	FPS Does Not Currently Assess Risks at Federal Facilities but Multiple Agencies Are Conducting Their Own Assessments

Our preliminary results indicate that, in the absence of RAMP, FPS  currently is not assessing risk at the over 9,000 federal facilities under the  custody and control of GSA in a manner consistent with federal standards  such as NIPP’s risk management framework, as FPS originally planned. As a result, FPS has accumulated a backlog of federal  facilities that have not been assessed for several years. According to FPS  data, more than 5,000 facilities were to be assessed in fiscal years 2010  through 2012. However, we were not able to determine the extent of the  FSA backlog because we found FPS’s FSA data to be unreliable. In addition, since September 2011,  FPS’s inspectors have collected information—such as location, purpose,  agency contacts, and current countermeasures (e.g., perimeter security,  access controls, and closed-circuit television systems) at over 1,400  facilities—which will be used as a starting point to complete FPS’s fiscal  year 2012 assessments. GSA is also  expending additional resources to assess risk. According to  FPS officials, on March 30, 2012, Argonne National Laboratory delivered  this tool, called the Modified Infrastructure Survey Tool (MIST), to FPS on  time and within budget. MIST is an interim vulnerability assessment tool  that FPS plans to use until it can develop a permanent solution to replace  RAMP. According to MIST project documents and FPS officials, among  other things, MIST will: allow FPS’s inspectors to review and document a facility’s security  posture, current level of protection, and recommend  countermeasures; provide FPS’s inspectors with a standardized way for gathering and  recording facility data; and allow FPS to compare a facility’s existing countermeasures against  the Interagency Security Committee’s (ISC) countermeasure  standards based on the ISC’s predefined threats to federal facilities  (e.g., blast-resistant windows for a facility designed to counter the  threat of an explosive device) to create the facility’s vulnerability  report. FPS Increased Its Use of Project Management Best Practices in Developing MIST

Our preliminary analysis indicates that in developing MIST, FPS  increased its use of GAO’s project management best practices, including  alternatives analysis, managing requirements, and conducting user  acceptance testing. Our  preliminary work suggests that MIST has several limitations:
Assessing Consequence. Three of the four risk assessment experts we  spoke with generally agreed that a tool that does not estimate  consequences does not allow an agency to fully assess the risks to a  federal facility. FPS officials stated that they did not include consequence  assessment in MIST’s design because it would have required  additional time to develop, validate, and test MIST. Comparing Risk across Federal Facilities. We reported in 2010 that  FPS’s approach to risk management provides limited assurance that  the most critical risks at federal facilities across the country are being  prioritized and mitigated.such a comprehensive approach to its FSA program when it  developed RAMP and FPS officials stated that they may develop this  capability for the next version of MIST. FPS Faces Challenges in Overseeing Its Contract Guards

GAO, Homeland Security: The Federal Protective Service Faces Several Challenges  That Hamper its Ability to Protect Federal Facilities, GAO-08-683 (Washington, D.C.: June  11, 2008). In the absence of RAMP, in June 2012, FPS decided to deploy an interim  method to enable inspectors to record post inspections. FPS  officials acknowledged that this method is not a comprehensive system  for guard oversight. Consequently, it is now more difficult for FPS to verify  that guards on post are trained and certified and that inspectors are  conducting guard post inspections as required. Although FPS collects guard training and certification information from the  companies that provide contract guards, it appears that FPS does not  independently verify that information. To verify the  guard companies’ reports, FPS conducts monthly audits. We plan to finalize our analysis and report to the Chairman in August  2012, including recommendations. We discussed the information in this  statement with FPS and incorporated technical comments as appropriate.
Why GAO Did This Study

FPS provides security and law enforcement services to over 9,000 federal facilities managed by the General Services Administration (GSA). GAO has reported that FPS faces challenges providing security services, particularly completing FSAs and managing its contract guard program. To address these challenges, FPS spent about $35 million and 4 years developing RAMPessentially a risk assessment and guard oversight tool. However, RAMP ultimately could not be used to do either because of system problems.
This testimony is based on preliminary work for the Chairman and discusses the extent to which FPS is (1) completing risk assessments, (2) developing a tool to complete FSAs, and (3) managing its contract guard workforce. GAO reviewed FPS documents, conducted site visits at 3 of FPSs 11 regions and interviewed officials from FPS, Argonne National Laboratory, GSA, Department of Veterans Affairs, the Federal Highway Administration, Immigration and Customs Enforcement, and guard companies; as well as 4 risk management experts.

What GAO Found

GAOs preliminary results indicate that the Department of Homeland Securitys (DHS) Federal Protective Service (FPS) is not assessing risks at federal facilities in a manner consistent with standards such as the National Infrastructure Protection Plans (NIPP) risk management framework, as FPS originally planned. Instead of conducting risk assessments, since September 2011, FPSs inspectors have collected information, such as the location, purpose, agency contacts, and current countermeasures (e.g., perimeter security, access controls, and closed-circuit television systems). This information notwithstanding, FPS has a backlog of federal facilities that have not been ssessed for several years. According to FPSs data, more than 5,000 facilities were to be assessed in fiscal years 2010 through 2012. However, GAO was not able to determine the extent of FPSs facility security assessment (FSA) backlog because the data were unreliable. Multiple agencies have expended resources to conduct risk assessments, even though they also already pay FPS for this service.
FPS has an interim vulnerability assessment tool, referred to as the Modified Infrastructure Survey Tool (MIST), which it plans to use to assess federal facilities until it develops a longer-term solution. In developing MIST, FPS generally followed GAOs project management best practices, such as conducting user acceptance testing. However, our preliminary analysis indicates that MIST has some limitations. Most notably, MIST does not estimate the consequences of an undesirable event occurring at a facility. Three of the four risk assessment experts GAO spoke with generally agreed that a tool that does not estimate consequences does not allow an agency to fully assess risks. FPS officials stated that they did not include consequence information in MIST because it was not part of the original design and thus requires more time to validate. MIST also was not designed to compare risks across federal facilities. Thus, FPS has limited assurance that critical risks at federal facilities are being prioritized and mitigated.
GAOs preliminary work indicates that FPS continues to face challenges in overseeing its approximately 12,500 contract guards. FPS developed the Risk Assessment and Management Program (RAMP) to help it oversee its contract guard workforce by verifying that guards are trained and certified and for conducting guard post inspections. However, FPS faced challenges using RAMP for guard oversight, such as verifying guard training and certification information, and has recently determined that it would no longer use RAMP. Without a comprehensive system, it is more difficult for FPS to oversee its contract guard workforce. FPS is verifying guard certification and training information by conducting monthly audits of guard information maintained by guard contractors. However, FPS does not independently verify the contractors information. Additionally, according to FPS officials, FPS recently decided to deploy a new interim method to record post inspections that replaces RAMP.

What GAO Recommends

GAO is not making any recommendations in this testimony. GAO plans to finalize its analysis and report to the Chairman in August 2012, including recommendations. GAO discussed the information in this statement with FPS and incorporated technical comments as appropriate.