Recommendation: The Under Secretary for Management should ensure that the Office of Program Accountability and Risk Management and component heads execute the Component Acquisition Executive nomination and designation process consistently, as described in its guidance. This should include nominating and designating Component Acquisition Executives to oversee all acquisition programs. (Recommendation 1)

Agency: Department of Homeland Security
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Under Secretary for Management should ensure that the Component Acquisition Executives that are responsible for oversight of acquisition programs comply with Department of Homeland Security direction to complete Component Acquisition Executive support staffing plans. (Recommendation 2)

Agency: Department of Homeland Security
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Under Secretary for Management should identify, in policy or guidance, the expertise that constitutes critical acquisition positions for effective Component Acquisition Executive oversight. (Recommendation 3)

Agency: Department of Homeland Security
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Under Secretary for Management should direct the Office of Program Accountability and Risk Management to establish a time frame for completing its assessment of the Investment Evaluation, Submission, and Tracking (INVEST) system data fields for which the Component Acquisition Executive certification is necessary, based on current use and reporting requirements, and take appropriate actions based on the results. (Recommendation 4)

Agency: Department of Homeland Security
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The FEMA Administrator should improve the completeness and consistency of its communication of the requirement to apply for an SBA disaster loan prior to being considered for SBA-dependent other needs assistance. (Recommendation 1)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The FEMA Administrator should assess the extent to which its process for determining an applicant's eligibility for SBA-dependent other needs assistance limits or prevents survivors' access to IHP assistance, and work with SBA to identify options to simplify and streamline the disaster assistance application process for survivors. (Recommendation 2)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The FEMA Administrator should improve the IHP award determination letters by using federal guidance and best practices for communicating with the public to ensure that applicants understand that an "ineligible" determination does not mean they cannot continue to pursue assistance. (Recommendation 3)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The FEMA Administrator should identify and implement strategies to provide additional information to applicants about how FEMA determined their eligibility for assistance and the amount of assistance to award. (Recommendation 4)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The FEMA Administrator should evaluate the method for communicating changes in IHP standard operating procedures (SOP) to identify ways to improve their accessibility and usability by National Processing Service Center (NPSC) staff. (Recommendation 5)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The FEMA Administrator should use desirable characteristics of employee engagement—including performance feedback, career development, communication, and attention to work-life balance—while completing planned activities for improving morale among call center staff. (Recommendation 6)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The FEMA Administrator should use desirable characteristics of employee engagement—including performance feedback, career development, communication, and attention to work-life balance—when assessing NPSC staff satisfaction scores and identifying additional steps to strengthen employee morale. (Recommendation 7)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The FEMA Administrator should assess the effectiveness of the IHP training and support for NPSC staff during surge events and implement any necessary changes. (Recommendation 8)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The FEMA Administrator should identify and implement strategies to help ensure staff deployed to Disaster Recovery Centers (DRC) have the needed skills and capabilities to provide support and consistent service to survivors. (Recommendation 9)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The FEMA Administrator should identify and implement strategies to provide readily accessible information and resources, such as guidance and training, about the Individuals and Households Program to state, local, tribal, and territorial officials. (Recommendation 10)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The FEMA Administrator should identify and implement best practices for information sharing and coordinating with local officials, and other recovery partners, on the delivery of Transportable Temporary Housing Units in the interim while FEMA completes system improvements. (Recommendation 11)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The FEMA Administrator should correct and refine the methodology used to survey survivor experiences with the IHP by (1) weighting the survey data to reflect the stratification of its survey design, (2) adjusting the base sampling weights for survey nonresponse within each stratum, and (3) calculating the sampling error for the survey data after adjusting the base sampling weights for nonresponse. (Recommendation 12)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The FEMA Administrator should complete the following key process improvement activities as part of its effort to redesign the Individual Assistance Program: (1) engage with additional program customers and stakeholders to obtain a more comprehensive understanding of their needs; (2) assess performance gaps between current processes and customer and stakeholder needs, and develop measurable and achievable improvement goals to address any identified performance gaps; and (3) prioritize the processes that need improvement based on documented selection criteria. (Recommendation 13)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The FEMA Administrator should establish time frames for finalizing the Individual Assistance Division's draft strategic plan and developing implementation plans that integrate its IHP improvement efforts. (Recommendation 14)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commandant of the Coast Guard should ensure that the Program Manager of the Vessel Response Plan Program establishes a process to analyze incidents where VRPs have been activated to determine whether or how the Coast Guard should improve its VRP review processes—including its approach to verifying plan information, contracts, and the quality of data used in review processes-- to assure VRP effectiveness. (Recommendation 1)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commandant of the Coast Guard should ensure that the Vessel Response Plan Program, in developing the charter and plan of action for the Maritime Oil Spill Response Plan Advisory Group, adopts key practices of program management. These practices include—outlining the (1) systems and methods to be used by the group to carry out its work and monitor progress on achieving desired outcomes, (2) roles and responsibilities of stakeholders involved, (3) mechanisms by which potential improvements identified by the group will be incorporated by the Vessel Response Plan Program into its processes and how such progress will be measured, (4) time frames and milestones for carrying out actions under the plan, and (5) mechanisms by which the group will obtain and incorporate feedback from the maritime industry. (Recommendation 2)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of DHS's Cybersecurity and Infrastructure Agency should assess EPA data when planning outreach to public water system and wastewater treatment works facilities (Recommendation 1).

Agency: Department of Homeland Security
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of FEMA should plan and conduct regular fraud risk assessments of PA emergency work grants to determine a fraud risk profile that aligns with leading practices as provided in the Fraud Risk Framework. Specifically, this process should include (1) identifying inherent fraud risks to PA grant funds, (2) assessing the likelihood and impact of inherent fraud risks, (3) determining fraud risk tolerance, (4) examining the suitability of existing fraud controls, and (5) documenting the fraud risk profile. (Recommendation 1)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of FEMA should designate one entity as the lead entity with responsibility for providing oversight of agency-wide efforts to manage fraud risks to PA emergency work grants, including managing the fraud risk assessment process, consistent with leading practices. (Recommendation 2)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of FEMA should update key training and guidance documents for the PA grant program to include information on where and how to report suspected fraud, and direct PA recipients to include such information in key training and guidance documents they provide to subrecipients. (Recommendation 3)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of FEMA should update key resources, such as training and guidance documents, FEMA makes available to PA applicants to ensure these resources consistently communicate information on the highest fraud risks to PA emergency work grant funds and applicants' responsibilities for managing those risks. The highest fraud risks may include risks related to procurement and debris removal, and other risks FEMA identifies through fraud risk assessments. (Recommendation 4)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of FEMA should implement program-specific antifraud training for PA staff who work directly with PA applicants; this training should include information on the highest fraud risks to PA emergency work grants. The highest fraud risks may include risks related to procurement and debris removal, and other risks FEMA identifies through fraud risk assessments. (Recommendation 5)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Under Secretary for Management should develop and implement a mechanism to compare component marine operating costs across components and locations, including a cost per vessel underway (float) hour methodology (Recommendation 1).

Agency: Department of Homeland Security
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commissioner of CBP should take steps to develop a streamlined enforcement approach to counterfeit goods in small packages. This may include assessing the feasibility and impact of such an approach, including any potential for cost savings. (Recommendation 1)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of the Federal Emergency Management Agency—who heads one of the agencies leading the COVID-19 response through the Unified Coordination Group—consistent with their roles and responsibilities, should work with relevant federal, state, territorial, and tribal stakeholders to devise interim solutions, such as systems and guidance and dissemination of best practices, to help states enhance their ability to track the status of supply requests and plan for supply needs for the remainder of the COVID-19 pandemic response. (Recommendation 4)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Homeland Security, in coordination with the Secretary of Defense, should (1) revise the criteria in the 2019 National Interest Action code memorandum of agreement to clearly identify steps they will take to obtain input from key federal agencies prior to extending or closing a National Interest Action code, (2) establish timelines for evaluating the need to extend a National Interest Action code, and (3) define what constitutes a consistent decrease in contract actions and routine contract activity to ensure the criteria for extending or closing the National Interest Action code reflect government-wide needs for tracking contract actions in longer term emergencies, such as a pandemic. (Recommendation 13)

Agency: Department of Homeland Security
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commissioner of CBP should ensure that the Biometric Entry-Exit Program's privacy notices contain complete and current information, including all of the locations where facial recognition is used and how travelers can request to opt out as appropriate. (Recommendation 1)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commissioner of CBP should ensure that the Biometric Entry-Exit Program's privacy signage is consistently available at all locations where CBP is using facial recognition. (Recommendation 2)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commissioner of CBP should direct the Biometric Entry-Exit Program to develop and implement a plan to conduct privacy audits of its commercial partners', contractors', and vendors' use of personally identifiable information. (Recommendation 3)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commissioner of CBP should develop and implement a plan to ensure that the biometric air exit capability meets its established photo capture requirement. (Recommendation 4)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commissioner of CBP should develop a process by which Biometric Entry-Exit program officials are alerted when the performance of air exit facial recognition falls below established thresholds. (Recommendation 5)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of ICE should direct Custody Management to regularly conduct analyses of contracted facility inspections oversight data over time, within and across facilities and regions, and in a manner to enable trends in inspection deficiencies to be identified and addressed. (Recommendation 1)

Agency: Department of Homeland Security: United States Immigration and Customs Enforcement
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of ICE should direct the Office of Detention Oversight and Custody Management to take steps to ensure that data on deficiencies identified through Office of Detention Oversight's inspections are recorded in a format that is accessible to Custody Management for analysis purposes. (Recommendation 2)

Agency: Department of Homeland Security: United States Immigration and Customs Enforcement
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of ICE should regularly conduct analyses of data on deficiencies identified through Office of Detention Oversight's inspections. (Recommendation 3)

Agency: Department of Homeland Security: United States Immigration and Customs Enforcement
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of ICE should ensure that all Operational Review Self-Assessment results and corrective actions are recorded in a format that is conducive to tracking and analysis. (Recommendation 4)

Agency: Department of Homeland Security: United States Immigration and Customs Enforcement
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of ICE should regularly conduct analyses of detention-related complaint data from relevant offices, including analyses of data over time, within and across facilities and regions, and at a level necessary to identify and address potentially reoccurring complaints. (Recommendation 5)

Agency: Department of Homeland Security: United States Immigration and Customs Enforcement
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of ICE should require that ERO field offices record any actions taken on, and the resolutions of, detention-related complaints referred to them from the Detention Reporting and Information Line and Administrative Inquiry Unit in a timely manner. (Recommendation 6)

Agency: Department of Homeland Security: United States Immigration and Customs Enforcement
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Homeland Security should ensure that integrators' solutions provide unique identifiers for hardware on selected agencies' networks. (Recommendation 1)

Agency: Department of Homeland Security
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Homeland Security should ensure that FAA's system integrator records FISMA system information in the agency's CDM tools. (Recommendation 2)

Agency: Department of Homeland Security
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Homeland Security should ensure that IHS's system integrator records FISMA system information in the agency's CDM tools. (Recommendation 3)

Agency: Department of Homeland Security
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Homeland Security should ensure that FAA's system integrator establishes a process to integrate all vulnerability information in the agency's CDM tools, including the time a vulnerability was remediated. (Recommendation 4)

Agency: Department of Homeland Security
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Homeland Security should ensure that IHS's system integrator establishes a process to integrate all vulnerability information in the agency's CDM tools, including the time a vulnerability was remediated. (Recommendation 5)

Agency: Department of Homeland Security
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Homeland Security should ensure that SBA's system integrator establishes a process to integrate all vulnerability information in the agency's CDM tools, including the time a vulnerability was remediated. (Recommendation 6)

Agency: Department of Homeland Security
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commandant of the Coast Guard should conduct a standards-specific review of the Coast Guard's regulations that incorporate standards and, if necessary, update the regulations or document its decision for not updating them. (Recommendation 7)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: In the Department of Homeland Security's comments on a draft of our report, the department concurred with our recommendation and stated that it conducts such reviews as part of its ongoing public rulemaking process. We plan to follow-up on the status of the recommendation.

Recommendation: The Commandant of the Coast Guard should update the agency's process for conducting standards-specific reviews to include time frames for completing such reviews every 3 to 5 years. (Recommendation 8)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: In the Department of Homeland Security's comments on a draft of our report, the department concurred with our recommendation and stated that the Coast Guard is in the process of updating its policy, "Standards Program For Marine Safety, Security, and Environmental Protection Programs," with timeframes for completing standards-specific reviews. The department estimated this would be completed in September 2021.

Recommendation: The Commandant of the Coast Guard should develop and implement workforce planning for the Office of Operating and Environmental Standards that addresses the four remaining key principles for strategic workforce planning. (Recommendation 9)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: In the Department of Homeland Security's comments on a draft of our report, the department concurred with our recommendation and stated that it is in the process of updating its Manpower Requirements Plan to include timeframes and milestones for completing manpower requirements analyses and determinations for positions and units. The Coast Guard anticipates promulgating the updated plan in March 2022.

Recommendation: The TSA Administrator should establish quantifiable targets for the Surface Transportation Security Inspectors Program's activity-level performance measures. (Recommendation 1)

Agency: Department of Homeland Security: Transportation Security Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commandant of the Coast Guard should ensure that the Deputy Commandant for Mission Support assesses and addresses the causes of data errors and inconsistent entries in MISLE as identified by program offices and MISLE users, including reviewing MISLE training and data validation processes. (Recommendation 1)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commandant of the Coast Guard should ensure that the Deputy Commandant for Mission Support uses the results of its 2019 Standardization Team assessment of command centers to develop a plan for improving the consistency and accuracy of MISLE data identified in its report. (Recommendation 2)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commandant of the Coast Guard should ensure that the Deputy Commandant for Mission Support and the Deputy Commandant for Operations use the processes outlined in the SELC to identify needed enhancements across the MISLE system by developing an updated mission needs statement. (Recommendation 3)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commandant of the Coast Guard should ensure that the Deputy Commandant for Mission Support and the Deputy Commandant for Operations use the processes outlined in the SELC to identify and analyze alternatives, and objectively select the preferred solution for MISLE to meet approved mission needs. (Recommendation 4)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commissioner of CBP should develop and implement additional guidance for ensuring funds appropriated for specific purposes are obligated consistent with the purpose of the funds. (Recommendation 1)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: DHS concurred with this recommendation and said it would take steps to implement it. In July 2020, CBP's Office of Finance issued new guidance on how to execute the remaining funds CBP received in the 2019 Emergency Supplemental. In September 2020, the CBP Budget Directorate's Program Analysis Division also updated its standard operating procedures to describe how it will review samples of purchase requests for supplemental funds. To fully implement our recommendation, CBP should develop and implement guidance for ensuring all funds appropriated for specific purposes, including future appropriations CBP may receive, are obligated consistent with the purpose of the funds.

Recommendation: The Commissioner of CBP should establish and document oversight roles and responsibilities to ensure funds appropriated for specific purposes are obligated consistent with the purpose of the funds. (Recommendation 2)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: DHS concurred with this recommendation and said it would take steps to implement it. In September 2020, the CBP Budget Directorate's Program Analysis Division updated its standard operating procedures to describe how it will review samples of purchase requests for supplemental funds. To fully implement our recommendation, CBP should establish and document oversight roles and responsibilities to ensure all funds appropriated for specific purposes, including regular appropriations, are obligated consistent with the purpose of the funds.

Recommendation: The Commissioner of CBP should develop and implement oversight mechanisms for CBP's implementation of policies and procedures relating to medical care for individuals in its custody to include documentation of expected practices, metrics and corresponding performance targets, and roles and responsibilities for taking corrective action. (Recommendation 3)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: DHS concurred with this recommendation and said it would take steps to implement it. We will continue to monitor DHS' efforts to address this recommendation.

Recommendation: The Commissioner of CBP should document what information it is using to assess whether to offer the influenza vaccine to individuals in custody, including how it weighs costs and benefits. (Recommendation 4)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: DHS concurred with this recommendation and said it would take steps to implement it. We will continue to monitor DHS' efforts to address this recommendation.

Recommendation: The Commissioner of CBP should develop and implement training on recognizing medical distress in children for all CBP officers and Border Patrol agents who may come into contact with children in custody. (Recommendation 5)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: DHS concurred with this recommendation and said it would take steps to implement it. We will continue to monitor DHS' efforts to address this recommendation.

Recommendation: The Commissioner of CBP should provide additional guidance to field personnel to ensure they classify significant incident reports on deaths, serious injuries, and suicide attempts, in accordance with CBP policy. (Recommendation 7)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: DHS concurred with this recommendation and said it would take steps to implement it. We will continue to monitor DHS' efforts to address this recommendation.

Recommendation: The Commissioner of CBP should update the Significant Incident Reporting System to include categories that align with CBP's directive on the reporting of significant incidents. (Recommendation 8)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: DHS concurred with this recommendation and said it would take steps to implement it. We will continue to monitor DHS' efforts to address this recommendation.

Recommendation: The Commissioner of CBP should provide additional guidance to components on the procedures for reporting deaths in custody to OPR and other entities within CBP. (Recommendation 9)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: DHS concurred with this recommendation and said it would take steps to implement it. We will continue to monitor DHS' efforts to address this recommendation.

Recommendation: The Commissioner of CBP should ensure that timely, reliable information on deaths in custody is reported to Congress, as directed, and maintain documentation on those reports. (Recommendation 10)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: DHS concurred with this recommendation and said it would take steps to implement it. We will continue to monitor DHS' efforts to address this recommendation.

Recommendation: The Commandant of the Coast Guard should develop formal performance goals and measures for its Spouse Employment Assistance Program. (Recommendation 3)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Acting Commissioner of CBP should better communicate to stakeholders the types of information stakeholders could collect and submit to CBP to help the agency initiate and investigate forced labor cases related to seafood and, as appropriate, other goods. (Recommendation 1)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary should ensure that the Director of Strategic Technology Management (STM), in collaboration with other members of the Information Technology Program Management Center of Excellence (ITPM COE), identifies the skills and resources needed to complete the work intended for the upcoming fiscal year, including the availability of supplementary staff, such as subject matter experts. (Recommendation 1)

Agency: Department of Homeland Security
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary should ensure that the Executive Steering Committee overseeing the activities of the ITPM COE establishes target measures for the department's desired outcomes of its transition to Agile development. (Recommendation 2)

Agency: Department of Homeland Security
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary should ensure that the DHS Chief Information Officer (CIO) defines a process and associated set of controls to ensure that Agile programs and projects are reporting a set of core required performance metrics for monitoring and measuring Agile adoption. (Recommendation 3)

Agency: Department of Homeland Security
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary should ensure that the ITPM COE, in coordination with the CIO, begins measuring results associated with the transition to Agile and the success of the transition based on its impact on the department. (Recommendation 4)

Agency: Department of Homeland Security
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary should ensure that the CIO, in collaboration with the Chief Procurement Officer, through the Homeland Security Acquisition Institute, establish Agile training requirements for senior stakeholders. (Recommendation 5)

Agency: Department of Homeland Security
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary should ensure that the Chief Human Capital Officer, in collaboration with the CIO, consider modifications to the current employee recognition and performance management governance to ensure that teamwork and team performance of Agile programs and projects are incentivized. (Recommendation 6)

Agency: Department of Homeland Security
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary should ensure that the CIO, in collaboration with the Chief Procurement Officer, through the Homeland Security Acquisition Institute, establish Agile training requirements for staff outside of the acquisition workforce but assigned to Agile programs. (Recommendation 7)

Agency: Department of Homeland Security
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary should ensure that the CIO, upon establishing a set of core performance metrics, tracks and monitors the pace of Agile team development. (Recommendation 8)

Agency: Department of Homeland Security
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary should ensure that the CIO, in collaboration with the Executive Director of the Office of Program Accountability and Risk Management (PARM), update or develop new guidance on Agile methodologies to describe how Agile teams can estimate the relative complexity of user stories. (Recommendation 9)

Agency: Department of Homeland Security
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary should ensure that the CIO, upon establishing a set of core performance metrics, sets expectations for automated testing and code quality, and tracks and monitors against those expectations. (Recommendation 10)

Agency: Department of Homeland Security
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Homeland Security should align the agency's contingency plan with OMB guidance by including (1) plans for a potential prolonged shutdown; (2) flexibilities available to supervisors if furloughed employees were unable to return to work after the end of the shutdown; and (3) procedures for resuming program activities, including steps to ensure appropriate oversight and disbursement of funds upon the end of a shutdown. (Recommendation 2)

Agency: Department of Homeland Security
Status: Open

Comments: The Department of Homeland Security agreed with the recommendation and and stated that it has begun to take steps to better address OMB guidance on contingency plans. When we confirm what actions DHS has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commissioner of CBP should develop internal controls to track and document which employees worked and what work was performed daily during a government shutdown. (Recommendation 7)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: The Department of Homeland Security agreed with the recommendation and stated that Customs and Border Protection plans to analyze existing systems to determine which is best suited to track and document employee work during a government shutdown and will ensure that the chosen system is available should a future shutdown occur. When we confirm what actions CBP has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commissioner of CBP should develop internal controls to limit access to physical workspaces to appropriate employees during a government shutdown. (Recommendation 8)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: The Department of Homeland Security (DHS) agreed with the recommendation but stated that because Customs and Border Protection (CBP) does not have systems capable of efficiently restoring physical access for furloughed employees, it would have to reinstate employee access individually and the cost would be substantial. DHS stated that CBP plans to update procedures to ensure more comprehensive workspace access guidance for furloughed employees. We continue to believe that physical access controls are important during shutdowns in order to prevent misuse of government resources. We encourage CBP to improve their systems to be able to efficiently implement such controls and will monitor CBP's efforts going forward.

Recommendation: The Commissioner of CBP should develop internal controls to limit access to virtual workspaces to appropriate employees during a government shutdown. (Recommendation 11)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: The Department of Homeland Security (DHS) agreed with the recommendation. DHS stated that Customs and Border Protection (CBP) believes that furloughed employees must be able to passively monitor the status of the government shutdown and access important agency communications using DHS-issued electronic devices. Additionally, disabling and reactivating thousands of employee user accounts during a shutdown posed a significant burden. DHS said that CBP plans to update shutdown procedures to clarify allowed use of DHS-issued electronic devices by furloughed employees. We agree that CBP should update procedures on workspace access as suggested, and continue to believe that virtual access controls are important during shutdowns in order to prevent misuse of government resources. We encourage CBP to improve their systems to be able to efficiently implement such controls and will monitor CBP's progress going forward.

Recommendation: The Assistant Director of the Infrastructure Security Division should implement a documented process for reviewing and, if deemed necessary, revising its guidance for implementing cybersecurity measures at regularly defined intervals. (Recommendation 1)

Agency: Department of Homeland Security: Cybersecurity and Infrastructure Security Agency
Status: Open

Comments: DHS concurred with this recommendation and stated that CISA's Infrastructure Security Division (ISD) will work to develop a documented process for reviewing CFATS cybersecurity guidance at regularly defined intervals. DHS stated in its comments that once the process is documented and implemented, ISD will revise or supplement existing guidance, as appropriate. We will continue to monitor DHS's actions to address the recommendation.

Recommendation: The Assistant Director of the Infrastructure Security Division should incorporate measures to assess the contribution that its cybersecurity training is making to program goals, such as inspector- or program-specific performance improvement goals. (Recommendation 2)

Agency: Department of Homeland Security: Cybersecurity and Infrastructure Security Agency
Status: Open

Comments: DHS concurred with this recommendation stated that CISA agrees that it is important to ensure training supports program goals, whether relating to inspector-specific or program-specific performance maintenance or improvement goals. Regarding inspector performance maintenance or improvement, DHS stated that, among other things, management will ensure that each inspector's individual performance plan fully captures their expected performance goals in the area of cybersecurity. We will continue to monitor DHS's actions to address this recommendation.

Recommendation: The Assistant Director of the Infrastructure Security Division should track delivery and performance data for its cybersecurity training, such as the completion of courses, webinars, and refresher trainings. (Recommendation 3)

Agency: Department of Homeland Security: Cybersecurity and Infrastructure Security Agency
Status: Open

Comments: DHS concurred with this recommendation and stated that CISA agrees that process improvements to better document and evaluate the effectiveness of the training provided to CFATS staff are worthwhile. DHS stated in its comments that CISA will establish policies and procedures intended to ensure that all cybersecurity training provided to chemical security personnel is accounted for in a centralized mechanism. We will continue to monitor DHS's actions taken to address this recommendation.

Recommendation: The Assistant Director of the Infrastructure Security Division should develop a plan to evaluate the effectiveness of its cybersecurity training, such as collecting and analyzing course evaluation forms. (Recommendation 4)

Agency: Department of Homeland Security: Cybersecurity and Infrastructure Security Agency
Status: Open

Comments: DHS concurred with this recommendation and stated that evaluating the effectiveness of training is beneficial and CISA will work to ensure that all cybersecurity courses provided to CISA chemical security staff are evaluated for effectiveness. DHS also stated that, among other things, CISA will require course evaluation forms from each attendee of any cybersecurity training provided by CISA to its chemical facility staff. We will continue to monitor DHS's actions to address this recommendation.

Recommendation: The Assistant Director of the Infrastructure Security Division should develop a workforce plan that addresses the program's cybersecurity-related needs, which should include an analysis of any gaps in the program's capacity and capability to perform its cybersecurity-related functions, and human capital strategies to address them. (Recommendation 5)

Agency: Department of Homeland Security: Cybersecurity and Infrastructure Security Agency
Status: Open

Comments: DHS concurred with this recommendation and stated that CISA will develop a concept of operations, which will include goals and requirements for a workforce review and planning effort to ensure the organization addresses the new program's capacity and capability to perform its regulatory, voluntary, and programmatic goals, to include its cybersecurity related functions. We will continue to monitor DHS's actions to address this recommendation.

Recommendation: The Assistant Director of the Infrastructure Security Division should maintain reliable, readily available information about the cyber integration levels of covered chemical facilities and inspector cybersecurity expertise. This could include updating the program's inspection database system to better track facilities' cyber integration levels. (Recommendation 6)

Agency: Department of Homeland Security: Cybersecurity and Infrastructure Security Agency
Status: Open

Comments: DHS concurred with this recommendation and stated that CISA retains information on cyber integration levels for regulated facilities but that it is not in a readily accessible format. DHS stated in its comments that ISD will execute a contract for new information technology development support for the CSAT system which, once executed, will work with the new support contractor to build a tool to automate the locating and reporting of a facility's cyber integration level data in a more accessible format. We will continue to monitor the status of DHS's actions to address this recommendation.

Recommendation: The Secretary of Homeland Security should direct the DHS Chief Procurement Officer to, in coordination with the Office of Program Accountability and Risk Management, develop a risk-based approach for reviewing service requirements—through the Procurement Strategy Roadmap or other means—to ensure proposed service requirements are clearly defined and reviewed before planning how they are to be procured. (Recommendation 1)

Agency: Department of Homeland Security
Status: Open

Comments: DHS disagreed with our recommendation, preferring to maintain the status quo in its policy and procedures. However, by doing so, DHS is missing important opportunities to prevent negative acquisition outcomes and the potential for wasted resources. In its response, DHS noted its processes for major acquisitions, however, DHS service programs and contracts did not rise to the level of being classified a major service acquisition.

Recommendation: The Secretary of Homeland Security should direct the DHS Chief Procurement Officer to document the factors the Office of the Chief Procurement Officer considers when waiving procurement actions from its Procurement Strategy Roadmap to ensure it is consistently considering potential acquisition risks in its planning—including those specific to services. (Recommendation 2)

Agency: Department of Homeland Security
Status: Open

Comments: DHS did not concur with this recommendation, maintaining that the factors considered when waiving a Procurement Strategy Roadmap are not static. We believe, however, that documenting the factors considered will help ensure that the decisions to waive the Procurement Strategy Roadmaps are made consistently, transparently, and help maintain institutional knowledge.

Recommendation: The Secretary of Homeland Security should direct the DHS Chief Procurement Officer to update the Inherently Governmental and Critical Functions Analysis to require the identification of special interest functions. (Recommendation 3)

Agency: Department of Homeland Security
Status: Open

Comments: DHS concurred with this recommendation and stated that it will update the Inherently Governmental and Critical Functions Analysis job aid to require the identification of a special interest function when applicable.

Recommendation: The Secretary of Homeland Security should direct the DHS Chief Procurement Officer to update the Inherently Governmental and Critical Functions Analysis to provide guidance for analyzing, documenting, and updating the federal workforce needed to perform or oversee service contracts requiring heightened management attention. (Recommendation 4)

Agency: Department of Homeland Security
Status: Open

Comments: DHS did not concur with this recommendation maintaining that the components are certifying that they have sufficient internal capacity or federal employees available for oversight within the Inherently Governmental and Critical Functions Analysis. We continue to believe, however, that without guidance, each component is making its own determination about which factors to consider, and DHS does not know how or whether the components are considering the federal workforce available to oversee service contracts in need of heightened management attention, or what steps, if any, the components are taking to mitigate risks if there are not enough federal personnel available to oversee the contracts after award.

Recommendation: The Secretary of Homeland Security should direct the DHS Chief Procurement Officer to develop guidance identifying oversight tasks or safeguards personnel can perform, when needed, to mitigate the risk associated with contracts containing closely associated with inherently governmental functions, special interest functions, or critical functions. (Recommendation 5)

Agency: Department of Homeland Security
Status: Open

Comments: DHS concurred with this recommendation and stated that it will develop guidance that identifies oversight tasks or safeguards that personnel can perform, when needed, to mitigate the risk associated with contracts containing closely associated with inherently governmental, special interest, or critical functions.

Recommendation: The Secretary of Homeland Security should direct the DHS Chief Financial Officer to work with Congress to identify information to include in its annual congressional budget justifications to provide greater transparency into requested and actual service requirement costs, particularly for those services requiring heightened management attention. (Recommendation 6)

Agency: Department of Homeland Security
Status: Open

Comments: DHS did not concur with this recommendation stating that its annual Congressional Budget Justification already contains substantial service contract information. We maintain, however, that the service contract information currently included limits visibility for both DHS and Congress into requested and actual service requirements costs.

Recommendation: The Administrator of FEMA should assess different approaches, in addition to community assistance visits, for using existing resources to ensure communities' compliance with NFIP requirements. This should include analyzing alternatives to community assistance visits. (Recommendation 1)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of FEMA should identify appropriate steps to ensure it has complete, up-to-date, and reliable records of community assistance visits, including information on why some visit records remain open for a significant period of time. (Recommendation 2)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of FEMA should ensure that communities are consistently collecting data on their substantial damage assessments and that FEMA has a way to readily access those data to evaluate community compliance with NFIP requirements for rebuilding substantially damaged properties. (Recommendation 3)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of FEMA should clarify with NFIP communities its policies on sharing data on NFIP claims and provide such information to those communities as needed. (Recommendation 4)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: FEMA should, following the completion of the 2021 National Preparedness Report, determine what steps are needed to address the nation's emergency management capability gaps across all levels of government and inform key stakeholders, such as the Office of Management and Budget and Congress, about what level of resources will be necessary to address the known gaps. (Recommendation 1)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: FEMA agreed with the recommendation. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: FEMA should develop guidance to help determine which after-action reviews should be prioritized based on factors, such as the severity of disasters and availability of staff and resources to conduct the review, and implement time frames for following up on incomplete after-action reports. (Recommendation 2)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: FEMA agreed with the recommendation. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: FEMA should develop a mechanism to consistently track best practices, lessons learned, and corrective actions that have been elevated to headquarters for resolution. (Recommendation 3)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: FEMA agreed with the recommendation. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: FEMA should develop guidance on sharing after-action reports and their relevant findings with external stakeholders, when appropriate. (Recommendation 4)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: FEMA agreed with the recommendation. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The FEMA Administrator should develop a plan—with time frames and milestones and input from field leadership—to address identified challenges that have hindered FEMA's ability to provide reliable and complete information to field leaders and managers about staff knowledge, skills, and abilities. (Recommendation 1)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: DHS concurred with our recommendation. In its agency comment letter, the department noted that FEMA plans to engage field leaders on enhancements to its coach-and-evaluator program to develop a plan to address identified challenges. DHS also reported that FEMA plans to increase training offerings and align its curriculum so that FEMA Qualification System status matches workforce capability. DHS anticipates completion by March 31, 2021.

Recommendation: The FEMA Administrator should develop mechanisms, including collecting relevant data, to assess how effectively FEMA's disaster workforce was deployed to meet mission needs in the field. (Recommendation 2)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: DHS concurred with our recommendation. In its agency comment letter, the department reported that FEMA plans to convene subject matter experts to develop mechanisms that demonstrate how effectively FEMA's disaster workforce deploys to meet mission needs in the field. Expected completion is March 31, 2021.

Recommendation: The FEMA Administrator should create a staff development program for FEMA's disaster workforce that, at a minimum, addresses access to training, delivery of on-the-job training and mentoring, use of performance evaluations, and consistent developmental opportunities regardless of deployment status. (Recommendation 3)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: DHS concurred with our recommendation. In its agency comment letter, the department stated that FEMA is working to finalize and implement some staff development initiatives we described in our report, such as the FEMA Deployment Performance Evaluation Directive, which will provide guidance on performance reviews for deployed staff. DHS anticipates that FEMA's efforts to implement will be completed by March 31, 2021.

Recommendation: The Director of USCIS should update published guidance, such as Handbook for Employers: Guidance for Completing Form I-9 (M-274), to consistently identify each of the official mechanisms that USCIS may use to communicate automatic extensions of TPS employment authorization documents.

Agency: Department of Homeland Security: United States Citizenship and Immigration Services
Status: Open

Comments: In its written comments on our draft report, DHS agreed with our recommendation and noted planned actions to implement it, including updating guidance in DHS's M-274 handbook. DHS's planned actions will address the intent of our recommendation if they include updating guidance regarding each of the official mechanisms that USCIS may use to communicate automatic extensions of TPS employment authorization documents, including the use of individually mailed notifications. When we confirm actions that the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The TSA Administrator should update the BASE cybersecurity template to ensure it reflects cybersecurity key practices, including the Detect and Recover functions outlined in the NIST Cybersecurity Framework. (Recommendation 2)

Agency: Department of Homeland Security: Transportation Security Administration
Status: Open

Comments: TSA concurred with this recommendation and said it would take steps to implement it by updating the BASE Cybersecurity Security Action Item section to ensure it reflects the NIST Cybersecurity Framework Detect and Recover functions. When we confirm what actions TSA has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Homeland Security should direct the Director of ICE to develop a strategy for the TTU program to ensure that ICE has a plan to guide its efforts to effectively partner with existing TTUs, and to expand the program, where appropriate, into additional countries. (Recommendation 1)

Agency: Department of Homeland Security: Office of the Secretary
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Homeland Security should direct the Director of ICE to develop a performance monitoring framework for the TTU program that would enable the agency to systematically track program results and how effectively it is achieving the program's goals. (Recommendation 2)

Agency: Department of Homeland Security: Office of the Secretary
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of United States Citizenship and Immigration Services should work with the Assistant Secretary for the Employment and Training Administration to assess options for changing the H-2B visa program and, as warranted, implement changes or submit proposed legislative changes to Congress. DHS and DOL could consider options included in their June 2019 report to Congress and identify those that may be implemented cost effectively and without adversely affecting U.S. workers. (Recommendation 1)

Agency: Department of Homeland Security: United States Citizenship and Immigration Services
Status: Open

Comments: DHS agreed with this recommendation and noted that it plans to work further with DOL to explore options for improving the H-2B visa program and possibly develop proposals for legislative changes.

Recommendation: The Director of United States Citizenship and Immigration Services should work with the Assistant Secretary for the Employment and Training Administration to assess the advantages and disadvantages of considering current economic trends in determining the appropriate number of additional H-2B visas to provide when given this authority by Congress and, as warranted, implement an approach that considers such trends. (Recommendation 3)

Agency: Department of Homeland Security: United States Citizenship and Immigration Services
Status: Open

Comments: DHS did not agree with this recommendation. DHS said it would continue to work with DOL-as it has done in prior years--if and when Congress delegates the authority to make additional H-2B visas available beyond the statutory cap to DHS. The agency also expressed its view that Congress is better positioned to determine whether and how many additional visas should be made available to meet the needs of U.S. businesses. In fiscal years 2017 through 2020, DHS was authorized to increase the number of H-2B visas beyond the statutory cap, after consulting with DOL to determine that "the needs of American businesses [could not] be satisfied...with United States workers..." In exercising this authority in prior years, DHS stated that "[t]he scope of the assessment called for by the statute [in making this determination] is quite broad, and accordingly delegates the Secretary of Homeland Security broad discretion to identify the business needs [s]he finds most relevant." In light of DHS's broad view of its authority, we continue to believe that it would be appropriate for DHS, in consultation with DOL, to assess the advantages and disadvantages of considering current economic trends in determining the appropriate number of additional H-2B visas to provide. If they determine that using such data would be warranted, the agencies would then be well positioned to implement such an approach if DHS is granted such authority in the future. Moreover, if-as DHS stated in its response to our recommendation-the agency believes that Congress is best suited to determine what increases in visa numbers may be needed to meet the needs of U.S. businesses, consistent with protecting American workers, it may wish to work with Congress to draft a legislative proposal reflecting this view.

