Furthermore, although  icon and park officials have acquired a variety of technologies to enhance  security, they do not have guidance to evaluate the cost-effectiveness of  proposed or actual countermeasures. The Park Service Lacks a Systematic Approach for Allocating Resources Using Risk Management

Park Service officials at the national, regional, icon, and park levels told us  that security awareness has increased throughout the organization, largely  because of Interior’s initiative to assess security risks at the icons, and the  resources the Park Service has allocated to address these concerns; yet  the Park Service has not formally applied risk management principles for  the rest of its national parks inventory. Hence, efforts in the  other key practice areas—leveraging technology, information sharing and  coordination, performance measurement and testing, and human capital  management—are diminished if they are not part of a risk management  approach which can be the vehicle for using these practices. The Park Service Lacks a Servicewide Approach to Sharing Information Internally and Measuring Performance

The Park Service has information sharing and coordination arrangements  with external organizations at the national, regional, icon, and park levels,  but lacks comparable arrangements for internal security communications  that would allow icon and park officials to share information with one  another on common security problems and solutions. Because the Park Service’s performance  management and testing capability is limited, the agency has little  information on the status and performance of security activities at the  icons and parks it can use to manage day-to-day activities or that Park  Service management can use to strategize security efforts throughout the  organization. As a result, there is little assurance that staff are  equipped to effectively identify and mitigate risks at icons and parks. The Interior IG and OLES officials are also concerned about the Park  Service’s management of security operations at individual icons. Specifically, the Secretary should instruct the Director of  the National Park Service, in consultation with OLES, to develop and  implement   1.  a more comprehensive, routine risk management approach for security  that encompasses the Park Service’s vast inventory of icons and parks,  including developing guidance, standards, and procedures for  conducting risk assessments at the icon and park level and for using  the results to inform resource allocation decisions at the national,  regional, icon, and park levels;  2.  guidance and standards for leveraging security technology, including  how to assess the costs and benefits of countermeasure alternatives  while taking into account risk management results; 3.  an internal communications strategy for security to address  coordination gaps, including a timeline for the development of a  servicewide Web portal for security;  4.  a servicewide performance management and testing program that  includes specific measures and an evaluation component, which can  be used to inform broader risk management decision-making and to  assess security performance; 5.  a strategy for more clearly defining security roles and responsibilities  within the Park Service, which should, among other things, ensure that  the Park Service is well equipped at the national and regional levels to  oversee security improvements; and 6.  a servicewide security training program and related curriculum to  provide staff with the knowledge, skills, and awareness needed to  improve Park Service security practices. Furthermore, as we reported, the Park Service does not have a special  training curriculum for its designated physical security coordinators. Of the six key practices, we used the  following as criteria:    Allocating resources using risk management. Strategic management of human capital.
Why GAO Did This Study

The September 11 terrorist attacks have heightened concerns about the security of the nation's icons and parks, which millions of people visit every year. The National Park Service (Park Service) within the Department of the Interior (Interior) is responsible for securing nearly 400 park units that include icons and other parks. In 2004, GAO identified a set of key protection practices that include: allocating resources using risk management, leveraging technology, information sharing and coordination, performance measurement and testing, and strategic management of human capital. As requested, GAO determined whether the Park Service's security efforts for national icons and parks reflected key practices. To meet this objective, GAO used its key practices as criteria, reviewed five icons and parks to gain firsthand knowledge, analyzed Interior documents, and interviewed Interior officials.

What GAO Found

The Park Service has implemented a range of security improvements since the September 11 terrorist attacks and has worked to integrate security into its primary mission to preserve national icons and parks for the public's enjoyment. For example, it has established a senior-level security manager position and taken steps to strengthen security at the icons, and is developing a risk management program for small parks. These efforts exhibit some aspects of the key protection practices, but GAO found limitations in each of the areas. The Park Service does not allocate resources using risk management servicewide or cost-effectively leverage technology. While the Park Service, with assistance from Interior, has conducted risk assessments and implemented countermeasures to enhance security at the icons, some critical vulnerabilities remain. Moreover, the Park Service has not advanced this risk management approach for icons to the rest of its national parks. Without a servicewide risk management approach, the Park Service lacks assurance that security efforts are focused where they are needed. Furthermore, while icons and parks may use a variety of security technologies and other countermeasures, they do not have guidance for evaluating the cost-effectiveness of these investments, thus limiting assurances of efficiency and cost-effectiveness. Additionally, the Park Service faces limitations with sharing and coordinating information internally and lacks a servicewide approach for routine performance measurement and testing. Although the Park Service collaborates with external organizations, it lacks comparable arrangements for internal security communications and, as a result, parks are not equipped to share information with one another on common security problems and solutions. Furthermore, the Park Service has not established security performance measures and lacks an analysis tool that could be used to evaluate program effectiveness and inform an overall risk management strategy. Thus, icons and parks have little information on the status and performance of security that they can use to manage daily activities or that Park Service management can use to manage security throughout the organization. Finally, strategic human capital management is an area of concern because of the Park Service's lack of clearly defined security roles and a security training curriculum. For example, staff that are assigned security duties are generally not required to meet qualifications or undergo specialized training. Absent a security training curriculum, there is less assurance that staff are well-equipped to effectively identify and mitigate risks at national icons and parks.