Individual Practices Used to Identify and Apply Lessons Learned Can Frame an Overall Lessons- Learned Process Applicable to Federal Facility Security

We identified eight individual practices that can be used to identify and  apply lessons learned. We combined and ordered  these practices to develop an overall, eight-step, lessons-learned  process—that is, a systematic means for agencies to learn from an event  and make decisions about when and how to use that knowledge to  change behavior. Not all  agencies used all practices, and the application of the practices varied  among agencies. Examples of agencies collecting  information as a step toward deriving lessons from incidents include the  following:  In the Knowledge from the Field initiative, the Bureau of Diplomatic  Security collects incident reports submitted by regional security  officers and footage from security cameras, and also interviews  witnesses directly. The Los Angeles Police Department produces a formal document  after a critical incident that captures lessons learned and best  practices that the department would like to sustain or improve. The  department disseminates this document to its units for use in  planning, preparing, and coordinating exercises. However, ISC officials cited a  number of current initiatives that could support a more comprehensive  lessons-learned effort. ISC provides forums for  its members to collect and disseminate physical security information  and best practices through its quarterly meetings and annual  classified briefings. ISC uses the Homeland  Security Information Network (HSIN)information. ISC Is Developing a Lessons-Learned Process, but Whether It Can Be Implemented Is Unclear

In response to a February 2012 request from the Internal Revenue  Service, ISC initiated a working group to explore the idea of creating a  systematic, governmentwide lessons-learned process for physical  security. The working group is a first step toward establishing a more deliberate  lessons-learned process, but it remains at its early stages. It is not clear if  the new program will include all of the practices that we have identified  within a lessons-learned process. Developing a lessons-learned process  for the security of federal facilities that does not incorporate all eight  practices, as appropriate, could result in a less effective ISC lessons- learned effort and fail to maximize the value of the lessons learned to the  ISC’s membership. Agencies Have Mitigated Some Challenges to Establishing a Governmentwide Lessons-Learned Process

Law enforcement agency officials we interviewed cited challenges  specific to implementing a successful governmentwide lessons-learned  process for physical security, including the need to (1) create a culture  that encourages information sharing, (2) address the concerns about  safeguarding sensitive security information, (3) determine how to  disseminate lessons in a timely and formalized manner, and (4) overcome  the constraints of limited human and financial resources. Agencies we  met with had found ways to mitigate these challenges using strategies  consistent with a lessons-learned process. For example, U.S. Recommendations for Executive Action

To improve the federal government’s ability to learn from and disseminate  physical security lessons, we recommend that the Secretary of Homeland  Security direct ISC to:
Develop a lessons-learned process for physical security that will (1)  leverage the lessons-learned practices it already employs and (2)  incorporate the full range of lessons-learned practices identified in our  report. DHS agreed with our  recommendations. We interviewed officials from 4 federal agencies with responsibilities for  developing physical security standards and guides:  Interagency Security Committee (ISC): ISC produces Physical  Security Criteria for Federal Facilities, which establishes a baseline  set of physical security measures to be applied to all federal facilities  and provides a framework for the customization of security measures  to address unique risks at a facility;
General Services Administration (GSA): As the federal government’s  landlord, GSA designs, builds, manages, and, with the help of the  Federal Protective Service, safeguards buildings to support the needs  of other federal agencies. To determine the actions that ISC has taken to learn lessons from attacks  on federal facilities, we interviewed officials from ISC and some of its  member agencies, obtained and analyzed documents, and attended two  quarterly meetings held for its member agencies.
Why GAO Did This Study

Attacks on federal facilities in the U.S. have highlighted the need to identify lessons learned from prior security incidents and apply that knowledge to security procedures governmentwide. Dozens of federal law enforcement agencies provide physical security services for domestic nonmilitary federal facilities. The ISC is responsible for developing governmentwide physical security standards and coordinating agencies to improve the protection of federal facilities. As requested, this report examines (1) the practices used to identify and apply lessons learned and how agencies have used these practices, (2) actions ISC has taken to identify and apply lessons learned from attacks on federal facilities, and (3) challenges to developing a governmentwide lessons-learned process and the strategies agencies have used to mitigate those challenges. GAO reviewed documents and interviewed officials from 35 security and law enforcement agencies with experience protecting selected tourist sites in cities in Greece, Israel, Italy, and the United States. GAO also interviewed officials from ISC and agencies known to apply lessons-learned practices.

What GAO Found

Based on GAOs previous work and the information obtained from other agencies, GAO identified eight individual practices that can be combined and considered steps within an overall lessons-learned processthat is, a systematic means for agencies to learn from an event and make decisions about when and how to use that knowledge to change behavior. Not all of the agencies with which GAO spoke used all of the practices, and the application of the practices varied among agencies. For example, to collect information about an incidentthe first step of the processthe Bureau of Diplomatic Security within the Department of State collects incident reports, footage from security cameras, and interviews witnesses. To disseminate lessons learnedthe fifth stepthe Los Angeles Police Department produces a formal document after a critical incident that captures the lessons learned and disseminates the document to its units for use in planning, preparation, and coordination exercises.
The Interagency Security Committee (ISC), which is led by the Department of Homeland Security (DHS), currently does not have a systematic, comprehensive lessons-learned process for physical security, but the ISC does have a number of current initiatives that could support a more comprehensive lessons-learned effort. For example, ISC collects and analyzes information to update its physical security standards, captures and disseminates best practices to its members through its quarterly meetings, and archives information in the Homeland Security Information Network. ISC has initiated a working group to explore the idea of creating a systematic, governmentwide lessons-learned process. But the working group is at an early stage, and it is not clear if the new effort will include all of the lessons-learned practices that GAO identified. Not incorporating all eight practices could result in a less effective effort and fail to maximize the value of the lessons learned to ISCs membership. ISC derives its authority from an executive order. However, it depends on its member agencies to take the initiative to share information and it is unclear that ISCs current authority over its members is sufficient to implement a governmentwide lessons-learned process, which will rely on members to openly share informationincluding mistakes.
Law enforcement officials cited various challenges to establishing a governmentwide lessons-learned process, including the need to create a culture that encourages information sharing, address the concerns about safeguarding sensitive security information, disseminate information in a timely manner, and overcome resource constraints. Agencies GAO met with had found ways to mitigate these challenges using strategies consistent with a lessons-learned process.

What GAO Recommends

ISC should (1) incorporate the practices of a lessons-learned process as it develops its own process and (2) determine if its existing authority is sufficient to effectively implement a governmentwide lessons-learned process. DHS agreed with our findings and recommendations.