TSARA Requirements

TSARA includes a number of requirements for TSA, including developing  and submitting a biennial technology investment plan and annual small  business contracting goals reports to Congress, adhering to various  acquisition and inventory policies and procedures, and ensuring  consistency with Federal Acquisition Regulation and departmental  policies and directives. TSA Generally Addressed TSARA Requirements

Since 2016, TSA generally addressed TSARA requirements through its  acquisitions policies and procedures. report) to  Congress 30 days prior to the award of a contract for an SRT acquisition  over $30 million. TSA’s Narrow Application of TSARA Has Resulted in Limited Reporting to Congress on SRT- related Acquisitions

Through July 2018, TSA’s narrow application of TSARA’s report and  certification provision resulted in no SRT acquisitions being reported to  Congress pursuant to TSARA. None of the Over $1 Billion TSA Obligated to Acquire SRT and Associated Services From December 18, 2014 Through July 2018 Resulted in TSA Reporting Under TSARA

TSA did not provide any information on contract awards or task or  delivery orders for the acquisition of SRT and associated services to  Congress under TSARA’s report and certification provision from  enactment through July 2018. Specifically, TSA obligated $591 million for  SRT. TSA’s Policy for Implementing TSARA’s Report and Certification Provision Reflects a Narrow Application of the Act

TSA officials said that none of the agency’s acquisition activities from  enactment through July 2018 invoked TSARA’s report and certification  provision because the activities did not align with TSA’s policy that  identifies SRT acquisitions subject to this provision. TSA’s policy on what  constitutes an SRT and the award of a contract for an SRT acquisition  ultimately determine what acquisitions are subject to TSARA’s report   and certification provision. TSA officials explained that in accordance with its policy, TSA provided its  first three notifications to Congress under TSARA’s report and  certification provision in August 2018, more than 30 days prior to the  award of three new SRT contracts, each with ceiling values in excess of  $30 million. TSA Has Not Effectively Communicated Internally Its TSARA Implementation Decisions

TSA has not effectively communicated its implementation decisions  internally for what constitutes an SRT under TSARA. During our review, TSA’s acquisition program staff were initially  unable to confirm in all instances whether the security-related equipment  they had acquired were subject to TSARA. In the absence of a policy that clearly  states what constitutes an SRT and with several large acquisitions  pending, TSA may be missing an opportunity to ensure effective and  consistent implementation of TSARA. Recommendations for Executive Action

We are making the following three recommendations to TSA:  The TSA Administrator should revise TSA’s policy to require that TSA  also submit information under TSARA’s report and certification provision  prior to the award of contracts and blanket purchase agreements for  services associated with the operation of security-related technology,  such as maintenance and engineering services, that exceed $30 million. In its comments,  reproduced in appendix II, DHS generally concurred with each of the  three recommendations and described steps it plans to take to implement  them. DHS also described planned actions to address our recommendation to  revise TSA’s policy to include reporting on individual task and delivery  orders that exceed $30 million. If implemented, this action should provide Congress  with greater transparency over TSA’s SRT acquisitions.
Why GAO Did This Study

Enacted in December 2014, TSARA introduced legislative reforms to promote greater transparency and accountability in TSA's SRT acquisitions.
TSARA contains a provision that GAO submit two reports to Congress on TSA's progress in implementing TSARA. In February 2016, GAO issued the first report that found TSA had taken actions to address TSARA.
This second report examines TSA's (1) progress in addressing TSARA requirements since 2016, (2) reporting to Congress on SRT acquisitions, and (3) internal communication of its implementation decisions. GAO examined TSARA and TSA documents and guidance; analyzed TSA contract data and reports from TSARA's enactment in December 2014 through July 2018 and September 2018, respectively; and interviewed DHS and TSA officials on actions taken to implement TSARA. GAO also conducted interviews with TSA officials on parameters for reporting on SRT acquisitions.

What GAO Found

Since 2016, the Transportation Security Administration (TSA) generally addressed Transportation Security Acquisition Reform Act (TSARA) requirements through its policies and procedures for acquisition justifications, baseline requirements, and management of inventory. TSA also, among other actions, submitted a technology investment plan and annual small-business contracting goals reports to Congress as required.
Since December 2014, TSA reported limited security-related technology (SRT) acquisitions to Congress under TSARA, submitting its first report in August 2018. TSARA contains a report and certification provision pursuant to which TSA is to submit information to Congress 30 days prior to the award of a contract for an SRT acquisition exceeding $30 million. Through July 2018, TSA obligated about $1.4 billion on SRT and associated services. TSA officials explained that none of these obligations—including 7 SRT orders, each in excess of $30 million—invoked the report and certification provision because the obligations did not align with TSA's implementation policy, which provides that the $30 million threshold relates to the contract ceiling of the initial SRT contract and not to individual task and delivery orders. Revising TSA's policy to include contracts for services that enhance the capabilities of SRT, including any orders for SRT and associated services in excess of $30 million, would better ensure that Congress has the information it needs to effectively oversee TSA's SRT acquisitions.
TSA has not effectively communicated internally its implementation decisions for what constitutes an SRT under TSARA. TSA officials described to GAO that SRT must be equipment that is public facing, but TSA's policy does not clearly state the parameters of what is considered an SRT. Without clear guidance, TSA staff may be unaware of these parameters and how they apply to future acquisitions under TSARA. For example, TSA acquisition program staff were initially unable to confirm for GAO whether the technologies TSA had acquired were SRTs and thus subject to TSARA. Updating TSA policy to include detailed parameters for what constitutes an SRT would better ensure consistency in applying the act.

What GAO Recommends

GAO recommends that TSA revise its policies for the report and certification provision of TSARA to include reporting on task and delivery orders and services associated with SRT, and clarify in policy what constitutes an SRT under TSARA. DHS generally concurred with the recommendations and described steps it plans to take to implement them.