that is not as useful as it could be,  because its approach lacks a defined management strategy, specific cost  estimates, and a clear implementation schedule. Developing the program’s  GIS component in this way is of particular concern, given the problems  that have resulted when other agencies used the same approach in  attempting to develop their information technology systems. Recommendations for Executive Action

To help ensure that the revised Port Security Assessment Program  provides the most effective tool possible for security planning and  response, we recommend that the Secretary of Homeland Security direct  the Commandant of the Coast Guard to (1) define and document the GIS  functional requirements and (2) develop a long-term project plan for the  GIS and the Port Security Assessment Program as a whole (including cost  estimates, schedule, and management responsibilities). Appendix I: Objectives, Scope, and Methodology

Our two objectives for this report were to (1) discuss why and how the  Port Security Assessment Program has changed over time and (2) assess  the Coast Guard’s approach for implementing the Port Security  Assessment Program as it is currently configured  To address why and how the assessment program changed, we reviewed  Coast Guard documents, interviewed officials at Coast Guard  headquarters responsible for implementing the program, and visited three  ports that had been assessed under the previous program assessment  approach.
Why GAO Did This Study

Created in the wake of the September 11, 2001, terrorist attacks, the Port Security Assessment Program was designed to evaluate security at the nation's 55 most economically and militarily strategic ports. Implemented by the U.S. Coast Guard, an agency of the Department of Homeland Security, the program focuses on identifying vulnerabilities, suggesting approaches to minimize them, and making the information available to those responsible for developing and implementing portwide security plans. The program has been under way for more than 2 years and has undergone several sets of changes, including the addition of a geographic information system (GIS). GAO was asked to discuss why and how the program changed and assess the Coast Guard's approach for implementing the program in its current form.

What GAO Found

Changes in the Port Security Assessment Program reflect attempts to deal with two main developments since the program's inception: evolving assessment needs at the ports and missteps in how the initial assessments were carried out. The program was designed as a comprehensive assessment of each port and its critical assets, such as passenger terminals, factories, cargo facilities, and bridges. However, the need for comprehensive assessments was diminished when many owners and operators of these critical assets began conducting their own assessments to comply with new regulatory requirements or apply for security grants. The program's assessments also proved more expensive than expected, and a GAO review conducted at the time found shortcomings in their quality and usefulness. The current program's assessments are more targeted in scope and nature, including the opportunity for local Coast Guard officials to request reviews of specific assets they do not know enough about. To help local authorities with security planning and response, the Coast Guard decided to incorporate a GIS. A GIS is a computer mapping system designed to have many information "layers" that can be easily updated and retrieved. The Coast Guard expects to complete the assessments at the 55 ports by February 2005, but no timeline exists for making the GIS component operational. Although the revised program holds promise, the implementation approach is at increased risk because the Coast Guard is not taking sufficient steps in the planning process. Contrary to best practices for technology systems development, the GIS is being developed without sufficient up-front work to identify how the system will be expected to perform. Both the GIS component and the program as a whole also lack a project plan detailing tasks, schedules, and costs. In other federal agencies, GAO has identified similar projects that failed when such steps were not followed. The initial response of local Coast Guard officials to the new, targeted assessments is generally positive. However, the assessments could be of greater benefit if functional requirements for the GIS were more clearly defined, so the Coast Guard could use the assessments to address gaps in security knowledge.