Recommendation: The Commandant of the Coast Guard should establish a systematic mechanism to track implementation and measure the Coast Guard's progress in achieving organizational change goals. (Recommendation 1)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: The Coast Guard concurred with this recommendation and said it would establish a policy requiring that requests to change organizational structure include a plan, and establish a mechanism to track implementation and measure progress in achieving organizational change goals. The Coast Guard stated that this will be completed by December 31, 2020.

Recommendation: The Commandant of the Coast Guard should establish a mechanism to periodically seek and monitor employee satisfaction with organizational change efforts. (Recommendation 2)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: The Coast Guard concurred with this recommendation and agreed that mechanisms to periodically seek and monitor employee satisfaction with organizational change efforts are valuable. However, they stated that their current feedback mechanisms capture this information therefore they requested we close the recommendation. The Coast Guard also stated its preference to add questions to existing surveys rather than create new survey instruments. However, we found that the Coast Guard's current surveys do not capture employee's perspectives as organizational changes are implemented. This recommendation remains open pending Coast Guard providing evidence of its actions to modify existing surveys with added questions that monitor employee satisfaction with organizational changes.

Recommendation: The Commandant of the Coast Guard should update its Manpower Requirements Manual with guidance for how to execute its manpower requirements determination process, and take steps to ensure the process is implemented. (Recommendation 3)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: The Coast Guard concurred with this recommendation and said it would develop a Tactics, Techniques and Procedures document to provide guidance for executing the manpower requirements determination process. This would provide additional guidance on the overall manpower requirements determination process, including explicit directions for the collection and analysis of manpower data, and the establishment of enterprise standards for key factors and allowances used when conducting analysis. The Coast Guard stated that this will be completed by September 30, 2020.

Recommendation: The Commandant of the Coast Guard should track and document the extent to which it has completed manpower requirements analyses and determinations for each unit type. (Recommendation 4)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: The Coast Guard concurred with this recommendation and said it would initiate the process to document and track Manpower Requirements in the Coast Guard's human resources system. The Coast Guard stated that this would be completed by December 31, 2020.

Recommendation: The Commandant of the Coast Guard should update its April 2018 Manpower Requirements Plan to include time frames and milestones for completing manpower requirements analyses and determinations for all positions and units. (Recommendation 5)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: The Coast Guard concurred with this recommendation and said it would update its Manpower Requirements Plan during the next required periodic report submitted to Congress, in fiscal year 2022. The Coast Guard stated that this would be completed by March 31, 2022.

Recommendation: The Commandant of the Coast Guard should determine the resources its manpower requirements determination program needs, both staff and funding, to achieve its goal of completing manpower requirements determinations for all positions and units. (Recommendation 6)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: The Coast Guard concurred with this recommendation and said it would review its 2010 manpower requirements analysis that determined the resources the Coast Guard required for its manpower requirements determination program. Its Office of Human Resources Strategy and Capability will then re-validate the inputs and update the findings for the manpower requirements analysis to reflect the currents needs of the manpower requirements determination program. The Coast Guard stated that this will be completed by September 30, 2020.

Recommendation: The Secretary of Homeland Security should take steps to consult with respective sector partner(s), such as the SCC and NIST, as appropriate, to collect and report sector-wide improvements from use of the framework across its critical infrastructure sectors using existing initiatives. (Recommendation 8)

Agency: Department of Homeland Security: Office of the Secretary
Status: Open

Comments: In written comments provided in February 2020, the Department of Homeland Security (DHS) stated that it agreed with our recommendation. It noted that in coordination with the IT Sector Coordinating Council, the department recently issued a survey to small and mid-sized IT sector partners to better understand framework adoption and use within the IT sector. Once the results of the survey are received, DHS's Cybersecurity and Infrastructure Security Agency will determine the feasibility of issuing similar surveys to other sectors, and the potential timelines for completing sector-specific survey modifications, issuing surveys, compiling responses, and developing white papers on the status of framework adoption for each sector. The department expects completion of this work by December 31, 2021.

Recommendation: The CBP Commissioner should issue updated Border Patrol and OFO training materials that reflect the correct definition of a family unit and guidance for recording that information. (Recommendation 1)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: DHS concurred with this recommendation. When we confirm what actions the CBP has taken in response to this recommendation, we will provide updated information.

Recommendation: The CBP Commissioner should provide written guidance to Border Patrol agents and OFO officers about what narrative information should be recorded on the child's and the accompanying adult's Forms I-213 to document cases in which CBP determines that a parent–child relationship may be invalid. (Recommendation 2)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: DHS concurred with this recommendation. When we confirm what actions the CBP has taken in response to this recommendation, we will provide updated information.

Recommendation: The CBP Commissioner should develop and implement additional controls to ensure that Border Patrol agents accurately record family unit separations in its data system. (Recommendation 3)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: In commenting on a draft of this report, DHS reported that CBP plans to add enhancements to Border Patrol's processing system that will prompt agents to create family units within the system, when applicable. Upon completion of these enhancements, CBP plans to provide training to agents to describe the enhancements to help ensure that family units are recorded when necessary. DHS estimates these actions will be completed by September 30, 2020. To fully address our recommendations, CBP should develop and implement controls to ensure agents are accurately recording family unit separations in its data system.

Recommendation: The CBP Commissioner should update Border Patrol's and OFO's data systems to ensure data captured on family unit separation reasons clearly align with CBP policy. (Recommendation 4)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: DHS concurred with this recommendation and provided documentation of guidance that OFO and Border Patrol issued about data system updates. We are reviewing the information and documents DHS provided to assess the extent to which CBP fully addressed this recommendation.

Recommendation: The CBP Commissioner should develop and implement additional controls to ensure that Border Patrol agents include a narrative description of a family unit separation on the parent's / legal guardian's and child's Forms I-213, including the reason for the separation. (Recommendation 5)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: DHS concurred with this recommendation. When we confirm what actions the CBP has taken in response to this recommendation, we will provide updated information.

Recommendation: The CBP Commissioner should provide guidance to Border Patrol agents and OFO officers on the narrative information they are to include about family unit separation events on the parent's / legal guardian's and child's Forms I-213. (Recommendation 6)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: DHS concurred with this recommendation. When we confirm what actions the CBP has taken in response to this recommendation, we will provide updated information.

Recommendation: The ICE Director should develop and implement a mechanism to systematically track in its data system the family units ICE separates. (Recommendation 7)

Agency: Department of Homeland Security: United States Immigration and Customs Enforcement
Status: Open

Comments: In commenting on a draft of our report, DHS reported that ICE is modifying its data system to track separations and reunification throughout the Office of Enforcement and Removal Operations' enforcement process. DHS estimates that this process will be complete by September 30, 2020. To fully address this recommendation, ICE should ensure that it has a mechanism in its data system to systematically track the family units it separates.

Recommendation: The Secretary of Homeland Security, jointly with the Secretary of Health and Human Services, should collaborate to address information sharing gaps identified in this report to ensure that ORR receives information needed to make decisions for UAC, including those apprehended with an adult. (Recommendation 8)

Agency: Department of Homeland Security
Status: Open

Comments: In commenting on a draft of our report, DHS reported that the Office of Strategy, Policy, and Plans will work with relevant components and HHS to document current information-sharing practices to validate the remaining gaps and draft a joint plan between DHS and HHS to ensure that HHS receives information needed to make decisions for unaccompanied children, including those apprehended with an adult. DHS estimated that these actions will be completed by December 31, 2020. Further DHS and HHS collaboration about information sharing methods and ways to enhance interagency agreements would better position HHS to make informed and timely decisions for unaccompanied children.

Recommendation: The Secretary of Homeland Security should identify the information about family members apprehended together that its components collectively need to process those family members and communicate that information to its components. (Recommendation 1)

Agency: Department of Homeland Security
Status: Open

Comments: According to DHS, in June 2020, DHS's Office of Immigration Statistics launched a Family Status Data Standards Community of Interest (COI) under the purview of the DHS Immigration Data Integration Initiative. In August 2020, DHS reported that the Family Status COI includes subject matter experts and data system managers from DHS components, the Department of Health and Human Services, and the Executive Office for Immigration Review. The COI's mandate includes drafting common DHS-wide and interagency data standards (common codes, common definitions, common formats) for all topics related to family status, including codes to identify the reasons for family separation, members apprehended together, and unaccompanied children. DHS expects to complete these actions by September 30, 2020. Identifying and communicating department-wide information needs with respect to family members who have been apprehended together should help provide DHS with greater assurance that its components are identifying all individuals who may be eligible for relief from removal from the United States based on their family relationships.

Recommendation: The Secretary of Homeland Security should ensure that, at the time of apprehension, CBP collects the information that DHS components collectively need to process family members apprehended together. (Recommendation 2)

Agency: Department of Homeland Security
Status: Open

Comments: In commenting on a draft of our report, DHS reported that its Office of Immigration Statistics (OIS) will work with relevant components and offices to ensure all required information is collected at the time of apprehension on the Form I-213 when processing family members apprehended together. As of August 2020, DHS reported that DHS OIS continues to work with relevant components and offices to ensure all required information is collected at the time of apprehension on Form I-213 when processing family members apprehended together. DHS expects to complete these actions by September 30, 2020. Collecting information about the relationships between family members apprehended together and documenting that information on the Form I-213 could help address fragmentation among DHS components and improve the information available to other agencies.

Recommendation: The Secretary of Homeland Security should ensure that CBP documents the information that DHS components collectively need to process family members apprehended together on the Form I-213. (Recommendation 3)

Agency: Department of Homeland Security
Status: Open

Comments: In commenting on a draft of our report, DHS reported that, upon implementation of the steps the department plans to take in response to our second recommendation, CBP will issue guidance to the field to ensure that CBP agents and officers document the information that DHS components collectively need to process family members. In August 2020, DHS reported that component agencies continue to collaborate to define the process of family members apprehended together, as will be reflected on CBP Form I-213. DHS estimates issuing this guidance by March 31, 2021. Collecting information about the relationships between family members apprehended together and documenting that information on the Form I-213 could help address fragmentation among DHS components and improve the information available to other agencies.immigration or other proceedings.

Recommendation: The Secretary of Homeland Security should evaluate options for developing a unique identifier shared across DHS components' data systems to link family members apprehended together. (Recommendation 4)

Agency: Department of Homeland Security
Status: Open

Comments: In commenting on a draft of our report, DHS reported that its Office of Immigration Statistics (OIS) plans to work with relevant components to develop a unique shared identifier linking family members apprehended together. According to DHS, DHS OIS launched the Family Status Community of Interest (COI) in June 2020, and the COI has since established a bi-weekly meeting schedule. The COI's initial focus is on standard codes describing the reasons for family separations. Upon completing the family separation reason standard, DHS reported that the COI will prioritize developing common codes to identify family members apprehended together. DHS estimates completing these actions by March 31, 2021. Evaluating options for developing a shared unique family member identifier across components that would allow each component access to certain information about family members apprehended together would help bridge the information gaps about family relationships between components caused by DHS's fragmented data systems.

Recommendation: The Director of USCIS should ensure that, in addition to USCIS's basic asylum officer training, all asylum offices provide pre-departure training on the credible and reasonable fear processes before their officers begin screening cases at the family residential centers. (Recommendation 1)

Agency: Department of Homeland Security: United States Citizenship and Immigration Services
Status: Open

Comments: In commenting on a draft of our report, DHS reported that USCIS plans to develop a standardized pre-departure training and provide this training to all detailees prior to deployment to the family residential centers. DHS estimated that these actions would be completed by September 2020. As of August 2020, USCIS told GAO that the number of noncitizens processed under expedited removal has decreased dramatically as a result of Coronavirus Disease 2019. Therefore, details to the Family Residential Centers have largely been paused. USCIS noted that the Asylum Division is reviewing the credible fear and reasonable fear training requirements; working on an enhanced training module; and, developing a standardized pre-departure training by December 31, 2020. USCIS plans to provide the training to all detailees prior to deployment to the Family Residential Centers during calendar year 2021, should the details resume. Providing pre-departure training, in addition to USCIS's basic training for new asylum officers, would help USCIS ensure that officers from all asylum offices are conducting efficient and effective fear screenings of families.

Recommendation: The Director of USCIS should ensure asylum officers systematically record in USCIS's automated case management system if individuals receive credible fear determinations as principal applicants, dependents, or in the interest of family unity, pursuant to regulation or USCIS policy. (Recommendation 3)

Agency: Department of Homeland Security: United States Citizenship and Immigration Services
Status: Open

Comments: In commenting on a draft of our report, DHS reported that USCIS planned to explore ways to modify its case management system so that asylum officers can record whether an individual received a positive credible fear determination as a principal applicant, dependent, or in the interest of family unity. USCIS plans to make any appropriate changes to its case management system and train asylum officers on these changes by December 2020. As of August 2020, USCIS reported that the agency remains on track to complete this work as planned, provided staffing is not affected by USCIS budget issues. Having complete data in its case management system on all outcomes of credible fear screenings at family residential centers would better position USCIS to report on the scope of either the agency's policy for family members who are treated as dependents, pursuant to regulation, or USCIS's use of discretion in the interest of family unity.

Recommendation: The Director of USCIS should collect and analyze additional information on case delays, including specific reasons for delays and how long they last, that asylum officers may face when screening credible and reasonable fear cases. (Recommendation 4)

Agency: Department of Homeland Security: United States Citizenship and Immigration Services
Status: Open

Comments: In commenting on a draft of our report, DHS reported that USCIS will explore ways to collect additional information on credible and reasonable fear case delays in its case management system. USCIS plans to modify the system, as appropriate, to instruct users on the changes, and begin collecting and analyzing the information by December 31, 2020. As of August 2020, USCIS reported that the agency remains on track to accomplish this work by the end of calendar year 2020, provided staffing is not adversely affected by the on-going COVID-19 pandemic and USCIS budget issues. Collecting additional information in its automated case management system on case delays would provide USCIS with more readily available information and analyzing such data could help USCIS identify case delay reasons relevant in the current environment for officers conducting fear screenings and better position USCIS to mitigate the reasons for the delays and improve efficiency in case processing.

Recommendation: The TSA Administrator should direct T&D and Security Operations to monitor for instances of TSO non-compliance by individual commercial airports across fiscal years that could potentially warrant corrective action at the headquarters level. (Recommendation 2)

Agency: Department of Homeland Security: Transportation Security Administration
Status: Open

Comments: In January 2020, TSA's formal comment letter in response to our draft report stated that T&D will begin recording instances of noncompliance and work with Security Operations to monitor trends at individual airports and with specific courses. TSA also reported that T&D had developed a repository in its iShare database for this information at the end of 2019 and the agency is currently testing various options for reporting and pulling data. Once options are chosen and incorporated into its standard operating procedures, TSA reports that T&D will begin sharing the reports with Security Operations on a monthly basis. In July 2020, TSA officials told us that T&D had begun sharing training compliance reports from their database with Security Operations and discussing the results with them on a monthly basis. This database allows T&D to recognize trends at individual airports and specific courses throughout the fiscal year. Going forward, this process will enable T&D to identify noncompliance trends across fiscal years. We will continue to montior these efforts to verify that the T&D is montioring trends across fiscal years and work with TSA towards closure of this recommendation.

Recommendation: The Executive Assistant Administrator / Director of FAMS should identify and utilize a suitable system that provides information about air marshals' medical qualification status. (Recommendation 1)

Agency: Department of Homeland Security: Transportation Security Administration: Office of Law Enforcement - Federal Air Marshal Service
Status: Open

Comments: DHS concurred with this recommendation and in January 2020, DHS officials stated that FAMS is evaluating case management software to track this information and plans to pursue funding for this effort in fiscal year 2021.This action, if fully implemented, should address the intent of the recommendation. When we confirm what actions DHS has taken in response to this recommendation, we will provide updated information.

Recommendation: The Executive Assistant Administrator / Director of FAMS should develop and implement a plan to assess the health and fitness of the FAMS workforce as a whole, including trends over time. (Recommendation 2)

Agency: Department of Homeland Security: Transportation Security Administration: Office of Law Enforcement - Federal Air Marshal Service
Status: Open

Comments: DHS concurred with this recommendation and in January 2020, DHS officials stated that FAMS had established a team to develop a plan for assessing workforce health and wellness issues. Adopting and implementing a plan that assesses the health and fitness of the FAMS workforce as a whole, should address the intent of the recommendation. When we confirm what actions DHS has taken in response to this recommendation, we will provide updated information.

Recommendation: The Executive Assistant Administrator / Director of FAMS should identify and implement a means to monitor the extent to which air marshals' actual shifts and rest hours are consistent with scheduling guidelines. (Recommendation 3)

Agency: Department of Homeland Security: Transportation Security Administration: Office of Law Enforcement - Federal Air Marshal Service
Status: Open

Comments: DHS concurred with this recommendation and in January 2020, DHS officials stated that FAMS will begin tracking air marshals' actual hours and examine the extent to which air marshals' actual and scheduled hours vary. This information could be helpful, for example, in assessing air marshals' schedule predictability. However, to address the intent of this recommendation, FAMS would need to monitor the extent that air marshals' actual work and rest hours are consistent with FAMS's scheduling guidelines. When we confirm what actions DHS has taken in response to this recommendation, we will provide updated information.

Recommendation: The Executive Assistant Administrator / Director of FAMS should take steps to reaffirm and strengthen efforts to prevent discrimination by, for example, updating and following through on its 2012 action plan and renewing leadership commitment to the plan's goals. (Recommendation 6)

Agency: Department of Homeland Security: Transportation Security Administration: Office of Law Enforcement - Federal Air Marshal Service
Status: Open

Comments: DHS concurred with this recommendation and in January 2020, DHS officials stated that FAMS plans to review the goals of its 2012 action plan and develop steps to strengthen efforts to prevent discrimination. These actions, if fully implemented, should address the intent of the recommendation. When we confirm what actions DHS has taken in response to this recommendation, we will provide updated information.

Recommendation: The TSA Administrator should develop performance goals for its Insider Threat Program that assess progress achieving the strategic objectives in the insider threat strategic plan. (Recommendation 2)

Agency: Department of Homeland Security: Transportation Security Administration
Status: Open

Comments: In May 2020, TSA published its strategic framework, the TSA Insider Threat Roadmap, for mitigating insider threats in the transportation sector. The Roadmap contains three overarching strategic priorities and specific objectives for each of these priorities to refine and continue to improve its efforts to detect, deter, and mitigate insider threats. TSA described that its next steps will be to develop implementation plans for each of these priorities and objectives, including detailed plans of actions with timelines and performance measures to assess its progress achieving the Roadmap's priorities and objectives. We will continue to monitor TSA's efforts to implement our recommendation.

Recommendation: The Director of the IPAWS program should document how it plans to address key actions needed to educate alerting authorities in their use of IPAWS and implement a mechanism that will allow FEMA to regularly and systematically obtain and analyze feedback on alerting authorities' educational needs. (Recommendation 2)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of the IPAWS program should establish procedures to prioritize pending IPAWS applications and to follow up with applicants to address these applications. (Recommendation 3)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The CISA Director should ensure that the operations plan fully addresses all lines of effort in the strategic plan for securing election infrastructure for the upcoming elections. (Recommendation 2)

Agency: Department of Homeland Security: Cybersecurity and Infrastructure Security Agency
Status: Open

Comments: The agency agreed with the recommendation and has taken steps towards implementing it. Specifically, in March 2020 CISA finalized its operations plan for the 2020 elections. CISA's operations plan addresses one of the 13 objectives and key actions from the strategic plan -- monitor threat activity. While CISA's operations plan is to supplement the agency's strategy, the plan does not fully address any of the four lines of effort and the other 12 objectives outlined in the strategic plan. When examining the key actions for the remaining 12 objectives in the strategic plan, we were only able to confirm that 10 of the 27 key actions called for in those strategic plan objectives were fully addressed. We will continue to monitor the agency's progress in implementing our recommendation.

Recommendation: The CISA Director should document how the agency intends to address challenges identified in its prior election assistance efforts and incorporate appropriate remedial actions into the agency's 2020 planning. (Recommendation 3)

Agency: Department of Homeland Security: Cybersecurity and Infrastructure Security Agency
Status: Open

Comments: The agency agreed with the recommendation and has taken steps towards implementing it. We reported in February 2020 that CISA's strategic plan had only addressed three challenges from its external lessons learned review. Subsequently, CISA addressed two additional challenges in its operations plan, which was finalized in March 2020, and its election infrastructure subsector specific plan, which was updated in March 2020. CISA's plans addressed challenges regarding the agency's role in sharing and collecting intelligence across the election community and facilitating industry-wide vulnerability disclosures. However, CISA has not documented how the agency intends to address other identified challenges and how it will incorporate remedial actions into the agency's 2020 planning. We will continue to monitor the agency's progress in implementing our recommendation.

Recommendation: The Commandant of the Coast Guard should direct the Assistant Commandant for Engineering and Logistics and Assistant Commandant for Prevention Policy to update the Coast Guard's ATON-related initiatives to include the specific outcomes to be achieved and associated time frames. (Recommendation 1)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: DHS concurred with our recommendation and stated that the Coast Guard plans to review and update ATON-related initiatives to include specific outcomes with associated implementation milestones by December 31, 2020.

Recommendation: The FEMA administrator should revise FEMA's cost-estimating guidance for Public Assistance projects to fully align with all 12 steps in the GAO Cost Estimating and Assessment Guide. (Recommendation 1)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: The agency agreed with the recommendation and is working to address it.

Recommendation: The FEMA administrator should develop a repository for all current applicable Public Assistance policies and guidance for Puerto Rico and make it available to all recovery partners, including subrecipients. (Recommendation 2)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: The agency agreed with the recommendation and is working to address it.

Recommendation: The Secretary of Homeland Security should develop a strategy to independently validate selected agencies' self-reported actions on meeting binding operational directive requirements, where feasible, using a risk-based approach. (Recommendation 2)

Agency: Department of Homeland Security: Office of the Secretary
Status: Open

Comments: DHS has drafted a preliminary strategy to independently validate agencies' actions, using a risk-based approach. However, this strategy has not yet been finalized and needs to more clearly align to the existing directive development process, to which it serves as an addendum. The strategy should include when and how primary and secondary sources of information for independent validation are selected within the directive development process.

Recommendation: The Secretary of Homeland Security should develop a schedule and plan for completing the high value asset program reassessment and addressing the outstanding issues on completing the required high value asset assessments, identifying needed resources, and finalizing guidance for Tier 2 and 3 HVA systems. (Recommendation 4)

Agency: Department of Homeland Security: Office of the Secretary
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of the Secret Service should identify which types of investigations and activities best prepare special agents for protective responsibilities. (Recommendation 1)

Agency: Department of Homeland Security: United States Secret Service
Status: Open

Comments: The agency has submitted a 180-day letter describing actions it is planning to take in response to this recommendation.

Recommendation: The Director of the Secret Service should develop a framework to help ensure special agents have an opportunity to work, to the extent possible, investigations and activities that best prepare them for protection. (Recommendation 2)

Agency: Department of Homeland Security: United States Secret Service
Status: Open

Comments: The agency has submitted a 180-day letter describing actions it is planning to take in response to this recommendation.

Recommendation: The Director of the Secret Service should establish a documented process to ensure that Office of Investigations resources are aligned with priority criminal threats. The process should outline key information to be included in plans for addressing priority threats. (Recommendation 3)

Agency: Department of Homeland Security: United States Secret Service
Status: Open

Comments: The agency has submitted a 180-day letter describing actions it is planning to take in response to this recommendation.

Recommendation: The Director of the Secret Service should identify investigations that address priority criminal threats agencywide and collect data on the resources expended to investigate the threats. (Recommendation 4)

Agency: Department of Homeland Security: United States Secret Service
Status: Open

Comments: The agency has submitted a 180-day letter describing actions it is planning to take in response to this recommendation.

Recommendation: The Secretary of Homeland Security should ensure that the Undersecretary for Management develops an oversight process to confirm that programs' schedule goals are developed and updated in accordance with GAO's Schedule Assessment Guide, to include ensuring traceability between APB schedule goals and IMSs. (Recommendation 1)

Agency: Department of Homeland Security: Office of the Secretary
Status: Open

Comments: In providing comments on this report, DHS concurred with our recommendation and stated that the Management Directorate's Office of Program Accountability and Risk Management (PARM) developed a checklist based on GAO's Schedule Assessment Guide, among other things, to evaluate programs' IMSs. PARM also plans to develop guidance on schedules which is intended to assist the Component Acquisition Executives (CAE) and acquisition program staff responsible for building IMSs and APBs. In July 2020, PARM officials reported that the schedule checklist was already being used to evaluate and ensure program IMSs adhered to GAO's Schedule Assessment Guide. In addition, PARM officials are updating and drafting guidance on schedules to assist CAEs and program staff when building IMSs and APBs. As of July 2020, PARM was still in the process of executing these efforts.

Recommendation: The Secretary of Homeland Security should ensure that the Undersecretary for Management revises the schedule development guidance in the Systems Engineering Life Cycle Guidebook to state clearly that an IMS should be used as the basis for APB schedule goals. (Recommendation 2)

Agency: Department of Homeland Security: Office of the Secretary
Status: Open

Comments: DHS concurred with our recommendation and stated that Management Directorate's Office of Program Accountability and Risk Management (PARM) was in the process of revising the Systems Engineering Life Cycle Guidebook and would clarify the language relating to IMSs to ensure guidance is consistent. As of July 2020, PARM was still in the process of revising the Systems Engineering Life Cycle Guidebook.

Recommendation: The Secretary of Homeland Security should establish and implement a time frame for completing its drafting of the AED regulations and submitting them to the Office of Management and Budget for further review. (Recommendation 1)

Agency: Department of Homeland Security: Office of the Secretary
Status: Open

Comments: According to DHS, the department was still reviewing its AED regulations in March 2020. Thus, DHS had not completed drafting the regulations or submitted them to the Office of Management and Budget for further review. DHS aims to publish the regulations by July 2020.

Recommendation: The Commissioner of CBP should ensure that the Office of Field Operations, in consultation with the Office of Trade, develops a plan for managing its increased workload. (Recommendation 1)

Agency: Department of Homeland Security: United States Customs and Border Protection: Office of the Commissioner
Status: Open

Comments: CBP concurred with this recommendation. According to CBP, the new ACE drawback module provides the capability to extract data for workload management. Further enhanced reporting capabilities for drawback claims are under development. CBP's Office of Field Operations and Office of Trade continue to collaborate on a plan to employ risk management principles and automation to resolve the drawback claims backlog and lay the foundation for processing current drawback claims workload. They estimate the completion of this workload management system by October 31, 2020.

Recommendation: The Commissioner of CBP should ensure that the Office of Trade assesses the feasibility of flagging excessive export submissions across multiple claims and takes cost-effective steps, based on the assessment, to prevent over claiming. (Recommendation 2)

Agency: Department of Homeland Security: United States Customs and Border Protection: Office of the Commissioner
Status: Open

Comments: CBP concurred with this recommendation. According to CBP, the Office of Trade is exploring alternatives to track and automatically flag duplicate exports across multiple drawback claims. CBP expects to complete their assessment and plan for implementation by December 31, 2020.

Recommendation: The Commissioner of CBP should ensure that the Office of Trade develops a plan, with time frames, to establish a reliable system of record for proof of export. (Recommendation 3)

Agency: Department of Homeland Security: United States Customs and Border Protection: Office of the Commissioner
Status: Open

Comments: CBP concurred with this recommendation. According to CBP, the Office of Trade will work to develop a plan for the use of the Automated Export System (and possibly other systems) for electronic proof of export in the future. They expect this to be complete by September 30, 2020.

Recommendation: The Commissioner of CBP should ensure that the Office of Trade turns the claim selection feature in ACE back on and finalizes and implements procedures to target claims for review that were accepted into ACE during the period in which the selection feature was disabled. (Recommendation 4)

Agency: Department of Homeland Security: United States Customs and Border Protection: Office of the Commissioner
Status: Open

Comments: CBP concurred with our recommendation. According to CBP, the Office of Trade, in collaboration with the Office of Information Technology, will automate updates that turn the claim selection feature on in ACE. The Office of Trade plans to retroactively identify drawback claims accepted during the lapse period, and is working to implement a solution by December 31, 2020.

Recommendation: The Commissioner of CBP should ensure that the Office of Trade analyzes the results of its targeting of claims for review and designs responses to mitigate identified risks. (Recommendation 5)

Agency: Department of Homeland Security: United States Customs and Border Protection: Office of the Commissioner
Status: Open

Comments: CBP concurred with this recommendation. According to CBP, on March 25, 2020, the Office of Trade initiated an analysis to improve automation and targeting on an ongoing basis. Based on the results of this analysis, the Office of Trade will make any needed adjustments to policy and procedures to assist with data quality, by September 30, 2020.

Recommendation: The Commissioner of CBP should ensure that the Office of Trade prioritizes developing a plan to conduct an ex post analysis of the impact on industry and government of key changes to the drawback program, including time frames and methodology. (Recommendation 6)

Agency: Department of Homeland Security: United States Customs and Border Protection: Office of the Commissioner
Status: Open

Comments: CBP concurs with this recommendation. According to CBP, the Office of Trade is finalizing a plan to conduct an ex post analysis of the impact on industry and government of key changes to the drawback program. CBP's analytical plan will include a timeline and methodology for assessing changes to the program. They expect to complete this by November 30, 2020.

Recommendation: The TSA Administrator should update TSA guidance for developing and approving screening technology explosives detection standards to reflect designated procedures, the roles and responsibilities of stakeholders, and changes in the agency's organizational structure. (Recommendation 1)

Agency: Department of Homeland Security: Transportation Security Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The TSA Administrator should require and ensure that TSA officials document key decisions, including testing and analysis decisions, used to support the development and consideration of new screening technology explosives detection standards. (Recommendation 2)

Agency: Department of Homeland Security: Transportation Security Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The TSA Administrator should require and ensure that TSA officials document their assessments of risk and the rationale—including the assumptions, methodology, and uncertainty considered—behind decisions to deploy screening technologies. (Recommendation 3)

Agency: Department of Homeland Security: Transportation Security Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The TSA Administrator should develop a process to ensure that screening technologies continue to meet detection requirements after deployment to commercial airports. (Recommendation 4)

Agency: Department of Homeland Security: Transportation Security Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The TSA Administrator should implement the process it develops to ensure that screening technologies continue to meet detection requirements after deployment to commercial airports. (Recommendation 5)

Agency: Department of Homeland Security: Transportation Security Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of ICE should implement a process to collect and maintain data in a readily available format on detained parents or legal guardians of U.S. citizen and legal permanent resident minors to ensure that information on this population is entered into ICE's data system as required by policy. (Recommendation 1)

Agency: Department of Homeland Security: United States Immigration and Customs Enforcement
Status: Open

Comments: In November 2019, ICE DHS did not concur with this recommendation, stating that ICE did not have any requirement or need to aggregate data on detained parents or legal guardians of U.S. citizens and legal permanent resident minors and doing so would not better inform ICE's decision-making processes. In a May 2020 update, ICE noted that ICE Enforcement and Removal Operations (ERO) officers continue to collect and maintain information in EARM and EAGLE regarding whether an alien is a parent, or legal guardian, of a U.S.-born citizen or legal permanent resident minor for actions specific to individual cases; and that this case-specific information is readily available to approved EARM users, including Child Welfare Coordinators. However, as we noted in our report, these data are not readily available because ICE's data on family relationships, including parents or legal guardians of U.S. citizens and legal permanent resident minors, can only be accessed by manually reviewing each separate case file in EARM. Further, ICE's policy states that in pursing the enforcement of U.S. immigration laws against parents of minors, ICE personnel should remain cognizant of the impact enforcement actions may have on U.S. citizen or legal permanent resident minors. Without making these data readily available, ICE is not able to account for the overall impact of its enforcement actions on U.S. citizen or legal permanent resident minors whose parents or legal guardians have been detained. In its May 2020 update, ICE also noted that ERO provided Congress with the report, "Deportation of Parents of U.S.-Born Children," incorporating the first half of calendar year 2019, in April 2020. However, as we noted in our report, to generate this semi-annual required report to Congress on removals of parents of U.S.-born citizen children, ICE must review this information manually. Also, there is no similar requirement to report in an aggregate way on parents of U.S. citizen or legal permanent residents who are detained. We continue to believe that collecting and maintaining information in a readily available format on detained parents or legal guardians of U.S. citizen or legal permanent resident minors could help ensure that ICE personnel can identify, evaluate, and share information on this population, as required by ICE policy.

Recommendation: The Secretary of Homeland Security should take steps to ensure appropriate agency-funded research data are readily findable and accessible to the public. (Recommendation 5)

Agency: Department of Homeland Security
Status: Open

Comments: The Department of Homeland Security concurred with this recommendation and noted that it was in the process of establishing a portal on its website to increase public access to agency-funded research. The department estimated these efforts would be completed by June 30, 2020. When we confirm what actions the agency has taken in response to the recommendation, we will provide updated information.

Recommendation: The Secretary of Homeland Security should complete development of data management plan requirements. (Recommendation 10)

Agency: Department of Homeland Security
Status: Open

Comments: The Department of Homeland Security concurred with this recommendation, stating that it would develop a departmentwide management directive for research and development data as well as data management plan guidance and a template to document requirements. The department estimated that these efforts would be completed by June 30, 2020. When we confirm what actions the agency has taken in response to the recommendation, we will provide updated information.

Recommendation: The Secretary of Homeland Security should evaluate training needs for agency officials or others involved in reviewing the merits of researchers' data management plans and, if additional training is found to be warranted, develop and provide such training. (Recommendation 15)

Agency: Department of Homeland Security
Status: Open

Comments: The Department of Homeland Security concurred with this recommendation, and indicated it would evaluate training needs for data management plan reviews and develop plans to fulfill any additional training needs identified. The department estimated these efforts would be completed by September 30, 2020. When we confirm what actions the agency has taken in response to the recommendation, we will provide updated information.

Recommendation: The Secretary of Homeland Security should develop and implement a mechanism to ensure researcher compliance with the public access plan and associated requirements. (Recommendation 26)

Agency: Department of Homeland Security
Status: Open

Comments: The Department of Homeland Security concurred with this recommendation and stated it would develop a mechanism to ensure researcher compliance with the department's public access plan and data management plan requirements. The department estimated these efforts would be completed by September 30, 2020. When we confirm what actions the agency has taken in response to the recommendation, we will provide updated information.

Recommendation: The Coast Guard should conduct a comprehensive analysis of its Deployable Specialized Forces' workforce needs. (Recommendation 1)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: In November 2019, GAO reported that the Coast Guard did not fully apply a leading practice for using data and evidence when it reorganized its Deployable Specialized Forces because it had not assessed its overall Specialized Forces workforce needs, as recommended by this practice. The Coast Guard, through DHS, concurred with GAO's recommendation that it conduct a comprehensive analysis of its Specialized Forces' workforce needs. In its May 2020 180-day letter response, DHS stated that the Coast Guard identified its Maritime Safety and Security Team as the highest priority Specialized Forces unit for workforce analysis and that it is scheduled to be completed by the end of fiscal year 2021 but noted that the overall completion of all five unit types is subject to available funding and is not estimated to be completed until September 20, 2025. As GAO reported in November 2019, officials from some of these units stated that they experienced periods of underutilization, while other units with the same or similar capabilities turned down operations for lack of available personnel. Without a comprehensive analysis in place, the Coast Guard does not have the assurance that it has the requisite number of personnel in the right units to conduct the required missions. GAO will continue to monitor Coast Guard actions to address this recommendation.

