1). 2). Most federal departments and agencies are generally responsible for  protecting their own facilities and have physical security programs in  place to do so. Selected Agencies’ Assessment Methodologies Do Not Fully Align with the ISC’s Risk Management Standard

None of the four selected agencies’ security assessment methodologies  fully aligned with the ISC Standard. Specifically, methodologies must:  consider all of the undesirable events identified in the ISC Standard  as possible risks to federal facilities, and assess three factors of risk (threats, vulnerabilities, and  consequences) for each of the events. In addition, the agencies did not always  adhere to these principles of risk management (see table 1). For example, they may not be able to assess whether to  acquire or forego costly physical-security countermeasures—such as, X- ray machines, access control systems, and closed-circuit television  systems—for facilities. In conducting risk assessments that do  not fully align with the ISC Standard (i.e., not assessing threats,  vulnerabilities, and consequences and measuring risks), agencies miss  the opportunity for more informed funding decisions. Selected Agencies Reported Facing Challenges in Conducting Security Assessments and Monitoring Results

		Agencies Have Not Conducted Timely Security Assessments

Standards for Internal Control state that agencies should use quality  information on an ongoing basis as a means to monitor program activities  and take corrective action, as necessary. We found that three of  the four agencies (CBP, ARS, and the Forest Service) did not meet this  requirement. Since the ISC issued its standard in 2010, ARS and the Forest Service  have assessed their higher-level facilities at least once. Specifically, security specialists have not  conducted required reassessments of two ARS and one Forest Service  higher-level facilities. Consequently, these agencies cannot  reasonably ensure that they have full knowledge of the risks to their  facilities. Without having long-term, agency-wide information to monitor whether  assessments are conducted on schedule, ARS and the Forest Service  may not meet the ISC Standard, resulting in not adequately protecting  their facilities and employees. FAA’s policy does not require ongoing monitoring of physical security  information, such as the status of recommended countermeasures or  assessment schedules. During our review, agencies improved  their methodologies to better align with the ISC Standard, but the  agencies had not yet incorporated the methodologies into their policies  and procedures. Recommendations for Executive Action

To improve agencies’ physical security programs’ alignment with the ISC  Risk Management Process for Federal Facilities and Standards for  Internal Control in the Federal Government for information and  monitoring, we recommend that the   Commissioner of U.S. Customs and Border Protection take the following  three actions: with regard to the updated Security Policy and Procedures Handbook,  the ISC’s Risk Management Process for Federal Facilities  requirement to assess all undesirable events, consider all three  factors of risk, and document deviations from the standard, and data collection and analysis requirements for monitoring the  performance of CBP’s physical security program. revise the assumptions used in the plan to address the backlog to  balance assessments with competing priorities, such as updating the  policy manual and reviewing new construction design, to develop a  feasible time frame for completing the assessment backlog. Secretary of Transportation direct the FAA Administrator to take the  following three actions: develop a plan that provides sufficient details on the activities needed  and time frames within the date when FAA will implement an  improved methodology; update FAA’s policy to require the use of a methodology that fully  aligns with the ISC’s Risk Management Process for Federal Facilities  for assessing all undesirable events, considering all three factors of  risk, and documenting all deviations from the standard  countermeasures; and update FAA’s policy to include ongoing monitoring of physical security  information. Secretary of Agriculture take the following two actions:  include data collection and analysis requirements for monitoring the  performance of agencies’ physical security programs, in the  department’s revised physical-security manual, and direct the Administrator of the Agricultural Research Service and the  Chief of the Forest Service to  implement and monitor a long-term assessment schedule with key  milestones to ensure that higher-level facilities are reassessed at  least once every 3 years. Appendix I: Objectives, Scope, and Methodology

This report examines: (1) how selected agencies’ assessment  methodologies align with the Interagency Security Committee’s (ISC) risk  management standard for identifying necessary countermeasures and (2)  what management challenges, if any, selected agencies reported facing  in conducting physical security assessments and monitoring the results. 2. 3. We interviewed security officials at ISC; three departments (DHS, DOT,  and USDA); and four agencies (CBP, FAA, ARS, and the Forest Service). This public version was also prepared in accordance with these  standards.
Why GAO Did This Study

Protecting federal employees and facilities from security threats is of critical importance. Most federal agencies are generally responsible for their facilities and have physical security programs to do so.
GAO was asked to examine how federal agencies assess facilities' security risks. This report examines: (1) how selected agencies' assessment methodologies align with the ISC's risk management standard for identifying necessary countermeasures and (2) what management challenges, if any, selected agencies reported facing in conducting physical security assessments and monitoring the results.
GAO selected four agencies—CBP, FAA, ARS, and the Forest Service—based on their large number of facilities and compared each agency's assessment methodology to the ISC Standard; analyzed facility assessment schedules and results from 2010 through 2016; and interviewed security officials. GAO also visited 13 facilities from these four agencies, selected based on geographical dispersion and their high risk level.

What GAO Found

None of the four agencies GAO reviewed—U.S. Customs and Border Protection (CBP), the Federal Aviation Administration (FAA), the Agricultural Research Service (ARS), and the Forest Service—used security assessment methodologies that fully aligned with the Interagency Security Committee's Risk Management Process for Federal Facilities standard (the ISC Standard). This standard requires that methodologies used to identify necessary facility countermeasures—such as fences and closed-circuit televisions—must:
1. Consider all of the undesirable events (i.e., arson and vandalism) identified by the ISC Standard as possible risks to facilities.
2. Assess three factors—threats, vulnerabilities, and consequences—for each of these events and use these three factors to measure risk.
All four agencies used methodologies that included some ISC requirements when conducting assessments. CBP and FAA assessed vulnerabilities but not threats and consequences. ARS and the Forest Service assessed threats, vulnerabilities, and consequences, but did not use these factors to measure risk. In addition, the agencies considered many, but not all 33 undesirable events related to physical security as possible risks to their facilities. Agencies are taking steps to improve their methodologies. For example, ARS and the Forest Service now use a methodology that measures risk and plan to incorporate the methodology into policy. Although CBP and FAA have updated their methodologies, their policies do not require methodologies that fully align with the ISC standard. As a result, these agencies miss the opportunity for a more informed assessment of the risk to their facilities.
All four agencies reported facing management challenges in conducting physical security assessments or monitoring assessment results. Specifically, CBP, ARS, and the Forest Service have not met the ISC's required time frame of every 3 years for conducting assessments. For example, security specialists have not conducted required reassessments of two ARS and one Forest Service higher-level facilities. While these three agencies have plans to address backlogs, CBP's plan does not balance conducting risk assessments with other competing security priorities, such as updating its policy manual, and ARS and the Forest Service lack a means to monitor completion of future assessments. Furthermore, CBP, ARS, and the Forest Service did not have the data or information systems to monitor assessment schedules or the status of countermeasures at facilities, and their policies did not specify such data requirements. For example, ARS and the Forest Service do not collect and analyze security-related data, such as countermeasures' implementation. FAA does not routinely monitor the performance of its physical security program. Without improved monitoring, agencies are not well equipped to prioritize their highest security needs, may leave facilities' vulnerabilities unaddressed, and may not take corrective actions to meet physical security program objectives. This is a public version of a sensitive report that GAO issued in August 2017. Information that the agencies under review deemed sensitive has been omitted.

What GAO Recommends

GAO recommends: (1) that CBP and FAA update policies to require the use of methodologies fully aligned with the ISC Standard; (2) that CBP revise its plan to eliminate the assessments backlog; and (3) that all four agencies improve monitoring of their physical security programs. All four agencies agreed with the respective recommendations.