In addition, State acquired—purchased or  leased—over 1,125 work facilities. State Manages Risk to Overseas Facilities through Several Activities and Has Recently Taken Steps to Improve These Activities

State conducts several key activities to manage risk to overseas facilities:
OBO tracks facilities in a property inventory database, and OBO and  other bureaus rely on the information in this database to inform a  number of security-related decisions. DS Assesses Threat Levels at Posts Overseas

DS assesses six types of threats at each overseas post by evaluating the  post’s security situation and assigning a corresponding threat level,  which is used to determine the security standards required for facilities at  that post. Problems with Categorizing Facilities and Ensuring Data Reliability May Impact State’s Tracking and Ranking of Facilities

Although State conducts a range of ongoing activities to manage risk to  facilities overseas, we identified facility categorization and data reliability  problems that may impact these activities:
DS and OBO have not defined the conditions that would determine  when a warehouse with desk positions should be categorized as an  office facility and meet appropriate office physical security standards. State Lacks Standard Terminology for Different Facility Categories

GAO-12-1022. Although State Has Developed Security Standards for Most Types of Facilities, It Lacks OSPB Standards for Several Others

State has developed security standards for a variety of facilities—such as  offices and warehouses—but it has not developed OSPB standards for  several other types of facilities. Although it may take years for State to update some security standards,  we found that State at times took steps to address identified threats in  advance of approving updates to the security standards. For  example, the OSPB standards include requirements for anti-ram  perimeter walls at medium- and higher-threat posts, but the Physical  Security Handbook used to include this requirement only for higher- threat posts. State Does Not Systematically Reassess Standards against Evolving Threats and Risks

Although OSPB is required to review its security standards on a regular  basis, State does not have a systematic process for evaluating the  existing security standards against evolving threats and risks. Interagency Security Assessment Teams recommended security  upgrades above current standards: Following the attacks of  September 2012, the teams traveled to a judgmental sample of high- threat, high-risk posts and made recommendations at each post,  many of which exceeded the threat standards at the post. State Mitigates Vulnerabilities for Work Facilities That Do Not Meet Security Standards, but Its Waivers and Exceptions Process Has Weaknesses

State takes steps to mitigate vulnerabilities for older, acquired, and  temporary work facilities that do not meet security standards, primarily  through a waivers and exceptions process to document vulnerabilities  and corresponding mitigation measures; however, the waivers and  exceptions process has several weaknesses. When Security Vulnerabilities Are Identified, a Post Must Obtain Waivers or Exceptions That Define Agreed-Upon Mitigation Steps

Diplomatic work facilities are required to meet two sets of physical  security standards, SECCA requirements and OSPB standards;   however, when facilities do not or cannot meet all of the standards, post  officials are required to request waivers to SECCA requirements,  exceptions to OSPB standards, or both. Furthermore, we found that posts we visited did not always request  waivers and exceptions when required. While DS outlined some principles for a  risk management policy, it did not fully develop and implement the policy. In addition, we found examples in which the  data informing DS’s risk assessments of facilities had changed, but DS  lacked processes to re-evaluate the risk to those facilities. We also found  that State lacked a process to re-evaluate interim and temporary facilities  that have been in use longer than anticipated. State’s Risk Management Activities Do Not Operate as a Continuous Process and Do Not Continually Incorporate New Information