Recommendation: The Coast Guard should assess the extent to which unnecessary overlap or duplication exists among Deployable Specialized Forces' capabilities. (Recommendation 2)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: In November 2019, GAO reported that the Coast Guard did not address potential overlap and duplication within its Specialized Forces. GAO identified some overlap among the capabilities of the different Specialized Forces units and the Coast Guard missions they support. The Coast Guard did not agree with the recommendation in its November 2019 response to GAO's draft report. At that time, DHS stated that GAO's conclusions illustrate a fundamental misunderstanding of the corresponding missions of Specialized Forces units. However, in technical comments provided in March 2020, the Coast Guard indicated that as of February 2020 it had not conducted the analysis necessary to fully identify potential overlap among the units. The Coast Guard stated that it is planning to begin analyzing the units this fiscal year. In its May 2020 180-day letter response, DHS stated that given current funding constrains and competing mission requirements, the Coast Guard could not consider conducting analyses not directly tied to improving mission outcomes. GAO continues to maintain that overlapping capabilities among units could indicate inefficiencies in how units are used as well as missed opportunities for use in others. Further, it is unclear why DHS and the Coast Guard simultaneously agreed to conduct the comprehensive workforce analyses of its Specialized Forces in the same 180-day letter (in response to recommendation #1 for this report), analyses that could inform an assessment of the extent to which unnecessary overlap and duplication exists among these units, while declining to address this recommendation. Without a comprehensive analysis in place, the Coast Guard does not have the assurance that it has the requisite number of personnel in the right units to conduct the required missions. GAO will continue to monitor Coast Guard actions to address this recommendation.

Recommendation: The TSA Administrator should clarify roles and responsibilities for all offices involved in the coordination of surface transportation exercises, including when these offices are to coordinate, as part of the planned revision of the Surface Division's Internal Operating Procedure for I-STEP. (Recommendation 1)

Agency: Department of Homeland Security: Transportation Security Administration
Status: Open

Comments: TSA concurred with the recommendation and will develop a standard operating procedure to clarify the roles and responsibilities for all offices involved in the coordination of surface transportation exercises, including when these offices are to coordinate, in conjunction with the planned revision of I-STEP's Surface Division Internal Operating Procedure. As part of this, TSA initiated a Surface Exercise Steering Group in January 2020 to clarify surface roles and responsibilities and to discuss a new approach for coordination of surface exercises. TSA estimates completing these actions by September 30, 2020.

Recommendation: The Administrator of TSA should document which rule review process TSA I&A uses (exigent or standard) for each new rule or rule change; (Recommendation 2)

Agency: Department of Homeland Security: Transportation Security Administration
Status: Open

Comments: DHS concurred with this recommendation and agreed to document which rule review process TSA I&A uses (exigent or standard) for each new rule or rule change. In March 2020, TSA updated its SOP to require that the selected rule review process be documented for each new rule and rule change. TSA's policy change is a positive first step, but to fully address this recommendation, TSA will need to demonstrate that the selected rule review process is now being documented.

Recommendation: The Administrator of TSA should explore additional data sources measuring the effectiveness of Silent Partner and Quiet Skies rules. (Recommendation 3)

Agency: Department of Homeland Security: Transportation Security Administration
Status: Open

Comments: DHS concurred with this recommendation and, in May 2020, DHS officials stated that they are reviewing data sources and assessing potential ways to assess the effectiveness of Quiet Skies and Silent Partner screening rules. DHS officials stated that they plan to fully address this recommendation by December 2020.

Recommendation: The FEMA Administrator should assess the need for an agency-wide consolidated standard operating procedures document for the Hazard Mitigation Grant Program that provides detailed information on the roles and responsibilities, requirements, and key tasks and milestones for monitoring and closing out program projects. (Recommendation 2)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: The agency agreed with this recommendation and is working to address it.

Recommendation: The Secretary of Homeland Security should direct the Administrator of FEMA to identify and develop controls, such as methods to more easily identify transit expenses within applications submitted by larger entities such as a city, county, or state government, to address the risk of duplicate funding. (Recommendation 2)

Agency: Department of Homeland Security
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Homeland Security should ensure that the agency fully implements each of the eight key IT workforce planning activities it did not fully implement. (Recommendation 4)

Agency: Department of Homeland Security
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary for Homeland Security should direct the Director of OTE to revise T&E policy or guidance as necessary to fully meet the key practice for programs to test that components and subsystems work together as a system in a controlled setting before finalizing a system's design. (Recommendation 1)

Agency: Department of Homeland Security
Status: Open

Comments: In providing comments on this report DHS concurred with our recommendation and stated that it planned to update its T&E policy to specify that acquisition programs demonstrate that components and subsystems work together before finalizing a system's design. In July 2020, DHS Test and Evaluation Division (TED) officials said they were in the process of updating the policy and that it was undergoing management review with an anticipated completion in fall 2020. Once finalized, GAO will evaluate the revised policy to determine whether DHS has met the intent of this recommendation.

Recommendation: The Secretary for Homeland Security should direct the Director of OTE, in coordination with OCPO, to develop an assessment process-including establishing performance measures-to help ensure T&E training achieves desired results. (Recommendation 2)

Agency: Department of Homeland Security
Status: Open

Comments: In providing comments on this report, DHS concurred with our recommendation and stated that it planned to assess the knowledge and skill requirements for the T&E workforce and establish performance goals for the training. DHS Test and Evaluation Division (TED), in coordination with OCPO, also plan to develop strategies to address any deficiencies with the current training that do not meet the identified requirements. In April 2020, TED officials said that they developed a new survey process to obtain recurring feedback from participants on the training's impact on their ability to perform T&E duties as assigned over time to inform the annual review of the T&E curriculum. However, this effort is still in a piloting stage so the extent to which this information is used to assess the training is still unknown at this time. As of July 2020, TED was still in the process of executing these efforts.

Recommendation: The Secretary for Homeland Security should direct the Director of OTE to revise T&E policy or guidance as necessary to specify when in the acquisition life cycle a major acquisition program manager should designate a level III certified T&E manager. (Recommendation 3)

Agency: Department of Homeland Security
Status: Open

Comments: In providing comments on this report DHS concurred with our recommendation and stated that it planned to update its T&E policy to specify when in the acquisition lifecycle acquisition program managers should designate a qualified T&E manager. In July 2020, DHS Test and Evaluation Division (TED) officials said they were in the process of revising the policy to include this specification and that it was undergoing management review with an anticipated completion in fall 2020. Once finalized, GAO will evaluate the revised policy to determine whether DHS has met the intent of this recommendation.

Recommendation: The Secretary for Homeland Security should direct the Director of OTE to establish an internal control process to ensure that data collected and maintained on major acquisition programs' T&E managers are reliable. (Recommendation 4)

Agency: Department of Homeland Security
Status: Open

Comments: In providing comments on this report, DHS concurred with our recommendation and stated that it planned to establish an internal control process to reliably collect and maintain data on acquisition programs' assigned test and evaluation managers. In April 2020, DHS Test and Evaluation Division (TED) reported taking steps to ensure the validity of this data including establishing points of contacts within each component to cross-check collected information for accuracy and having the Director review collected data on a quarterly basis beginning in third quarter fiscal year 2020. As of July 2020, TED was still in the process of improving its internal collection process, but had not completed these efforts.

Recommendation: The Secretary for Homeland Security should direct the Under Secretary for Science and Technology to assess OTE's workforce to ascertain the extent to which it has the appropriate number of staff with the necessary skills to fulfill its responsibilities. (Recommendation 5)

Agency: Department of Homeland Security
Status: Open

Comments: In providing comments on this report, DHS concurred with our recommendation and stated that it planned to assess the Test and Evaluation Division's (TED) workforce by reviewing current staffing levels and vacancies against the division's roles and responsibilities. The Senior Official Performing the Duties of the Under Secretary for Science and Technology plans to use the results of this review to inform strategic hiring in future years, if needed. In February 2020, DHS released its fiscal year 2020 strategic guidance memorandum for the Science and Technology (S&T) Directorate which included a statement pertaining to resourcing S&T's test and evaluation capabilities. However, as of July 2020, S&T had not yet conducted its review of TED's workforce.

Recommendation: We recommend that the FEMA Administrator comprehensively assess operations to identify any additional updates to its management controls—such as policies, procedures, or training—that could enhance future response and recovery from large-scale and severe wildfires. (Recommendation 1)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: DHS concurred with this recommendation. On 7/28/2020, FEMA provided updates on three separate efforts to help states carry out sheltering and housing missions and a larger effort to standardize its continuous improvement process. FEMA officials said they have begun deploying sheltering and housing field teams to disaster affected areas, as necessary, to develop strategies. Officials described efforts to update direct housing guidance and expect to incorporate results of a JFO-level review into a new version (3) of the guidance by June 2021. Officials also described efforts to administer a pilot program for state-administered direct housing grants for temporary housing and permanent construction authorized by the Disaster Recovery Reform Act of 2018 (pilot authority expires October 2020). FEMA expected the grant program would help states, territories, and tribes build capacity and capability to administer disaster housing missions in a manner that proactively addresses hazards (including wildfires) that are common within a particular jurisdiction. According to officials, FEMA developed guidance for this effort in November 2019 and shared the draft with OMB for interagency review in December 2019. Upon issuance of the guidance, FEMA planned to begin assisting with developing housing strategies and administrative plans required to qualify for a grant, following a presidentially-declared major disaster declaration. (FEMA did not provide an update on the status of this state administered housing mission in the July 2020 update.) FEMA officials also reported that FEMA has finalized National Collection Analysis Priorities (NCAP) to guide disaster assessment efforts across all FEMA Regions by establishing focus areas for continuous Improvement activities. The priorities are to be regularly reviewed by all Associate Administrators, directing continuous improvement analysts at Headquarters and in the Regions to examine select issues at all disaster operations and report findings on a quarterly basis. FEMA is then to brief senior leadership quarterly (which officials said happened in December 2019 and March 2020). Officials also said they provided a 2019 summary of findings highlighting the most common findings across disasters for senior leader consideration. FEMA did not specify whether any of these efforts resulted in updates to policy, procedures, or training specific to wildfire disasters. Note: in its management letter response to the report, FEMA reported plans for the development of a project to analyze and improve capabilities and identify areas of innovation in response to a wildfire disaster. Neither of its two updates to date (4/2020 and 7/2020) have referenced this project. To respond to this recommendation, DHS will need to demonstrate that it has completed a broad-based review of management controls--policies, procedures, and training--and taken action to ensure than any changes necessary to ensure the applicability of those controls to response and recovery for large-scale and severe wildfires.

Recommendation: The Director of USCIS should plan and conduct regular fraud risk assessments of the self-petition program to determine a fraud risk profile, as provided in GAO's Fraud Risk Framework. (Recommendation 1)

Agency: Department of Homeland Security: United States Citizenship and Immigration Services
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of USCIS should develop and implement an antifraud strategy with specific control activities, based upon the results of fraud risk assessments and a corresponding fraud risk profile, as provided in GAO's Fraud Risk Framework. (Recommendation 2)

Agency: Department of Homeland Security: United States Citizenship and Immigration Services
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of USCIS should develop and implement data analytics capabilities for the self-petition program, as a means to prevent and detect fraud, as provided in GAO's Fraud Risk Framework. (Recommendation 3)

Agency: Department of Homeland Security: United States Citizenship and Immigration Services
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commandant of the Coast Guard should ensure that the Deputy Commandant for Mission Support implements risk management processes that more fully align with the five key steps outlined in DHS's Critical Infrastructure Risk Management Framework to better guide agency shore infrastructure investment decisions. This should include (1) setting goals and objectives, (2) identifying critical infrastructure, (3) assessing and analyzing risks and costs, (4) implementing risk management activities, and (5) measuring the effectiveness of actions taken. (Recommendation 1)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: The Coast Guard concurred with the spirit of GAO's recommendation to formalize its shore infrastructure risk management processes. As noted in their formal comment, the Coast Guard was mandated by the DHS Under Secretary for Management to follow risk management guidance outlined in the DHS Resilience Framework in March 2018. The Coast Guard reported that progress towards implementing GAO's recommendation is expected to be concurrent with the development and implementation of the Component Resilience Plan in accordance with the DHS Resilience Framework. According to the Coast Guard, the DHS-mandated Component Resilience Plan assigns a mission criticality level and resilience factor to each shore facility based on a criticality assessment, inter-dependencies between mission essential assets and functions, and risk. It will then align its current resilience factor formulation to that defined through the process in the DHS Resilience Framework. Risks identified through the Framework will be managed through a strategic combination of risk acceptance, mitigation, engineering, and operational controls. The Coast Guard stated that it intends to complete these multiple efforts by the end of 2021. In a March 2020 update, the Coast Guard stated that its Office of Civil Engineering was developing the Work Plan, newly named the 2020 Civil Engineering Program Work Plan: Initiatives and Tactics and said it would include goals and objectives for identifying and addressing infrastructure resilience gaps and resource needs in alignment with the Coast Guard's Component Resilience Plan. The Coast Guard expected to publish this Civil Engineering Work Plan by July 31, 2020, after which it said it would begin implementing and measuring the effectiveness of the actions identified in the Work Plan. In June 2020, the Coast Guard reported that it now anticipates finalizing the Civil Engineering Work Plan by September 30, 2020.

Recommendation: To strengthen the mass care response to future disasters, the Secretary of Homeland Security should direct FEMA to periodically review the current structure of ESF-6 leadership roles andresponsibilities for coordinating mass care. (Recommendation 1)

Agency: Department of Homeland Security
Status: Open

Comments: DHS concurred with this recommendation. The department considers this issue to be resolved because FEMA established a working group in 2018 that reports on performance metrics and corrective actions and improvement plans. As part of that mission they are establishing a reporting system for emergency support function (ESF) coordinators to provide monthly updates on implementing corrective actions and validating improvements through exercises. We agree that these actions are important parts of effectively overseeing and evaluating ESF activities and results. However, while these efforts may address the responsibilities of ESF agencies, they may overlook the overall leadership roles of ESF agencies. To fully implement this recommendation, DHS and FEMA would need to demonstrate there is a process for reviewing the structure of ESF leadership roles on a regular basis.

Recommendation: To better clarify what mass care services voluntary organizations can provide, especially for severe or overlapping hurricanes, FEMA should strengthen its guidance to state and local governments to emphasize the importance of clearly defining roles and responsibilities related to mass care when state and local governments develop written agreements with partner organizations. This could include creating a guidance document or memo that calls attention to the issue and brings together existing resources, such as the Multi-Agency Feeding Plan Template and training materials, in a comprehensive and accessible manner. (Recommendation 2)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: DHS and FEMA concurred with this recommendation. In their June 2020 update, FEMA said it would address this recommendation through the Individual Assistance Mass Care unit within the Office of Response and Recovery. The Individual Assistance Mass Care unit will conduct a strategic review of existing guidance and protocols related to the development of written agreements. FEMA will coordinate the review with state, local, territorial, and tribal governments (SLTT), regional staff, and other key stakeholders, and will identify common challenges encountered during the coordination process. FEMA will then develop recommendations based on stakeholder feedback and will prepare language accordingly for use in the next update of the Individual Assistance Program and Policy Guidance. FEMA anticipates that it will begin preparing language by March 31, 2021. When this language is complete we will close the recommendation.

Recommendation: To ensure assistance reaches all survivors, FEMA should develop mechanisms for the agency and its partners to leverage local community groups, such as conducting regular outreach to communicate and share aggregate information with these groups.(Recommendation 3)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: DHS and FEMA agreed with this recommendation. In June 2020, FEMA said it plans to conduct a virtual Partnership Day meeting (to occur in increments throughout the month of July) to enable voluntary organizations to exchange information, to network and to support ongoing operations. When FEMA provides evidence that this has taken place, we will close the recommendation.

Recommendation: To ensure more accurate mass care capability assessments, FEMA should require grantees to solicit capabilities information from key mass care service-delivery providers in making capability estimates and identify these providers in their submissions. (Recommendation 4)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: DHS and FEMA did not concur with this recommendation. The agencies said implementing this recommendation would increase the burden on grantees and could put certain communities at a disadvantage because grantees cannot control which partners participate. In addition, DHS and FEMA said that because capabilities assessments are not limited to mass care, such a requirement may have unintended consequences for other partners. FEMA plans to continue working with the mass care community to identify the best solution, including encouraging collaboration at all levels of government. Our recommendation specifies that FEMA should require grantees to solicit information from key mass care partners and to identify these partners in their submission. We recognize that grantees cannot compel partners to participate, but they can, at a minimum, invite such partners to participate in the process. We continue to believe that grantees should be required to make an effort to include mass care providers in developing their mass care capability assessments, as this is vital for developing high quality assessments. FEMA has emphasized the importance of having an active relationship and ongoing communication with key partners before disasters strike. In its Strategic Plan, FEMA states that pre-disaster coordination and communication among partners is critical to improve response and recovery outcomes. Thus, we do not believe it would be an undue burden to reach out to such partners as part of the capability assessment process.

Recommendation: To build the emergency preparedness capabilities of grantees, FEMA should develop systematic, documented protocols to determine the conditions under which it will follow up and provide feedback to grantees about mass care capability assessments. (Recommendation 5)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: DHS and FEMA concur with this recommendation and will take steps to address it, although they didn't specify their plans.

Recommendation: The Secretary of Homeland Security should update the department's environmental justice strategic plan. (Recommendation 4)

Agency: Department of Homeland Security
Status: Open

Comments: In comments on our report, the department agreed with this recommendation. We will continue to review the department's actions and update this information.

Recommendation: The Deputy Secretary of Homeland Security should ensure that S&T take steps to more fully incorporate practices for developing milestones within DHS's budget preparation guidance, into the Surface Transportation Explosive Threat Detection program. (Recommendation 1)

Agency: Department of Homeland Security
Status: Open

Comments: In September 2019, GAO reported on a Department of Homeland Security's (DHS) Science and Technology Directorate (S&T) research and development (R&D) program to develop technologies to secure mass transit systems. DHS budget guidance requires S&T to develop results-oriented milestones to track program progress. GAO found that the S&T program's milestones did not clearly link to key activities described in program plans, and thus, were not results oriented. Therefore, we recommended that DHS develop milestones to track its progress developing the technologies that fully adhered to guidance. DHS concurred with our recommendation, and in February 2020, reported that S&T's Finance and Budget Division validated that milestones for the program were compliant with DHS guidance. GAO is currently working with DHS S&T to review documentation related to the validation process in order to close the recommendation..

Recommendation: The Administrator of TSA should develop a mechanism to more routinely and comprehensively share appropriate information on the performance of mass transit security technologies (such as the annual sensor catalog and security technology assessments) with mass transit operators and stakeholders until DHS completes work on a more permanent information sharing resource. (Recommendation 2)

Agency: Department of Homeland Security: Transportation Security Administration
Status: Open

Comments: In September 2019, GAO reported on key mechanisms that TSA uses to collaborate and share information on identifying capability gaps and security technologies with stakeholders, including mass transit operators. We found that TSA regularly assesses commercially available technologies, but does not routinely or comprehensively share its results with mass transit operators. Therefore, we recommended that TSA develop a mechanism to routinely and comprehensively share security technology information with mass transit operators. TSA concurred with our recommendation, and in February 2020, reported implementing two of three planned efforts to better share security technology information, including steps to increase distribution of its annual publication on security technologies and to provide regular updates on assessed technologies at routine stakeholder meetings. We will continue to monitor TSA efforts with a third effort in order to close this recommendation.

Recommendation: The Commissioner of CBP should review and update policies related to land port of entry inspections in accordance with Office of Field Operations guidance. (Recommendation 1)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: CBP concurred with the recommendation and stated that it intends to implement it by January 2021. We will continue to monitor CBP's ongoing efforts to do so.

Recommendation: The Commissioner of CBP should analyze the results of the Self-Inspection Program over time and at a level necessary to identify and address potentially reoccurring inspection deficiencies at individual ports of entry. (Recommendation 2)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: CBP concurred with the recommendation and stated that it intends to implement it by November 2021. We will continue to monitor CBP's ongoing efforts to do so.

Recommendation: The Commissioner of CBP should implement a policy to conduct periodic comprehensive analyses of covert test findings. (Recommendation 3)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: CBP concurred with the recommendation and, in March 2020, it provided information on its plans to conduct a comprehensive analysis after completing several covert tests. To fully address this recommendation, CBP should implement a policy to conduct periodic comprehensive analyses of covert test findings. We will continue to monitor CBP's ongoing efforts to do so.

Recommendation: The Commissioner of CBP should develop a new target for the land border interception rate for passengers in privately-owned vehicles with major violations that sets an ambitious and realistic goal based on past performance. (Recommendation 4)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: CBP concurred with the recommendation and stated that it intends to implement it by January 2021. We will continue to monitor CBP's ongoing efforts to do so.

Recommendation: The Secretary of Homeland Security should develop a cybersecurity risk management strategy that includes the key elements identified in this report. (Recommendation 14)

Agency: Department of Homeland Security
Status: Open
Priority recommendation

Comments: The Department of Homeland Security concurred with this recommendation. As of January 2020, the department stated that it was in the process of developing an enterprise-wide Cybersecurity Risk Management Strategy that will define cybersecurity risk tolerance thresholds and promote inclusion of cybersecurity risk management into the Department's overall risk management capabilities. The estimated completion date for this effort is July 31, 2020. Once the department states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of Homeland Security should establish and document a process for coordination between cybersecurity risk management and enterprise risk management functions. (Recommendation 15)

Agency: Department of Homeland Security
Status: Open
Priority recommendation

Comments: The Department of Homeland Security concurred with this recommendation. As of January 2020, the department stated that, once developed, its Cybersecurity Risk Management Strategy will incorporate clarifications of the cybersecurity risk executive's role and will be coordinated with the DHS Office of the Chief Financial Officer, other offices within the DHS Management Directorate, and Department Components, as appropriate. The department estimated completing this effort by July 31, 2020. Once the department has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Secretary of Homeland Security should develop performance metrics for the department's EEO program including a mechanism for tracking progress towards eliminating barriers. (Recommendation 1)

Agency: Department of Homeland Security
Status: Open

Comments: On August 18, 2020, DHS informed us that the work it is undertaking to respond to this recommendation is ongoing.

Recommendation: DHS component EEO Directors, in consultation with the Deputy Officer for EEO and Diversity, should develop policies and procedures to help ensure that their component EEO programs have action plans for addressing deficiencies in their Management Directive 715 (MD-715) reports. (Recommendation 2)

Agency: Department of Homeland Security
Status: Open

Comments: On May 11, 2020, DHS provided GAO with copies of standard operating procedures for addressing EEO program deficiencies for seven out of eight operational components as well as DHS headquarters. Each of the components' standard operating procedures require that action plans are in place to address any outstanding EEO program deficiencies.

Recommendation: The Deputy Officer for EEO and Diversity should develop a formal staffing model for its EEO program. (Recommendation 3)

Agency: Department of Homeland Security
Status: Open

Comments: On August 18, 2020, DHS informed us that the work it is undertaking to respond to this recommendation is ongoing.

Recommendation: DHS component EEO Directors, in collaboration with the Deputy Officer for EEO and Diversity, should develop component formal staffing models. (Recommendation 4)

Agency: Department of Homeland Security
Status: Open

Comments: On August 18, 2020, DHS informed us that the work it is undertaking to respond to this recommendation is ongoing.

Recommendation: The Secretary of Homeland Security—in consultation with the Office for Civil Rights and Civil Liberties (CRCL) and EEOC, and other agencies and components, as relevant—should analyze options for granting additional authorities to the Deputy Officer for EEO and Diversity to ensure DHS components comply with MD-715 guidance, including the authority of the Deputy Officer for EEO and Diversity to certify components' MD-715 reports. (Recommendation 6)

Agency: Department of Homeland Security
Status: Open

Comments: On August 18, 2020, DHS informed us that the work it is undertaking to respond to this recommendation is ongoing.

Recommendation: The Secretary of Homeland Security should ensure that the fiscal year 2019 plan includes the statutorily required elements or discloses why any element was not included in the plan. (Recommendation 1)

Agency: Department of Homeland Security
Status: Open

Comments: DHS agreed with our recommendation and in August 2020, DHS issued the Fiscal Year 2019-2020 Border Security Improvement Plan. The plan includes a description and the status for satisfying of each of the 11 statutorily required elements. GAO has on-going work to review the plan.

Recommendation: The CBP Commissioner, in conjunction with the DHS Office of the Chief Readiness Support Officer, should develop and implement a plan to ensure that CBP executes its Facility Condition Assessments (FCA) program by conducting FCAs at each CBP-owned land border crossing consistent with DHS Directive 119-02-004. (Recommendation 1)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: CBP concurred with the recommendation and, in March 2020, provided a plan for conducting FCAs at some, but not all, CBP-owned land border crossings. According to officials, CBP will update this plan to include all CBP-owned land border crossings and may coordinate with the DHS Office of the Chief Readiness Support Officer to ensure the plan is consistent with DHS Directive 119-02-004. To fully address this recommendation, CBP should complete the FCA plan to include all CBP-owned land border crossings.

Recommendation: The CBP Commissioner should share FCA reports with GSA and use facility condition information in GSA's Building Assessment Tool to inform FCAs. (Recommendation 2)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: CBP concurred with the recommendation and, in February 2020, GSA confirmed that it received FCA reports from CBP for GSA-owned land border crossings. GSA also confirmed that it provided CBP with a spreadsheet containing data from GSA Building Assessment Tools. To fully address this recommendation, CBP should demonstrate that it is using GSA Building Assessment Tool information to inform its FCAs at GSA-owned land border crossings.

Recommendation: The CBP Commissioner should use information on maintenance and repair work conducted by GSA at GSA-owned land border crossings to update facility condition information in TRIRIGA on an ongoing basis. (Recommendation 5)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: CBP concurred with the recommendation and, in December 2019, reported that it began documenting processes for validating and correcting existing records in TRIRIGA using information on maintenance and repair work conducted by GSA. In addition, CBP reported that it is developing a standard operating procedure for TRIRIGA data entry. To fully address this recommendation, CBP should demonstrate that it is regularly receiving information on maintenance and repair work performed by GSA and that it is using this information to update data in TRIRIGA.

Recommendation: The CBP Commissioner should establish review time frames for stakeholders involved in its Five-year Capital Investment Plan review and approval process. (Recommendation 6)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: CBP concurred with the recommendation and, in April 2020, provided a document establishing time frames for stakeholders involved in the five-year plan review and approval process. To fully address this recommendation, CBP should demonstrate that it has communicated these time frame expectations to stakeholders.

Recommendation: The CBP Commissioner should establish and document a methodology for its annual land border crossing capital prioritization process that includes procedures and time frames for each step. (Recommendation 7)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: CBP concurred with the recommendation and, in April 2020, provided a document that formally establishes and documents a methodology for its land border crossing prioritization process, including procedures and time frames for each step. To fully address this recommendation, CBP should demonstrate that it is implementing this methodology during its annual five-year capital investment planning process.

Recommendation: The Secretary of Homeland Security should develop outcome-based performance measures for the DHS JTFs that are consistent. (Recommendation 3)

Agency: Department of Homeland Security
Status: Open

Comments: DHS stated it concurred with the GAO recommendation. In December 2019, DHS officials stated it is overseeing the implementation of measures that contain outcome-based direction for assessing counter drug operations effects, which requires a phased approach, and added that DHS hopes to achieve two consecutive years of consistent reporting of performance measures. The estimated completion date for addressing this recommendation is June 2020. GAO will continue to follow-up with DHS on its progress towards implementing the recommendation.

Recommendation: The Chief of Border Patrol should develop and implement performance measures to assess its effectiveness at securing the northern border between ports of entry (Recommendation 1).

Agency: Department of Homeland Security: United States Customs and Border Protection: Office of the Commissioner: U.S. Border Patrol
Status: Open

Comments: Border Patrol concurred with this recommendation and in an April 2020 update and stated that it is developing new northern border security metrics. Border Patrol is in the process of evaluating them and coordinating with subject matter experts to ensure they are valid. We will continue to monitor Border Patrol's ongoing efforts.

Recommendation: The Executive Assistant Commissioner of AMO should develop and implement performance measures to assess its effectiveness at securing the northern border between ports of entry in the air and maritime environments (Recommendation 2).

Agency: Department of Homeland Security: United States Customs and Border Protection: Air and Marine Operations
Status: Open

Comments: AMO concurred with this recommendation and in a July 2020 update, stated that it has developed preliminary performance measures and established a working group to assess their effectiveness. According to AMO, they remain on track to implement the performance measures and report on them beginning in fiscal year 2022. We will continue to monitor AMO's efforts.

Recommendation: The Director of ICE should take action to ensure consistent implementation of ICE's policies for handling cases of potentially removable veterans. (Recommendation 1)

Agency: Department of Homeland Security: United States Immigration and Customs Enforcement
Status: Open

Comments: In June 2019, we reported on U.S. Immigration and Customs Enforcement's (ICE) efforts to handle, track, and monitor cases related to veterans. We found that ICE has developed policies for handling cases of potentially removable Veterans, but does not consistently adhere to those policies. Therefore, some veterans who were removed may not have received the level of review and approval that ICE has determined is appropriate for cases involving veterans. We recommended that ICE take action to ensure consistent implementation of its policies for handling cases of potentially removable veterans. ICE agreed with this recommendation. In November 2019, ICE reported that it had established a working group to gather requirements for ERO officer and HSI agent training and will identify all of the lesson plans, practice exercises, and checklists to ensure veteran status information is collected during the booking process. In July 2020, ICE reported that the efforts of the working group were ongoing. We will continue to monitor ICE's efforts to address this recommendation.

Recommendation: The Director of ICE should develop and implement a policy or revise its current polices to ensure that ICE agents and officers identify and document veteran status when interviewing potentially removable individuals. (Recommendation 2)

Agency: Department of Homeland Security: United States Immigration and Customs Enforcement
Status: Open

Comments: In June 2019, we reported on U.S. Immigration and Customs Enforcement's (ICE) efforts to handle, track, and monitor cases related to veterans. We found that ICE has not developed a policy to identify and document all military veterans it encounters. Without such a policy, ICE has no way of knowing whether it has identified all of the veterans it has encountered and, therefore, does not have reasonable assurance that it is consistently implementing its policies and procedures for handling veterans' cases. We recommended that ICE develop and implement a policy or revise its current policies to ensure that ICE offices and agents identify and document veteran status when interviewing potentially removable individuals. ICE agreed with this recommendation. In November 2019, ICE reported that its internal working group is gathering requirements to systematically collect and maintain veteran status information. ICE noted that once the requirement gathering is complete it will revise existing ICE guidance on the issuance of issuing Notices to Appear for individuals with U.S. military service. In July 2020, ICE reported that the working group reviewed and updated its current policy and the Office of Policy and Planning is in the process of reviewing the updates. However, ICE was unable to provide an estimated completion date for finalizing the policy. We will continue to monitor ICE's efforts to address this recommendation.

Recommendation: The Director of ICE should collect and maintain complete and electronic data on veterans in removal proceedings or who have been removed. (Recommendation 3)

Agency: Department of Homeland Security: United States Immigration and Customs Enforcement
Status: Open

Comments: In June 2019, we reported on U.S. Immigration and Customs Enforcement's (ICE) efforts to handle, track, and monitor cases related to veterans. We found that ICE does not maintain complete electronic data on veterans who have been placed in removal proceedings or removed. As a result, ICE does not know exactly how many veterans have been placed in removal proceedings or removed, or if their cases have been handled according to ICE's policies. We recommended that ICE collect and maintain electronic data on veterans in removal proceedings or who have been removed. ICE agreed with this recommendation. In November 2019, ICE reported that its internal working group is analyzing systems and processes used by ICE officers and agents to identify the components in need of updating to properly capture veteran status. As of July 2020, the working group has identified fields that will be added to its integrated database to capture and maintain veterans' status information. Once the working group is done gathering systems, procedural, and training requirements, this work will also identify updates needed for ICE policies for handling cases of potentially removable veterans. We will continue to monitor ICE's efforts to address this recommendation.

Recommendation: The TSA Administrator should periodically review, and as appropriate, update the 2010 Pipeline Security and Incident Recovery Protocol Plan to ensure the plan reflects relevant changes in pipeline security threats, technology, federal law and policy, and any other factors relevant to the security of the nation's pipeline systems. (Recommendation 5)

Agency: Department of Homeland Security: Transportation Security Administration
Status: Open

Comments: DHS concurred with this recommendation and stated that TSA will periodically review, and as appropriate, update the 2010 Pipeline Security and Incident Recovery Protocol Plan to ensure the plan reflects relevant changes in pipeline security threats, technology, federal law and policy, and any other factors relevant to the security of the nation's pipeline systems. In October 2019, TSA officials reported that they were in the process of reviewing the 2010 Pipeline Security and Incident Recovery Protocol Plan and anticipated completing the review by December 2019. However, this review was delayed and we will continue to monitor TSA's efforts to implement this recommendation.

Recommendation: The Secretary of Homeland Security should ensure that the Commandant of the Coast Guard develops the capability to present servicemembers' race and ethnicity data in its investigations and personnel databases using the same categories of race and ethnicity established in the December 2018 uniform standards for the military justice databases, either by (1) modifying the Coast Guard's investigations and personnel databases to collect and maintain the data in accordance with the uniform standards, (2) developing the capability to aggregate the data into the race and ethnicity categories included in the uniform standards, or (3) implementing another method identified by the Coast Guard. (Recommendation 5)

Agency: Department of Homeland Security
Status: Open

Comments: DHS concurred with this recommendation. In May 2019, the Coast Guard stated that it would implement modifications to the Coast Guard's military justice database to support the tracking of race, ethnicity and gender information as part of a longer term initiative to capture all of the data elements required by the uniform standard adopted by the Department of Defense. They estimated this would be completed in September 2020.

Recommendation: The Secretary of Homeland Security should ensure that the Commandant of the Coast Guard considers the feasibility, to include the benefits and drawbacks, of collecting and maintaining complete information for all nonjudicial punishment cases in one of the Coast Guard's databases, such as information on the servicemembers' race, ethnicity, gender, offense, and punishment imposed. (Recommendation 10)

Agency: Department of Homeland Security
Status: Open

Comments: DHS concurred with this recommendation. In May 2019, the Coast Guard stated that it would consider the feasibility of collecting and maintain complete information for all nonjudicial punishments cases through a military justice and personnel work group. The estimated completion date for this action was not yet determined.

Recommendation: The Director of the Secret Service should develop and implement a plan to ensure that special agents assigned to Presidential Protective Division and Vice Presidential Protective Division reach annual training targets given current and planned staffing levels. (Recommendation 1)

Agency: Department of Homeland Security: United States Secret Service
Status: Open

Comments: In May 2019 we reported that the Secret Service had not met the established training target (25 percent of work time) and lacked a plan for achieving it. We therefore recommended that the Director of the Secret Service develop and implement a plan to ensure that special agents assigned to the Presidential Protective Division and the Vice Presidential Protective Division reach annual training targets given current and planned staffing levels. The agency concurred with our recommendation. Towards addressing this recommendation, in October 2019, the Secret Service reported that the Office of Protective Operations is currently soliciting training requirements from each internal operational division, including the Presidential and Vice Presidential Protective Divisions, to determine the appropriate amount of training and associated training hours for each division. They further reported that once reviewed, the training requirements are to inform the agency's revised Human Capital Strategic Plan. The revised Human Capital Strategic Plan is to include an overview of Office of Protective Operations' training requirements and corresponding staffing needs. The Secret Service anticipates a revised Human Capital Strategic Plan to be available by the end of January 2020. The Secret Service's efforts to reevaluate the training requirements and targets are a positive first step. However, Secret Service's actions are not fully consistent with the recommendation. Specifically, in its updated response, the Secret Service stated that training hours for Presidential Protective Division and Vice Presidential Protective Division special agents training will only increase once the agency nears its ultimate staffing target. This is inconsistent with our recommendation to establish a plan to ensure these special agents reach annual training targets given current staffing levels. In the interim, affected special agents may continue to lack training required to prevent security breaches, such as that of September 19, 2019, when an intruder jumped the north fence and entered the White House. We will continue to monitor the Secret Service's progress in implementing this recommendation.

