Stakeholder Roles and Responsibilities

DHS and DOT share responsibility for securing the commercial vehicle  sector. TSA Has Begun Conducting Risk Assessments of the Commercial Vehicle Sector, but Has Not Completed These Efforts or Fully Used the Results to Support Its Security Strategy

TSA has taken actions to assess the security risks associated with the  commercial vehicle sector, including assessing threats, initiating  vulnerability assessments, and developing best security practices, but  more work remains to fully assess the security risks of commercial trucks  and buses, and to ensure that this information is used to inform TSA’s  security strategy. As a result, TSA cannot be assured that its approach for securing the  commercial vehicle sector is aligned with the highest priority security  needs. Moreover, TSA has not completed a report as required by the 9/11  Commission Act on various aspects of commercial vehicle security. However, TSA officials could not identify  when the NTSRA will be finalized. However, TSA has  not developed a plan or a time frame for completing a risk assessment of  the commercial vehicle sector, including the level of resources required to  complete the assessment and the appropriate scope of the assessment  including determining the combination of threat scenarios and field-level  vulnerability assessments it intends to use. Government and Industry Have Taken Actions to Strengthen the Security of Commercial Vehicles, but TSA Has Not Completely Assessed the Effectiveness of Its Actions

Key government and industry stakeholders have taken actions to  strengthen the security of the commercial vehicles sector, but TSA has not  assessed the effectiveness of its actions. States, individually and collectively, through their  state transportation and law enforcement associations, have also worked  to strengthen the security of commercial vehicles. Several of these programs have  been implemented by TSA and other DHS components, others by DOT,  and several jointly by DHS and DOT. TSA Uses Performance Measures to Monitor Its Efforts in Securing Commercial Vehicles, but Lacks Effectiveness Measures for Key Security Programs

TSA has begun developing measures that gauge the completion of its  program activities, but could improve its efforts by collecting data that  would measure the effectiveness of its programs in strengthening  commercial vehicle security. TSA Has Strengthened Efforts to Coordinate with Federal, State, and Industry Stakeholders Regarding the Security of the Commercial Vehicle Sector, but Further Actions Can Enhance Coordination

While TSA has taken actions to improve coordination with federal, state,  and industry stakeholders to strengthen commercial vehicle security, more  can be done to ensure that these coordination efforts enhance security for  the sector. Without enhanced coordination,  TSA will have difficulty expanding its vulnerability assessments to other  states. TSA and FMCSA also do not have a process in place to share information  important to monitoring the results of security programs, consistent with  leading practices for collaborating agencies. In addition, as  TSA expands its CSRs of hazardous materials transporters, DOT may  benefit from knowing which firms TSA has reviewed to avoid duplication  of effort. TSA also has  not developed a plan to conduct consequence assessments, or leveraged  the consequence assessments of other sectors. Establish a plan and a time frame for completing risk assessments of  the commercial vehicle sector, and use this information to support  future updates to the Transportation Sector Strategic Plan, to include  conducting:  to the extent feasible, assessments that include information about the  likelihood of a terrorist attack method on a particular asset, system, or  network as required by the National Infrastructure Protection Plan;  a vulnerability assessment of the commercial vehicle sector, including:    assessing the scope and method of assessments required to gauge  the sector’s vulnerabilities;    considering the findings and recommendations of the Missouri pilot  evaluation report to strengthen future Corporate Security Reviews;  and    enhancing direct coordination with state governments to expand  the Transportation Security Administration’s field inspection  Corporate Security Review capacities;    consequence assessments of the commercial vehicle sector, or  developing alternative strategies to assess potential consequences of  attacks, such as coordinating with other Sector-Specific Agencies to  leverage their consequence assessment efforts. 2. (3) To what extent has TSA coordinated its  strategy and efforts for securing commercial vehicles with other federal  entities, states and private sector stakeholders? We also met with  TSA HMC officials and interviewed officials from truck and bus companies  that had undergone CSRs.
Why GAO Did This Study

Numerous incidents around the world have highlighted the vulnerability of commercial vehicles to terrorist acts. Commercial vehicles include over 1 million highly diverse truck and intercity bus firms. Within the Department of Homeland Security (DHS), the Transportation Security Administration (TSA) has primary federal responsibility for ensuring the security of the commercial vehicle sector, while vehicle operators are responsible for implementing security measures for their firms. GAO was asked to examine: (1) the extent to which TSA has assessed security risks for commercial vehicles; (2) actions taken by key stakeholders to mitigate identified risks; and (3) TSA efforts to coordinate its security strategy with other federal, state, and private sector stakeholders. GAO reviewed TSA plans, assessments, and other documents; visited a nonrandom sample of 26 commercial truck and bus companies of varying sizes, locations, and types of operations; and interviewed TSA and other federal and state officials and industry representatives.

What GAO Found

TSA has taken actions to evaluate the security risks associated with the commercial vehicle sector, including assessing threats and initiating vulnerability assessments, but more work remains to fully gauge security risks. Risk assessment uses a combined analysis of threat, vulnerability, and consequence to estimate the likelihood of terrorist attacks and the severity of their impact. TSA conducted threat assessments of the commercial vehicle sector and has also cosponsored a vulnerability assessment pilot program in Missouri. However, TSA's threat assessments generally have not identified the likelihood of specific threats, as required by DHS policy. TSA has also not determined the scope, method, and time frame for completing vulnerability assessments of the commercial vehicle sector. In addition, TSA has not conducted consequence assessments, or leveraged the consequence assessments of other sectors. As a result of limitations with its threat, vulnerability, and consequence assessments, TSA cannot be sure that its approach for securing the commercial vehicle sector addresses the highest priority security needs. Moreover, TSA has not developed a plan or time frame to complete a risk assessment of the sector. Nor has TSA completed a report on commercial trucking security as required by the Implementing Recommendations of the 9/11 Commission Act (9/11 Commission Act). Key government and industry stakeholders have taken actions to strengthen the security of commercial vehicles, but TSA has not assessed the effectiveness of federal programs. TSA and the Department of Transportation (DOT) have implemented programs to strengthen security, particularly those emphasizing the protection of hazardous materials. States have also worked collaboratively to strengthen commercial vehicle security through their transportation and law enforcement officials' associations, and the establishment of fusion centers. TSA also has begun developing and using performance measures to monitor the progress of its program activities to secure the commercial vehicle sector, but has not developed measures to assess the effectiveness of these actions in mitigating security risks. Without such information, TSA will be limited in its ability to measure its success in enhancing commercial vehicle security. While TSA has also taken actions to improve coordination with federal, state, and industry stakeholders, more can be done to ensure that these coordination efforts enhance security for the sector. TSA signed joint agreements with DOT and supported the establishment of intergovernmental and industry councils to strengthen collaboration. TSA and DOT completed an agreement to avoid duplication of effort as required by the 9/11 Commission Act. However, some state and industry officials GAO interviewed reported that TSA had not clearly defined stakeholder roles and responsibilities consistent with leading practices for collaborating agencies. TSA has not developed a means to monitor and assess the effectiveness of its coordination efforts. Without enhanced coordination with the states, TSA will have difficulty expanding its vulnerability assessments.