While many of State’s activities align with the DS risk management policy  statement, in this report we have identified a number of problems with  these activities. For example, we found that DS does not  use all available information when establishing threat levels at posts. Unless State implements a risk management policy that  addresses the problems we identified with State’s current security efforts,  State cannot be assured that the most effective security measures are in  place at a time when personnel working at U.S. diplomatic facilities are  facing ever increasing threats to their safety and security. Direct M/PRI, DS, and OBO to harmonize the terminology State uses  to categorize facilities in State’s physical security standards and  property databases. Direct OBO to establish a routine process for validating the accuracy  of the data in OBO’s property database. Direct DS to establish a routine process for validating the accuracy of  the data in DS’s risk matrix. Develop physical security standards for facilities not currently covered  by existing standards. Clarify existing flexibilities in the FAH to ensure that security and life- safety updates to the OSPB standards and Physical Security  Handbook are updated through an expedited review process. Develop a process to routinely review all OSPB standards and the  Physical Security Handbook to determine if the standards adequately  address evolving threats and risks. Develop a policy for the use of interim and temporary facilities that  includes definitions for such facilities, time frames for use, and a  routine process for reassessing the interim or temporary designation. Direct DS to routinely ensure that necessary waivers and exceptions  are in place for all work facilities at posts overseas. Direct DS to develop a process to ensure that mitigating steps agreed  to in granting waivers and exceptions have been implemented. Develop a risk management policy and procedures for ensuring the  physical security of diplomatic facilities, including roles and  responsibilities of all stakeholders and a routine feedback process that  continually incorporates new information. Appendix I: Objectives, Scope, and Methodology

The objectives of our report were to evaluate (1) how the Department of  State (State) manages risks to work facilities under chief-of-mission  authority overseas; (2) the adequacy of State’s physical security  standards for these work facilities; (3) State’s processes to mitigate  vulnerabilities when older, acquired, and temporary work facilities  overseas do not meet physical security standards; and (4) how State’s  risk management activities align with its risk management policy and risk  management best practices. To provide context and background and address our objectives, we  reviewed classified, sensitive-but-unclassified, and unclassified  documents, including U.S. laws; State’s physical security policies and  procedures as found in memoranda, guidance, the Foreign Affairs Manual  (FAM), and Foreign Affairs Handbooks (FAH)—most notably, the Physical  Security Handbook and the Overseas Security Policy Board (OSPB)  standards; DS documentation of anti-U.S. attacks, overseas posts’  physical security surveys, threat and risk ratings, and physical security  waivers and exceptions; post-specific documents pertaining to physical  security; State’s Bureau of Overseas Buildings Operations (OBO) facility,  construction, and physical security upgrade documentation; U.S. Agency  for International Development (USAID) facility and physical security  documentation; classified and unclassified Accountability Review Board  (ARB) reports resulting from physical security attacks and State’s  documents evaluating their response to ARB recommendations; past  GAO, State Office of Inspector General (OIG), and Congressional  Research Service reports; and reports by congressional committees and  independent panels.
Why GAO Did This Study

U.S. policy can call for U.S. personnel to be posted to high-threat, high-risk posts overseas. To maintain a presence in these locations, State has often relied on older, acquired (purchased or leased), and temporary work facilities that do not meet the same security standards as more recently constructed permanent facilities.
GAO was asked to review how State assures the security of these work facilities. GAO evaluated (1) how State manages risks at work facilities overseas; (2) the adequacy of State's physical security standards for these facilities; (3) State's processes to address vulnerabilities when older, acquired, and temporary overseas facilities do not meet physical security standards; and (4) the extent to which State's activities to manage risks to its overseas work facilities align with State's risk management policy and with risk management best practices. GAO reviewed U.S. laws and State's policies, procedures, and standards for risk management and physical security. GAO reviewed facilities at a judgmental sample of 10 higher-threat, higher-risk, geographically dispersed, overseas posts and interviewed officials from State and other agencies in Washington, D.C., and at 16 overseas posts, including the 10 posts at which GAO reviewed facilities.

