	FPS Faces Challenges Ensuring Contract Guards Have Been Properly Trained and Certified before Being Deployed to Federal Facilities

		Some FPS Contract Guards Have Not Received Required Training on Responding to Active-Shooter Scenarios

According to FPS officials, since 2010 the agency has required its guards  to receive training on how to respond to an active-shooter scenario. Without ensuring that  all guards receive training on how to respond to active-shooter incidents,  FPS has limited assurance that its guards are prepared for this threat. We were unable to determine the extent to which FPS’s guards have  received active-shooter response training, in part, because FPS lacks a  comprehensive and reliable system for guard oversight (as discussed  below). When we asked officials from 16 of the 31 contract guard  companies we contacted if their guards had received training on how to  respond during active-shooter incidents, responses varied.of the 16 contract guard companies we interviewed about this topic: officials from eight contract guard companies stated that their guards  had received active-shooter scenario training during FPS orientation; officials from five guard companies stated that FPS has not provided  active-shooter scenario training to their guards during the FPS- provided orientation training; and officials from three guard companies stated that FPS had not provided  active-shooter scenario training to their guards during the FPS- provided orientation training, but that the topic was covered at some  other time. For example, an official at one  contract guard company stated that 133 of its approximately 350 guards  (about 38 percent) on three separate FPS contracts (awarded in 2009)  have never received their initial x-ray and magnetometer training from  FPS. Consequently, some guards deployed to federal facilities may  be using x-ray and magnetometer equipment that they are not qualified to  use─thus raising questions about the ability of some guards to execute a  primary responsibility to properly screen access control points at federal  facilities. As noted above, FPS agreed with our 2013 recommendation to determine  which guards have not had screener training and agreed to provide it to  them. FPS Lacks Effective Management Controls to Ensure Contract Guards Have Met Training and Certification Requirements

In our September 2013 report, we found that FPS continues to lack  effective management controls to ensure that guards have met training  and certification requirements. For example, although FPS agreed with  our 2012 recommendation to develop a comprehensive and reliable  system for contract guard oversight, it has not yet established such a  system. FPS Continues to Face Challenges with Assessing Risk at Federal Facilities

We reported in 2012 that FPS is not assessing risks at federal facilities in  a manner consistent with federal standards. The preliminary results of our  ongoing review of risk assessments of federal facilities indicate that this is  still a challenge for FPS and several other federal agencies. Federal  standards such as the National Infrastructure Protection Plan’s (NIPP)  risk management framework and ISC risk assessment provisions call for  a risk assessment to include threat, vulnerability, and consequence  assessments. Risk assessments help decision-makers identify and  evaluate security risk and implement protective measures to mitigate risk. Instead of conducting risk assessments, FPS uses an interim vulnerability  assessment tool, referred to as the Modified Infrastructure Survey Tool  (MIST), with which it assesses federal facilities until it develops a longer- term solution. Most notably, it does not assess  consequence (the level, duration, and nature of potential loss resulting  from an undesirable event). Three of the four risk assessment experts we  spoke with generally agreed that a tool that does not estimate  consequences does not allow an agency to fully assess risks. FPS  officials stated that they did not include consequence information in MIST  because it was not part of the original design and thus requires more time  to validate. We will continue to monitor this issue and plan to  report the results early next year. DHS agreed with our 2012 recommendations to incorporate NIPP’s risk  management framework in any future risk assessment tool; coordinate  with federal agencies to reduce any unnecessary duplication in FPS’s  assessments; and address limitations with its interim tool to better assess  risk at federal facilities. Related GAO Products

Homeland Security: Challenges Associated with Federal Protective  Service’s Contract Guards and Risk Assessments at Federal Facilities. GAO-13-694. Homeland Security: Protecting Federal Facilities Remains a Challenge for  the Department of Homeland Security’s Federal Protective Service. Federal Facility Security: Staffing Approaches Used by Selected  Agencies. Homeland Security: Preliminary Results Show Federal Protective  Service’s Ability to Protect Federal Facilities Is Hampered by  Weaknesses in Its Contract Security Guard Program.
Why GAO Did This Study

