Agencies’ Physical Security Programs Are Largely Informed by Institutional Knowledge and ISC Standards

Agencies draw upon a variety of information sources in developing and  continually refining aspects of their physical security programs, such as  how and when to conduct risk assessments, what skills security staff  should have, and how to determine which countermeasures to implement  at their facilities. Although the majority of agencies we surveyed use ISC standards, the  extent of their reliance varies—with some agencies using the standards  extensively to inform their physical security programs and some using  them in a more limited way. For example, officials from the case- study agencies that we interviewed said that certain conditions at their  agencies contribute to their limited use of the standards. Furthermore, according to ISC officials, the Criteria  do not prescribe specific countermeasures and, as a result, can be  used by all agencies regardless of the type of facilities in their  portfolio. Clarifying how  agencies can use the standards regardless of the types of facilities in  their portfolio and in concert with their existing physical security programs  may result in the greater use of the standards. Agencies Use a Range of Management Practices to Oversee Physical Security Activities, but Make Limited Use of These Practices to Help Allocate Resources

		Agencies Use Several Management Practices to Oversee Physical Security and Ensure Program Effectiveness

Based on responses to our survey and our interviews with agency  officials, we found that agencies use a range of management practices  that can contribute to effective oversight of physical security programs,  including: having a manager responsible for physical security, having agency-wide physical-security policies, using risk management practices that compare physical security measuring the performance of physical security programs. A majority of the agencies (24) we surveyed reported that they have  documented agency-wide guidelines for monitoring and overseeing  security programs at individual facilities, as shown in figure 4. Agencies Make Limited Use of Management Practices for Allocating Resources

Among the physical security activities we asked about, agencies we  surveyed identified allocating physical security resources across an  agency’s portfolio as the greatest challenge. For example, as shown  in figure 3, of the 30 agencies responding to the survey question on  whether they have a manager responsible for physical security aspects  we asked about, only 13 reported that they have a manager for allocating  resources based on risk assessments. In contrast, a majority of  agencies reported having managers for other aspects of physical security,  including those related to oversight. The use of management practices for the purposes of resource allocation  is particularly relevant given the challenges cited in this area. As the government’s central forum for exchanging information and  disseminating guidance on physical security at federal facilities, ISC is  well positioned to develop and disseminate guidance on management  practices that can help agencies make funding decisions across a  portfolio of facilities. ISC’s key physical security standards can help  agencies make resource allocation decisions at individual facilities, but  the standards do not currently address management practices for  allocating resources across an agency’s entire portfolio of facilities. ISC has an opportunity to clarify to agencies  how the standards are intended to be used when it disseminates new or  updated standards, provides training to agencies on the standards, or  engages in other outreach regarding the standards. Furthermore, ISC can  use its quarterly meetings with its member agencies as a forum to share  best practices on how the standards are to be used. Recommendations

We recommend that the Secretary of Homeland Security direct ISC to  take the following two actions:
To help achieve the purpose of Executive Order 12977 to enhance  the quality and effectiveness of security of federal facilities, conduct  outreach to all executive branch agencies to clarify how the standards  can be used in concert with agencies’ existing physical security  programs. To help agencies make the most effective use of resources available  for physical security across their portfolios of facilities, develop and  disseminate guidance on management practices for resource  allocation as a supplement to ISC’s existing physical security  standards. Appendix I: Objectives, Scope, and Methodology

The objectives of our review were to examine (1) the sources that inform  how federal agencies conduct their physical security programs and (2) the  management practices that agencies use to oversee physical security  activities and allocate physical security resources. The remaining 32 agencies are included in our review, and in this report  we identify these agencies as the agencies we surveyed. In addition to the survey, we also conducted case studies with five  agencies for more in-depth analysis.
Why GAO Did This Study

GAO has designated federal real property management as a high-risk area due, in part, to the continued challenge of facility protection. Executive branch agencies are responsible for protecting about 370,000 non-military buildings and structures; the Federal Protective Service (FPS) protects over 9,000 of these. ISC--an interagency organization led by the Department of Homeland Security (DHS)--issues physical security standards for agencies' use in designing and updating physical security programs. GAO was asked to review physical security programs at executive branch agencies with facilities that FPS does not protect. This report examines (1) the sources that inform agencies' physical security programs and (2) the management practices agencies use to oversee physical security and allocate resources. GAO reviewed and analyzed survey responses from 32 agencies. GAO also interviewed officials and reviewed documents from 5 of these agencies, which were selected as case studies for more indepth analysis. The survey and results can be found at GAO-13-223SP .

What GAO Found

Agencies draw upon a variety of information sources in developing and updating their physical security programs. The most widely used source, according to survey responses from 32 agencies, is the institutional knowledge or subject matter expertise in physical security that agencies' security staff have developed through their professional experience. The second most used source are standards issued by the Interagency Security Committee (ISC). The standards, which are developed based on leading security practices across the government, set forth a decision-making process to help ensure that agencies have effective physical security programs in place. However, according to survey responses, the extent of agencies' use of ISC standards varied--with some agencies using them in a limited way. Agency officials from the case-study agencies said that certain conditions at their agencies--such as the types of facilities in the agencies' portfolios and their existing physical security requirements--contribute to limited use of the standards. ISC officials said that the standards are designed to be used by all agencies regardless of the types of facilities or their existing security programs; the standards can be customized to the needs of individual facilities and do not require the use of specific countermeasures. ISC has an opportunity to clarify how the standards are intended to be used when it trains agencies on them; during quarterly meetings with member agencies, where ISC can share best practices on the use of the standards; or when ISC engages in other outreach on the standards. Clarifying how agencies can use the standards may result in their greater use. Greater use of the standards may maximize the effectiveness and efficiency of agencies' physical security programs.
Agencies use a range of management practices to oversee physical security activities. For example, 22 surveyed agencies reported that they have a manager at the agency-wide level responsible for monitoring and overseeing physical security at individual facilities. In addition, 22 surveyed agencies reported that they have some documented performance measures for physical security. Such performance measures can help agencies evaluate the effectiveness of their physical security programs and identify changes needed to better meet program objectives. Agencies' use of management practices such as having a physical security manager responsible for allocating resources and using performance measures to justify investment decisions could also contribute to more efficient allocation of physical security resources across an agency's portfolio of facilities. However, some agencies make limited use of such practices to allocate resources. For example, only 13 reported that they have a manager for allocating resources based on risk assessments. In contrast, a majority of agencies reported having managers for other aspects of physical security, including those related to oversight. Greater use of management practices for allocating resources is particularly relevant given that the surveyed agencies identified allocating resources as the greatest challenge. As the government's central forum for exchanging information and disseminating guidance on physical security, ISC is well positioned to develop and disseminate guidance about management practices that can help agencies allocate resources across a portfolio of facilities. However, ISC's key physical security standards do not currently address management practices for allocating resources across an agency's entire portfolio of facilities.

What GAO Recommends

DHS should direct ISC to conduct outreach to executive branch agencies to clarify how its standards are to be used, and develop and disseminate guidance on management practices for resource allocation as a supplement to ISC's existing physical security standards. DHS concurred with these recommendations.