What GAO Found

To manage risks at its overseas work facilities, the Department of State (State) tracks information about each facility, assesses threat levels at posts, develops security standards to meet threats facing different types of facilities overseas, identifies vulnerabilities, and sets risk-based construction priorities. For example, State assesses six types of threats, such as terrorism, and assigns threat levels, which correspond to physical security standards at each overseas post. However, GAO found several inconsistencies in terminology used to categorize properties and within the property inventory database used to track them, raising questions about the reliability of the data. For example, GAO identified a facility categorized as a warehouse that included offices and therefore should have been subject to more stringent standards. Gaps in categorization and tracking of facilities could hamper the proper implementation of physical security standards.
Although State has established physical security standards for most types of overseas facilities, GAO identified some facility types for which standards were lacking or unclear, instances in which the standards were not updated in a timely manner, and inconsistencies within the standards. The following are examples:
It is unclear what standards apply to some types of facilities.
In some instances, updating standards took more than 8 years.
One set of standards requires anti-ram perimeter walls at medium- and higher-threat posts; another required them only at higher-threat posts.
Furthermore, GAO found that State lacks a process for reassessing standards against evolving threats and risks. GAO identified several posts that put security measures in place that exceed the standards because the standards did not adequately address emerging threats and risks. Without adequate and up-to-date standards, post officials rely on an ad hoc process to establish security measures rather than systematically drawing upon collective subject-matter expertise.
Although State takes steps to mitigate vulnerabilities to older, acquired, and temporary work facilities, its waivers and exceptions process has weaknesses. When posts cannot meet security standards for a given facility, the posts must submit requests for waivers and exceptions, which identify steps the post will take to mitigate vulnerabilities. However, GAO found neither posts nor headquarters systematically tracks the waivers and exceptions and that State has no process to re-evaluate waivers and exceptions when the threat or risk changes. Furthermore, posts do not always request required waivers and exceptions and do not always take required mitigation steps. With such deficiencies, State cannot be assured it has all the information needed to mitigate facility vulnerabilities and that mitigation measures have been implemented.
GAO found that State has not fully developed and implemented a risk management policy for overseas facilities. Furthermore, State's risk management activities do not operate as a continuous process or continually incorporate new information. State does not use all available information when establishing threat levels at posts, such as when posts find it necessary to implement measures that exceed security standards. State also lacks processes to re-evaluate the risk to interim and temporary facilities that have been in use longer than anticipated. Without a fully developed risk management policy, State may lack the information needed to make the best security decisions concerning personnel and facilities.
To manage risk to overseas work facilities, State conducts a range of ongoing activities, including the setting of security standards. However, GAO identified a number of problems with these activities. Moreover, GAO found that State lacked a fully developed risk management policy to coordinate these activities (see figure).
This is the public version of a Sensitive but Unclassified report by the same title.

What GAO Recommends

GAO is making 13 recommendations for State to address gaps in its security-related activities, standards, and policies. State generally agreed with GAO’s recommendations.
Specifically, GAO is recommending that the Secretary of State:
1. Define the conditions when a warehouse should be categorized as an office facility and meet appropriate security standards.
2. Harmonize the terminology State uses to categorize facilities in its security standards and property databases.
3. Establish a routine process for validating the accuracy of the data in State’s property database.
4. Establish a routine process for validating the accuracy of the data in State’s risk matrix.
5. Identify and eliminate inconsistencies between and within State’s physical security guidance.
6. Develop physical security standards for facilities not currently covered by existing standards.
7. Clarify existing flexibilities to ensure that security and life-safety updates to the security standards are updated through an expedited review process.
8. Develop a process to routinely review all security standards to determine if the standards adequately address evolving threats and risks.
9. Develop a policy for the use of interim and temporary facilities that includes definitions for such facilities, time frames for use, and a routine process for reassessing the interim or temporary designation.
10. Automate waivers and exceptions documentation, and ensure that headquarters and post officials have ready access to the documentation.
11. Routinely ensure that necessary waivers and exceptions are in place for all work facilities at posts overseas.
12. Develop a process to ensure that mitigating steps agreed to in granting waivers and exceptions have been implemented.
13. Develop a risk management policy and procedures for ensuring the physical security of diplomatic facilities, including roles and responsibilities of all stakeholders and a routine feedback process that continually incorporates new information.