Recommendation: The Director of the Secret Service should develop and implement a policy that documents the process for collecting complete Uniformed Division officer training data and establishes the types of information that should be collected. (Recommendation 2)

Agency: Department of Homeland Security: United States Secret Service
Status: Open

Comments: In May 2019 we reported that training data collected on the Secret Service's Uniform Division were incomplete and in certain cases unrelated to protection or lacked descriptions to clearly link the training to required skills. Further, the process used to capture the data was not consistently employed and did not include information on how or whether to capture internal on-the-job training instances, or instruction on the type of training to be captured to demonstrate that the training is protection-related training. We therefore recommended that the Director of the Secret Service develop and implement a policy that documents the process for collecting complete Uniformed Division officer training data and establishes the types of information that should be collected. The Secret Service, through DHS, concurred with our recommendation, stating that it would develop rigorous and uniform standards for collecting and reporting training data related to the Uniformed Division branch, and would work to capture additional training information. In response to our recommendation, in October 2019 the Secret Service reported that the Uniformed Division has worked with the Office of Training and Performance and Learning Management System (PALMS) team to capture Uniformed Division training requirements. The requirements are to include the 20 formalized on-the-job training programs for officers assigned to the Uniformed Division's White House, Foreign Missions, and Naval Observatory Branches, or one of the Special Operations Branch specialized units. In addition, the Secret Service stated that approximately 19 micro-training courses (also known as Roll Call Training) are currently captured within PALMS-the Department of Homeland Security's learning management system -and additional formalized on-the-job training programs are being reviewed for inclusion in PALMS. According to the Secret Service, use of PALMS should help ensure that the process for collecting and recording Uniformed Officer training is standardized and monitored. The Secret Service's efforts to capture additional training information in PALMS is a positive development. However, we have not yet observed progress towards the Secret Service's implementation of a policy that documents the process for collecting complete Uniformed Division officer training data and establishes the types of information that should be collected, as we recommended. We will continue to monitor the Secret Service's progress in implementing this recommendation.

Recommendation: The FEMA Administrator should develop and publicize guidance for partners working to assist individuals who are older or have disabilities for requesting data and working with FEMA staff throughout the data sharing process to obtain Individual Assistance data, as appropriate. (Recommendation 1)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: DHS agreed with this recommendation and has plans to address it. Specifically, FEMA is developing new, enhanced templates, policies and guidance for field staff to facilitate data sharing with states and other partners. The agency also reported that it is expanding its Open FEMA datasets to provide more autonomous, self-service sharing of aggregated data to fulfill partner data needs when personally identifiable information data is not required. FEMA plans to publish data sharing guidelines on its web site by March 31, 2020 on how to obtain FEMA data to best service individuals who are older or have disabilities.

Recommendation: The FEMA Administrator should improve communication of registrants' disability-related information across FEMA programs, such as by developing an alert within survivor files that indicates an accommodation request. (Recommendation 3)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: FEMA disagreed with this recommendation, noting that it lacks specific funding to augment the legacy data systems that capture and communicate registration information. Also, FEMA began a long-term initiative in April 2017 to improve data management and exchange, and improve overall data quality and standardization. The agency expects the initiative to include the development of a modern, cloud-based data storage system with a data analytics platform that will allow analysts, decision makers, and stakeholders more ready access to FEMA data. After the completion of this initiative, FEMA expects that efforts to share and flag specific disability-related data will be much easier. Our recommendation, however, is not solely focused on system changes: other cost-effective ways may improve communication of registrants' disability-related information prior to implementing the system upgrades. For example, as noted in the report, FEMA officials handling different stages of the disaster assistance process may overlook disability-related needs recorded in the case file notes. FEMA could revise its guidance to remind program officials to review the notes to identify whether there is a record of any such needs. As FEMA moves ahead with its data improvement initiatives, we encourage it to consider and ultimately implement technology changes, such as developing an alert within files that indicates an accommodation request. Such improvements would be consistent with the recommendation and help improve communication across FEMA programs.

Recommendation: The FEMA Administrator should communicate to Regional Administrators and Regional Disability Integration Specialists a written plan for implementing its new disability integration staffing approach, consistent with the objectives established for disability integration. Such a plan should include an implementation timeline and details on staff responsibilities, which regions could use to evaluate staff performance. (Recommendation 5)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: DHS agreed with this recommendation, reporting that it is developing a project plan to implement the proposed staffing approach in the Regions. The plan will include implementation timelines, detailed roles and responsibilities for the proposed Disability Integration Advisor positions, a force structure for each Region, and recommendations to the Regional Administrator to establish performance metrics for the new positions that support the overall approach to disability integration. The plan will be presented to the Administrator for review and concurrence in 2019.

Recommendation: The FEMA Administrator should develop a plan for delivering training to FEMA staff that promotes competency in disability awareness. The plan should include milestones and performance measures, and outline how performance will be monitored. (Recommendation 6)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: FEMA agreed with this recommendation and has plans to improve disability competencies among FEMA staff, but it does not include training. Specifically, FEMA is developing a plan to include a disability integration competency in the position task books for all deployable staff, rather than through training. Position task books outline the required activities, tasks, and behaviors for each job, and serve as a record for task completion. The plan will also include a communications and outreach plan; milestones for measuring the effectiveness of the integration of this competency across the agency; and a monitoring plan and milestones to measure the overall integration of this competency across the deployable workforce. However, the plan doesn't cover how it will deliver training to promote competency in disability awareness among its staff, including milestones, performance measures, and how performance will be monitored.

Recommendation: The Assistant Secretary of the Countering Weapons of Mass Destruction Office (CWMD) should ensure that the office regularly collects detailed information from cities on expenditures made using program funds and compares that information to approved purchase plans to ensure that these funds were spent as approved, consistent with program goals, and that the expenditures are in keeping with the objectives of the program. (Recommendation 1)

Agency: Department of Homeland Security: Countering Weapons of Mass Destruction Office
Status: Open

Comments: The Countering Weapons of Mass Destruction Act of 2018 requires that CWMD develop an implementation plan for the Securing the Cities program that, among other things, identifies the goals of the program and provides a strategy for achieving those goals. The act requires CWMD to submit this implementation plan to Congress by December 2019. As of June 2020, DHS/CWMD had not yet completed its implementation plan for the Securing the Cities program. Depending on its content, this plan may contain key provisions that could address this recommendation.

Recommendation: The Assistant Secretary of CWMD should more fully assess cities' performance by collecting information from cities on achieving key performance metrics and program milestones and enforcing reporting requirements on performance during exercises. (Recommendation 2)

Agency: Department of Homeland Security: Countering Weapons of Mass Destruction Office
Status: Open

Comments: The Countering Weapons of Mass Destruction Act of 2018 requires that CWMD develop an implementation plan for the Securing the Cities program that, among other things, identifies the goals of the program and provides a strategy for achieving those goals. The act requires CWMD to submit this implementation plan to Congress by December 2019. As of June 2020, DHS/CWMD had not yet completed its implementation plan for the Securing the Cities program. Depending on its content, this plan may contain key provisions that could address this recommendation.

Recommendation: The Assistant Secretary of CWMD should analyze risks related to sustaining detection capabilities, work with cities to address these risks, and enforce sustainment planning requirements for future cities. (Recommendation 3)

Agency: Department of Homeland Security: Countering Weapons of Mass Destruction Office
Status: Open

Comments: The Countering Weapons of Mass Destruction Act of 2018 requires that CWMD develop an implementation plan for the Securing the Cities program that, among other things, identifies the goals of the program and provides a strategy for achieving those goals. The act requires CWMD to submit this implementation plan to Congress by December 2019. As of June 2020, DHS/CWMD had not yet completed its implementation plan for the Securing the Cities program. Depending on its content, this plan may contain key provisions that could address this recommendation.

Recommendation: The Assistant Secretary of CWMD should clearly communicate to cities how the existing program will operate until a new program is developed and implemented. (Recommendation 4)

Agency: Department of Homeland Security: Countering Weapons of Mass Destruction Office
Status: Open

Comments: The Countering Weapons of Mass Destruction Act of 2018 requires that CWMD develop an implementation plan for the Securing the Cities program that, among other things, identifies the goals of the program and provides a strategy for achieving those goals. The act requires CWMD to submit this implementation plan to Congress by December 2019. As of June 2020, DHS/CWMD had not yet completed its implementation plan for the Securing the Cities program. Depending on its content, this plan may contain key provisions that could address this recommendation.

Recommendation: The Commandant of the Coast Guard should establish a formal process to solicit input from officials directly involved in the agency's response and recovery following a disaster and to share that input with the Emergency Support Function Leadership Group. (Recommendation 8)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: The US Coast Guard concurred with this recommendation. In its agency response, the Coast Guard stated that it was reviewing its current policies and processes to update its After Action Report Policy or to identify and implement other policy improvements. As of July 2020, these actions were still in progress.

Recommendation: The FEMA Administrator should take the lead to work together with the Coast Guard and the U.S. Army Corps of Engineers to revise the mission assignment policy and related guidance to better incorporate consideration of contracting needs, such as demobilization, and to ensure clear communication of coordination responsibilities related to contracting. (Recommendation 9)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: The Federal Emergency Management Agency (FEMA) concurred with the recommendation. In its response, FEMA stated it would work with its federal partners and develop mission assignment project management tools and training. In addition, FEMA is planning to develop a Mission Assignment Project Manager Guide to provide guidance to address the issues GAO identified. As of July 2020, FEMA indicated it would develop a new project plan and timeline for completing these actions in the winter of 2020.

Recommendation: The FEMA Administrator should assess its workforce needs—including staffing levels, mission needs, and skill gaps—for contracting staff, to include regional offices and DART; and develop a plan, including timelines, to address any gaps. (Recommendation 10)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: The Federal Emergency Management Agency (FEMA) concurred with this recommendation. In its official response, FEMA stated it would take actions to address this recommendation, including hiring contractor support and additional Cadre of On-Call Response/Recovery Employees. As of August 2020, these actions were still in progress. FEMA officials indicated that its workforce assessment was expected to be complete in December 2020.

Recommendation: The Secretary of the Department of Homeland Security (DHS) should take action to meet the data center closure targets established under DCOI by OMB. (Recommendation 10)

Agency: Department of Homeland Security
Status: Open

Comments: In comments on our report, the Department of Homeland Security (DHS) agreed with our recommendation and began taking action to implement it. After the Office of Management and Budget (OMB) released the updated Data Center Optimization Initiative policy in June 2019, the department established a new data center closure target. Subsequently, the department reported meeting its closure target for fiscal year 2019. However, given the short time to evaluate implementation efforts between when OMB released the updated policy in June 2019 and the end of fiscal year 2019, we will continue to monitor DHS's efforts to implement this recommendation through fiscal year 2020.

Recommendation: The Secretary of DHS should take action to meet the data center optimization metric targets established under DCOI by OMB. (Recommendation 11)

Agency: Department of Homeland Security
Status: Open

Comments: In comments on our report, The Department of Homeland Security (DHS) agreed with our recommendation and began taking action to implement it. After the Office of Management and Budget (OMB) released the updated Data Center Optimization Initiative policy in June 2019, the department established new data center optimization targets. The department subsequently reported meeting its targets for the virtualization, advanced energy metering, and server utilization metrics. However, given the short time to evaluate implementation efforts between when OMB released the updated policy in June 2019 and the end of fiscal year 2019, we will continue to monitor DHS's efforts to implement this recommendation through fiscal year 2020.

Recommendation: The FEMA Administrator should ensure that the GMM program management office finalizes the organizational change management plan and time frames for implementing change management actions. (Recommendation 1)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: DHS concurred with this recommendation. We will continue to monitor the department's efforts to implement it.

Recommendation: The FEMA Administrator should ensure that the GMM program management office updates the program schedule to address the leading practices for a reliable schedule identified in this report. (Recommendation 4)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: DHS concurred with this recommendation. We will continue to monitor the department's efforts to implement it.

Recommendation: The FEMA Administrator should ensure that the FEMA Office of the Chief Information Officer (OCIO) defines sufficiently detailed planned evaluation methods and actual evaluation methods for assessing security controls. (Recommendation 5)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: DHS concurred with this recommendation. We will continue to monitor the department's efforts to implement it.

Recommendation: The FEMA Administrator should ensure that the FEMA OCIO approves a security assessment plan before security assessment reviews are conducted. (Recommendation 6)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: DHS concurred with this recommendation. We will continue to monitor the department's efforts to implement it.

Recommendation: The FEMA Administrator should ensure that the GMM program management office follows DHS guidance on preparing corrective action plans for all security vulnerabilities. (Recommendation 7)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: DHS concurred with this recommendation. We will continue to monitor the department's efforts to implement it.

Recommendation: The FEMA Administrator should ensure that the GMM program management office fully tests all of its security controls for the system. (Recommendation 8)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: DHS concurred with this recommendation. We will continue to monitor the department's efforts to implement it.

Recommendation: The Secretary of Homeland Security should ensure that the CIO of the Department of Homeland Security (DHS) completes an assessment of all IT investments for suitability for migration to a cloud computing service, in accordance with OMB guidance. (Recommendation 16)

Agency: Department of Homeland Security
Status: Open

Comments: The Department of Homeland Security (DHS) concurred with our recommendation and stated that the department was taking steps to implement it. Specifically, in October 2019, DHS officials reported that the department was in the process of accessing its remaining systems to determine whether a cloud computing assessment should be completed but did not provide a date when this effort would be finished. As of May 2020, we have not received a more recent update from DHS regarding its implementation of our recommendation. We will continue to monitor the status of this recommendation.

Recommendation: The Secretary of Homeland Security should ensure that the CIO of DHS establishes a consistent and repeatable mechanism to track savings and cost avoidances from the migration and deployment of cloud services. (Recommendation 17)

Agency: Department of Homeland Security
Status: Open

Comments: The Department of Homeland Security (DHS) concurred with our recommendation and stated that the department was taking steps to implement it. Specifically, in October 2019, DHS officials reported that the department was working on a plan to define the resources and processes needed to implement a mechanism to track savings that would be completed by October 2020. As of May 2020, we have not received a more recent update from DHS regarding its implementation of our recommendation. We will continue to monitor the status of this recommendation.

Recommendation: The Administrator of TSA should assess Security Operations guidance for applying root causes for test failures, and identify opportunities to clarify how they should be applied. (Recommendation 4)

Agency: Department of Homeland Security: Transportation Security Administration
Status: Open

Comments: TSA concurred with this recommendation and said it would take steps to implement it. In March 2020, TSA officials reported that they are developing new guidance to help testers identify and record root causes for covert test failures. Once TSA completes this guidance and GAO has been provided a copy for review, we will close this recommendation.

Recommendation: The Secretary of Homeland Security should develop and implement a process to systematically review the reliability of the data used in its Border Security Metrics Report and comprehensively identify any limitations with the data and methodologies that underlie its metrics. (Recommendation 1)

Agency: Department of Homeland Security
Status: Open

Comments: DHS concurred with the recommendation and in a May 2020 update stated that it plans to address this recommendation in its FY2019 Border Security Metrics Report scheduled to be issued in the summer of 2020. We will continue to monitor DHS's ongoing efforts to do so.

Recommendation: The Secretary of Homeland Security should ensure the communication of the limitations of the metrics identified through the systematic review in the department's annual Border Security Metrics Report. (Recommendation 2)

Agency: Department of Homeland Security
Status: Open

Comments: In its comment letter, DHS concurred with the recommendation and requested that we consider it closed as implemented because the department already detailed some of the limitations in its fiscal year 2017 report, and plans to continue to identify known limitations and the progress made to mitigate previously identified limitations in future reports. As discussed in the report, we agree that DHS identified and disclosed limitations for some metrics in its fiscal year 2017 Border Security Metrics Report; however, we identified at least one additional limitation for 21 of the 35 metrics on which DHS reported that DHS did not disclose or about which it could have been more transparent. To address the intent of this recommendation, once DHS has implemented a process to systematically review the reliability of the data used in its report and comprehensively identified related limitations, it should disclose those limitations in its annual Border Security Metrics Report. In a May 2020 update, DHS stated that it plans to address this recommendation in its FY2019 Border Security Metrics Report scheduled to be issued in the summer of 2020. We will continue to monitor DHS's ongoing efforts to do so.

Recommendation: The Under Secretary for the Office of Strategy, Policy, and Plans should include the results of sensitivity analyses to key assumptions in its statistical models of unlawful entry estimates in its annual Border Security Metrics Report. (Recommendation 3)

Agency: Department of Homeland Security
Status: Open

Comments: DHS concurred with the recommendation and in a May 2020 update stated that it plans to address this recommendation in its FY2019 Border Security Metrics Report scheduled to be issued in the summer of 2020. We will continue to monitor DHS's ongoing efforts to do so.

Recommendation: The Under Secretary for the Office of Strategy, Policy, and Plans should include measures of statistical uncertainty for all metrics based on estimates derived from statistical models in its annual Border Security Metrics Report. (Recommendation 4)

Agency: Department of Homeland Security
Status: Open

Comments: DHS concurred with the recommendation and in a May 2020 update stated that it plans to address this recommendation in its FY2019 Border Security Metrics Report scheduled to be issued in the summer of 2020. We will continue to monitor DHS's ongoing efforts to do so.

Recommendation: The Deputy Secretary of the Department of Homeland Security should develop a mechanism that aligns processes and information sources for collecting R&D project data from DHS components to ensure that the information can be collected, integrated and result in a comprehensive accounting of R&D projects DHS-wide. (Recommendation 2)

Agency: Department of Homeland Security: Office of the Secretary: Office of the Deputy Secretary
Status: Open

Comments: As of September 2020, DHS reported that S&T was revising the related DHS Directive to improve R&D project data collection and that detailed procedures for the data collection would be described in an associated guidance document. DHS further reported that S&T would be coordinating with the Undersecretary for Management, and meeting with DHS components regarding the data collection efforts. We will continue to monitor DHS's efforts to implement this recommendation.

Recommendation: The Deputy Secretary of the Department of Homeland Security should direct Office of the Chief Financial Officer program officials to ensure that S&T take steps to more fully incorporate leading practices, such as those included in DHS's budget preparation guidance, into R&D milestones. (Recommendation 3)

Agency: Department of Homeland Security: Office of the Secretary: Office of the Deputy Secretary
Status: Open

Comments: As of September 2020, S&T reported preparing Budget Justification documents, which will include key milestones for R&D projects, and indicated that the documents will be reviewed by the DHS Office of the Chief Financial Officer. We will continue to monitor DHS's efforts related to this recommendation.

Recommendation: The Deputy Secretary of the Department of Homeland Security should develop standard processes and procedures for collecting and analyzing customer feedback, applicable to components conducting R&D, for improving the usefulness of existing customer feedback mechanisms to assess R&D efforts and for implementing such mechanisms where absent. (Recommendation 4)

Agency: Department of Homeland Security: Office of the Secretary: Office of the Deputy Secretary
Status: Open

Comments: As of September 2020, DHS stated that a new DHS Directive and Instruction is being developed related to R&D customer and program feedback. This recommendation remains open, and we will continue to monitor DHS's efforts to address it.

Recommendation: The Secretary of Homeland Security should establish a time frame for developing or updating policy to implement the statutory requirement to consult with ANCs on the same basis as Indian tribes under Executive Order 13175. (Recommendation 5)

Agency: Department of Homeland Security
Status: Open

Comments: In February 2019, the Department of Homeland Security provided GAO documentation supporting a planned time frame of March 2020 for developing and updating its consultation policy to implement the statutory requirement to consult with ANCs in response to this recommendation. We plan to close the recommendation after reviewing documentation that the policy has been updated.

Recommendation: The Secretary of Homeland Security should document in the agency's tribal consultation policy how agency officials are to communicate with tribes about how tribal input from consultation was considered in agency decisions on infrastructure projects. (Recommendation 16)

Agency: Department of Homeland Security
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of ICE should build on existing efforts to use data analytics by employing techniques, such as network analysis, to identify potential fraud indicators in schools petitioning for certification. (Recommendation 2)

Agency: Department of Homeland Security: United States Immigration and Customs Enforcement
Status: Open

Comments: As of March 2020, ICE officials indicated that they were in the process of addressing GAO's recommendation and would submit an update including supporting documentation when available. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of ICE should develop an implementation plan for the project aimed at strengthening background checks for DSOs; that plan should outline how the project will be executed, monitored, and controlled. (Recommendation 5)

Agency: Department of Homeland Security: United States Immigration and Customs Enforcement
Status: Open

Comments: As of March 2020, ICE officials indicated that they were in the process of addressing GAO's recommendation and would submit an update including supporting documentation when available. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of ICE should implement mandatory DSO training and verify that the training is completed. (Recommendation 6)

Agency: Department of Homeland Security: United States Immigration and Customs Enforcement
Status: Open

Comments: As of March 2020, ICE officials indicated that they were in the process of addressing GAO's recommendation and would submit an update including supporting documentation when available. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of ICE should complete the development and implementation of its plans for mandatory fraud-specific training for DSOs. (Recommendation 7)

Agency: Department of Homeland Security: United States Immigration and Customs Enforcement
Status: Open

Comments: As of March 2020, ICE officials indicated that they were in the process of addressing GAO's recommendation and would submit an update including supporting documentation when available. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: To complete the appropriate assignment of codes to their positions performing IT, cybersecurity, or cyber-related functions, in accordance with the requirements of the Federal Cybersecurity Workforce Assessment Act of 2015, the Secretary of Homeland Security should take steps to review the assignment of the "000" code to any positions in the department in the 2210 IT management occupational series, assign the appropriate NICE framework work role codes, and assess the accuracy of position descriptions. (Recommendation 9)

Agency: Department of Homeland Security
Status: Open
Priority recommendation

Comments: The Department of Homeland Security (DHS) concurred with our recommendation. DHS conducted an audit of its components' cybersecurity coding efforts in fiscal year 2018 and identified actions that components needed to take to complete the assignment of appropriate NICE framework work role codes and assess the accuracy of position descriptions; a second audit for fiscal year 2019 is underway, and the department expects to complete its coding efforts by December 2020. As of January 2020, DHS has not yet provided sufficient evidence to demonstrate that it has implemented this recommendation. To fully implement this recommendation, DHS will need to provide evidence that it has assigned appropriate NICE framework work role codes to its positions in the 2210 IT management occupational series and assessed the accuracy of position descriptions.

Recommendation: The Commandant of the Coast Guard should direct program managers to establish shore infrastructure performance goals, measures, and baselines to track the effectiveness of maintenance and repair investments and provide feedback on progress made. (Recommendation 2)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: The Coast Guard concurred with this recommendation and said it would take steps to implement it. As of April 2020, the Coast Guard continues to develop and refine its shore infrastructure measures with associated goals and estimates that it will complete these efforts in December 2020. When we confirm actions the Coast Guard has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commandant of the Coast Guard should work with Congress to develop and implement a process to routinely align Coast Guard's shore infrastructure portfolio with mission needs, including by disposing of all unneeded assets. (Recommendation 3)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: The Coast Guard concurred with this recommendation and said it would take steps to implement it. As of April 2020, the Coast Guard continues work to establish a formalized process to assess current and projected operational and mission support needs to identify and recommend disposal of unneeded land, buildings, and structures. The Coast Guard anticipates completing these efforts by December 2020. When we confirm actions the Coast Guard has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commandant of the Coast Guard should establish guidance for planning boards to document inputs, deliberations, and project prioritization decisions for infrastructure maintenance projects. (Recommendation 4)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: The Coast Guard concurred with this recommendation and said it would take steps to implement it. As of April 2020, the Coast Guard is reviewing its existing guidance for planning boards and expects to complete these efforts in December 2020. When we confirm actions the Coast Guard has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commandant of the Coast Guard should employ models for its asset lines for predicting the outcome of investments, analyzing trade-offs, and optimizing decisions among competing investments. (Recommendation 5)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open
Priority recommendation

Comments: In 2019, GAO reported that the Coast Guard generally has not employed models for predicting the outcome of maintenance investments and optimizing among competing investments, as called for in leading practices. GAO found that, in one instance, the Coast Guard used a model to optimize maintenance for its aviation pavement and, according to Coast Guard officials, found that it could save nearly $14 million by accelerating investment in this area (e.g., paving runways) sooner rather than deferring such maintenance. Coast Guard officials told GAO that such modeling could be applied within and across all of its shore infrastructure asset types, but the Coast Guard did not implement the results of this model and does not require their use. Employing models to predict the future condition and performance of facilities could potentially identify and achieve cost savings, according to leading practices. The Coast Guard concurred with GAO's recommendation that it employ models for its asset lines for predicting the outcome of investments, analyzing trade-offs, and optimizing decisions among competing investments. As of January 2020, the Coast Guard has not employed models to evaluate its asset lines. Instead, the Coast Guard reported that it is evaluating alternative models for its asset lines, and estimated that the Coast Guard will complete this analysis by December 31, 2020.

Recommendation: The Commandant of the Coast Guard should include supporting details about competing project alternatives and report trade-offs in Congressional budget requests and related reports. (Recommendation 6)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: In February 2019, GAO reported that Coast Guard budget requests did not provide Congress with accurate information about its funding needs. Specifically, we found that the Coast Guard did not meet this leading practice as its budget requests (1) have not clearly identified funding allotted for routine shore infrastructure maintenance needs, and (2) have not generally addressed deferred maintenance and repair deficiencies, resulting in increases to its backlogs. Specifically, GAO found that budget requests related to shore infrastructure for fiscal years 2012 through 2019 did not provide Congress with required and complete information, as previously noted, necessary to inform decision-makers of the risks posed by untimely investments in maintenance and repair backlogs. GAO also reported that the Coast Guard annual Unfunded Priorities List does not clearly articulate prioritization decisions, including information about trade-offs among competing project alternatives, as well as the impacts on missions conducted from shore facilities in disrepair that had not been prioritized in previous years, or is it aligned with its requirements-based budget targets for shore infrastructure. DHS concurred with GAO's recommendation that the Coast Guard include supporting details about competing project alternatives and report trade-offs in Congressional budget requests and related reports. In its August 2019 180-day letter response, DHS stated that the Coast Guard Office of Budget and Programs will include additional information in the future Unfunded Priorities Lists. However, when the Coast Guard released its 2020 Unfunded Priorities List to Congress it did not contain additional details on competing priorities. GAO will continue to monitor Coast Guard budget requests and related reports, including the Unfunded Priorities Lists, for additional supporting details about competing project alternatives and trade-offs

Recommendation: The Commandant of the U.S. Coast Guard should direct the chair of the Interagency Coordinating Committee on Oil Pollution Research, in coordination with member agencies, to systematically review its membership to determine whether any additional agencies should be involved in coordinating oil spill research and that the most appropriate offices within member agencies are represented. (Recommendation 1)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: In October 2020, the U.S. Coast Guard informed GAO that the Interagency Coordinating Committee on Oil Pollution Research (ICCOPR) review of non-member agencies was complete and that the formal process to invite the U.S. Geological Survey (USGS) for membership has been initiated. To formalize membership, a majority of current ICCOPR members must approve USGS by vote, which is expected. This will be followed by a letter of invitation from the Coast Guard Commandant to USGS making the membership official.

Recommendation: The Commandant of the U.S. Coast Guard should direct the chair of the Interagency Coordinating Committee on Oil Pollution Research, in coordination with member agencies, to coordinate with the relevant Natural Resource Damage Assessment trustee councils to help ensure that the interagency committee's research informs and supports the councils' damage assessment and restoration efforts. (Recommendation 2)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: In October 2020, the Coast Guard informed GAO that the ICCOPR FY 2022-2027 Research and Technology Plan will include a process to engage Natural Resource Damage Assessment (NRDA) trustees. Once updated and finalized, ICCOPR will execute this plan to coordinate with the NRDA trustee councils.

Recommendation: The Secretary of Homeland Security should direct the ISC, in collaboration with member agencies, to assess the extent of, and develop strategies to address, government-wide challenges to implementing physical access control systems. (Recommendation 2)

Agency: Department of Homeland Security
Status: Open

Comments: In August 2019, GAO learned that DHS has recently completed the "Physical Access Control System (PACS) Modernization Working Group Charter." This charter was created under the direction of the Co-Chairs of the Federal Chief Information Security Officer Council, Identity, Credentialing and Access Management Subcommittee, and the Program Director of the DHS Interagency Security Committee. The purpose of the PACS Modernization Working Group is to facilitate the implementation and use of the technology and processes related to modernizing electronic-PACS within the federal government, thereby increasing security, coordination, and compliance with national-level policies and standards. GAO is following up with DHS to obtain additional information about this effort and to determine whether it addresses this recommendation.

Recommendation: The Secretary of DHS should direct the appropriate staff to work with OMB to follow up with agencies to identify obstacles and impediments affecting their abilities to implement intrusion detection and prevention capabilities. (Recommendation 2)

Agency: Department of Homeland Security
Status: Open

Comments: DHS provided evidence in December 2019 but it was insufficient to close this recommendation. We will continue to follow-up with DHS.

Recommendation: The TSA Administrator should direct the Security Policy and Industry Engagement's Surface Division to clarify TSA's Pipeline Security Guidelines by defining key terms within its criteria for determining critical facilities. (Recommendation 2)

Agency: Department of Homeland Security: Transportation Security Administration
Status: Open

Comments: As of June 2020, TSA reported that it completed a review of the Pipeline Security Guideline criteria for determining critical facilities. TSA sought and received pipeline stakeholder comments following their review of the criteria. According to TSA officials, TSA is sharing draft criteria with federal stakeholders and anticipates completion of the review by December 31, 2020. We will continue to monitor the status of TSA's activities to determine whether our recommendation is fully implemented.

Recommendation: The TSA Administrator should develop a strategic workforce plan for its Security Policy and Industry Engagement's Surface Division, which could include determining the number of personnel necessary to meet the goals set for its Pipeline Security Branch, as well as the knowledge, skills, and abilities, including cybersecurity, that are needed to effectively conduct Corporate Security Reviews (CSR) and Critical Facility Security Reviews (CFSR). (Recommendation 3)

Agency: Department of Homeland Security: Transportation Security Administration
Status: Open
Priority recommendation

Comments: As of June 2020, TSA reported that officials, including TSA's Office of Human Capital Strategic Planning, began collaborating to draft a strategic workforce plan for the pipeline security section of TSA. According to the officials, while this effort was delayed as TSA's Office of Human Capital needed focus on protecting TSA's workforce in response to the COVID-19 public health emergency, progress has been made. Phase one of a four-phase process began the week of 6/8/2020, with a Manpower Study to be completed by October 2020. The second phase will be a job skills/competency analysis and the third and fourth phases are position management and classification, and plan development and approval, respectively. TSA estimated completion of the workforce plan by June 30, 2021. We will continue to monitor the status of these efforts to develop a strategic workforce plan in response to this recommendation.

Recommendation: The TSA Administrator should direct the Security Policy and Industry Engagement's Surface Division to identify or develop other data sources relevant to threat, vulnerability, and consequence consistent with the National Infrastructure Protection Plan and DHS critical infrastructure risk mitigation priorities and incorporate that data into the Pipeline Relative Risk Ranking Tool to assess relative risk of critical pipeline systems, which could include data on prior attacks, natural hazards, feedback data on pipeline system performance, physical pipeline condition, and cross-sector interdependencies. (Recommendation 6)

Agency: Department of Homeland Security: Transportation Security Administration
Status: Open

Comments: As of June 2020, TSA officials reported meeting with representatives from the Department of Homeland Security (DHS) and the Federal Emergency Management Agency (FEMA) in February and March 2019 for their input on the identification of sources relevant to threat, vulnerability, and consequence consistent with the National Infrastructure Protection Plan and DHS critical infrastructure risk mitigation priorities. TSA officials also reported meeting with RAND personnel in March 2020 to discuss possible contract options for addressing this recommendation. Further action on this recommendation has been limited due to work on the COVID-19 response. We will continue to monitor the status of TSA's activities to determine whether our recommendation is fully implemented.

Recommendation: The TSA Administrator should direct the Security Policy and Industry Engagement's Surface Division to take steps to coordinate an independent, external peer review of its Pipeline Relative Risk Ranking Tool, after the Pipeline Security Branch completes enhancements to its risk assessment approach. (Recommendation 7)

Agency: Department of Homeland Security: Transportation Security Administration
Status: Open

Comments: As of June 2020, DHS officials reported that TSA will take steps to coordinate an independent, external peer review of its Pipeline Relative Risk Ranking Tool after addressing recommendations 4,5, and 6 of this report. DHS estimated that this effort would be completed by April 30, 2021.

Recommendation: FEMA's Administrator should update the strategy identified in its 2007 Advance Contracting of Goods and Services Report to Congress to clearly define the objectives of advance contracts, how they contribute to FEMA's disaster response operations, and whether and how they should be prioritized in relation to new post-disaster contract awards. (Recommendation 1)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: FEMA agreed with this recommendation. In February 2020, FEMA updated its Disaster Contracting Desk Guide to more clearly identify what advance contracts are and how they should be used in relation to post-disaster contracts. Additionally, in July 2020, FEMA officials stated that they had initiated efforts to draft an advance contract strategy as part of FEMA's policy development process. According to FEMA officials, the directive will outline an agency-wide process for identifying and establishing advance contracts, and encourage the maximum use of advance contracts. The officials anticipate completing the directive by January 2021.

Recommendation: The Director should update the enterprise governance policy to specify (1) the CIO's current role and responsibilities on the Executive Resources Board, to include developing and reviewing the IT budget formulation and execution; and (2) the Deputy CIO's role and responsibilities on the Enterprise Governance Council. (Recommendation 2)

Agency: Department of Homeland Security: United States Secret Service
Status: Open

Comments: DHS concurred with this recommendation. In March 2020, Secret Service officials stated that the component had drafted a revised enterprise governance policy that outlines the CIO's and Deputy CIO's roles and responsibilities. We will continue to monitor the component's efforts to finalize this policy.

Recommendation: The Director should ensure that the Secret Service develops a charter for its Executive Resources Board that specifies the roles and responsibilities of all board members, including the CIO. (Recommendation 3)

Agency: Department of Homeland Security: United States Secret Service
Status: Open

Comments: DHS concurred with this recommendation. In March 2020, Secret Service officials stated that the component had drafted a charter for its Executive Resources Board that specifies the roles and responsibilities of Board members, including the CIO. We will continue to monitor the component's efforts to finalize this charter.

Recommendation: The Director should ensure that the CIO includes product quality and post-deployment user satisfaction metrics in the modular outcomes and target measures that the CIO sets for monitoring agile projects. (Recommendation 4)

Agency: Department of Homeland Security: United States Secret Service
Status: Open

Comments: Secret Service officials stated that Secret Service acquisition directives require the component to conduct a Post Implementation Review of IT programs after such a program achieves Initial Operating Capability. However, it is unclear whether and how this requirement applies to agile projects, and if the Secret Service has included post-deployment user satisfaction metrics in the modular outcomes and target measures that the CIO sets for monitoring such projects. DHS's draft agile guidance strongly recommends that user satisfaction be assessed at the end of each production deployment, not just one time after Initial Operating Capability. Moreover, the Secret Service has not yet demonstrated that the CIO has included product quality in the modular outcomes and target measures that the CIO sets for monitoring agile projects. We will continue to monitor the department's efforts to implement this recommendation.

Recommendation: The Director should ensure that the CIO identifies all of the required knowledge and skills for the IT workforce. (Recommendation 5)

Agency: Department of Homeland Security: United States Secret Service
Status: Open

Comments: In 2018 and 2019, the Secret Service participated in the Department of Homeland Security's Strategic Workforce Planning initiative, during which the department identified critical competencies and target proficiency levels for various IT workforce roles across the department (e.g., systems analysis, network management). However, it is unclear whether the Secret Service's participation in this initiative included the identification of the required knowledge and skills for all of the roles within the component's IT workforce, or just certain roles. In addition, while the Secret Service also established a standard operating procedure document in December 2019 that, among other things, identified recommended training and certifications for each OCIO division (e.g., network management, cyber security), this procedure document did not identify the required knowledge and skills for the workforce roles within each of those OCIO divisions. We will continue to monitor the component's efforts to implement this recommendation.

Recommendation: The Director should ensure that the CIO regularly analyzes the IT workforce to identify its competency needs and any gaps it may have. (Recommendation 6)

Agency: Department of Homeland Security: United States Secret Service
Status: Open

Comments: According to Secret Service officials, the component analyzed its IT workforce to identify its competency needs, as well as determined the projected staffing and competency gaps that it would have in fiscal year 2019. However, it has not yet provided supporting documentation of the analyses that the CIO conducted to determine these competency needs and projected competency gaps. We will continue to follow-up with the Secret Service for documentation of its efforts to implement this recommendation.

