Homeland Security: Guidance and Standards Are Needed for Measuring the Effectiveness of Agencies' Facility Protection Efforts

We found a range of examples of performance measures that organizations outside the U.S. government--including private-sector entities, state and local governments, and foreign government agencies--have developed that, collectively, indicate whether facility protection efforts are achieving results. Without effective performance measurement data, decision makers may have insufficient information to evaluate whether their investments have improved security or reduced federal facilities vulnerability to acts of terrorism or other forms of violence. However, agencies faced challenges in further developing and using security performance measures, and there was no governmentwide guidance or standards on measuring facility protection performance to help federal agencies address these challenges. We recommended, in addition to developing such guidance, that the Interagency Security Committee (ISC) communicate its guidance and standards for measuring performance in federal government facility protection to relevant federal agencies. In response, ISC made its guidance and standards entitled, "Use of Physical Security Performance Measures" available on the Department of Homeland Security's website and the guidance intended for use by federal departments and agencies. As a result, this guidance (issued in 2009) provides a performance model that measures inputs and accomplishments, identifies the performance measurement cycle process, and provides examples of physical security performance metrics.

We found a range of examples of performance measures that organizations outside the U.S. government--including private-sector entities, state and local governments, and foreign government agencies--have developed that, collectively, indicate whether facility protection efforts are achieving results. Without effective performance measurement data, decision makers may have insufficient information to evaluate whether their investments have improved security or reduced federal facilities vulnerability to acts of terrorism or other forms of violence. However, agencies faced challenges in further developing and using security performance measures, and there was no governmentwide guidance or standards on measuring facility protection performance to help federal agencies address these challenges. We recommended, in addition to developing such guidance and standards, that the Interagency Security Committee (ISC) ensure that the guidance and standards are updated regularly. In response, ISC issued performance measurement guidance and standards in 2009, entitled, "Use of Physical Security Performance Measures." According to ISC, the guidance provides the foundation for a measurement program that is one of six key management practices the ISC is promoting within the federal physical security committee. In addition, ISC's identification of performance measurement as one of six key practices it is promoting is responsive to the spirit of GAO's recommendation that the guidance be regularly reviewed and updated. As a result, regular review and updating of the guidance should better ensure that agencies have a current performance model that measures inputs and accomplishments, identifies the performance measurement cycle process, and provides examples of physical security performance metrics.

In response to this report, the Interagency Security Committee issued guidance entitled "Use of Physical Security Performance Measures" in 2009. According to ISC, this policy requires all federal agencies to assess and document the effectiveness of their physical security programs through performance measurement and testing. This standard intends to provide guidance on how to establish and implement a comprehensive measurement and testing program.