Federal Requirements

Homeland Security Protection Directive-12: HSPD-12 is a 2004  presidential directive establishing the requirement for a mandatory,  government-wide standard for secure and reliable forms of identification  (PIV cards) issued by the federal government to its employees and  contractors. Interagency Security Committee

The ISC is chaired by DHS and consists of 60 federal departments and  agencies. OMB and GSA Have Taken Steps to Fulfill Their Responsibilities to Implement Physical Access Control Systems, but Oversight Is Limited

		OMB and GSA Have Supported Implementing Physical Access Control Systems

OMB and GSA have taken steps to help agencies procure and implement  secure and interoperable GSA-approved physical access control systems  across the federal government. For example, OMB has issued three  guidance memorandums to clarify agency responsibility to use GSA’s  Approved Products List. In 2011 OMB issued a memo that cited DHS guidance that stated  effective in fiscal year 2012 agencies must upgrade existing physical  and logical access control systems to use PIV credentials prior to  using relevant funds for other activities. These five selected agencies are illustrative of the oversight difficulties  that OMB faces because it does not have baseline information about  agencies’ efforts to implement physical access control systems, including  implementation of GSA-approved systems. OMB staff explained that Schedule 84 does not have the  testing and evaluation requirements for PACS equipment on it that  Schedule 70 does. Lack of trained agency officials: Stakeholders told us they believe  that some federal agency officials have limited knowledge of physical  access control system requirements. Staff  said that OMB and GSA are working with ISC to develop a consolidated  guidance document concerning federal identification credentials. For example, ISC is well-positioned to determine  through its membership the extent to which the challenges we identified  are present across the federal government. Additionally, an ISC official told GAO that the ISC  has approved commissioning a working group to assess what additional  guidance related to physical access control would be beneficial for to the  federal physical security community. This two-pronged approach, the  establishment of a baseline and a better understanding of the challenges  agencies face as they implement physical access control systems, could  prove beneficial in achieving the vision of secure, interoperable systems  across departments and agencies. (Recommendation 1)
The Secretary of Homeland Security should direct the ISC, in  collaboration with member agencies, to assess the extent of, and  develop strategies to address, government-wide challenges to  implementing physical access control systems. (Recommendation 2)

	Agency Comments

We provided a draft of this report to the Departments of Commerce,  Justice, and Homeland Security, EPA, GSA, and OMB for their review  and comment. DHS provided written comments and  concurred with our recommendation. Appendix I: Objectives, Scope, and Methodology

Our objectives were: (1) to assess the steps the Office of Management  and Budget (OMB) and the General Services Administration (GSA) have  taken to fulfill their government-wide responsibilities related to physical  access control system implementation requirements and (2) to identify  challenges selected federal agencies face in adhering to federal physical  access control system requirements. To assess the steps OMB and GSA have taken to fulfill their government- wide efforts to implement Homeland Security Presidential Directive 12’s  (HSPD-12) requirements, and to assess progress in these efforts, we  interviewed OMB and GSA about their efforts to ensure that agencies  meet the requirement to use GSA’s Approved Products List. To identify illustrative examples of the progress that individual agencies  have made in using the Approved Products List and implementing other  HSPD-12 requirements, as well as the challenges that they have faced in  doing so, we selected five executive branch agencies.
Why GAO Did This Study

A 2004 federal directive and the related standard set forth a vision for using information technology to verify the identity of individuals accessing federal buildings. The vision calls for secure and reliable forms of identification that work in conjunction with access control systems. Interoperability of these systems across departments and agencies is part of the vision. OMB and GSA have government-wide responsibilities related to this effort. ISC provides guidance to non-military executive branch agencies on physical security issues. GAO was asked to examine PACS implementation efforts.
This report discusses (1) steps OMB and GSA have taken to fulfill their government-wide responsibilities related to PACS and (2) challenges selected federal agencies face in meeting current requirements. For review, GAO analyzed documents from Commerce, GSA, ISC, and OMB. GAO selected five non-military agencies based on factors including number of buildings and geographic location. GAO reviewed relevant requirements and key practices. GAO also interviewed federal agency officials, PACS vendors, and knowledgeable industry officials.

What GAO Found

The Office of Management and Budget (OMB) and the General Services Administration (GSA) have taken steps to help agencies procure and implement secure, interoperable, GSA-approved “physical access control systems” (PACS) for federal buildings. PACS are systems for managing access to controlled areas within buildings. PACS include identification cards, card readers, and other technology that electronically confirm employees' and contractors' identities and validate their access to facilities (see figure). Steps taken include the following:
OMB issued several memos to clarify agencies' responsibilities. For example, OMB issued a 2011 memo citing Department of Homeland Security (DHS) guidance that agencies must upgrade existing PACS to use identity credentials before using relevant funds for other activities. But, GAO found OMB's oversight efforts are hampered because it lacks baseline data on agencies' implementation of PACS. Without such data, OMB cannot meet its responsibility to ensure agencies adhere to PACS requirements or track progress in implementing federal PACS requirements and achieving the vision of secure, interoperable systems across agencies.
GSA developed an Approved Products List that identifies products that meet federal requirements through a testing and evaluation program. Federal agencies are required to use the Approved Products List to procure PACS equipment. GSA also has provided procurement guidance to agencies through its identity management website.
Officials from the five selected agencies that GAO reviewed identified a number of challenges relating to PACS implementation including cost, lack of clarity on how to procure equipment, and difficulty adding new PACS equipment to legacy systems. Officials from OMB, GSA, and industry not only confirmed that these challenges exist but also told GAO that they were most likely present across the federal government. The Interagency Security Committee (ISC), chaired by the DHS and consisting of 60 federal departments and agencies, has a mission to develop security standards for non-military agencies. In this capacity the ISC is well-positioned to determine the extent that PACS implementation challenges exist across its membership and to develop strategies to address them. An ISC official told GAO that the ISC has taken steps to do so including setting up a working group to assess what additional PACS guidance would be beneficial.

What GAO Recommends

GAO recommends (1) that OMB determine and regularly monitor a baseline level of progress on PACS implementation and (2) that ISC assess the extent of, and develop strategies to address, government-wide challenges to implementing PACS. OMB had no comment on the recommendation. DHS concurred with the recommendation to ISC.