Recommendation: The Director should ensure that, after OCIO completes an analysis of the IT workforce to identify any competency and staffing gaps it may have, the Secret Service updates its recruiting and hiring strategies and plans to address those gaps, as necessary. (Recommendation 7)

Agency: Department of Homeland Security: United States Secret Service
Status: Open

Comments: According to Secret Service officials, the component determined that it had a projected staffing gap for fiscal year 2019 of 35 staff within the 2210 occupational job series (i.e., IT management staff). The officials also said that they had identified projected competency gaps related to positions such as Cyber Intelligence Analyst and Intelligence Research Specialist. While the Secret Service has not yet provided documentation of the analyses it conducted to determine these gaps, the component provided documentation to demonstrate that it targeted its fiscal year 2019 recruiting events to focus on addressing IT staffing and competency gaps. For example, among other things, in fiscal year 2019 the component conducted outreach and recruiting events focused on defense, cyber, IT, and intelligence hiring, as well as conducted a targeted cyber security hiring campaign with a large online job search service. We will continue to follow-up with the Secret Service for documentation of the analyses the OCIO conducted to determine its IT staffing and competency gaps, in order to verify whether the 2019 recruiting events conducted were focused on addressing such gaps.

Recommendation: The Director should ensure that the Office of Human Resources (1) develops and tracks metrics to monitor the effectiveness of the Secret Service's recruitment activities for the IT workforce, including their effectiveness at addressing skill and staffing gaps; and (2) reports to component leadership on those metrics. (Recommendation 8)

Agency: Department of Homeland Security: United States Secret Service
Status: Open

Comments: Secret Service officials stated that the component has conducted recruitment and outreach efforts focused on IT, cyber, and engineering careers, and monitors the effectiveness of these efforts. However, the Secret Service has not yet provided supporting documentation demonstrating that it has (1) developed and tracked metrics to monitor the effectiveness of these recruitment activities, including their effectiveness at addressing skill and staffing gaps within the IT workforce; and (2) reported to component leadership on those metrics. We will continue to monitor the Secret Service's efforts to implement this recommendation.

Recommendation: The Director should ensure that the Office of Human Resources and OCIO adjust their recruitment and hiring plans and activities, as necessary, after establishing and tracking metrics for assessing the effectiveness of these activities for the IT workforce. (Recommendation 9)

Agency: Department of Homeland Security: United States Secret Service
Status: Open

Comments: The Secret Service has not yet demonstrated that it has established and tracked metrics for assessing the effectiveness of its recruitment and hiring plans and activities for the IT workforce. As such, the component is not yet able to demonstrate that its Office of Human Resources and OCIO have adjusted their recruitment and hiring plans and activities based on these metrics. We will continue to monitor the Secret Service's efforts to implement this recommendation.

Recommendation: The Director should ensure that the CIO (1) defines the required training for each IT workforce group, (2) determines the activities that OCIO will include in its IT workforce training and development program based on its available training budget, and (3) implements those activities. (Recommendation 10)

Agency: Department of Homeland Security: United States Secret Service
Status: Open

Comments: In December 2019, the Secret Service established a standard operating procedure document that identifies, among other things, recommended training and certifications for each OCIO division (e.g., network management, cyber security). However, this procedure document does not identify required training for each of these divisions. In March 2020, Secret Service officials stated that OCIO supervisors issued individual development plans to their team members that identified training requirements for continued professional development. However, the Secret Service has not yet provided documentation of these training requirements, nor evidence to support that the planned professional development activities are based on the required training for each IT workforce group. Moreover, the officials stated that, in response to the Coronavirus Disease 2019 (COVID-19), training is suspended. As such, the component is not implementing IT workforce training activities at this time. The officials plan to continue staff training once it is reinstated. We will continue to monitor the component's efforts to implement this recommendation.

Recommendation: The Director should ensure that the CIO ensures that the IT workforce completes training specific to their positions (after defining the training required for each workforce group). (Recommendation 11)

Agency: Department of Homeland Security: United States Secret Service
Status: Open

Comments: While Secret Service officials stated that the component's Office of Training establishes the required curriculum for Secret Service personnel, the component has not yet demonstrated that the CIO has defined the training required for each IT workforce group, as we previously recommended. As such, the component is also not able to demonstrate that it is ensuring that each IT workforce group completes the training specific to their positions, as we also recommended. We will continue to monitor the Secret Service's efforts to implement this recommendation.

Recommendation: The Director should ensure that the CIO collects and assesses performance data (including qualitative or quantitative measures, as appropriate) to determine how the IT training program contributes to improved performance and results (once the training program is implemented). (Recommendation 12)

Agency: Department of Homeland Security: United States Secret Service
Status: Open

Comments: Secret Service officials stated that they are assessing how IT training has contributed to improved performance and results by comparing IT course completion results to the results of related training exercises that the component conducts (for example, the Secret Service may compare the completion rates for an IT security awareness training course to the results of a related IT security awareness exercise that the component conducts). However, the Secret Service has not yet provided supporting documentation of these assessments. We will continue to monitor the component's efforts to implement this recommendation.

Recommendation: The Director should ensure that the CIO updates the performance plans for each occupational series within the IT workforce to include the relevant technical competencies, once identified, against which IT staff performance should be assessed. (Recommendation 13)

Agency: Department of Homeland Security: United States Secret Service
Status: Open

Comments: According to Secret Service officials, the component has implemented a performance management system that enables OCIO supervisors to update the individual performance plans of each IT workforce staff member to include the relevant technical competencies against which each staff member's performance is to be assessed. However, the Secret Service has not yet provided supporting documentation demonstrating that OCIO has updated the performance plans for each IT workforce staff member to include the relevant technical competencies. We will continue to monitor the component's efforts to address this recommendation.

Recommendation: The Secretary of Homeland Security should create corresponding processes and procedures to help implement the mission, roles, and responsibilities defined in the delegation of authority or similar document to help ensure predictability, repeatability, and accountability in departmentwide and crosscutting strategy and policy efforts. (Recommendation 2)

Agency: Department of Homeland Security
Status: Open

Comments: The Department of Homeland Security agreed with GAO's recommendation, and finalized a delegation of authority, which is a requisite step in being able to complete this action, in December 2019. As of February 2020, however, the agency had not taken action that addresses GAO's September 2018 recommendation to create processes and procedures corresponding to the mission, roles, and responsibilities defined in the delegation of authority. To close this recommendation, PLCY will need to create such processes and procedures to help ensure predictability, repeatability, and accountability in department-wide and crosscutting strategy and policy efforts. Until DHS creates these processes and procedures, the Office of Strategy, Policy, and Plans' ability to lead and coordinate policy will continue to be limited. Taking this recommended action would enhance the department's efficiency and reduce risks associated with fragmentation in the development of department-wide and crosscutting strategies, policies, and plans

Recommendation: The Under Secretary for Strategy, Policy, and Plans should use the DHS Workforce Planning Guide to help identify and analyze any gaps in PLCY's workforce, design strategies to address any gaps, and communicate this information to DHS leadership. (Recommendation 3)

Agency: Department of Homeland Security
Status: Open

Comments: On December 3, 2019, PLCY restated its concerns with this recommendation--specifically, that due to changes in administration and secretarial priorities, PLCY has to recalibrate and base budget and staffing projections on what officials expect will be needed, rather than current needs due to changing priorities. PLCY's ability to properly align resources with current needs must remain flexible and the workforce planning guidance that GAO references does not allow for that in whole. GAO maintains that utilizing the workforce planning guidance can be done while still maintaining the desired flexibility.

Recommendation: The Under Secretary for Strategy, Policy, and Plans should enhance the use of collaboration and communication mechanisms to connect with staff in the components with responsibilities for policy and strategy to better identify and address emerging needs. (Recommendation 4)

Agency: Department of Homeland Security
Status: Open

Comments: On March 5, 2019, PLCY officials told us PLCY has instituted many cross-component efforts to more clearly define its roles and responsibilities. For example, PLCY convenes frequent engagements with components via the Immigration Policy Council, the Strategy and Policy Executive Steering Committee, the Deputies Management Action Group, and the Threat Prevention and Security Policy Council. On December 3, 2019, PLCY officials told us that the pending delegation of authority will help address this recommendation, and the delegation of authority is expected to be completed in calendar year 2020. To close this recommendation, PLCY must provide documentary evidence of collaboration and communication mechanisms to connect staff and better identify emerging needs.

Recommendation: The Commandant of the Coast Guard, in collaboration with the Secretary of the Navy, should direct the polar icebreaker program and NAVSEA 05C to update the HPIB cost estimate in accordance with best practices for cost estimation, including (1) developing risk bounds for all phases of the program lifecycle, and on the basis of these risk bounds, conduct risk and uncertainty analysis, as well as sensitivity analysis, on all phases of the program lifecycle, and (2) reconciling the results with an updated independent cost estimate based on the same technical baseline before the option for construction of the lead ship is awarded. (Recommendation 2)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: In providing comments on this report, the Coast Guard concurred with our recommendation. As of August 2020, Coast Guard officials stated that they are updating the polar icebreaker program's life cycle cost estimate to reflect information provided by the shipbuilder and anticipate completing the update in the fall 2020. We will review the updated life cycle cost estimate at that time and determine if the actions taken meet the intent of this recommendation.

Recommendation: The Commandant of the Coast Guard should direct the polar icebreaker program office to develop a program schedule in accordance with best practices for project schedules, including determining realistic durations of all shipbuilding activities and identifying and including a reasonable amount of margin in the schedule, to set realistic schedule goals for all three ships before the option for construction of the lead ship is awarded. (Recommendation 3)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: In providing comments on this report, the Coast Guard concurred with our recommendation. As of August 2020, Coast Guard officials stated that they updated the polar icebreaker program's schedule for the lead ship and are in the process of developing schedules for the follow-on ships. We will review the updated schedules once the Coast Guard provides them and determine if the actions taken meet the intent of this recommendation.

Recommendation: The DHS Under Secretary for Management should require the Coast Guard to update the HPIB acquisition program baselines prior to authorizing lead ship construction, after completion of the preliminary design review, and after it has gained the requisite knowledge on its technologies, cost, and schedule, as recommended above. (Recommendation 5)

Agency: Department of Homeland Security
Status: Open

Comments: In providing comments on this report, DHS concurred with our recommendation and stated that it will require the Coast Guard to update the HPIB program's acquisition program baselines prior to authorizing lead ship construction. As of August 2020, Coast Guard officials anticipate updating the acquisition program baselines by no later than February 2021. We will review the updated HPIB acquisition program baselines at that time and determine if the actions taken meet the intent of this recommendation.

Recommendation: The Assistant Secretary for Countering Weapons of Mass Destruction should develop a strategy and implementation plan to help the Department of Homeland Security, among other things, guide, support, integrate and coordinate its chemical defense programs and activities; leverage resources and capabilities; and provide a roadmap for addressing any identified gaps. (Recommendation 1)

Agency: Department of Homeland Security: Countering Weapons of Mass Destruction Office
Status: Open
Priority recommendation

Comments: DHS agreed with GAO's September 2018 recommendation and is taking actions to address it. Countering Weapons of Mass Destruction Office (CWMD) officials stated in December 2018 that CWMD plans to develop a strategy and implementation plan to help DHS guide, support, integrate and coordinate its chemical defense programs and activities; leverage resources and capabilities; and provide a roadmap for addressing any identified gaps. According to CWMD officials, the implementation plan would broadly address DHS chemical defense activities and programs to prevent, protect against, and respond to chemical incidents, including support to federal, state, tribal, and territorial operators and agencies, as well as the private sector. CWMD officials provided GAO with the completed strategy in December 2019 and plan to complete the implementation plan by December 2020. The strategy includes four overarching goals that will drive CWMD's mission in protecting American safety and security from chemical threats and incidents. We will continue to monitor the status of the implementation plan, as completion of both documents is essential to help the CWMD Office guide DHS's efforts to address fragmentation and coordination issues and would be consistent with the office's aim to establish a coherent mission.

Recommendation: The Secretary of DHS should ensure that the Commissioner of Customs and Border Protection through the Executive Assistant Commissioner for Operations Support updates the 2013 workforce assessment to account for the independent requirements organization's current workforce needs. (Recommendation 2)

Agency: Department of Homeland Security
Status: Open

Comments: DHS concurred with this recommendation. Customs and Border Protection provided an estimated completion date for their workforce assessment of September 30, 2020.

Recommendation: The Secretary of DHS should ensure that the Administrator of the Federal Emergency Management Agency establishes a policy for requirements development. (Recommendation 4)

Agency: Department of Homeland Security
Status: Open

Comments: DHS concurred with this recommendation. The Federal Emergency Management Agency plans to establish a policy for requirements development by September 30, 2020, about one year after it completes changes to its governance processes.

Recommendation: The Secretary of DHS should ensure that the Director of Immigration and Customs Enforcement establishes a policy for requirements development. (Recommendation 8)

Agency: Department of Homeland Security
Status: Open

Comments: DHS concurred with this recommendation but has not yet taken action to implement it as of August 2020.

Recommendation: The Secretary of DHS should ensure that the Director of Immigration and Customs Enforcement establishes the planned independent requirements development organization within Immigration and Customs Enforcement. (Recommendation 9)

Agency: Department of Homeland Security
Status: Open

Comments: DHS concurred with this recommendation but has not yet taken action to implement it as of August 2020.

Recommendation: The Secretary of DHS should ensure that the Director of Immigration and Customs Enforcement conducts a workforce assessment to account for an independent requirements organization's workforce needs. (Recommendation 10)

Agency: Department of Homeland Security
Status: Open

Comments: DHS concurred with this recommendation but has not yet taken action to implement it as of August 2020.

Recommendation: The Secretary of DHS should ensure that the Director of Immigration and Customs Enforcement establishes component specific training for requirements development. (Recommendation 11)

Agency: Department of Homeland Security
Status: Open

Comments: DHS concurred with this recommendation but has not yet taken action to implement it as of August 2020.

Recommendation: The Secretary of DHS should ensure that the Under Secretary of Homeland Security for the National Protection and Programs Directorate finalizes and promulgates the National Protection and Programs Directorate's draft policy for requirements development. (Recommendation 12)

Agency: Department of Homeland Security
Status: Open

Comments: The National Protection and Programs Directorate changed its name to the Cybersecurity and Infrastructure Security Agency in January 2018. DHS concurred with this recommendation. The Cybersecurity and Infrastructure Security Agency estimates that it will have a final policy by September 30, 2020.

Recommendation: The Secretary of DHS should ensure that the Under Secretary of Homeland Security for the National Protection and Programs Directorate establishes the planned independent requirements development organization within the National Protection and Programs Directorate. (Recommendation 13)

Agency: Department of Homeland Security
Status: Open

Comments: DHS concurred with this recommendation. In January 2018, the National Protection and Programs Directorate changed its name to the Cybersecurity and Infrastructure Security Agency. The Cybersecurity and Infrastructure Security Agency estimates that it will establish an independent requirements organization by September 30, 2020.

Recommendation: The Secretary of DHS should ensure that the Under Secretary of Homeland Security for the National Protection and Programs Directorate conducts a workforce assessment to account for an independent requirements organization's workforce needs. (Recommendation 14)

Agency: Department of Homeland Security
Status: Open

Comments: DHS concurred with this recommendation. In January 2018, the National Protection and Programs Directorate changed its name to the Cybersecurity and Infrastructure Security Agency. The Cybersecurity and Infrastructure Security Agency estimates it will complete an assessment to account for an independent requirements organization's workforce needs by September 30, 2020.

Recommendation: The Secretary of DHS should ensure that the Director of the U.S. Citizenship and Immigration Services establishes the planned independent requirements development organization within U.S. Citizenship and Immigration Services. (Recommendation 21)

Agency: Department of Homeland Security
Status: Open

Comments: DHS concurred with this recommendation. The U.S. Citizenship and Immigration Services estimates that it will establish an independent requirements development organization by September 30, 2020.

Recommendation: The Director of DHS's National Protection and Programs Directorate's Infrastructure Security Compliance Division (ISCD) should incorporate vulnerability into the CFATS site security scoring methodology to help measure the reduction in the vulnerability of high-risk facilities to a terrorist attack, and use that data in assessing the CFATS program's performance in lowering risk and enhancing national security. (Recommendation 1)

Agency: Department of Homeland Security
Status: Open

Comments: DHS concurred with this recommendation and has taken steps to implement and monitor two new performance metrics intended to better demonstrate the CFATS program's effectiveness in enhancing national security and reducing national risk. Specifically, according to DHS, these new performance metrics allow for the (1) evaluation of the progress individual facilities have made in enhancing their security while part of the CFATS program, and (2) comparison of the security measures employed by CFATS-covered chemical facilities upon first entering the program against the improved and enhanced security measures contained in their approved CFATS security plans. DHS began reporting the two measures, "Average score of approved Site Security Plans" and "Average score of initial Site Security Plans", for the first quarter of fiscal year 2019. DHS stated that these measures will be used to demonstrate the percent increase in security score of facilities' security plans, resulting in a representation of the increase in the security posture across the facility population, which will be used internally to assess progress. GAO continues to monitor the results of these two new performance metrics.

Recommendation: The Secretary of Homeland Security should direct Homeland Security's members of the interagency working group for protection of Native American cultural property to implement selected leading collaboration practices, such as taking steps to agree on outcomes and objectives, clarify roles and responsibilities, and document these decisions. (Recommendation 1)

Agency: Department of Homeland Security
Status: Open

Comments: As of August 2019, we have reached out to the Department of Homeland Security and are awaiting a response on actions they may have taken in response to this recommendation.

Recommendation: The Secretary of Homeland Security should direct Homeland Security's members of the interagency working group for protection of Native American cultural property to identify and externally communicate to tribes points of contact within the agency that are responsible for responding to tribes' requests for assistance with repatriating cultural items from overseas auctions. (Recommendation 5)

Agency: Department of Homeland Security
Status: Open

Comments: As of August 2019, we have reached out to the Department of Homeland Security and are awaiting a response on actions they may have taken in response to this recommendation.

Recommendation: The Secretary of Homeland Security should direct Homeland Security's members of the interagency working group for protection of Native American cultural property to collaborate with the interagency working group members from other agencies to assess, in consultation with Indian tribes, whether and how amending the U.S. legal framework governing the export, theft, and trafficking of Native American cultural items would facilitate the repatriation of these items from auctions overseas and report its findings to Congress. (Recommendation 9)

Agency: Department of Homeland Security
Status: Open

Comments: As of August 2019, we have reached out to the Department of Homeland Security and are awaiting a response on actions they may have taken in response to this recommendation.

Recommendation: The Secretary of Homeland Security should ensure that the department's IT management policies address the role of the CIO for key responsibilities in the five areas we identified. (Recommendation 10)

Agency: Department of Homeland Security
Status: Open

Comments: The agency agreed with the recommendation, and revised and provided additional departmental directives and delegations to address 19 of the 21 responsibility gaps identified in the report. The remaining responsibilities are for the Chief Information Officer (CIO) to 1) review and approve IT contracts, acquisition plans, or strategies; and 2) ensure that all personnel are held accountable for complying with the agency-wide information security program. In particular, while the DHS CIO has the authority to coordinate with the Chief Acquisition Officer on acquisition strategies, coordination is not the same as reviewing and approving. Regarding holding agency personnel accountable for information security, DHS's Sensitive Systems Policy Directive gives that authority to the heads of DHS's components, rather than the DHS CIO. We will continue to monitor the steps the agency takes to address these requirements.

Recommendation: The Commissioner of CBP should revise policy or guidance to ensure documentation of required control activities in its case management system, such as legal review of adverse actions, and data verification (Recommendation 1).

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: In February 2020, CBP provided documentation of a data verification checklist used by its Office of Professional Responsibility for the Joint Integrity Case Management System. However, CBP also needs to develop a similar tool or method to verify case management data contained in its Human Resource Business Engine system. And to fully implement this recommendation, CBP needs to revise policy or guidance to ensure documentation of control activities (data verification and legal review of adverse actions) in its case management systems. We are continuing to follow-up on the actions taken by CBP to implement this recommendation.

Recommendation: The Commissioner of CBP should monitor the duration of all cases beginning-to-end by stage and by case type (Recommendation 4).

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: In October 2018, CBP told us that it is currently updating one of its case management systems to better monitor cases beginning-to-end by stage and by case type. Once implemented, CBP's Office of Professional Responsibility will develop an internal management report that includes information on caseload and associated timelines. The estimated completion date for this recommendation is September 30, 2019. As of September 2020, we are continuing to follow up with CBP on its actions to implement this recommendation.

Recommendation: The Commissioner of CBP should monitor the timeliness of misconduct cases according to established targets for management inquiries, administrative inquiries, and criminal and non-criminal investigations using case management system data (Recommendation 5).

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: In October 2018, CBP stated that it is currently updating one of its case management systems to better monitor the timeliness of misconduct cases according to established targets. Once updated, CBP's Office of Professional Responsibility will develop an internal management report that includes information on caseload and associated timelines. The estimated completion date for this recommendation is September 30, 2019. As of September 2020, we are continuing to follow up with CBP on its actions to implement this recommendation.

Recommendation: The Commissioner of CBP should define and document the case management system data fields to be used for monitoring all established performance targets and provide related guidance to staff (Recommendation 6).

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: In October 2018, CBP stated that its Office of Professional Responsibility will define the case management system data fields used to measure established performance targets, and it will provide the appropriate guidance to staff. The estimated completion date of this recommendation is September 30, 2019. As of September 2020, we are continuing to follow up with CBP on its actions to implement this recommendation.

Recommendation: The Director of ICE should require staff to document the investigative findings (case resolution codes) of management inquiries in the case management system (Recommendation 8).

Agency: Department of Homeland Security: United States Immigration and Customs Enforcement
Status: Open

Comments: In November 2018, ICE provided documentation of related communication provided to staff. However, this documentation did not include revised policy or guidance documents that requires staff to document the investigative findings in the employee misconduct case management system. As of September 2020, we are continuing to follow-up on ICE's actions to implement this recommendation.

Recommendation: The Director of ICE should modify ICE's annual self-inspection program to track the status of related corrective actions to ensure they are implemented in a timely manner (Recommendation 9).

Agency: Department of Homeland Security: United States Immigration and Customs Enforcement
Status: Open

Comments: In October 2018, ICE stated that it is revising its policy for its self-Inspection program to track the status of related corrective actions. ICE also stated that it will review three program offices for compliance with these revised policies and procedures during fiscal year 2019. The estimated completion date of this recommendation is June 28, 2019. As of September 2020, we are continuing to follow-up on ICE's actions to implement this recommendation.

Recommendation: The Director of ICE should monitor the duration of all cases beginning-to-end by stage and by case type (Recommendation 10).

Agency: Department of Homeland Security: United States Immigration and Customs Enforcement
Status: Open

Comments: In October 2018, ICE stated that beginning in fiscal year 2019, a project team will develop the capability to monitor the duration of all employee misconduct cases beginning-to-end by stage and by case type. The estimated completion date of this recommendation is June 28, 2019. As of September 2020, we are continuing to follow-up on ICE's actions to implement this recommendation.

Recommendation: The Director of ICE should monitor the timeliness of misconduct cases according to established targets for management inquiries and Employee Relations specialist review of proposal and decision of disciplinary outcomes using case management system data (Recommendation 11).

Agency: Department of Homeland Security: United States Immigration and Customs Enforcement
Status: Open

Comments: In October 2018, ICE stated that its Office of Professional Responsibility developed guidance regarding established targets for the completion of management inquiries and will distribute the guidance to applicable staff. ICE also stated that it is developing timeliness targets for Employee Relations specialist review of proposals and decisions of disciplinary outcomes and will also distribute this guidance to applicable staff. The estimated completion date for this recommendation is June 28, 2019. As of September 2020, we are continuing to follow-up on ICE's actions to implement this recommendation.

Recommendation: The Director of ICE should define and document the case management system data fields and methodology to be used for monitoring all established performance targets and provide related guidance to staff (Recommendation 12).

Agency: Department of Homeland Security: United States Immigration and Customs Enforcement
Status: Open

Comments: In October 2018, ICE stated that it will work to define and document the case management system data fields and methodology to be used for monitoring all established performance targets and will provide related guidance to applicable staff. The estimated completion date for this recommendation is June 28, 2019. As of September 2020, we are continuing to follow-up on ICE's actions to implement this recommendation.

Recommendation: The Administrator of TSA should monitor the duration of all cases beginning-to-end by stage and case type (Recommendation 16).

Agency: Department of Homeland Security: Transportation Security Administration
Status: Open

Comments: In September 2020, TSA provided documentation of internal reports that measure duration. However, the reports do not provide management information on the duration of all case types from beginning-to-end and, by stage. TSA needs to provide evidence that it monitors the duration of all cases, including a description of which process stages are measured and which data fields are used to measure the total duration from beginning-to-end and by stage. We are continuing to follow up on the actions taken by TSA to implement this recommendation.

Recommendation: The Administrator of TSA should monitor the timeliness of misconduct cases according to established targets for management inquiries (fact finding) and administrative inquiries, and the proposal and decision stages, using case information system data (Recommendation 17).

Agency: Department of Homeland Security: Transportation Security Administration
Status: Open

Comments: In September 2020, TSA provided evidence of reports it uses to measure duration. However, these reports do not show how TSA performs with regards to established targets. TSA needs to provide evidence of how it monitors the timeliness of all established targets , including which specific data fields are used to measure these targets. We are continuing to follow up on the actions taken by TSA to implement this recommendation.

Recommendation: The Administrator of TSA should define and document the case management system data fields and methodology to be used for monitoring all established performance targets and provide related guidance to staff (Recommendation 18).

Agency: Department of Homeland Security: Transportation Security Administration
Status: Open

Comments: In May 2019, TSA provided guidance to its staff related to monitoring performance targets. However, these documents do not specify which system data should be used as part of the methodology for monitoring all established performance targets. TSA needs to provide documentation of guidance to staff that defines and documents all the specific case management system data field names (in the various databases, as applicable) and methodology staff should use to monitor all established timeliness targets. We are continuing to follow up on the actions taken by TSA to implement this recommendation.

Recommendation: The Commissioner of CBP should analyze the costs associated with future barrier segments and include cost as a factor in the Impedance and Denial Prioritization Strategy. (Recommendation 1)

Agency: Department of Homeland Security
Status: Open
Priority recommendation

Comments: In July 2018, we reported on U.S. Customs and Border Protection's (CBP) efforts to construct new physical barriers along the southwest border. We found that the Impedance and Denial Prioritization Strategy--CBP's decision support tool for prioritizing locations for barrier construction projects--did not include analysis of the costs of deploying barriers in each location, which can vary depending on topography, land ownership, and other factors. We recommended that CBP analyze the costs associated with future barrier segments and include cost as a factor in the Impedance and Denial Prioritization Strategy. CBP agreed with this recommendation. CBP officials stated that, after prioritizing locations, CBP conducts detailed cost estimates as part of the acquisitions process. As of January 2020, CBP officials stated that this cost information may affect how the construction projects are executed, but that it would not influence how CBP prioritizes barrier construction projects across various locations. As we have previously reported, organizations should use an integrated approach to the requirements, acquisitions, and budget processes to prioritize needs and allocate resources, so they can optimize return on investment, and maintain program affordability. To fully address our recommendation, Border Patrol needs to incorporate its analysis of the costs of barrier projects into its process for prioritizing locations for construction of barriers.

Recommendation: The Commandant of the Coast Guard should work with Congress to include in the Coast Guard's annual 5-year CIP a discussion of the acquisition programs it prioritized that describes how trade-off decisions made could affect other acquisition programs, such as by delaying recapitalization efforts or needing to conduct Service Life Extension Projects for legacy assets. (Recommendation 1)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: The Coast Guard agreed with this recommendation and in August 2019 officials reported that the Coast Guard is working with DHS to include additional information that addresses how trade-off decisions made could affect other major acquisition programs in future CIP reports. It anticipates including this information in the FY 2021-2025 CIP, which it expects to release in late summer 2020.

Recommendation: The Commandant of the Coast Guard should require the Executive Oversight Council, in its role to facilitate a balanced and affordable acquisition portfolio, to annually review the acquisition portfolio collectively, specifically for long-term affordability. (Recommendation 2)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: The Coast Guard disagreed with this recommendation stating that other bodies within the Coast Guard--such as the Investment Board, Deputies Council, and Investment Review Board--are responsible for making decisions regarding out-year funding, while the Executive Oversight Council works outside of the annual budget process. DHS also stated that, to meet the spirit of our recommendation, the Coast Guard will update the Executive Oversight Council's charter to require a review of the collective acquisition portfolio, specifically evaluating long-term planning. We believe that updating the Executive Oversight Council's charter to include long-term-planning is a positive step. However, we continue to believe that in addition to long-term planning, the Executive Oversight Council should include the major acquisition portfolio's budget realities faced by the Coast Guard in its reviews, or long-term affordability. If the planning accounts for long-term funding considerations to achieve the Coast Guard's acquisition goals and objectives, we believe the intent of our recommendation would be met. The Coast Guard expects to complete the update of the EOC charter by by late summer 2020.

Recommendation: The Secretary of DHS should take steps to develop and document a plan that fully addresses best practices with regards to reduction of backlogged FOIA requests. (Recommendation 4)

Agency: Department of Homeland Security
Status: Open

Comments: In April 2018, the Department of Homeland Security initiated a department-wide compliance assessment and stated that it plans to use the results of the assessment to help guide the department in identifying best practices and areas of improvement. The department does not have an estimate for when the plan will be complete.

Recommendation: The Under Secretary for Management should require the Office of Program Accountability and Risk Management to assess the results of major acquisition programs' post-implementation reviews and identify opportunities to improve performance across the acquisition portfolio. (Recommendation 2)

Agency: Department of Homeland Security
Status: Open

Comments: In providing comments on this report, DHS concurred with our recommendation and stated that it planned to update its policy to require more formal reporting requirements and execution criteria for post-implementation reviews. PARM also plans to initiate a study focused on assessing lessons learned and developing a tool to share them across components to improve performance of the acquisition portfolio. In February 2020, PARM approved guidance intended to standardize analysis elements for post-implementation reviews. As of July 2020, PARM was still in the process of developing a tool to share results across components, but in the interim, results from some post-implementation reviews have been shared during meetings with Component Acquisition Executives. GAO will review post-implementation reviews conducted under the new guidance and will monitor DHS's implementation of the tool to ensure the department's actions meet the intent of this recommendation.

Recommendation: The Administrator of FEMA should work with regional emergency communications coordination working group members to reach consensus on and implement an ongoing mechanism to encourage nationwide collaboration across these groups, considering the costs of one or more suitable methods, such as a national-level working group that uses virtual or other means of coordination, as appropriate. (Recommendation 1)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: DHS concurred with our recommendation. DHS created a national RECCWG website as part of the Homeland Security Information Network in fall 2019, and began a phased roll-out of 10 regional sub-pages available to all RECCWG members can post content and share information on exercises and training. In August 2020 FEMA officials confirmed the national site and all 10 regional sites were operational. They said that briefings on how to use the website for the regions are ongoing. We will continue to follow up on DHS's actions to implement the recommendation.

Recommendation: The Secretary of Homeland Security should work with Congress to include O&S data in monthly execution reports at a major acquisition program level within current program/project activity accounts. (Recommendation 2)

Agency: Department of Homeland Security
Status: Open

Comments: DHS agreed with this recommendation and has indicated the OCFO budget division will develop a display that provides major acquisition program level data at the program project activity level by March 30, 2019. As of March 2020, DHS has developed these displays and is working to populate them with all components' data.

Recommendation: To ensure that all eligible Coast Guard servicemembers are provided the opportunity to complete the Transition Assistance Program (TAP), the Commandant of the Coast Guard should issue an updated Commandant Instruction that establishes policies and procedures to improve the reliability and completeness of TAP data by including when and by whom data should be recorded and updated. (Recommendation 1)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: The Department of Homeland Security agreed with our recommendation and reported that a Commandant Instruction had been drafted, which will include a policy on the duties and requirements for recording TAP data. The Commandant Instruction is anticipated to be issued by October 31, 2018. We will consider this recommendation closed when the Commandant Instruction is officially issued.

Recommendation: To ensure that all eligible Coast Guard servicemembers are provided the opportunity to complete the Transition Assistance Program (TAP), the Commandant of the Coast Guard should establish a formal performance goal with a measurable target for participation rates in VOW Act-mandated portions of TAP. (Recommendation 2)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: The Department of Homeland Security (DHS) agreed with our recommendation and reported that the Coast Guard, Department of Defense (DOD), and other partners collaborated to identify measurable and specific performance goals that are compliant with VOW requirements. In addition, the these goals will be measured using the DOD's TAP-IT Enterprise tracking system once it becomes fully functional to the Coast Guard by October 31, 2018. We will close this recommendation when DHS provides documentation of its measures and goals.

Recommendation: To ensure that all eligible Coast Guard servicemembers are provided the opportunity to complete the Transition Assistance Program (TAP), the Commandant of the Coast Guard should issue an updated Commandant Instruction that defines the roles and responsibilities of the personnel who administer the program and ensure servicemembers' participation. (Recommendation 5)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: The Department of Homeland Security agreed with our recommendation and reported that a Commandant Instruction has been drafted, which will identify the duties of personnel who administer TAP. The Commandant Instruction is anticipated to be issued by October 31, 2018. We will consider this recommendation closed when the Commandant Instruction is officially issued.

Recommendation: To ensure that all eligible Coast Guard servicemembers are provided the opportunity to complete the Transition Assistance Program (TAP), the Commandant of the Coast Guard should, once reliable data are available by installation or unit, enable unit commanders and the higher-level commanders to whom they report to access TAP performance information specifically for the units they oversee so that they can monitor compliance with all TAP requirements. (Recommendation 6)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: The Department of Homeland Security agreed with our recommendation and reported the Coast Guard expects to fully transition to DOD's TAP-IT Enterprise System by October 31, 2018, which is expected to facilitate tracking of servicemember attendance within all TAP components. The agency also stated that following the transition and release of the new Commandant Instruction, Commanding Officers will be able to monitor their compliance with TAP performance and requirements. Both these efforts are expected to be completed by October 31, 2018. We will consider this recommendation closed when the Commandant Instruction has been issued and documentation is provided of the ability to track performance information by unit.

Recommendation: The Director of ICE should take steps to document and implement its review process to ensure accuracy in its budget documents.

Agency: Department of Homeland Security: United States Immigration and Customs Enforcement
Status: Open

Comments: ICE provided us with documentation showing the agency has implemented a review process to prioritize all agency resource requests and document management approval. As of June 2020, we are awaiting documentation that demonstrates this process has been implemented and provides an assurance of accuracy in ICE's budget documents. We will continue to monitor and evaluate ICE's actions to close this recommendation.

Recommendation: The Director of ICE should take steps to assess ICE's adult bed rate methodology to determine the most appropriate way to project the adult bed rate, including any inflation rates used.

Agency: Department of Homeland Security: United States Immigration and Customs Enforcement
Status: Open

Comments: As of June 2020, ICE is taking steps to assess the adult bed rate methodology. ICE provided a verification and validation assessment on the adult bed rate conducted to meet the GPRA Modernization Act of 2010 requirements. From the documentation provided, it is unclear that the assessment examines the methodology of the adult bed rate. According to ICE officials, the agency is working towards conducting an analysis on the methodology of the adult bed rate calculations. We will continue to monitor and evaluate ICE's actions to close the recommendation.

Recommendation: The Director of ICE should take steps to update ICE's adult bed rate methodology by incorporating necessary changes based on its assessment, and ensure the use of appropriate inflation rates and the removal of family beds from all calculations.

Agency: Department of Homeland Security: United States Immigration and Customs Enforcement
Status: Open

Comments: As part of addressing this recommendation, ICE developed a bed rate calculator that the agency stated ensures the use of proper inflation rates and the removal of family beds. ICE provided documentation demonstrating changes to the calculations of the adult bed rate, including the removal of family beds from its budget calculations. As of June 2020, we are awaiting documentation from ICE that demonstrates the use of appropriate inflation rates. We will continue to monitor and evaluate ICE's actions to close this recommendation.

Recommendation: The Director of ICE should take steps to determine the most appropriate way to project the ADP for use in the congressional budget justification and document the methodology and rationale behind its ADP projection. As part of that determination, ICE should consider the extent to which a statistical model could be used to accurately forecast ADP.

Agency: Department of Homeland Security: United States Immigration and Customs Enforcement
Status: Open

Comments: ICE provided us with documentation on the statistical model and its methodology during the course of our review and utilized the model during the fiscal years 2019 and 2020 budget cycles. ICE used the model to provide a point estimate within a specific confidence interval and documented the interval that the agency used and the reasoning behind the use of that interval. As of June 2020, we are following up with ICE regarding the extent to which the model was used to determine the total number of detention beds.