As part of the Department of Homeland Security (DHS), the Federal Protective Service (FPS) is responsible for protecting federal employees and visitors in approximately 9,600 federal facilities under the control and custody of the General Services Administration (GSA). Recent incidents at federal facilities demonstrate their continued vulnerability to attacks or other acts of violence. To help accomplish its mission, FPS conducts facility security assessments and has approximately 13,500 contract security guards deployed to federal facilities.
This testimony discusses challenges FPS faces in (1) ensuring contract security guards deployed to federal facilities are properly trained and certified and (2) conducting risk assessments at federal facilities. It is based on GAO work issued from 2008 through 2013 on FPS's contract guard and risk assessment programs, and preliminary results of GAO's ongoing work to determine the extent to which FPS and select federal agencies' facility risk assessment methodologies align with federal risk assessment standards. To perform this work, GAO reviewed FPS's and eight federal agencies' risk assessment documentation and compared it to the Interagency Security Committee (ISC) standards. These agencies were selected based on their missions and types of facilities.

What GAO Found

FPS faces challenges ensuring that contract guards have been properly trained and certified before being deployed to federal facilities around the country. In its September 2013 report, GAO found that providing active shooter response and screener training is a challenge for FPS. For example, according to officials at five guard companies, their contract guards have not received training on how to respond during incidents involving an active shooter. Without ensuring that all guards receive training on how to respond to incidents at federal facilities involving an active-shooter, FPS has limited assurance that its guards are prepared for this threat. Similarly, an official from one of FPS's contract guard companies stated that 133 (about 38 percent) of its approximately 350 guards have never received screener training. As a result, guards deployed to federal facilities may be using x-ray and magnetometer equipment that they are not qualified to use which raises questions about their ability to screen access control points at federal facilities--one of their primary responsibilities. GAO was unable to determine the extent to which FPS's guards have received active-shooter response and screener training, in part, because FPS lacks a comprehensive and reliable system for guard oversight. FPS agreed with GAO's 2013 recommendation that they take steps to identify guards that have not had required training and provide it to them. GAO also found that FPS continues to lack effective management controls to ensure its guards have met its training and certification requirements. For instance, although FPS agreed with GAO's 2012 recommendation that it develop a comprehensive and reliable system for managing information on guards' training, certifications, and qualifications, it does not yet have such a system.
FPS also continues to face challenges assessing risk at federal facilities. GAO reported in 2012 that FPS is not assessing risks at federal facilities in a manner consistent with federal standards. GAO's preliminary results from its ongoing work on risk assessments at federal facilities indicate that this is still a challenge for FPS and several other federal agencies. Federal standards, such as the National Infrastructure Protection Plan 's risk management framework and ISC's risk assessment provisions, state that a risk assessment should include threat, vulnerability, and consequence assessments. Risk assessments help decision-makers identify and evaluate security risks and implement protective measures to mitigate the risk. Instead of conducting risk assessments, FPS is using an interim vulnerability assessment tool, referred to as the Modified Infrastructure Survey Tool (MIST) to assess federal facilities until it develops a longer-term solution. However, MIST does not assess consequence (the level, duration, and nature of potential loss resulting from an undesirable event). Three of the four risk assessment experts GAO spoke with generally agreed that a tool that does not estimate consequences does not allow an agency to fully assess risks. Thus, FPS has limited knowledge of the risks facing about 9,600 federal facilities around the country. FPS officials stated that they did not include consequence information in MIST because it was not part of the original design. GAO will continue to monitor this issue and plans to report its final results early next year.

What GAO Recommends

DHS and FPS agreed with the recommendations in GAO's 2012 and 2013 reports to improve FPS's contract guard and risk assessment processes.