While airport operators, not  TSA, retain direct day-to-day operational responsibility for these areas of  security, ATSA’s sections 106, 136, and 138 direct TSA to improve the  security of airport perimeters and the access controls leading to secured  airport areas, as well as measures to reduce the security risks posed by  airport workers, as shown in figure 1. Airport operators are  responsible for implementing TSA security requirements for airport  perimeters, access controls, and airport workers. TSA Has Begun Evaluating Commercial Airport Security but Needs a Better Approach for Assessing Results

TSA has three efforts under way to evaluate the security of commercial  airports’ perimeters and the controls that limit unauthorized access into  secured areas. TSA  acknowledged the importance of conducting these evaluation efforts as an  essential step to determine the need for, and prioritization of, additional  perimeter security and access control security measures. However, TSA has not yet developed a plan  outlining how the results of its compliance inspections will be used to  interpret and help analyze the results of airport vulnerability assessments  and covert testing. TSA Has Begun Efforts but Has Not Fully Developed Plans to Fund Security Enhancements and Assess Security Technologies

Through funding of a limited number of security enhancements, TSA has  helped to improve perimeter and access control security at some airports. Without a plan, TSA could be less able to document, measure,  and improve the effectiveness of the agency’s efforts to provide funding  support for enhancing perimeter and access control security. TSA had not developed such a plan. TSA Has Helped to Reduce Potential Security Risks Posed by Airport Workers but Has Not Determined How to Fully Address Legislative Requirements

TSA has taken steps to increase measures to reduce the potential security  risks posed by airport workers, but it has not addressed all of the  requirements in ATSA related to background checks, screening, security  training, and vendor security programs or developed plans that describe  the actions they intend to take to fully address these requirements. For  example, TSA required criminal history records checks and security  awareness training for most, but not all, the airport workers called for in  ATSA (Secs. Despite these  challenges, TSA said the agency is considering the costs, benefits, and  feasibility of issuing a regulation that would require airport vendors to  develop security programs in order to meet the requirements in ATSA. Appendix I: Objectives, Scope, and Methodology

To assess the Transportation Security Administration’s (TSA) efforts to   (1) evaluate the security of airport perimeters and the controls that limit  access into secured airport areas, (2) help airports implement and enhance  perimeter security and access controls by providing funding and technical  guidance, and (3) implement measures to reduce the potential security  risk posed by airport workers, we reviewed pertinent legislation (the  Aviation and Transportation Security Act, or ATSA), regulatory  requirements, and policy guidance.
Why GAO Did This Study

In the 2 years since passage of the Aviation and Transportation Security Act (ATSA), the Transportation Security Administration (TSA) has primarily focused its efforts on improving aviation security through enhanced passenger and baggage screening. The act also contained provisions directing TSA to take actions to improve the security of airport perimeters, access controls, and airport workers. GAO was asked to assess TSA's efforts to: (1) evaluate the security of airport perimeters and the controls that limit access into secured airport areas, (2) help airports implement and enhance perimeter security and access controls by providing them funding and technical guidance, and (3) implement measures to reduce the potential security risks posed by airport workers.

What GAO Found

TSA has begun evaluating the security of airport perimeters and the controls that limit access into secured airport areas. Specifically, TSA is conducting compliance inspections and vulnerability assessments at selected airports. These evaluations--though not complete--have identified perimeter and access control security concerns. While TSA officials acknowledged that conducting these airport security evaluations is essential to identifying additional perimeter and access control security measures and prioritizing their implementation, the agency has not determined how the results will be used to make improvements to the entire commercial airport system. TSA has helped some airport operators enhance perimeter and access control security by providing funds for security equipment, such as electronic surveillance systems. TSA has also begun efforts to evaluate the effectiveness of security-related technologies, such as biometric identification systems. However, TSA has not begun to gather data on airport operators' historical funding of security projects and current needs to aid the agency in setting funding priorities. Nor has TSA developed a plan for implementing new technologies or balancing the costs and effectiveness of these technologies with the security needs of individual airport operators and the commercial airport system as a whole. TSA has taken some steps to reduce the potential security risks posed by airport workers. However, TSA had elected not to fully address all related ATSA requirements. In particular, TSA does not require fingerprint-based criminal history checks and security awareness training for all airport workers, as called for in ATSA. Further, TSA has not required airport vendors to develop security programs, another ATSA requirement. TSA said expanding these efforts would require a time-consuming rulemaking process and impose additional costs on airport operators. Finally, although not required by ATSA, TSA has not developed a plan detailing when and how it intends to address these challenges.