Recommendation: The Director of ICE should take steps to ensure that ICE's budget estimating process more fully addresses cost estimating best practices.

Agency: Department of Homeland Security: United States Immigration and Customs Enforcement
Status: Open

Comments: As of June 2020, ICE is taking steps to address this recommendation, and has provided documentation. For example, ICE has developed a sliding bed rate scale from conducting a sensitivity analysis and has detailed some of its calculations and assumptions for the adult bed rate. We will continue to work with ICE to obtain additional documentation needed to evaluate the agency's efforts to improve its detention cost estimating practices.

Recommendation: The Secretary of Homeland Security, in cooperation with the co-SSAs as necessary, should take steps to consult with respective sector partner(s), such as the SCC, and NIST, as appropriate, to develop methods for determining the level and type of framework adoption by entities across their respective sectors. (Recommendation 7)

Agency: Department of Homeland Security
Status: Open
Priority recommendation

Comments: In written comments, the Department of Homeland Security (DHS) concurred with the recommendation in our report and stated that its National Protection and Programs Directorate, as the sector-specific agency for 9 of the 16 critical infrastructure sectors, will continue to work closely with its private sector partners to ensure framework adoption is a priority. Additionally, the department stated that the directorate will work closely with its private sector partners to better understand the extent of framework adoption and barriers to adoption by entities across their respective sectors. As of January 2020, the department had begun taking steps to develop methods to determine the level and type of framework adoption in the respective sectors. Specifically, in October 2019, DHS, in coordination with its Information Technology (IT) sector partner, administered a survey to all small and midsized IT sector organizations to gather information on, among other things, framework use and plans to report on the results in 2020. DHS officials stated that any small or mid-sized business across all critical infrastructure sectors could complete the survey and that the department had promoted the survey to all sectors.

Recommendation: The Commissioner of CBP should take steps to evaluate the effectiveness of CBP's IPR enforcement efforts, such as by improving its metrics to track the overall effectiveness of its IPR enforcement efforts, evaluating selected activities to enhance IPR enforcement, and developing a process to assess and share information on port-led initiatives to enhance IPR enforcement (Recommendation 1)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: CBP concurred with this recommendation. In September 2018, CBP stated that it had established an IPR working group that meets every 4-6 weeks to implement its Fiscal Year 2018 IPR Strategic Plan and develop priorities and metrics. CBP stated that, in these meetings, headquarters and field personnel share information on the results and effectiveness of local and national port initiatives and develop policies for improving IPR enforcement. Additionally, CBP provided evidence that it has begun efforts to improve its tracking of metrics and evaluation of selected activities to enhance IPR enforcement. For example, CBP provided data for 5 of the 16 measurement indicators included in its IPR Strategic Plan. Additionally, the IPR Strategic Plan includes at least 5 action items to assess or evaluate aspects of CBP's IPR enforcement. As of February 2020, CBP officials indicated they are continuing to work on these efforts. We will continue to monitor their implementation.

Recommendation: The Commissioner of CBP, in consultation with ICE, should assess what, if any, additional information would be beneficial to share with the private sector and, as appropriate, take action to enhance information sharing, where possible, such as by proposing regulatory revisions or requesting additional legal authorities from Congress. (Recommendation 2)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: CBP concurred with this recommendation. CBP stated that, in May 2018, it briefed the Senate Finance Committee on six policy goals to improve IPR, import safety, and e-commerce enforcement that require additional legislative authority to implement. In December 2018, CBP stated that it had identified the need to establish an information sharing structure for e-commerce as a first step in implementing its E-Commerce Strategy. CBP officials stated that they would work with offices throughout CBP and with key stakeholders in the trade community and the Commercial Customs Advisory Committee (COAC) to build an information sharing structure and identify the necessary statutory and regulatory changes to implement it. CBP said that, when statutory changes have been identified, it will work through the interagency process to make any necessary Congressional recommendations. In January 2020, the Department of Homeland Security published a report that identified actions to combat trafficking of counterfeit and pirated goods in conjunction with the private sector. These actions included steps to share additional information with the private sector. For example, the report said that when CBP identifies suspected counterfeit merchandise that is destined for a U.S. fulfillment center or warehouse, it will notify the e-commerce platform or other third-party intermediary operating the facility. This will allow the operator of the fulfillment center or warehouse to remove or destroy any identical items from the same seller in coordination with rights holders. The report also recommends the formation of the Anti-Counterfeiting Consortium to Identify Online Nefarious Actors and a framework for sharing information with sellers, shippers, and other third-party intermediaries. If implemented, these steps could help to enhance information sharing with the private sector. GAO continues to monitor the implementation of these actions.

Recommendation: The Secretary of Homeland Security, in collaboration with other agencies, through the planned interagency working group or another mechanism, should identify further opportunities to more effectively publicize resources to reach additional colleges. (Recommendation 2)

Agency: Department of Homeland Security
Status: Open

Comments: In early 2020, the federal government created the schoolsafety.gov clearinghouse website to compile and publicize emergency preparedness resources from across multiple agencies including the Departments of Education, Homeland Security, and Justice. The website houses key emergency preparedness resources we identified during our work as well as newer information that was not part of our review, such as guidance related to the Coronavirus Pandemic. DHS issued a press release when the website was launched, but does not prominently publicize it on it website, including on its webpages that are specifically focused on colleges and universities. We will monitor the agency's efforts to publicize these resources and consider closing it at that time.

Recommendation: The Commissioner of CBP should develop a monitoring system to help ensure that CBP officials comply with license verification policies and procedures. (Recommendation 1)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open
Priority recommendation

Comments: CBP agreed with our recommendation and said they would complete their corrective actions by April 30, 2020. To fully implement it, CBP should develop a monitoring system that observes agency verification of licenses for imported radiological materials to ensure CBP officials are complying with existing policies and procedures.

Recommendation: The Commissioner of CBP should develop a system that better identifies shipments of radiological material that pose the greatest risk and revise CBP's policies and procedures as necessary to verify licenses for these shipments. (Recommendation 3)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open
Priority recommendation

Comments: CBP agreed with our recommendation and said they would complete their corrective actions by April 30, 2020. To fully implement it, CBP should develop a system to better identify which shipments of radiological material pose the greatest risk and revise their policies and procedures for verification of the licenses for these shipments accordingly.

Recommendation: The Assistant Administrator for Recovery should develop a detailed workforce plan that documents steps for hiring, training, and retaining key appeals staff. The plan should also address staff transitions resulting from deployments to disasters. (Recommendation 3)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: DHS concurred with this recommendation and said it would take steps to implement it. According to FEMA, to prepare for the potential production of a detailed regional workforce plan, PAAB (Public Assistance Appeals Branch) has been collecting information from the Regions regarding the percentage of time (on a monthly basis) that each Regional appeals analyst has worked on appeals. In August 2018, PAAB shared with the Regions its preliminary analysis of this information and asked the Regions to provide feedback regarding the methods used to analyze this information. PAAB said that they intend to assess first-level appeals' regional inventory and timeliness issues, as well as the work needed to prepare and finalize a detailed regional workforce plan. According to FEMA, PAAB is also analyzing second-level appeal inventory and timeliness, and will continue to monitor second-level appeal timeliness. In April 2020, we met with FEMA to discuss additional information and documentation they sent us involving their analysis of appeal inventories and whether this analysis is part of a larger effort to develop a detailed workforce plan as called for in the recommendation. As a result of this meeting, we received further documentation from FEMA in July 2020, and are in the process of evaluating this to determine whether FEMA has fully addressed this recommendation.

Recommendation: The Assistant Administrator for Recovery should work with Regional Administrators in all 10 regional offices, to establish and use goals and measures for processing first-level PA appeals to monitor performance and report on progress. (Recommendation 4)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: DHS concurred with this recommendation and said it would take steps to implement it. According to FEMA, in July 2018, the Public Assistance Division and PAAB transmitted a survey to the Regions containing questions about how each Region establishes goals for processing first-level appeals and how each Region measures and monitors performance with respect to those goals. Thereafter, the Regions provided survey responses to PAAB. According to FEMA, PAAB has begun analyzing the survey responses for the purpose of enabling FEMA's Associate Administrator for the Office of Response and Recovery and FEMA's Chief of Staff to work with all FEMA Regional Administrators to establish and use goals and measures for processing first-level PA appeals to monitor performance and report on progress. In April 2020, we met with FEMA to discuss additional information and documentation they sent us involving these efforts and their development of performance metrics that reflect best practices for the timely processing, tracking, and reporting of first appeals. As a result of this meeting, we received further documentation from FEMA in July 2020, and are in the process of evaluating this to determine whether FEMA has fully addressed this recommendation.

Recommendation: Once reliable data are available, the Coast Guard, or another agency identified by the working group, should assess the rates of commercial fishing vessel accidents, injuries, and fatalities to determine whether certain factors--including vessel length and region of operation, among other things--affect these rates. (Recommendation 3)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: The Department of Homeland Security (DHS) did not concur with our recommendation that the Coast Guard assess the rates of commercial fishing vessel accidents, injuries, and fatalities to determine whether certain factors-such as vessel length and region of operation-affect these rates. DHS officials stated that the Coast Guard has limited resources and capabilities to conduct such assessments and noted that the National Institute for Occupational Safety and Health (NIOSH) studies marine incidents to identify causal factors in fishing vessel casualties, which could more effectively determine casualty rates. The Coast Guard uses this information to update and develop commercial fishing vessel safety standards and policy, as appropriate. GAO agrees that NIOSH plays an important role in identifying commercial fishing fatalities and regional risk factors, but such assessments typically focus on fatalities in specific fisheries, and generally did not consider such factors as vessel length or whether the vessel has been classed. As of July 2020, Coast Guard officials stated the Coast Guard continues to work with other Federal partners on data collection strategies through the established work group to determine the best reliable data in order to establish credible rates of casualties, injuries, and fatalities in the commercial fishing vessel industry. This recommendation will remain open pending a decision by the working group on the appropriate agency to conduct these assessments.

Recommendation: The Coast Guard should issue regulations or guidance to clarify and implement the alternative-to-class approach. (Recommendation 4)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: The Department of Homeland Security concurred with our recommendation that the Coast Guard issue regulations or guidance to clarify and implement the alternative-to-class approach. As of November 2018, the Coast Guard made a presentation to the commercial fishing industry clarifying the alternative-to-class approach as it relates to commercial fishing vessels including discussion topics such as understanding the language of 46 USC 4503 and State Licensed Naval Architect and Marine Engineers' scope of responsibilities when incorporating standards equivalent to those prescribed by a classification society. As of June 2020, Coast Guard officials stated they have formalized work instruction guidance regarding implementation of the alternative-to-class approach. This guidance is expected to be released by the end of 2020.

Recommendation: The FEMA Assistant Administrator for Recovery, in coordination with the Associate Administrator of the Federal Insurance and Mitigation Administration, should develop performance measures and associated objectives for the new delivery model to better align with FEMA's strategic goal for hazard mitigation in the recovery process. (Recommendation 5)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency: Office of Response and Recovery: Assistant Administrator for Recovery
Status: Open

Comments: FEMA concurred with this recommendation and said it would take steps to implement it. As of September 2018, officials reported completing activities to develop disaster-specific mitigation performance measures that align with strategic goals and analyzed available data to identify the drivers of mitigation in events of various sizes. Due to hiring delays associated with the establishment of the 406 Mitigation Branch, officials have extended the expected completion date for all actions, including proposing refined performance measures to FEMA senior leadership, to the end of January 2019. As of December 2019, GAO is awaiting a response from FEMA on their progress completing these actions.

Recommendation: The Commandant of the Coast Guard should either develop new performance goals to address mission activity gaps, or explain in the Coast Guard's Annual Performance Report (APR) why certain aspects of mission performance are measured while others are not. (Recommendation 1)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: In October 2017, the Coast Guard concurred with our recommendation and stated that it would add new measures in future Annual Performance Reports (APRs) and explain what is measured and what is not, as appropriate. In May 2020, the Coast Guard provided GAO with its updated fiscal year 2019 APR. After reviewing the fiscal year 2019 APR, we found that the Coast Guard made revisions to the goals for the Ports, Waterways, and Coastal Security (PWCS) and Marine Environmental Protection-prevention activities (MEP) missions and added a goal for the Search and Rescue mission. However, the APR did not include additional goals or an explanation why certain aspects of mission performance are measured while others are not for the other performance goals we previously identified as not fully addressing all related mission activities. In its July 2020 update to this recommendation, the Coast Guard reported that the metrics published in the APR are measures of Coast Guard performance and not performance goals. The Coast Guard also noted that it continually evaluates the utility of its performance measures, and makes changes to individual measures, as well as its suite of measures, when doing so provides meaningful improvement. In its July 2020 update, the Coast Guard added that targets established for performance measures are intended to be realistic expectations of future performance and targets are continually evaluated and changed when current performance modify expectations. However, we continue to believe that in the absence of documentation explaining how existing performance goals address each mission, the extent to which the Coast Guard's performance goals encompass all of its mission activities is unclear. Either developing new goals to address mission activity gaps, or describing in the APR how existing goals sufficiently assess the performance of each mission could provide more meaningful information on progress in achieving Coast Guard's missions to executive branch decision makers, Congress, and the public. In order to fully implement the recommendation as intended, in instances in which performance goals do not fully address all of the respective mission activities, the Coast Guard's APR should include an explanation of the Coast Guard's rationale for why certain aspects of mission performance are measured while others are not. We will continue to follow-up on the Coast Guard's efforts to address this recommendation.

Recommendation: The Commandant of the Coast Guard should establish and follow a sound air station optimization process similar to its process for analyzing boat stations to allow it to comprehensively analyze its need for air stations and air facilities and determine what changes may be needed. (Recommendation 1)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: In 2017, GAO reported that a 2014 Coast Guard contracted analysis of selected air stations and air facilities identified overlap and unnecessary duplication but it did not comprehensively review all air stations and air facilities. The analysis determined that certain air facilities (Newport, Oregon, and Charleston, South Carolina) provided overlapping search and rescue coverage, some of which was unnecessarily duplicative. Coast Guard officials used the results of this analysis to support proposed closures of the air facilities in the President's Fiscal Year 2014 Budget. However, shortly before their planned closure date, the Coast Guard encountered strong opposition to the closures at the local, state, and Congressional levels, and did not close them. The Coast Guard agreed with GAO's recommendation that it establish and follow a sound air station optimization process and comprehensive analysis to determine what changes may be needed. In its December 2017 60-Day letter response, DHS said the Coast Guard will utilize the FY 2020 Planning, Programming, Budget, and Execution cycle to identify efficiencies in air station optimization and that the cycle is proceeding as planned. However, the response did not say whether the Coast Guard will act on findings and permanently close stations identified as overlapping, unnecessarily duplicative, and unnecessary, if any are identified. As of March 2020, the agency has identified the need for further analysis and estimates completion of these analyses in March 2021.

Recommendation: The Commandant of the Coast Guard should establish a plan with target dates and milestones for closing boat stations that it has determined, through its 9-step process and subsequent analysis, provide overlapping search and rescue coverage and are unnecessarily duplicative. (Recommendation 2)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open
Priority recommendation

Comments: In 2017, GAO reported that the Coast Guard has a sound process for analyzing its boat stations that includes clear and specific steps for analyzing the need for stations using terms that can be readily defined and measured. A 2013 analysis of Coast Guard stations identified unnecessary duplication and recommended certain stations that could be permanently closed without negatively affecting the Coast Guard's ability to meet its 2-hour search and rescue response standard and other mission requirements; however, as of August 2017 the Coast Guard had not closed any stations, nor developed a plan with time frames for closing stations even though leaders said the results of the analysis remain valid. Closing unneeded stations has historically been difficult due to public concern about the effect of closures on local communities and other factors. In some cases over the years, Congress has intervened and enacted federal laws that have affected Coast Guard's proposed closures. Nevertheless, the Coast Guard agreed with GAO's recommendation that it establish a plan with target dates and milestones for closing stations. In its December 2017 60-Day letter response, DHS said the Coast Guard Office of Boat Forces continues to evaluate the optimal number, location, and configuration of stations to better meet mission requirements, and is finalizing analysis of operational needs in Coast Guard Districts One (D1) and Five (D5). As of December 2019, the agency had completed additional analyses and reported that it was considering changes in operations for several stations. The Coast Guard estimated that it will continue to consider changes until spring 2020. However, the Coast Guard did not establish target dates or milestones for closing stations. By developing a plan with target dates and milestones for closing stations that are unnecessarily duplicative, the Coast Guard would be better positioned to improve operations and achieve cost savings over time.

Recommendation: The Commandant of the Coast Guard should take action to close the stations identified according to its plan and target dates. (Recommendation 3)

Agency: Department of Homeland Security: United States Coast Guard
Status: Open
Priority recommendation

Comments: In 2017, GAO reported that the Coast Guard has not taken action to implement the results of its analyses which recommended station closures even though it has completed requirements to pursue some station closures. For example, a 2013 analysis of Coast Guard stations identified unnecessary duplication and recommended certain stations that could be permanently closed without negatively affecting the Coast Guard's ability to meet its 2-hour search and rescue response standard and other mission requirements. However, as of August 2017 the Coast Guard had not closed any stations, nor developed a plan with time frames for closing stations even though Coast Guard leaders said the results of the analysis remain valid. GAO reported that the Coast Guard had not closed stations because past efforts to close stations (eight attempts since 1973) were met with resistance from affected communities and instances where the Congress intervened. Nevertheless, the Coast Guard agreed with GAO's recommendation that it establish a plan with target dates and milestones for closing stations. In its December 2017 60-Day letter response, DHS said that once analyses of the need for and locations of boat stations are completed for Coast Guard Districts One and Five, the Coast Guard will commence Congressional engagement and public outreach regarding any operational changes to D1 and D5 stations, if any, including processing feedback from stakeholders before making final decisions on recommended changes. As of December 2019, the Coast Guard reported that it was considering changes in operational status for several stations. The Coast Guard estimated that it will continue to consider changes until spring 2020, which, if implemented, will be more than 7 years after it proposed station closures. By closing unnecessarily duplicative stations, the Coast Guard could be better positioned to improve its operations and achieve cost savings over time.

Recommendation: To improve agencies' physical security programs' alignment with the ISC Risk Management Process for Federal Facilities and Standards for Internal Control in the Federal Government for information and monitoring, the Commissioner of U.S. Customs and Border Protection, with regard to the updated Security Policy and Procedures Handbook, should include data collection and analysis requirements for monitoring the performance of CBP's physical security program.

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: The U.S. Customs and Border Protection issued an updated Physical Security Policy and Procedures Handbook in January 2020, which includes a series of internal controls and physical security performance measures. We have reviewed the handbook and requested additional information from CBP to determine whether it meets ISC's Risk Management Process for Federal Facilities.

Recommendation: The Commissioner of CBP should clearly document the process and criteria for making decisions on funding non-owned operational requirements and communicate this process to Border Patrol sectors. (Recommendation 2)

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: In September 2017, CBP concurred with our recommendation and stated that it will use the Capability Gap Analysis Process to validate its access and mobility requirements on a national level. The national priorities will be determined through requirements planning at Border Patrol stations. CBP noted that it will outline the process and criteria for making decisions on funding for non-owned operational requirements and communicate this process to Border Patrol sectors. In November 2018, CBP reported that Border Patrol developed a prioritization process related to the order of wall deployments, which will be tailored to use in determining the priority order for road investments. According to CBP, priority order is to be determined based on the analysis of quantitative and qualitative data and the operational expertise of Border Patrol station, sector and national level leadership. The process was developed by USBP's Operational Requirements Management Division, communicated to southern border sectors, and executed to establish the priority deployment order of fiscal year 2018 new road requirements. Once the prioritization process has been refined, it will be expanded to also include the maintenance and repair on existing roads. In October 2019, CBP reported that it continues to work on enhancing the existing prioritization strategy, which includes exploring implementation of a new prioritization modeling tool and methodology. Discussions on how and if the model will be effective as a prioritization tool have been delayed due to several other internal priorities and external disruptions. Therefore, and based on leadership guidance, the prioritization strategy and methodology will be delayed. CBP officials reported in June 2020 that Border Patrol's Strategic Planning and Analysis Directorate Operational Requirements Management Division personnel will conduct data calls over the upcoming weeks with Tactical Infrastructure subject matter experts from the sectors and stations to validate existing road requirements and initiate the data collection for the prioritization process. Once the process is formalized, we will determine whether CBP's efforts fully address the intent of this recommendation.

Recommendation: The DHS Under Secretary for Management should develop and implement effective processes and improve guidance to reasonably assure that future AAs fully follow AOA process best practices and reflect the four characteristics of a reliable, high-quality AOA process. (Recommendation 1)

Agency: Department of Homeland Security
Status: Open

Comments: DHS stated that it remains committed to its financial system modernization program and agrees that effective processes and guidance are necessary to assure best practices. In September 2020, DHS officials informed us that they did not have any updates to report on efforts to address this recommendation. We will continue to follow-up with DHS on actions to address this recommendation.

Recommendation: The DHS Under Secretary for Management should improve the Risk Management Planning Handbook and other relevant guidance for managing risks associated with financial management system modernization projects to fully incorporate risk management best practices, including (1) defining thresholds to facilitate review of performance metrics to determine when risks become unacceptable; (2) identifying and analyzing risks to include periodically reconsidering risk sources, documenting risks specifically related to the lack of sufficient, reliable cost and schedule information needed to help properly manage and oversee the project, and timely disposition of IV&V contractor-identified risks; (3) developing risk mitigation plans with specific risk-handling activities, the costs and benefits of implementing them, and contingency plans for selected critical risks; and (4) implementing risk mitigation plans to include establishing periods of performance for risk-handling activities and defining time intervals for updating and certifying the accuracy and completeness of information on risks in DHS's risk register. (Recommendation 2)

Agency: Department of Homeland Security
Status: Open

Comments: DHS stated that it is committed to its financial system modernization program and agrees that effective processes and guidance are necessary to assure best practices. In September 2019, DHS provided documentation that cross walked DHS' Risk Management Training Aide to the Capability Maturity Model Integration (CMMI) for acquisition risk management best practices. However, the optional nature of the language used in the Training Aide does not reasonably assure that program offices will follow the suggested guidance. Also, the Training Aide does not specifically require the linking of thresholds to cost, schedule, and performance elements of identified risks. Based on our review of the information provided, DHS's corrective actions were not sufficient for addressing the intent of our recommendation. We will continue to evaluate DHS actions to address this recommendation.

Recommendation: The Administrator of TSA should explore and pursue methods to assess the deterrent effect of TSA's passenger aviation security countermeasures; such an effort should identify FAMS—a countermeasure with a focus on deterring threats—as a top priority to address. (Recommendation 1)

Agency: Department of Homeland Security: Transportation Security Administration
Status: Open

Comments: DHS concurred with this recommendation and has begun taking steps intended to address it. In May 2018, officials with DHS's Requirements and Capabilities Analysis (RCA) reported conducting a literature review to identify ways DHS might be able to measure deterrence. ORCA officials reported looking to published studies and other agencies to identify data sources and methods, and were in the process of developing a model to assess the deterrent value of various aviation security countermeasures. In July 2019, TSA officials reported that they were continuing to develop this model which could better inform deployment of deterrence-related countermeasures. As of October 2020, DHS has provided no further updates on steps taken to implement this recommendation. To fully address this recommendation, TSA will need to fully develop this or another method to assess the deterrent effect of TSA's aviation security countermeasures.

Recommendation: To provide reasonable assurance that USRAP applicant fraud prevention and detection controls are adequate and effectively implemented, the Secretaries of Homeland Security and State should conduct regular joint assessments of applicant fraud risk across USRAP.

Agency: Department of Homeland Security
Status: Open

Comments: We reported that the Department of State and DHS's U.S. Citizenship and Immigration Services (USCIS) have not jointly assessed applicant fraud risks across the U.S. Refugee Admissions Program (USRAP), consistent with federal internal control standards and leading practices for fraud risk management. Specifically, we reported that although State and USCIS perform a number of fraud risk management activities and have responded to individual instances of applicant fraud in the program, these efforts do not position State and USCIS to assess fraud risks program-wide for USRAP or know if their controls are appropriately targeted to the areas of highest risk in the program. Therefore, we recommended that the Secretaries of Homeland Security and State conduct regular joint assessments of applicant fraud risk across USRAP. USCIS concurred with our recommendation. In response, State reported that it will work together with USCIS to conduct joint risk assessments by jointly developing a risk assessment framework. According to DHS and State documentation, the departments finalized a joint framework in January 2018. In February 2019, DHS and State provided us with the interim progress report on their efforts to conduct an assessment of applicant fraud risk across USRAP. In June 2019, USCIS reported that DHS and State have completed the planned analysis and the draft report is being prepared for leadership review and clearance. DHS estimated that the report will be completed by September 30, 2020. To fully address the recommendation, State and USCIS should jointly conduct regular fraud risk assessments across USRAP.

Recommendation: The Commissioner of CBP should identify and collect additional performance information on the impact of the ISF rule data, such as the identification of shipments containing contraband, to better evaluate the effectiveness of the ISF program.

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: In March 2018, the CBP liaison informed GAO that offices within CBP are collaborating on a plan to assess additional performance metrics to evaluate the effectiveness of the ISF program. On June 13, 2018, the CBP liaison stated that CBP staff continue to work on additional performance metrics to evaluate the effectiveness of the ISF program and noted, in particular, are analyzing data to: (1) identify the number of unmanifested containers and determine how/if they were mitigated before arrival; (2) determine the number of times C-TPAT companies were identified and given targeting benefits, but did not receive the same treatment based on manifest information; and (3) identify the number of times potential terrorism matches were made against an ISF entities vs. the number of times not matched using the same manifest data. In March 2019, the CBP liaison stated that the new estimated completed date for this recommendation is the end of 2019. This recommendation will remain open until CBP's planned actions are completed and meet the intent of GAO's recommendation. In late February 2020, CBP liaison staff informed GAO that they are continuing to work on this recommendation, which they expect to complete by March 31, 2020.

Recommendation: In order to improve employee misconduct policies and procedures, the Secretary of Homeland Security should direct the FEMA Administrator to document policies and procedures to address potential Surge Capacity Force misconduct.

Agency: Department of Homeland Security
Status: Open

Comments: We found that the Federal Emergency Management Agency (FEMA) had developed and documented misconduct policies and procedures for most employees, but not its entire workforce. Specifically, FEMA had not documented misconduct policies and procedures for Surge Capacity Force members, who may augment FEMA's workforce in the event of a catastrophic disaster. As a result, we recommended that FEMA document policies and procedures to address potential Surge Capacity Force misconduct. In September 2017, FEMA officials reported taking action to address this recommendation. Specifically, FEMA distributed a memorandum to Federal Coordinating Officers and Federal Disaster Recovery Coordinators providing guidance on how and to whom to report allegations of misconduct by Surge Capacity Force members, coordination efforts regarding investigations, and how to address the member's duty status during the course of an investigation. FEMA stated that it will further address this recommendation by updating the FEMA Human Capital Plan for the Surge Capacity Force. As of August 2020, FEMA was finalizing a comprehensive Human Capital Guide based on lessons learned during the 2017 disaster season, which will address the Surge Capacity Force. This recommendation will remain open until the Human Capital Guide is completed.

Recommendation: In order to improve employee misconduct policies and procedures, the Secretary of Homeland Security should direct the FEMA Administrator to document Reservist disciplinary options and appeals policies and procedures that are currently in practice at the agency.

Agency: Department of Homeland Security
Status: Open

Comments: We found that the Federal Emergency Management Agency's (FEMA) policies and procedures for Reservist employees did not outline disciplinary options to address misconduct or address the appeals process available for Reservists. As a result, we recommended that FEMA document Reservist disciplinary options and appeals policies and procedures that are currently in practice at the agency. In September 2017, FEMA reported that the Office of Response and Recovery was drafting an addendum to the FEMA Reservist program manual. As of August 2020, FEMA was finalizing a FEMA Reservist Performance Management Directive which will provide agency-wide guidance for Reservist management and discipline. FEMA expects the directive to be completed by November 2020. This recommendation will remain open until the directive is complete.

Recommendation: In order to better identify and address trends in employee misconduct, the Secretary of Homeland Security should direct the FEMA Administrator to, once the quality of the data is improved, conduct routine reporting on employee misconduct trends.

Agency: Department of Homeland Security
Status: Open

Comments: We found that the Federal Emergency Management Agency (FEMA) did not regularly conduct trend analysis on misconduct cases, and that the quality of the data restricted the agency's ability to identify and address trends. As a result, we recommended that, once steps were taken to improve the quality of the data, FEMA should conduct routine reporting on employee misconduct trends. As of July 2020, FEMA's Office of Professional Responsibility (OPR) changed plans on which information system to use for reporting purposes due to cyber security concerns. According to FEMA officials, OPR will be using a DHS enterprise system and the system will be able to generate regular reporting. FEMA anticipates reporting functionality by October 2020. We will continue to monitor FEMA's efforts to address the recommendation.

Recommendation: To strengthen CBP's trade enforcement efforts, the Commissioner of CBP should direct the Office of Trade to include performance targets, when applicable, in addition to performance measures in its Priority Trade Issue strategic and annual plans.

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: As of August 2019, the seven FY 2019 Priority Trade Issue (PTI) annual plans prepared by CBP's Office of Trade all included performance measures with performance targets, but some plans did not include baselines to measure it's trade enforcement efforts against. The Office of Trade reported that it was in the process of finalizing its FY2020 annual plans, which should be available in December 2019. In addition, the Office of Trade reported that it no longer develops a single strategic plan covering all of its PTIs and only prepares the PTI annual plans.

Recommendation: To strengthen CBP's trade enforcement efforts, the Commissioner of CBP should direct the Office of Trade and the Office of Field Operations to develop a long-term hiring plan that articulates how CBP will reach its staffing targets for trade positions set in the Homeland Security Act and the agency's resource optimization model.

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: As of June 2019, CBP stated that both the Office of Trade (OT) and Office of Field Operations (OFO) continue to take steps to address hiring gaps which include evaluating approaches to hiring and evaluating and selecting candidates for its various trade positions. For example, OT had developed a recruitment strategy for hiring regulatory auditors. OT reported that it has brought regulatory auditors onboard as a result of its strategy but experienced attrition and challenges in attaining its staffing target for this position. OT and OFO did not provide recruitment strategies for the other trade positions. OFO's Human Capital Division, along with assistance from OT and other CBP components, reported finalizing a long-term hiring plan to meet and maintain the congressional floor for certain trade and revenue positions, including those for import specialists, by the end of fiscal year 2020.

Recommendation: To ensure that DHS effectively implements FITARA, the Secretary of Homeland Security should direct the Under Secretary for Management to direct the Chief Information Officer to establish time frames and implement a plan for (1) identifying the department's future IT skillset needs as a result of DHS's new delivery model, (2) conducting a skills gap analysis, and (3) resolving any skills gaps identified.

Agency: Department of Homeland Security
Status: Open

Comments: In 2018 and 2019, the DHS Office of the Chief Information Officer implemented a Strategic Workforce Planning initiative that included (1) identifying the department's future IT skillset needs, and (2) conducting a skills gap analysis related to these needs. The department is currently working to resolve the skills gaps identified during the initiative. We will continue to monitor and evaluate the Department's efforts to resolve these skills gaps.

Recommendation: To ensure that DHS effectively implements FITARA, the Secretary of Homeland Security should direct the Under Secretary for Management to update the department's acquisition policies and guidance to be consistent in identifying that the DHS CIO is to certify investments' incremental development activities.

Agency: Department of Homeland Security
Status: Open

Comments: In response to our recommendation, DHS updated its agile development policy to specify that the DHS CIO is responsible for certifying investments' incremental development activities, which is consistent with the Department's Acquisition Management Instruction. However, DHS has not yet updated its Systems Engineering Life Cycle Instruction and Guidebook to be consistent in specifying that this certification is the responsibility of the DHS CIO. We will continue to monitor the Department's progress in implementing this recommendation.

Recommendation: To ensure that DHS effectively implements FITARA, the Secretary of Homeland Security should direct the Under Secretary for Management to update DHS headquarters', Customs and Border Protection's, and U.S. Coast Guard's processes to track, for all contracts and agreements, the IT investment with which each is associated (as applicable).

Agency: Department of Homeland Security
Status: Open

Comments: In response to our recommendation, Customs and Border Protection implemented a process to track the IT investments associated with each contract and agreement. The U.S. Coast Guard also implemented a process to track the IT investments associated with its contracts; however, it has not yet demonstrated that it has implemented such a process for tracking the IT investments associated with its agreements. Further, DHS headquarters is still working to establish a process for tracking the IT investments associated with its contracts and agreements. We will continue to monitor and evaluate the Department's progress in implementing this recommendation.

Recommendation: To ensure that DHS effectively implements FITARA, the Secretary of Homeland Security should direct the Under Secretary for Management to update and implement the process DHS uses for assessing the risks of major IT investments to ensure that the CIO rating reported to the Dashboard fully reflects the CIO's assessment of each major IT investment.

Agency: Department of Homeland Security
Status: Open

Comments: DHS concurred with our recommendation. In May 2020, DHS officials stated that the Office of the CIO began piloting a new program health assessment process in the second quarter of fiscal year 2020, and DHS intends to report the program ratings resulting from that process to the IT Dashboard. We will continue to monitor and evaluate the Department's efforts to implement this new process.

Recommendation: To help ensure that efforts to address smuggling through cross-border tunnels, ultralight aircraft, panga boats, and recreational vessels are effective and that managers and stakeholders have the information needed to make decisions, the Secretary of Homeland Security should direct the Commissioner of CBP to assess and document how the alternative technological solutions being considered will fully meet operational needs related to ultralight aircraft.

Agency: Department of Homeland Security
Status: Open

Comments: DHS concurred with this recommendation and stated that it plans to assess and document requirements related to ultralight aircraft threats and how technological solutions will address these requirements as part of U.S. Customs and Border Protection (CBP) Air and Marine Operations (AMO) air domain awareness efforts. In March 2018, CBP completed an Air Domain Awareness Capability Analysis Report that identifies current capability gaps, including those related to ultralight aircraft. CBP stated that it plans to build upon the Capability Analysis Report to identify mission needs, a concept of operations, and operational requirements to address ultralight aircraft and other threats in the air domain. In February 2020, AMO reported that, in 2019, it conducted a technical assessment of one technology and plans to assess other systems in 2020 and 2021 to help determine if they fit into AMO's larger strategic vision for persistent wide area surveillance to address ultralight aircraft and other threats in the air domain. To fully address our recommendation, CBP should assess and document how alternative solutions will meet operational requirements related to ultralight aircraft.

Recommendation: To help ensure that efforts to address smuggling through cross-border tunnels, ultralight aircraft, panga boats, and recreational vessels are effective and that managers and stakeholders have the information needed to make decisions, the Secretary of Homeland Security should direct the Commissioner of CBP and the Director of ICE to jointly establish and monitor performance measures and targets related to cross-border tunnels.

Agency: Department of Homeland Security
Status: Open

Comments: DHS concurred with this recommendation and stated that U.S. Customs and Border Protection and U.S. Immigration and Customs Enforcement will review available information and develop performance measures and targets as deemed appropriate. As of March 2020, CBP and ICE have not reported taking any actions to develop performance measures and targets. To fully address our recommendation, CBP and ICE should establish and monitor performance measures and targets related to cross-border tunnels.

Recommendation: To help ensure that efforts to address smuggling through cross-border tunnels, ultralight aircraft, panga boats, and recreational vessels are effective and that managers and stakeholders have the information needed to make decisions, the Secretary of Homeland Security should direct the Commissioner of CBP to establish and monitor performance targets related to ultralight aircraft.

Agency: Department of Homeland Security
Status: Open

Comments: DHS concurred and stated that within U.S. Customs and Border Protection (CBP), Air and Marine Operations and the U.S. Border Patrol are developing a joint performance measure and targets for interdicting ultralight aircraft. However, in December 2019, CBP reported that it will no longer pursue establishing a performance measure because it found that the ultralight aircraft interdiction rate fluctuated year to year, and that the number of ultralight aircraft incidents had been trending downward. Subsequently, in September 2020, CBP officials stated that they had reinitiated efforts to develop a performance measure and target in response to our continued belief that they can be set and would help CBP monitor performance to ensure that technology investments and operational responses to address ultralight aircraft are effective. To fully address our recommendation, CBP should establish a measure and monitor performance related to ultralight aircraft.

Recommendation: To help ensure that efforts to address smuggling through cross-border tunnels, ultralight aircraft, panga boats, and recreational vessels are effective and that managers and stakeholders have the information needed to make decisions, the Secretary of Homeland Security should direct the U.S. Customs and Border Protection (CBP)-U.S. Immigration and Customs Enforcement (ICE) tunnel committee to convene and establish standard operating procedures for addressing cross-border tunnels, including procedures for sharing information.

Agency: Department of Homeland Security
Status: Open

Comments: DHS did not concur with this recommendation. However, CBP and ICE agreed that strengthening operational procedures may be beneficial and stated that they will jointly review procedures and discuss revising and/or consolidating the procedures. In May 2018, CBP stated that it is looking for opportunities to standardize procedures for the detection, interdiction, mapping, and remediation of cross-border tunnels. To this end, CBP has plans to develop a standardized training on tunnel identification and tactics, techniques, and procedures for different types of tunnels. In addition, CBP is working to develop a consistent process that will facilitate coordination and collaboration with ICE. In March 2019, CBP reported that CBP and ICE have begun to routinely meet to collectively develop processes for using tunnel robotics, including processes to enhance communication between CBP and ICE. In September 2020, CBP and ICE reported that they do not plan to take any additional steps to address this recommendation. To fully address our recommendation, CBP and ICE should establish standardized procedures for addressing tunnels, including procedures for sharing information with one another.

Recommendation: To help ensure that efforts to address smuggling through cross-border tunnels, ultralight aircraft, panga boats, and recreational vessels are effective and that managers and stakeholders have the information needed to make decisions, the Secretary of Homeland Security should direct the Commandant of the Coast Guard, Commissioner of CBP, and the Director of ICE to establish and monitor Regional Coordinating Mechanisms performance measures and targets related to panga boat and recreational vessel smuggling.

Agency: Department of Homeland Security
Status: Open

Comments: DHS did not concur with this recommendation. DHS stated that that it believes that by establishing common terminology to address our first recommendation, the RECOMs will have more reliable, usable analyses to inform their maritime interdiction efforts. However, DHS did not believe that performance measures and targets related to smuggling by panga boats would provide the most useful strategic assessment of operations to prevent all illicit trafficking, regardless of area of operations or mode of transportation. DHS also cited the recent creation of the DHS Office of Policy, Strategy, and Plans that is to work with U.S. Coast Guard, U.S. Customs and Border Protection, U.S. Immigration and Customs Enforcement, and other components and offices to better evaluate the effectiveness of all operations that work to prevent the illegal entry of goods and people into the country, as appropriate. In February 2020, DHS reported that the department had not taken any further actions to implement this recommendation. We continue to believe that the recommendation is valid and will monitor any actions DHS takes that are responsive to it. For example, in response to a requirement in the National Defense Authorization Act for Fiscal Year 2017, DHS issued reports in May 2018, February 2019, and August 2020 that contain metrics and planned metrics to measure the effectiveness of border security in the maritime environment and other domains. Planned metrics that DHS does not yet have a methodology to measure across all components include situational awareness in the maritime environment, illicit drugs removal rate, and DHS maritime threat response rate. To fully address our recommendation, DHS should measure its performance related to smuggling across U.S. maritime borders.

Recommendation: To help identify what domestic CVE efforts are to achieve and the extent to which investments in CVE result in measureable success, the Secretary of Homeland Security and the Attorney General--as heads of the two lead agencies responsible for coordinating CVE efforts--should direct the CVE Task Force to develop a cohesive strategy that includes measurable outcomes for CVE activities.

Agency: Department of Homeland Security
Status: Open

Comments: In April 2019, DHS provided the National Counterterrorism Strategy as evidence that the department is including terrorism prevention as a necessary tool to meet its missions. While the strategy discusses terrorism prevention, it does not include specific activities or efforts, identify the agencies that will lead these efforts, or describe measurable outcomes for these efforts. In June 2019, DHS indicated that CVE-style prevention work would fall under a newly formed Office for Targeted Violence and Terrorism Prevention under which it will be part of a broad counterterrorism strategy that DHS plans to have ready by this fall. We will continue to monitor DHS's progress in this area as it develops its plan.

Recommendation: To help identify what domestic CVE efforts are to achieve and the extent to which investments in CVE result in measureable success, the Secretary of Homeland Security and the Attorney General--as heads of the two lead agencies responsible for coordinating CVE efforts--should direct the CVE Task Force to establish and implement a process to assess overall progress in CVE, including its effectiveness.

Agency: Department of Homeland Security
Status: Open

Comments: In April 2019, DHS provided a commissioned review of CVE programs and activities that was expected to help identify ways to measure their effectiveness. The report provides a broad assessment of past activities and suggestions for measures and metrics going forward, but does not establish a process for agencies to measure the success of their activities or overall progress of CVE efforts. In June 2019, DHS indicated that CVE-style prevention work would fall under a newly formed Office for Targeted Violence and Terrorism Prevention under which it will be part of a broad counterterrorism strategy that DHS plans to have ready by this fall. We will continue to monitor DHS's progress in this area as it develops its plan.

Recommendation: To mitigate the risk of poor acquisition outcomes and strengthen the department's investment decisions, the Secretary of Homeland Security should direct the Undersecretary for Management to update the acquisition policy to require that major acquisition programs' technical requirements are well defined and key technical reviews are conducted prior to approving programs to initiate product development and establishing Acquisition Program Baselines, in accordance with acquisition best practices.

Agency: Department of Homeland Security
Status: Open

Comments: In providing comments on this report, DHS concurred with our recommendation and stated that it planned to initiate a study to assess how to better align its processes for technical reviews and acquisition decisions. Upon completion of the study, DHS updated its acquisition policy instruction in May 2019, which adjusted the acquisition life cycle. Specifically, the updated instruction requires programs to conduct key technical reviews--including a preliminary design review--prior to establishing the program's Acquisition Program Baseline. As of July 2020, DHS was in the process of updating the related policies and guidance for its Systems Engineering Life Cycle, which govern the department's technical reviews. GAO will review these policies and guidance once complete to confirm alignment with the changes made to the acquisition management instruction and will monitor DHS's implementation of its new acquisition life cycle to ensure the department's actions meet the intent of this recommendation.

Recommendation: To improve management and oversight of the SAVE program, the director of USCIS should develop and implement a mechanism to oversee agencies' completion of training on additional verification in accordance with SAVE MOA provisions and program policies.

Agency: Department of Homeland Security: United States Citizenship and Immigration Services
Status: Open

Comments: In March 2017, we found that USCIS does not track or monitor whether SAVE users have completed training and therefore does not have reasonable assurance that users have mastered SAVE policies and procedures prior to accessing the system. We recommended that USCIS develop and implement a mechanism to oversee agencies' completion of training on additional verification in accordance with SAVE provisions and program policies. The USCIS Verification Division reported that it planned to address providing additional training for SAVE users developed by December 31, 2017. The SAVE Program would then offer training events for agencies on the new material reflecting the agency user requirements for additional verification as well as system enhancements. In September 2017, the Verification Division implemented part one of this recommendation, a monthly webinar training session on user agency responsibilities and additional verification. This training can also be delivered to user agencies upon request. For part two of this recommendation, the SAVE program also developed training features to oversee agencies' completion of training. These training features are a system enhancement that will be incorporated into SAVE's overall modernization effort and was expected to be completed by September 30, 2019. In the interim, SAVE is implementing several other enhancements that will reduce the number of cases sent to additional verification, including the completion of modernized matching logic and initial verification screens and retiring less efficient access methods. In September 2019, SAVE officials told us that SAVE has reduced the number of cases sent to additional verification by retiring inefficient access methods and completing modernization of SAVE matching logic and initial verification screens. However, SAVE officials said they also determined that they must update the SAVE tutorial platform and content to account for these and other changes. Officials said that while SAVE is updated, the program continues to provide training, resources, and other support to user agencies to help ensure they are performing additional verification in accordance with SAVE MOA provisions and program policies. The new estimated completion date is February 28, 2021.

Recommendation: To ensure Border Patrol has the best available information to inform future investments in TI and resource allocation decisions among TI and other assets Border Patrol deploys in the furtherance of border security operations, and to ensure that key parties within Border Patrol's Requirements Management Process are aware of their roles and responsibilities within the process, the Chief of the Border Patrol should develop metrics to assess the contributions of pedestrian and vehicle fencing to border security along the southwest border using the data Border Patrol already collects and apply this information, as appropriate, when making investment and resource allocation decisions.

Agency: Department of Homeland Security: United States Customs and Border Protection: Office of the Commissioner: U.S. Border Patrol
Status: Open
Priority recommendation

Comments: DHS agreed with the recommendation and stated that it planned to develop metrics for southwest border security operations. To fully implement it, the Border Patrol should complete its efforts to develop metrics for assessing the contributions of pedestrian and vehicle fencing to border security operations and apply these metrics when making resource allocation decisions. As of October 2019, DHS stated that they have developed and are testing the initial metrics. DHS stated that they will continue to gather data over the next two fiscal years (FY20-FY21) which will help to identify if these metrics are accurately representing realities in the field. The estimated completion date is September 2021.

Recommendation: To better ensure FEMA's regional activities effectively support individuals with disabilities, the Secretary of Homeland Security should direct the FEMA Administrator to take steps to establish written procedures for how regions should involve the Office of Disability Integration and Coordination in clarifying disability integration staff's roles, evaluating staff performance, and setting expectations for how staff communicate with headquarters and the regions.

Agency: Department of Homeland Security
Status: Open

Comments: FEMA agreed with this recommendation and FEMA's Office of Disability Integration and Coordination (ODIC) is in the process of establishing a working group that will clarify and codify the roles, responsibilities, and expectations among the various agency offices and personnel involved in carrying out the agency's disability integration mission. In January 2018, FEMA reported that it had created Regional Integration Teams in the regions to improve the efficiency and efficacy of mission delivery. In August 2018, ODIC reported its goal to meet with Regional Administrators and other senior leaders across the agency by the end of CY 2018 to refine the role for disability integration staff. The reported intent of refining the role is to better align it with the FEMA Administrator's goal of empowering emergency managers in states, localities, tribes, and territories. In June 2019, ODIC officials reported plans to convene a workgroup to examine the role of the Regional Disability Integration Specialist, including their reporting chain and their roles and responsibilities in each of FEMA's ten regions. The workgroup will meet over two months and develop recommendations to be considered by FEMA's Chief of Staff by August 23, 2019. GAO is encouraged by FEMA's efforts to engage Regional Administrators and other senior leaders in its refinement of the role of disability integration staff, and awaits evidence of FEMA establishing documentation of the agency's procedures for carrying out its disability integration mission.

Recommendation: To help ensure its key training on incorporating access and functional needs into emergency planning reaches a sufficiently wide audience, the Secretary should direct the FEMA Administrator to collect information about the potential pool of participants, set general goals for the number of state and local emergency managers that will take this course, and implement the delivery methods needed to meet these goals.

Agency: Department of Homeland Security
Status: Open

Comments: FEMA agreed with this recommendation and reported that it will work with its regional staff to map potential training participants in each state and set goals for delivery of the course to state and local emergency managers. The agency also reported that it may be able to use data in the State Preparedness Report and states' self-reporting on the need for training on integrating the needs of people with access and functional needs into emergency management. As of January 2018, the Office of Disability Integration and Coordination reported plans to hire a permanent staff person to review, assess, and recommend how FEMA should incorporate disability into all internal and external training. In August 2018, FEMA reported hiring a new Program and Policy Branch Chief in July 2018, and noted that this individual will formulate a plan to incorporate the needs of people with disabilities into internal and external training over several weeks. However, FEMA did not address whether this individual will seek information about the potential pool of external participants, or set goals for the number of state and local emergency managers who could participate in external training. FEMA also reported providing just-in-time training in the field to support field staff in providing services to people with disabilities. The agency anticipates completing these efforts by December 31, 2019 and we will consider closing this recommendation when the agency can document it has addressed the recommendation.

Recommendation: To enhance its ability to fulfill its role as the facilitator of cross-sector collaboration and best-practices sharing, the Secretary of Homeland Security should direct the Assistant Secretary of Infrastructure Protection, Office of Infrastructure Protection, to explore with key critical infrastructure partners, whether and what opportunities exist to harmonize federally-administered screening and credentialing access control efforts across critical infrastructure sectors.

Agency: Department of Homeland Security
Status: Open

Comments: As of 2/12/2020, awaiting additional evidence/clarification from DHS.

Recommendation: To more fully address the requirements identified in the National Cybersecurity Protection Act of 2014 and the Cybersecurity Act of 2015, the Secretary of the Department of Homeland Security should develop metrics for assessing adherence to applicable principles in carrying out statutorily required functions.

Agency: Department of Homeland Security
Status: Open
Priority recommendation

Comments: For all eleven functions, DHS has measures that evaluate compliance with five (1, 2, 5, 6, 7) of the nine principles and considered whether measures and applicability were appropriate for the other four principles. In February 2020, DHS stated that it does not measure any functions' adherence with principle #8 related to safeguarding against unauthorized access or #9 regarding compliance with policies, regulations, and laws related to privacy and civil liberties. Specifically, the agency stated these two principles are a steady state consideration across all mission areas and functions and have no associated identified measure. For the remaining two principles, DHS did not provide measures that were related to prioritizing activities based on level of risk (#3) or ensuring that appropriate consideration of coordination with subject matter experts from industry, academia, and national labs (#4). As such, DHS does not have appropriate means for assessing the eleven functions against those two principles. However, in March 2020, DHS stated that the metrics for 2020 were different than those in 2019. Officials are in the process of creating a mapping between the previously provided metrics and those for 2020. We will review this mapping and determine if the aforementioned is still applicable with the new metrics.

Recommendation: To more fully address the requirements identified in the National Cybersecurity Protection Act of 2014 and the Cybersecurity Act of 2015, the Secretary of the Department of Homeland Security should establish methods for monitoring the implementation of cybersecurity functions against the principles on an ongoing basis.

Agency: Department of Homeland Security
Status: Open
Priority recommendation

Comments: For all 11 functions, DHS stated they have a means of evaluating compliance with five (1, 2, 5, 6, 7) of the nine principles. Once DHS provides specific evidence of data tracked in support of the aforementioned compliance measures, we will review to determine if they have closed this recommendation.

Recommendation: To more fully address the requirements identified in the National Cybersecurity Protection Act of 2014 and the Cybersecurity Act of 2015, the Secretary of the Department of Homeland Security should integrate information related to security incidents to provide management with more complete information about NCCIC operations.

Agency: Department of Homeland Security
Status: Open

Comments: In November 2018, DHS invited GAO to observe a vendor's demonstration of the anticipated Unified Workflow Solution (UWS) that officials stated could support closure of this recommendation, when implemented. In February 2020, DHS stated that their planning and design efforts are ongoing and are on track for deployment of a Minimal Viable Product in April 2020. Once DHS has developed and implemented the UWS, we will review their efforts to determine the extent to which the agency has integrated information related to security incidents.

Recommendation: To more fully address the requirements identified in the National Cybersecurity Protection Act of 2014 and the Cybersecurity Act of 2015, the Secretary of the Department of Homeland Security should determine the necessity of reducing, consolidating, or modifying the points of entry used to communicate with NCCIC to better ensure that all incident tickets are logged appropriately.

Agency: Department of Homeland Security
Status: Open

Comments: In March 2019, DHS said that they will provide GAO with a list of the entry points into the NCCIC service desk as well as the standard operating procedures (SOP) and process for quality assurance and quality control. Additionally, the development of the NCCIC Unified Workflow Solution (UWS) could impact this recommendation as well. In February 2020, DHS stated that their planning and design efforts are ongoing and are on track for deployment of a Minimal Viable Product in April 2020. Once DHS has developed and implemented the UWS, we will review their efforts to determine the extent to which the agency has integrated information related to security incidents.

Recommendation: To more fully address the requirements identified in the National Cybersecurity Protection Act of 2014 and the Cybersecurity Act of 2015, the Secretary of the Department of Homeland Security should take steps to ensure the full representation of the owners and operators of the nation's most critical cyber-dependent infrastructure assets.

Agency: Department of Homeland Security
Status: Open

Comments: In November 2019, DHS stated that while no alerts or advisories are sent only to Section 9 entities, they do have various forms and mechanisms that Section 9 entities receive cybersecurity information: through HSIN Communities of Interest, the CISCP program, the applicable Sector Specific Agencies, and the applicable Section Information Sharing and Analysis Centers. Further analysis of the membership of the aforementioned forums and mechanisms is needed to determine the extent of Section 9 representation.

Recommendation: To more fully address the requirements identified in the National Cybersecurity Protection Act of 2014 and the Cybersecurity Act of 2015, the Secretary of the Department of Homeland Security should establish plans and time frames for consolidating or integrating the legacy networks used by NCCIC analysts to reduce the need for manual data entry.

Agency: Department of Homeland Security
Status: Open

Comments: In November 2019 DHS stated that the legacy Help Desk and operational activity tracking tools continue to be assessed and requirements identified for configuration into the Unified Workflow Solution (UWS). In February 2020, DHS stated that their planning and design efforts are ongoing and are on track for deployment of a Minimal Viable Product in April 2020. Once DHS has developed and implemented the UWS, we will review their efforts to determine the extent to which the agency has integrated information related to security incidents.

Recommendation: The Commandant of the Coast Guard should update Commandant Instruction M6000.1F, Coast Guard Medical Manual, to classify gambling disorder as an addiction and not as an impulse control issue.

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: The U.S. Coast Guard/DHS concurred with this recommendation. As of August 2019, the Coast Guard stated that updates to this manual are ongoing. According to Coast Guard officials, including gambling disorder in this manual is one of many significant updates the program is adjudicating for this manual and it's a lengthy clearance process. No timeline was provided for expected issuance.

Recommendation: To better inform on the effectiveness of CDS implementation and border security efforts, the Chief of Border Patrol should strengthen the methodology for calculating recidivism such as by using an alien's apprehension history beyond one fiscal year and excluding aliens for whom there is no record of removal and who may remain in the United States.

Agency: Department of Homeland Security: United States Customs and Border Protection: Office of the Commissioner: U.S. Border Patrol
Status: Open

Comments: DHS did not concur with this recommendation. DHS noted that the U.S. Customs and Border Protection (CBP) Consequence Delivery System Program Management Office (CDS PMO) uses annual recidivism rate calculations to measure annual change, which is not intended to be, or used, as a performance measure for CDS. We continue to believe that DHS should strengthen its methodology for calculating recidivism. DHS noted in its comments on our report that the recidivism rate is used as a performance measure by U.S. Border Patrol and DHS. Additionally, strengthening the recidivism rate methodology would not preclude its use for CDS as a measure of annual change, and would provide Border Patrol a more complete assessment of the rate of change in recidivism. In January 2018, CDS-PMO officials stated that the office started reporting nationwide the recidivism rates for multiple years to U.S. Border Patrol sectors for situational awareness. However, the methodology for this reported recidivism rate does not exclude aliens for who there is no record of removal. In May 2020, CDS-PMO reported that it has not taken any further steps to implement this recommendation. To fully implement this recommendation, DHS needs to further strengthen its recidivism rate methodology by excluding aliens for whom there is no record of removal. Further, DHS needs to demonstrate that it is using this updated methodology on a recurring basis and for CDS performance measurement purposes.

Recommendation: The Secretary of Homeland Security should direct the Assistant Secretary of Immigration and Customs Enforcement and Commissioner of Customs and Border Protection to collaborate on sharing immigration enforcement and removal data to help Border Patrol account for the removal status of apprehended aliens in its recidivism rate measure.

Agency: Department of Homeland Security
Status: Open

Comments: DHS concurred with the recommendation. In May 2017, U.S Immigration and Customs Enforcement's (ICE) Enforcement and Removal Operations directorate provided immigration enforcement and removal data on a one-time basis to U.S. Customs and Border Protection's U.S. Border Patrol. In March 2018, U.S. Border Patrol officials requested that ICE provide these data on a quarterly basis. As of July 2020, ICE stated that it had shared the data with U.S. Border Patrol on multiple occasions. To fully implement this recommendation, ICE and U.S. Border Patrol need to document and implement their plans to share the data on a recurring basis.

Recommendation: To improve the transparency and accountability over the compensation paid to WYO companies and set appropriate compensation rates, the FEMA administrator should take into account WYO company characteristics that may impact companies' expenses and profits when developing the new compensation methodology and rates.

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: According to FEMA officials, FEMA is responding to this recommendation as part of its development of a final rule on WYO compensation practices, required by the Biggert-Waters Act. FEMA issued a Notice of Proposed Ruling on July 8, 2019 seeking comments by September 6, 2019 regarding possible approaches to incorporate actual flood expense data into the WYO payment methodology.

Recommendation: To improve federal agencies' efforts to rationalize their portfolio of applications, the Secretaries of Defense, Homeland Security, the Interior, and Labor; and the Director of the National Science Foundation should direct the CIOs and other responsible officials to modify existing investment management processes to address applications more completely. Specifically, the Secretary of Homeland Security should direct the department's CIO to identify one high-cost function it could collect detailed cost, technical, and business information for and modify existing processes to collect and review this information.

Agency: Department of Homeland Security
Status: Open

Comments: In April 2018, DHS officials stated that they identified FOIA systems as a high cost function, and will modify existing processes to collect and review the cost, technical, and business information. In November 2019, DHS reported that it is continuing to make progress in acquiring a new enterprise-wide FOIA system by reviewing current capabilities. We plan to continue to monitor the department's efforts.

Recommendation: If DHS's proposed CBRNE program consolidation is approved by Congress, the Secretary of Homeland Security should direct the Assistant Secretary for the Office of Policy to use, where appropriate, the key mergers and organizational transformation practices identified in our previous work to help ensure that a CBRNE consolidated office benefits from lessons learned from other organizational transformations.

Agency: Department of Homeland Security
Status: Open

Comments: We found that key mergers and organizational transformation practices identified in previous GAO work could benefit the Department of Homeland Security (DHS) during implementation of the proposed CBRNE consolidation. As a result, we recommended that should Congress approve DHS's CBRNE consolidation plan, the department use these key mergers and organizational transformation practices. In December 2018, the Countering Weapons of Mass Destruction Act of 2018 was enacted into law (Public Law 115-387) authorizing the proposed consolidation of CBRNE functions into a new Countering Weapons of Mass Destruction Office (CWMD office). In a memo to Congress regarding the new CWMD office, DHS stated that it remained committed to evaluating GAO's identified practices when implementing the consolidation. In August 2019, DHS provided us with information outlining efforts to use the key mergers and organizational transformation practices during the CWMD implementation phase. However, we requested additional evidence that all practices were considered. For example, one of the key practices is to use the performance management system to define responsibility and assure accountability for change. DHS created position descriptions for CWMD office leadership but we did not receive evidentiary support to demonstrate that DHS has added CWMD office transition goals to relevant employee performance plans. In April 2020, DHS estimated June 2020 for completing steps responsive to this recommendation. We will update the status of this recommendation as additional information is made available.

Recommendation: To improve risk management in the collection of AD/CV duties and to identify new or changing risks, CBP should regularly conduct a comprehensive risk analysis that assesses both the likelihood and the significance of risk factors related to AD/CV duty collection. For example, CBP could construct statistical models that explore the associations between potential risk factors and both the probability of nonpayment and the size of nonpayment when it occurs.

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open
Priority recommendation

Comments: As of December 2019, CBP was taking steps to conduct the type of risk analysis GAO recommended in July 2016. In November 2019 we reported that according to CBP , the agency had developed and successfully tested two models using risk factors including, but not limited to, the type of good, country of origin of the good, and whether the importer is from a foreign country. One test demonstrated that, using data from fiscal years 2007-2015, CBP could have predicted over 95 percent of the importers with delinquent antidumping and countervailing (AD/CV) duty bills in fiscal years 2016 and 2017. CBP requested $17 million in fiscal year 2020 funds to make updates to its information systems necessary to facilitate the implementation of statistical models. CBP is also working on long-term enhancements to the models that it says will leverage additional modeling techniques, such as social network and spatial analysis. Regularly conducting a comprehensive risk analysis of factors related to AD/CV duty non-collection could enhance CBP's capacity to collect additional revenue by enabling CBP to increase bonding amounts for continuous entry and single-transaction bonds for importers with a greater risk of nonpayment. In a December 2019 Commercial Customs Operations Advisory Committee report, CBP said that it planned to begin rolling out a risk-based bonding framework in March 2020. The new framework relies on a bond formula that is in part based on risk factors identified by the statistical models .

Recommendation: To improve risk management in the collection of AD/CV duties, CBP should, consistent with U.S. law and international obligations, take steps to use its data and risk assessment strategically to mitigate AD/CV duty nonpayment, such as by using predictive risk analysis to identify entries that pose heightened risk and taking appropriate action to mitigate the risk.

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open
Priority recommendation

Comments: As of December 2019, CBP was taking steps to develop a risk-based AD/CV bonding framework to use in conjunction with the development of an AD/CV risk assessment model. CBP is developing a supplemental AD/CV duty continuous entry bond that incorporates nonpayment risk factors identified in its statistical models and has worked with Commercial Customs Operations Advisory Committee (COAC) to test the proposed risk based bonding formula by applying it to historical data. CBP has estimated that the collection rate under the risk-based bonding framework using the proposed formula would have been significantly higher than the collection rate under its existing bond policies during fiscal years 2007-2017, both in number and value of the bills collected; however, COAC members said the proposed bond formula would have resulted in overinsurance, which could increase cost to importers. The use of supplemental continuous entry bonds may require regulatory changes and modifications to CBP's database. CBP has also conducted an analysis of the use of single-transaction bonds using historical data, and found that this procedure would have allowed CBP to collect significantly more revenue in fiscal years 2007-2018. CBP is working with COAC members to test a risk-based application of single-transaction bonds to historical AD/CV duty entries to assess whether the bond would have reduced the amount of uncollected duties. In a December 2019 Commercial Customs Operations Advisory Committee report, CBP said that it plans to rolls out its risk-based bonding framework in March 2020.

Recommendation: To better position the Coast Guard to effectively plan its Arctic operations, the Commandant of the Coast Guard should develop measures, as appropriate, for gauging how the agency's actions have helped to mitigate the Arctic capability gaps.

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: In June 2016, we reviewed and reported on the U.S. Coast Guard's efforts in the Arctic. We found that the Coast Guard had taken actions to implement its Arctic strategy and conduct Arctic operations, which may help the Coast Guard to better understand and mitigate identified Arctic capability gaps. Further, we found that the Coast Guard was tracking, or had plans to track, its various activities in the Arctic, but that it had not developed measures to systematically assess how its actions have helped to mitigate Arctic capability gaps. We recommended that the Coast Guard develop measures, as appropriate, for gauging how the agency's actions have helped to mitigate the Arctic capability gaps. Since that time, the Coast Guard updated its Arctic strategy in April 2019. In February 2020, Coast Guard officials stated that they are revising the implementation plan for its Arctic Strategy and are working on a framework tool to measure the impacts of its actions in the Arctic. According to Coast Guard officials, they expect the implementation plan to include actionable items that can be measured and the framework tool to include outcome and success measures. In July 2020, officials estimated that the implementation plan would be finalized by the end of fiscal year 2020. Further, the Coast Guard issued a contract in August 2019 to help develop the framework tool by the end of fiscal year 2020. Officials stated that the tool may require revisions before it is finalized and implemented and that throughout fiscal year 2021 they will test, evaluate, and adjust the framework tool, as appropriate. To fully address this recommendation, the Coast Guard will need to finalize the development of its measures to gauge how its actions have helped to mitigate Arctic capability gaps, which we will continue to monitor.

Recommendation: To better position the Coast Guard to effectively plan its Arctic operations, the Commandant of the Coast Guard should design and implement a process to systematically assess the extent to which actions taken agency-wide have helped mitigate the Arctic capability gaps for which it has responsibility.

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: In June 2016, we reviewed and reported on the U.S. Coast Guard's efforts in the Arctic. We found that the Coast Guard had taken actions to implement its Arctic strategy and conduct Arctic operations, which may help the Coast Guard to better understand and mitigate identified Arctic capability gaps. Further, we found that the Coast Guard was tracking, or had plans to track, its various activities in the Arctic, but that it had not systematically assessed how its actions have helped to mitigate Arctic capability gaps. We recommended that the Coast Guard design and implement a process to systematically assess the extent to which actions taken agency-wide have helped mitigate the Arctic capability gaps for which it has responsibility, so that it will better understand the status of these gaps and be better positioned to effectively plan its Arctic operations. Since that time, the Coast Guard updated its Arctic strategy in April 2019. In February 2020, Coast Guard officials stated that they are revising the implementation plan for its Arctic Strategy and are working on a framework tool to measure the impacts of its actions in the Arctic. Officials estimated that the implementation plan would be finalized by the end of fiscal year 2020. Further, the Coast Guard issued a contract in August 2019 to help develop the framework tool by the end of fiscal year 2020. Officials stated that the tool may require revisions before it is implemented and utilized for assessment of its progress. In July 2020, Coast Guard officials stated that they plan to test, evaluate, and adjust the framework tool, as appropriate, throughout fiscal year 2021. To fully address this recommendation, the Coast Guard will need to assess how its actions have helped to mitigate Arctic capability gaps, and provide documentation that identifies the progress it has made in helping to mitigate Arctic capability gaps and its plans to systematically assess progress, which we will continue to monitor.

Recommendation: To better ensure that FAMS uses its resources to cover the highest-risk flights, in addition to considering risk when determining how to divide FAMS's international flight coverage resources among international destinations, the Director of FAMS should incorporate risk into FAMS's method for initially setting its annual target numbers of average daily international and domestic flights to cover.

Agency: Department of Homeland Security: Transportation Security Administration: Office of Law Enforcement - Federal Air Marshal Service
Status: Open

Comments: In May 2016, we found that FAMS officials considered risk when selecting specific domestic and international flights to cover, but they did not consider risk when deciding how to initially divide their annual resources between domestic and international flights. Rather, each year FAMS considered two variables--travel budget and number of air marshals--to identify the most efficient way to divide the agency's resources between domestic and international flights. As a result, we recommended that FAMS incorporate risk into FAMS's method for initially setting its annual target numbers of average daily international and domestic flights to cover. In March 2018, FAMS revised its deployment methodology to no longer set an annual target number of average daily international and domestic flights to cover. Rather, FAMS now prioritizes deploying air marshals on as many flights as possible with passengers who have been identified as potentially higher risk because they match TSA's intelligence-based screening rules, among other risk-based priorities. In August 2020, FAMS officials explained that they were evaluating their concept of operations and planned to more fully develop a risk basis for dividing its resources between international and domestic flights. By doing so, FAMS could better ensure it is targeting its limited resources to the highest risk flights and better aligning with FAMS's stated goal of using risk-based decisions to guide mission operations. As a result, this recommendation remains open.

Recommendation: To enable a more effective approach in working with states to adopt the NDRF, the Secretary of Homeland Security should direct the Administrator of FEMA to clarify with regional offices and Federal Disaster Recovery Coordinators (FDRCs) the role of the regional implementation plans in FDRC performance plans and how they will be used to assess NDRF regional implementation efforts.

Agency: Department of Homeland Security
Status: Open

Comments: DHS concurred with this recommendation and said it would take steps to implement it. According to FEMA, to achieve greater integration of FEMA's field leadership components, FEMA's Field Operations Directorate (FOD) convened a Field Leadership Working Group of senior subject matter experts to conduct a mission analysis of FEMA's Field Leadership function (which includes Federal Disaster Recovery Coordinators as well as Federal Coordinating Officers and Incident Management Assistance Teams team leads). According to FEMA, the Working Group was preparing a Field Leader Manual (FLM) for review by FOD leadership. FEMA officials told us that the 2018 Hurricane season led to the deployment of many of FEMA's FOD leaders. These deployments allowed FOD leaders to experience first-hand the connection between regional implementation plans and FDRC performance plans and FEMA said that this knowledge is being integrated into edits of the FLM. In February 2020, FEMA told us that the FOD leadership responsible for the oversight of FDRCs is still determining the timeline to update the FLM based on a realignment of the Field Leadership Cadre. This update will integrate the Federal Coordinating Officers (FCOs) and FDRCs into a single FCO title with professional development specializations in response or recovery. This integration will support all FCOs in having a common baseline of training and experience in both response and recovery. In an August 2020 update, FEMA stated that while they continue to work toward implementing this recommendation, the FOD is currently focused on COVID-19 response efforts and planning for a more severe than average hurricane season. We will continue to monitor FEMA's efforts to see what additional actions the agency takes in response to this recommendation.

Recommendation: To enable a more effective approach in working with states to adopt the NDRF, the Secretary of Homeland Security should direct the Administrator of FEMA to align the annual FDRC performance expectations with clearly defined organizational goals and priorities, consistent with key management practices.

Agency: Department of Homeland Security
Status: Open

Comments: DHS concurred with this recommendation and said it would take steps to implement it. According to FEMA, the Field Leadership Working Group will implement the elements of this recommendation alongside efforts to clarify the role of the regional National Disaster Recovery Framework implementation plans. FEMA told us that the 2018 Hurricane season led to the deployment of many of FEMA's field leaders and these deployments allowed leaders to experience first-hand the connection between FDRC performance expectations and FEMA's organizational goals. According to FEMA, this knowledge is being integrated into edits of the Field Leader Manual (FLM). In February 2020, FEMA told us the FOD leadership responsible for the oversight of FDRCs is working with their partners in FEMA's Recovery and Resilience sections, as well as with the Regions to define performance expectations for steady-state recovery planning and preparedness under the NDRF. This will include identifying who is functionally accountable for these activities, any gaps, and best practices across Regions. In an August 2020 update, FEMA stated that while they continue to work toward implementing this recommendation, the FOD is currently focused on COVID-19 response efforts and planning for a more severe than average hurricane season. We will continue to monitor FEMA's efforts to see what additional actions the agency takes in response to this recommendation.

Recommendation: To strengthen the transparency of the complaints process, the Secretary of Homeland Security should direct CBP and ICE to develop and issue guidance on how and which complaint mechanisms should be communicated to individuals in custody at holding facilities.

Agency: Department of Homeland Security
Status: Open

Comments: In May 2016, we reported on the Department of Homeland Security's management and oversight of short-term holding facilities. We found, for example, that only 4 of 17 Border Patrol holding facilities posted information on how individuals can contact the DHS OIG to file general complaints, and the remaining facilities did not have information posted on any complaint mechanisms, such as the Joint Intake Center or CBP INFO Center. In December 2016, ICE Enforcement and Removal Operations (ERO) sent a broadcast to ICE field offices stating that posters should be visible at all of ICE ERO temporary holding facilities. This broadcast directed ICE ERO Field Office staff to immediately post copies of the Detention Reporting and Information Line poster, both in English and in Spanish, in temporary confinement areas or other areas so that it is visible to individuals in custody at ICE ERO temporary holding facilities. With regard to CBP, in October 2019, officials informed us there is no current CBP guidance requiring signage in CBP holding facilities to communicate complaint mechanisms other than the Prison Rape Elimination Act poster, which relates to reporting mechanisms for any potential incidents of sexual abuse and assault. In September 2020, CBP told us it planned to implement the necessary corrective actions to close this recommendation by March 31, 2021. In order to be able to close the recommendation as implemented, we will need to see updated guidance to the field about the posters that should be displayed in CBP facilities.

Recommendation: To improve transparency in allocating its limited resources, and to help ensure that its resource allocation decisions are the most effective ones for fulfilling its missions given existing risks, the Commandant of the Coast Guard should document how the risk assessments conducted were used to inform and support its annual asset allocation decisions.

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: In February 2018, the Coast Guard liaison stated that Coast Guard management made a decision to not to address this recommendation within the annual Strategic Planning Direction (SPD) or Operational Planning Direction (OPD) products as previously planned, but rather within the Standard Operational Planning Process/Global Force Management Process Guide. The liaison further stated that both of these documents are currently under revision and expected to be completed by March 31, 2018. On October 11, 2018, the Coast Guard liaison stated that The Standard Operational Planning Process/Global Force Management Instruction is in routing for edits, comment, and final approval. The new estimated completion date is the 2nd quarter of FY 2019. GAO sent an inquiry to the Coast Guard on April 24, 2019 and is awaiting a reply. On March 30, 2020, the Coast Guard liaison informed GAO that the update to the Standard Operational Planning Process (SOPP)/Global Force Management (GFM) Instruction, which includes the addition and test of Strategic Priorities Planning Guidance and the new Coast Guard Force Allocation Matrix, was further delayed due to recent discussions of changing to a 2-year SOPP planning cycle to align with the Department of Defense Global Force Management process. This change would further require an update of the SOPP/GFM Instruction. The COVID-19 crisis as well as the need to finalize the Strategic Planning Direction by June 2020 are also factors in this delay. New Estimated Completion Date (ECD): June 30, 2021.

Recommendation: To ensure that high priority mission activities are fully supported with the appropriate number of staff possessing the requisite mix of skills and abilities, the Commandant of the Coast Guard should develop a systematic process that prioritizes manpower requirements analyses for units that are the most critical for achieving mission needs.

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: On December 14, 2016, the Coast Guard noted that it submitted two FY 2019 Resource Proposals to staff and equip the Manpower Requirements Determination Division to conduct the analysis as described in the recommendation. In April, 2016, the Coast Guard liaison stated that, resources permitting, the Coast Guard is to address the following steps: (1) Validate the "unit-type" list so that it encompasses the vast majority of active duty and civilian billets in a logical framework that can be readily analyzed, review/update the list as changes (e.g., asset mix, organizations) occur. (2) Develop the requirements for the envisioned Manpower Analysis & Simulation Tool (MAST). (3) Prioritize unit list according to strategic alignment and risk assessment (4) Conduct the manpower requirements analyses (MRA) in accordance with established priorities. As of August 2020, the Coast Guard reported it had not implemented the actions. Specifically, the Coast Guard reported that in response to GAO's February 2020 modernization report (GAO-20-223, rec#2), it was developing new guidance for executing the manpower requirement determination process. Officials told us that the new guidance would include a systematic process for prioritizing manpower analysis. In this way, the actions for implementing the GAO-20-223 recommendation may also serve to meet the intent of the recommendation for GAO-16-379. Officials told us the Coast Guard estimated implementing the actions by December 31, 2020.

Recommendation: To improve the strategic allocation of assets, the Commandant of the Coast Guard should incorporate field unit input, such as information on assets' actual performance from Operational Performance Assessment Reports and Planning Assessments, to inform more realistic asset allocation decisions--in addition to asset performance capacities currently used--in the annual Strategic Planning Directions to more effectively communicate strategic intent to field units.

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: In February 2018, the Coast Guard liaison stated that Coast Guard management made a decision to not to address this recommendation within the annual Strategic Planning Direction (SPD) or Operational Planning Direction (OPD) products as previously planned, but rather within the Standard Operational Planning Process/Global Force Management Process Guide. The liaison further stated these documents are under revision and expected to be completed by March 31, 2018. On October 11, 2018, the Coast Guard liaison stated that The Standard Operational Planning Process/Global Force Management Instruction is in routing for edits, comment, and final approval. The new estimated completion date is the 2nd quarter of FY 2019. GAO sent an inquiry to the Coast Guard on April 24, 2019 asking for an update. On March 30, 2020, the Coast Guard liaison informed GAO that the update to the SOPP/GFM Instruction, which includes the addition and test of Strategic Priorities Planning Guidance and the new Coast Guard Force Allocation Matrix, was further delayed due to recent discussions of changing to a 2-year SOPP planning cycle to align with the Department of Defense Global Force Management process. The liaison stated that the COVID-19 crisis as well as the need to finalize the Strategic Planning Direction by June 2020 are also factors in this delay. The new estimated completion date for this recommendation is June 30, 2021.

Recommendation: To promote greater visibility over the extent of hazing in the Coast Guard to better inform actions to address hazing, the Commandant of the Coast Guard should evaluate the prevalence of hazing in the Coast Guard.

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: DHS concurred with this recommendation in its written comments on our report. In 2017 the Coast Guard surveyed servicemembers on hazing and stated that it planned to, but had not yet conducted an evaluation of prevalence. However, in July 2018, the Coast Guard stated that no further analysis was planned for the 2017 survey data. The Coast Guard stated that a second survey was planned for 2019, but did not identify any plans to evaluate the prevalence of hazing in the Coast Guard. As of October 2020, the Coast Guard has not provided a requested update on the status of the implementation of this recommendation or indicated any ongoing plans to implement it.

Recommendation: To enable FEMA to and more effectively respond to disasters, the Secretary of Homeland Security should direct the FEMA Administrator to develop a workforce strategy to manage and improve retention that includes a process for systematically gathering attrition data and a plan to retain IMAT Cadre-of On-Call Response Employees.

Agency: Department of Homeland Security
Status: Open

Comments: In August 2019, FEMA provided an update on the status of actions taken in response to our report. As of April 2019, FEMA stated that they are continuing to work on two actions. One, the development of a new organizational structure. FEMA is still refining and assessing the impact of the new IMAT structure. Two, in April 2019, FEMA delivered a new IMAT Program Orientation to nineteen new IMAT members. FEMA plans to analyze the impact of these changes along with attrition information. It plans to develop a high-level blueprint of the actions taken by FEMA to better manage the IMAT program and retain staff. Until completion of the action items, this recommendation will remain open. FEMA officials plan to provide a status update and finalize their efforts by September 2019. As of July 2020, FEMA officials have not completed steps to implement a revised IMAT structure. FEMA anticipates completing several actions by September 2020 and finalizing their plan by December 2020. However, due to COVID-19, the agency may face additional delays in doing so.

Recommendation: To provide reasonable assurance that USCIS's fraud prevention controls are adequate and effectively implemented, and ensure that asylum officers and FDNS immigration officers have the capacity to detect and prevent fraud, the Secretary of Homeland Security should direct USCIS to conduct regular fraud risk assessments across the affirmative asylum application process.

Agency: Department of Homeland Security
Status: Open
Priority recommendation

Comments: In October 2016, DHS indicated that USCIS had established a working group and collected fraud trend information from all eight asylum offices that will be used to inform the development of a risk assessment framework. According to USCIS officials, the Asylum Division, in cooperation with other relevant internal stakeholders such as USCIS's Fraud Detection and National Security Directorate (FDNS), completed a draft asylum fraud risk assessment in September 2017. In January 2019, Asylum Division officials told us that they had identified limitations in the data used in the draft assessment. Thus, USCIS was working to complete a revised qualitative risk assessment report for our review. Officials also told us that the report was undergoing additional revisions due to changes in 2019 to the affirmative asylum program, and to reflect updates to the resources dedicated to FDNS's functions. As of October 2020, USCIS anticipates finalizing the report by the end of December 2020. Regularly assessing fraud risks across the affirmative asylum process would provide USCIS more complete information on risks that may affect the integrity of the process and therefore help USCIS target its fraud prevention efforts to those areas that are of highest risk.

Recommendation: To help ensure that biosurveillance-related funding is directed to programs that can demonstrate their intended capabilities, and to help ensure sufficient information is known about the current Gen-2 system to make informed cost-benefit decisions about possible upgrades and enhancements to the system, the Secretary of Homeland Security should direct the Assistant Secretary for Health Affairs and other relevant officials within the Department to not pursue upgrades or enhancements to the current BioWatch system until the Office of Health Affairs (OHA): (1) establishes technical performance requirements, including limits of detection, necessary for a biodetection system to meet a clearly defined operational objective for the BioWatch program by detecting attacks of defined types and sizes with specified probabilities; (2) assesses the Gen-2 system against these performance requirements to reliably establish its capabilities; and (3) produces a full accounting of statistical and other uncertainties and limitations in what is known about the system's capability to meet its operational objectives.

Agency: Department of Homeland Security
Status: Open

Comments: DHS told us in June, 2019 that it terminated the Biodetection Technology Enhancements program to enhance BioWatch. Additionally, DHS is transitioning to a new acquisition program called BioDetection 21 intended to replace BioWatch. We will update the status of this recommendation as we obtain more information about DHS's BioDetection 21 acquisition efforts and the extent to which these efforts are consistent with our recommendation.

Recommendation: To help reduce the risk of acquiring immature detection technologies, the Secretary of Homeland Security should direct the Assistant Secretary for Health Affairs, in coordination with the Under Secretary for Science and Technology, to use the best practices outlined in this report to inform test and evaluation actions for any future upgrades or changes to technology for BioWatch.

Agency: Department of Homeland Security
Status: Open

Comments: DHS told us in June, 2019 that it terminated the Biodetection Technology Enhancements program to enhance BioWatch. Additionally, DHS is transitioning to a new acquisition program called BioDetection 21 intended to replace BioWatch. We will update the status of this recommendation as we obtain more information about DHS's BioDetection 21 acquisition efforts and the extent to which these efforts are consistent with our recommendation.

Recommendation: To help ensure that agencies' policies and oversight are fully consistent with The Attorney General's Guidelines Regarding the Use of Confidential Informants, the Assistant Secretary of ICE and the Commandant of USCG should update their respective agencies' informant policies and corresponding monitoring processes to explicitly address the Guidelines' provisions on oversight of informants' illegal activities.

Agency: Department of Homeland Security: United States Immigration and Customs Enforcement
Status: Open

Comments: In December 2016, ICE issued a memo regarding changes to its policies for the registration and suitability of confidential informants. The memo included updated forms to oversee those aspects of confidential informant oversight. In April 2017, ICE officials informed GAO that the agency planned for a working group to update the Informants Handbook and the Undercover Operations Handbook. As of October 2018, ICE reported that officials had made draft updates to the handbooks and that these updates were undergoing review. In June 2019, ICE reported that the updates were expected to be finalized in July 2019. The handbook updates had not been finalized as of February 2020, and, at that time, ICE officials reported that the handbooks were undergoing additional updates related to a separate effort unrelated to GAO's recommendation. As of June 2020, ICE officials did not have an estimated completion date for finalizing revisions to the handbooks. When the updated handbooks are available for GAO's review, we will assess the extent to which they address our recommendation.

Recommendation: To increase the efficiency and improve the accuracy of the interagency UAC referral and placement process, the Secretaries of Homeland Security and Health and Human Services should jointly develop and implement a documented interagency process with clearly defined roles and responsibilities, as well as procedures to disseminate placement decisions, for all agencies involved in the referral and placement of UAC in HHS shelters.

Agency: Department of Homeland Security
Status: Open
Priority recommendation

Comments: Since our 2015 report, DHS and HHS developed two documents to guide interagency procedures related to the processing of UAC. Specifically, in April 2018, HHS and DHS established a memorandum of agreement regarding information sharing for UAC. Subsequently, on July 31, 2018, DHS and HHS issued a Joint Concept of Operations to memorialize interagency policies, procedures, and guidelines related to the processing of UAC. However, in February 2020, we reported that DHS and HHS officials' indicated that, in practice, the agencies have not resolved long-standing differences in opinion about whether and how agencies are to share information, and what type of information is needed to inform decisions about the care and placement of UAC. In commenting on our draft report, DHS stated that its components are working with HHS to document current information sharing practices, to validate remaining information sharing gaps, and to draft a joint plan between DHS and HHS to ensure that HHS receives information needed to make decisions for UAC. In their comments, HHS officials stated that they intend to reach out to counterparts at DHS in June 2020 to discuss potential periodic updates to the Joint Concept of Operations. In August 2020, DHS informed us that the department is working with HHS to document current information sharing practices, validate gaps, and draft a joint plan between DHS and HHS, among other actions. DHS estimates that it will complete these actions by March 31, 2021. To fully address the recommendation, DHS and HHS should ensure that they have implemented procedures aimed at improving the efficiency and accuracy of the interagency UAC referral and placement process.

Recommendation: To help the department effectively manage spending on mobile devices and services, the Secretary of Homeland Security should ensure procedures to monitor and control spending are established department-wide. Specifically, ensure that (1) procedures include assessing devices for zero, under, and over usage; (2) personnel with authority and responsibility for performing the procedures are identified; and (3) the specific steps to be taken to perform the process are documented.

Agency: Department of Homeland Security
Status: Open

Comments: In October 2019, the Department of Homeland Security developed an asset and inventory management plan for managing devices under its enterprise blanket purchase agreement. The plan includes procedures for assessing devices for zero usage; however, it does not include procedures for assessing over and under usage. The department also has not demonstrated that it has established procedures for devices not covered by its enterprise blanket purchase agreement.We will continue to monitor the department's efforts.

Recommendation: To more accurately communicate DHS's funding plans for USCG's major acquisition programs, the Secretary of Homeland Security should ensure the funding plans presented to Congress in fiscal year 2015 are comprehensive and clearly account for all operations and maintenance funding DHS plans to allocate to each of the USCG's major acquisition programs.

Agency: Department of Homeland Security
Status: Open

Comments: The Department of Homeland Security (DHS) concurred with this recommendation and stated in their comments that the U.S. Coast Guard and the DHS Chief Financial Officer will develop a plan to address this recommendation by September 30, 2015, then work together to fully implement the plan. DHS estimated it would complete this effort March 31, 2016. However, the USCG encountered technical challenges during this process and was unable to implement the plan by that time. The U.S. Coast Guard has revised the estimated completion date and now anticipates it will be able to address this recommendation in fiscal year 2022. GAO will continue to assess the updated APBs as a part of its annual review of select DHS major acquisition programs to determine whether the department has addressed the recommendation.

Recommendation: To improve the management of DHS FOIA requests, the Secretary of DHS should direct the Chief FOIA Officer to improve reporting of FOIA costs by including salaries, employee benefits, non-personnel direct costs, indirect costs, and costs for other offices.

Agency: Department of Homeland Security
Status: Open

Comments: As of August 2020, we have followed up with the department to request documentation but have not yet received evidence of DHS's planned actions to address this recommendation.

Recommendation: To improve the management of DHS FOIA requests, the Secretary of DHS should direct the Chief FOIA Officer to direct USCIS and Coast Guard to fully implement the recommended FOIA processing system capabilities and the section 508 requirement.

Agency: Department of Homeland Security
Status: Open

Comments: As of August 2020, we have followed up with the department to request documentation but have not yet received evidence of DHS's planned actions to address this recommendation.

Recommendation: To improve the management of DHS FOIA requests, the Secretary of DHS should direct the Chief FOIA Officer to determine the viability of re-establishing the service-level agreement between the U.S. Citizenship and Immigration Services (USCIS) and U.S. Immigration and Customs Enforcement to eliminate duplication in the processing of immigration files. If the benefits of doing so would exceed the costs, re-establish the agreement.

Agency: Department of Homeland Security
Status: Open

Comments: As of August 2020, we have followed up with the department to request documentation but have not yet received evidence of DHS's planned actions to address this recommendation.

Recommendation: To promote forward-looking construction and rebuilding efforts while FEMA phases out most subsidies, the Secretary of the Department of Homeland Security should direct FEMA to consider amending NFIP minimum standards for floodplain management to incorporate, as appropriate, forward-looking standards, similar to the minimum standard adopted by the Hurricane Sandy Rebuilding Task Force.

Agency: Department of Homeland Security
Status: Open

Comments: In August 2019, a FEMA official stated that FEMA intends to implement the recommendation in full eventually, but it is unlikely that it will happen as a cohesive effort in 2020, given other ongoing flood insurance reforms. As of August 2020, the status of this recommendation remains unchanged.

Recommendation: In order to improve transparency and allow for more informed decision making by congressional leaders and DHS and GSA decision-makers, before requesting additional funding for the DHS headquarters consolidation project, the Secretary of Homeland Security and the Administrator of the General Services Administration should work jointly to conduct the following assessments and use the results to inform updated DHS headquarters consolidation plans: (1) a comprehensive needs assessment and gap analysis of current and needed capabilities that take into consideration changing conditions, and (2) an alternatives analysis that identifies the costs and benefits of leasing and construction alternatives for the remainder of the project and prioritizes options to account for funding instability.

Agency: Department of Homeland Security
Status: Open
Priority recommendation

Comments: The Department of Homeland Security Headquarters Consolidation Accountability Act of 2015 (Pub. L. No. 114-150) was enacted on April 29, 2016. Among other things, the act requires DHS, in coordination with GSA, to submit information to Congress about DHS headquarters consolidation efforts not later than 120 days of enactment. As of April 2020, DHS and GSA had not submitted the information to Congress required by Pub. L. No. 114-150. Required information includes a comprehensive assessment of property and facilities utilized by DHS in the National Capital Region, and an analysis that identifies the costs and benefits of leasing and construction alternatives for the remainder of the consolidation project. DHS reported that DHS and GSA prepared a comprehensive response to P.L. No. 114-150, but that the consolidation plan and response needed to be revised based on changing budget circumstances, among other things. In April 2020, DHS estimated that the final consolidation plan will be completed and approved in 2020. GAO will review the latest information on DHS headquarters consolidation efforts when it is provided to Congress, and will assess the materials in the context of this recommendation at that time. Continued DHS and GSA attention to following leading capital planning practices is critical given the project's multi-billion dollar cost and impact on future departmental operations.

Recommendation: In order to improve transparency and allow for more informed decision making by congressional leaders and DHS and GSA decision-makers, before requesting additional funding for the DHS headquarters consolidation project, after revising the DHS headquarters consolidation plans, the Secretary of Homeland Security and the Administrator of the General Services Administration should work jointly to develop revised cost and schedule estimates for the remaining portions of the consolidation project that conform to GSA guidance and leading practices for cost and schedule estimation, including an independent evaluation of the estimates.

Agency: Department of Homeland Security
Status: Open
Priority recommendation

Comments: The Department of Homeland Security Headquarters Consolidation Accountability Act of 2015 (Pub. L. No. 114-150) was enacted on April 29, 2016. Among other things, the act requires DHS, in coordination with GSA, to submit information to Congress about DHS headquarters consolidation efforts not later than 120 days of enactment. As of April 2020, DHS and GSA had not submitted the information to Congress required by Pub. L. No. 114-150. Required information includes updated cost and schedule estimates for the consolidation project that are consistent with GAO's recommendations in GAO-14-648. Furthermore, the act requires the Comptroller General to evaluate the cost and schedule estimates not later than 90 days after their submittal to Congress. DHS reported that DHS and GSA prepared a comprehensive response to P.L. No. 114-150, but that the consolidation plan and response needed to be revised based on changing budget circumstances, among other things. In April 2020, DHS estimated that the final consolidation plan will be completed and approved in 2020. GAO will review the latest DHS headquarters consolidation cost and schedule estimates when they are provided to Congress, and will assess the materials in the context of this recommendation at that time. Continued DHS and GSA attention to following leading cost and schedule estimation practices is critical given the project's multi-billion dollar cost and impact on future departmental operations.

Recommendation: To help ensure that all employees are treated fairly and receive the protections established in the executive order, the Secretary of Homeland Security should direct the Commandant, U.S. Coast Guard, to revise the Coast Guard instruction for military personnel to specify that military personnel may be represented by counsel or other representatives at their own expense.

Agency: Department of Homeland Security
Status: Open

Comments: DHS concurred with our recommendation. As of August 2018, the Commandant of the Coast Guard issued a policy message stating that individuals may have counsel or other representatives present at the service member's own expense. According to a Coast Guard official, this message serves as interim guidance until the personnel security manual can be finalized. Coast Guard officials stated that the manual will be undergoing revision, and is expected to be updated at the end of March 2019 . We are awaiting documentation from the Coast Guard that this manual is complete. This recommendation will remain open until the Coast Guard finalizes the update to its manual in accordance with our recommendation.

Recommendation: To help the Coast Guard improve the long-term outlook of its portfolio, the Commandant of the Coast Guard should develop a 20-year fleet modernization plan that identifies all acquisitions needed to maintain the current level of service and the fiscal resources necessary to build the identified assets. The plan should also consider trade-offs if the fiscal resources needed to execute the plan are not consistent with annual budgets.

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: The agency concurred with this recommendation. Since the issuance of GAO's report, in February 2016, Congress directed the Coast Guard to develop a long-term plan to cover fiscal year 2017 and 20 years thereafter and that it should be updated every two years. In November 2017, officials told GAO that the Coast Guard was developing a 20-year long-term plan that specifically focused on the highest priority recapitalization and sustainment efforts for its assets and will focus on meeting the intent of the 2016 congressional mandate. However, as of July 2020, the Coast Guard has not completed this plan. At that time, officials said that the Coast Guard continues to refine the process to define the long term acquisition and capital sustainment needs of the Service and align them with published and anticipated fiscal top line budgets. The Coast Guard is working with internal and external stakeholders to define useful parameters in order to complete work to close this recommendation. GAO will continue to monitor the Coast Guard's actions in completing its long-term plan given that GAO's recent work has found that the Coast Guard continues to pursue an unaffordable acquisition portfolio that is not likely to fully address all known and anticipated capability gaps.

Recommendation: To improve the acquisition management of the Plan and the reliability of its cost estimates and schedules, assess the effectiveness of deployed technologies, and better inform CBP's deployment decisions, once data on asset assists are required to be recorded and tracked, the Commissioner of CBP should analyze available data on apprehensions and seizures and technological assists, in combination with other relevant performance metrics or indicators, as appropriate, to determine the contribution of surveillance technologies to CBP's border security efforts.

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open
Priority recommendation

Comments: In 2014, CBP expanded its Arizona Border Surveillance Technology Plan to the Southwest Border Technology Plan. In February 2015, the Border Patrol took steps to address this recommendation by developing the Capability Gap Analysis Process (CGAP) with the support of Johns Hopkins University's Applied Physics Lab to examine the effects of technology and other assets. In May 2017, Border Patrol officials demonstrated a new system, intended to allow for more comprehensive analysis of the contributions of surveillance technologies to Border Patrol's mission during the CGAP process. As of March 2019, Border Patrol is now able to generate a performance report, using data collected from multiple systems, on how surveillance technologies have assisted agents during operations, including Border Patrol apprehensions. In February 2020 Border Patrol officials stated the data gathered in the report were reliable. They also provided examples of how they use available performance data to help identify gaps in capabilities and inform future investments in surveillance technologies. Border Patrol officials are also developing a surveillance capability score intended to represent the combined contributions of individual technology assets and agents on patrol to conduct surveillance in a given area. Border Patrol plans to report this score in fiscal year 2021, according to documentation provided by Border Patrol. We view these efforts, as described, as important progress toward fulfilling our recommendation, and will review the planned surveillance capability score once it is implemented to determine whether Border Patrol has fully implemented our recommendation.

Recommendation: To ensure that the increasing risks of GPS disruptions to the nation's critical infrastructure are effectively managed, the Secretary of Homeland Security should increase the reliability and usefulness of the GPS risk assessment by developing a plan and time frame to collect relevant threat, vulnerability, and consequence data for the various critical infrastructure sectors, and periodically review the readiness of data to conduct a more data-driven risk assessment while ensuring that DHS's assessment approach is more consistent with the National Infrastructure Protection Plan (NIPP).

Agency: Department of Homeland Security
Status: Open

Comments: DHS officials had previously indicated that DHS's Office of Infrastructure Protection (IP) and Office of Cyber and Infrastructure Analysis (OCIA) have discussed an update of the GPS risk assessment. Additionally, information from DHS shows that DHS has continued other efforts to collect potentially relevant threat, vulnerability, and consequence data for various GPS equipment in use. For example, according to DHS officials, DHS has conducted visits to major maritime, finance, wireless communications, and electricity firms to gauge their understanding of GPS vulnerabilities and of technology- and strategy-based efforts to improve GPS resilience, and DHS documentation shows that DHS has held events to test GPS receivers as part of assessing vulnerabilities. In August 2020, DHS officials provided GAO with additional information regarding their progress on implementing the recommendation. We will update the status of this recommendation after we review the additional information from DHS.

Recommendation: To better ensure that CBP's Office of Field Operations' (OFO) staffing processes are transparent and to help ensure CBP can demonstrate that these resource decisions have effectively addressed CBP's mission needs, the Commissioner of CBP should document the methodology and process OFO uses to allocate staff to land ports of entry on the southwest border, including the rationales and factors considered in making these decisions.

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: In May 2017, CBP's Office of Field Operations began working with a contractor to develop a comprehensive CBP position allocation methodology and tool. According to CBP officials, the purpose of this tool was to ensure a data driven, transparent process for allocating CBP resources--including staff--to land ports of entry on the southwest border. CBP officials stated that the contractor completed the tool in January 2018, CBP tested the tool in fiscal year 2018, and CBP planned to implement the tool in fiscal year 2019. However, CBP officials told us in September 2020 that a subsequent reorganization of the Office of Field Operations rendered the tool unusable without further modification. As a result, they used a manual method to allocate staff in fiscal year 2020 and plan to do the same in fiscal year 2021. As of September 2020, CBP officials planned to document the methodology and process they are now using to allocate staff to land ports of entry, including rationales and factors considered, by November 2020. This recommendation remains open.

Recommendation: To establish full-risk rates for properties with previously subsidized rates that reflect their risk for flooding, the Secretary of the Department of Homeland Security (DHS) should direct the FEMA Administrator to develop and implement a plan, including a timeline, to obtain needed elevation information as soon as practicable.

Agency: Department of Homeland Security
Status: Open
Priority recommendation

Comments: As of January 2020, FEMA continues its multi-year effort to redesign its risk rating system to reflect industry best practices, such as providing credible, understandable rates based on graduated risk. As part of this redesign, FEMA plans to obtain multiple sources of data and information about a property's risk of flooding--from which it may be able to derive elevation information on some properties--to develop the insurance rate. FEMA has delayed implementation of the new risk rating system until 2021, pending further analysis. In addition, FEMA issued a Request for Information on obtaining structural elevation information from third party sources and is reviewing responses from potential vendors. The agency also encourages subsidized policyholders who seek to ensure the appropriateness of their NFIP rates to voluntarily submit elevation documentation. We will continue to monitor the extent to which FEMA is able to produce elevation information for all currently subsidized properties.

Recommendation: To increase the efficiency and effectiveness of the process for disaster declarations, the FEMA Administrator should develop and implement a methodology that provides a more comprehensive assessment of a jurisdiction's capability to respond to and recover from a disaster without federal assistance. This should include one or more measures of a jurisdiction's fiscal capacity, such as TTR, and consideration of the jurisdiction's response and recovery capabilities. If FEMA continues to use the PA per capita indicator to assist in identifying a jurisdiction's capabilities to respond to and recover from a disaster, it should adjust the indicator to accurately reflect the annual changes in the U.S. economy since 1986, when the current indicator was first adopted for use. In addition, implementing the adjustment by raising the indicator in steps over several years would give jurisdictions more time to plan for and adjust to the change.

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open
Priority recommendation

Comments: On January 20, 2016, FEMA published an Advanced Notice of Proposed Rulemaking to solicit comments on an option FEMA is considering to establish a disaster deductible, which would require a predetermined level of financial or other commitment from a recipient, generally the state or territorial government, before FEMA would provide assistance under the Public Assistance Program. According to FEMA, the agency received 150 responses during the 60-day public comment period, which ended on March 21, 2016, and used this input to develop a plan for further engagement on a more detailed proposal for public comment. The Supplemental Advanced Notice of Proposed Rulemaking, published on January 12, 2017, provided another opportunity for stakeholder input prior to any changes to the Public Assistance program. This proposal included an explanation of how deductible amounts might be calculated, identified specific credits that states could apply for, and detailed how the deductible would be applied post-declaration. According to FEMA officials, the comments received, in part, raised concerns about the complexity of the proposed deductible model. FEMA agreed with the concerns raised that the proposal was too complicated, and in August 2018, told us that it is no longer pursuing that option. However, FEMA is considering options that leverage similar approaches but does not have an estimated completion date for implementation. On October 5, 2018, the Disaster Recovery Reform Act of 2018 (DRRA), was signed into law. DRRA (section 1239) directs the FEMA Administrator to initiate a rulemaking to update the factors considered when evaluating a request for a Major Disaster Declaration for Public Assistance, specifically the estimated cost of assistance (i.e. the per capita indicator). FEMA is working to implement this provision pursuant to the law, and this effort represents one of the top priorities of the agency; however, the estimated completion date is still "to be determined." Until FEMA implements a new methodology, FEMA will not have an accurate assessment of a jurisdiction's capabilities to respond to and recover from a disaster without federal assistance and runs the risk of recommending that the President award Public Assistance to jurisdictions that have the capability to respond and recover on their own.

Recommendation: To help ensure that FEMA's agencywide workforce planning and training efforts are conducted in a comprehensive and integrated manner, the FEMA Administrator should identify and document long-term and quantifiable mission critical goals that reflect the agency's priorities for workforce planning and training.

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: In October 2016, agency officials said they had contracted for the development of a Workforce Strategic Plan that is intended to assess current steady state staffing needs based on mission requirements and establish workforce models capable of determining future needs based on workload drivers. Further, they said the plan will monitor and evaluate FEMA's progress towards mission critical goals and the contribution that human capital results have made towards achieving programmatic priorities. In July 2017, they provided an updated estimate that the plan will be completed by June 2020. Pending completion of this effort, the recommendation will remain open. As of February 2020, GAO is awaiting additional information about these actions.

Recommendation: To help ensure that FEMA's agencywide workforce planning and training efforts are conducted in a comprehensive and integrated manner, the FEMA Administrator should establish a time frame for completing the development of quantifiable performance measures related to workforce planning and training efforts.

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: In October 2016, agency officials said they had contracted for the development of a Workforce Strategic Plan that is intended to assess current steady state staffing needs based on mission requirements and establish workforce models capable of determining future needs based on workload drivers. Once complete, they said the plan will identify performance metrics to track FEMA's progress towards mission critical goals regarding workforce planning and training efforts. In July 2017, they provided an updated estimate that the plan will be completed by June 2020. Pending completion of this effort, the recommendation will remain open. As of February 2020, GAO is awaiting additional information about this effort.

Recommendation: To better inform FEMA's decision-making related to agencywide workforce planning and training efforts, the FEMA Administrator should develop systematic processes to collect and analyze workforce and training data.

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: In July 2017, officials reported that FEMA's Chief Component Human Capital Office was preparing a Training Plan that will outline the collection and analysis methodology of training data with an estimated completion date of September 2018. Pending documentation of the results of these efforts, this recommendation will remain open. As of February 2020, GAO is awaiting additional information about these efforts.

Recommendation: To provide transparency and accountability over the payments FEMA makes to WYOs for expenses and profits, the Secretary of Homeland Security should direct the Under Secretary of Homeland Security, FEMA, to determine in advance the amounts built into the payment rates for estimated expenses and profit.

Agency: Department of Homeland Security
Status: Open

Comments: According to FEMA officials, FEMA is responding to this recommendation as part of its development of a final rule on WYO compensation practices, required by the Biggert-Waters Act. FEMA's current payment rates do not explicitly consider WYO insurers' actual expenses and profit. FEMA issued an Advance Notice of Proposed Ruling on July 8, 2019 seeking comments by September 6, 2019 regarding possible approaches to incorporating actual flood insurance expense data into the WYO payment methodology. As of February 2020, FEMA officials said that they were reviewing comments received in response to the July 2019 notice.

Recommendation: To provide transparency and accountability over the payments FEMA makes to WYOs for expenses and profits, the Secretary of Homeland Security should direct the Under Secretary of Homeland Security, FEMA, to annually analyze the amounts of actual expenses and profit in relation to the estimated amounts used in setting payment rates.

Agency: Department of Homeland Security
Status: Open
Priority recommendation

Comments: According to FEMA officials, FEMA is responding to this recommendation as part of its development of a final rule on WYO compensation practices, required by the Biggert-Waters Act. However, GAO has reported that an annual analysis of the WYO insurers' actual expenses and profit could be regularly performed in relation to FEMA's existing payment methodology. FEMA issued an Advance Notice of Proposed Ruling on July 8, 2019 seeking comments by September 6, 2019 regarding possible approaches to incorporating actual flood insurance expense data into the WYO payment methodology. As of February 2020, FEMA officials said that they would complete an annual analysis of WYO data by the end of fiscal year 2020 and that they were reviewing comments received in response to the July 2019 notice.

Recommendation: To provide transparency and accountability over the payments FEMA makes to WYOs for expenses and profits, the Secretary of Homeland Security should direct the Under Secretary of Homeland Security, FEMA, to consider the results of the analysis of payments, actual expenses, and profit in evaluating the methods for paying WYOs.

Agency: Department of Homeland Security
Status: Open

Comments: According to FEMA officials, FEMA is responding to this recommendation as part of its development of a final rule on WYO compensation practices, required by the Biggert-Waters Act. FEMA issued an Advance Notice of Proposed Ruling on July 8, 2019 seeking comments by September 6, 2019 regarding possible approaches to incorporating actual flood insurance expense data into the WYO payment methodology. As of February 2020, FEMA officials said that they were reviewing comments received in response to the July 2019 notice.

Recommendation: To increase the usefulness of the data reported by WYOs to the National Association of Insurance Commissioners (NAIC) and to institutionalize FEMA's use of such data, the Secretary of Homeland Security should direct the Under Secretary of Homeland Security, FEMA, to take actions to obtain reasonable assurance that NAIC flood insurance expense data can be considered in setting payment rates that are appropriate, including identifying affiliated company profits in reported flood insurance expenses.

Agency: Department of Homeland Security
Status: Open

Comments: According to FEMA officials, FEMA is responding to this recommendation as part of its development of a final rule on WYO compensation practices, required by the Biggert-Waters Act. FEMA can also take actions, in addition to any actions related to the rule, to develop method(s) for obtaining reasonable assurance that NAIC data is accurate and usable for setting payment rates before implementation of a new compensation methodology. FEMA issued an Advance Notice of Proposed Ruling on July 8, 2019 seeking comments by September 6, 2019 regarding possible approaches to incorporating actual flood insurance expense data into the WYO payment methodology. As of February 2020, FEMA officials said that they were reviewing comments received in response to the July 2019 notice.

Recommendation: To increase the usefulness of the data reported by WYOs to the National Association NAIC and to institutionalize FEMA's use of such data, the Secretary of Homeland Security should direct the Under Secretary of Homeland Security, FEMA, to develop comprehensive data analysis strategies to annually test the quality of flood insurance data that WYOs report to NAIC.

Agency: Department of Homeland Security
Status: Open

Comments: According to FEMA officials, FEMA is responding to this recommendation as part of its development of a final rule on WYO compensation practices, required by the Biggert-Waters Act. FEMA can also take actions, in addition to any actions related to the rule, to develop and implement data analysis strategies to annually test the quality of flood insurance data WYO insurers report to NAIC before implementation of a new compensation methodology. FEMA issued an Advance Notice of Proposed Ruling on July 8, 2019 seeking comments by September 6, 2019 regarding possible approaches to incorporating actual flood insurance expense data into the WYO payment methodology. As of February 2020, FEMA officials said that they were reviewing comments received in response to the July 2019 notice.

Recommendation: The Secretary of the Department of Homeland Security should direct FEMA to take steps to ensure that its rate-setting methods and the data it uses to set rates result in full-risk premiums rates that accurately reflect the risk of losses from flooding. These steps should include, for example, verifying the accuracy of flood probabilities, damage estimates, and flood maps; ensuring that the effects of long-term planned and ongoing development, as well as climate change, are reflected in the flood probabilities used; and reevaluating the practice of aggregating risks across zones.

Agency: Department of Homeland Security
Status: Open
Priority recommendation

Comments: In April 2018, FEMA officials told us they had begun to redesign NFIP's risk rating system to help ensure policy rates better reflect the risk of flooding. The redesign, known as Risk Rating 2.0, includes efforts to use catastrophe models, stochastic approaches, and updated map information to better reflect the variation in flood risk. These reforms are also intended to improve how FEMA's rating process accounts for general and specific factors that affect flood probabilities and damage. While FEMA initially announced that new rates for all single-family homes would go into effect nationwide on October 1, 2020, it announced in November 2019 that it would defer implementation to October 1, 2021. FEMA said this would allow it to conduct a comprehensive analysis of the proposed rating structure so as to protect policyholders and minimize any unintentional negative effects of the transition, and that the new implementation date would cover all NFIP policies.

Recommendation: The Secretary of the Department of Homeland Security should direct FEMA to ensure that information is collected on the location, number, and losses associated with existing and newly created grandfathered properties in NFIP and to analyze the financial impact of these properties on the flood insurance program.

Agency: Department of Homeland Security
Status: Open

Comments: As of February 2020, FEMA officials said they had finished identifying properties with grandfathered premium rates and that they planned to analyze their economic implications as part of their efforts to update their premium rate setting approach, known as Risk Rating 2.0. FEMA plans to implement this redesign on October 1, 2021.