Recommendation: The TSA Administrator should update the BASE cybersecurity template to ensure it reflects cybersecurity key practices, including the Detect and Recover functions outlined in the NIST Cybersecurity Framework. (Recommendation 2)

Agency: Department of Homeland Security: Transportation Security Administration
Status: Open

Comments: TSA concurred with this recommendation and said it would take steps to implement it by updating the BASE Cybersecurity Security Action Item section to ensure it reflects the NIST Cybersecurity Framework Detect and Recover functions. When we confirm what actions TSA has taken in response to this recommendation, we will provide updated information.

Recommendation: The FEMA administrator should revise FEMA's cost-estimating guidance for Public Assistance projects to fully align with all 12 steps in the GAO Cost Estimating and Assessment Guide. (Recommendation 1)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: The agency agreed with the recommendation and is working to address it.

Recommendation: The FEMA administrator should develop a repository for all current applicable Public Assistance policies and guidance for Puerto Rico and make it available to all recovery partners, including subrecipients. (Recommendation 2)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: The agency agreed with the recommendation and is working to address it.

Recommendation: The FEMA Administrator should assess the need for an agency-wide consolidated standard operating procedures document for the Hazard Mitigation Grant Program that provides detailed information on the roles and responsibilities, requirements, and key tasks and milestones for monitoring and closing out program projects. (Recommendation 2)

Agency: Department of Homeland Security: Directorate of Emergency Preparedness and Response: Federal Emergency Management Agency
Status: Open

Comments: The agency agreed with this recommendation and is working to address it.

Recommendation: The Administrator of FEMA should develop and provide clear written information in the form of policy, guidance, or regulations, as appropriate, to COR3 and PREPA that clarifies how FEMA will implement new authorities for the electricity grid recovery in Puerto Rico, including guidance on industry standards and defining resilience. (Recommendation 1)

Agency: Federal Emergency Management Agency
Status: Open

Comments: Since GAO's October 2019 report, FEMA updated its guidance and has provided information to local entities on project eligibility and the industry standards it would accept for restoring the grid. In addition, in January 2020, FEMA provided training to FEMA regional officials and local entities on how to implement this guidance. Despite these efforts, uncertainty remains regarding the extent to which local entities in Puerto Rico have sufficient information to implement projects to promote grid resilience. This is in part due to challenges such as the need for written guidance on how project development will proceed after the fixed-cost estimate is finalized. GAO will continue to monitor FEMA progress towards implementation of this recommendation.

Recommendation: The Secretary of HUD should establish time frames and a plan for publication of the grant process and requirements for CDBG-DR funding available for improvements to Puerto Rico's electricity grid. (Recommendation 2)

Agency: Department of Housing and Urban Development
Status: Open

Comments: As of August 2020, HUD had not published a federal notice outlining the grant process and requirements for CDBG-DR funding available for improvements to Puerto Rico's electricity grid, nor has it established time frames and a plan for issuing this notice. We continue to believe that the action we recommended is needed and will monitor HUD's efforts as part of our regular recommendation follow-up and additional work examining federal support to improve grid resilience in Puerto Rico. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of FEMA, in coordination with DOE, HUD, and other federal and local entities, should establish a mechanism, or take steps to improve existing mechanisms, for coordination among the multiple local and federal entities involved in grid recovery that facilitates decision-making and information sharing among local and federal agencies. (Recommendation 3)

Agency: Federal Emergency Management Agency
Status: Open

Comments: FEMA and DOE have enhanced coordination efforts between their respective agencies and with local entities involved in long-term grid recovery in Puerto Rico via the Technical Coordination Team but until the team's fiscal working group demonstrates how it will help coordinate different potential funding sources, the extent to which these efforts will enhance progress toward grid recovery is uncertain. FEMA can demonstrate this, in part, by providing documentation of efforts to coordinate funding for long-term recovery projects. GAO will continue to monitor agency efforts to support grid recovery in Puerto Rico.

Recommendation: The NIST Associate Director for Laboratory Programs should update NIST policy to include periodic comprehensive management review of the agency's measurement services to assess gaps and ensure alignment with stakeholders' needs, and take steps to ensure that the Associate Director completes the review of NIST's standards development activities (Recommendation 1).

Agency: Department of Commerce: National Institute of Standards and Technology
Status: Open

Comments: NIST concurred with this recommendation and, as of May 2020, had taken some steps to implement it. Specifically, NIST provided information indicating it uses multiple information sources to identify potential measurement service gaps. For example, the Associate Director for Laboratory Programs (ADLP) reviews quarterly reports from NIST's laboratory divisions that include information on measurement services. The ADLP may identify measurement service gaps as part of this review. Also, the NIST Measurement Services Council serves the ADLP in an advisory role to identify and address NIST-wide issues related to the quality, relevance, performance, operations, and resources allocated to the health and improvement of NIST measurement services. The Council produces an annual report that addresses the health of NIST's measurement services, including potential changes needed to meet future customer needs. Further, NIST employees may suggest new services through processes established in suborder 5901.01. Many of these efforts also include consideration of potential gaps in NIST's participation in standards development activities. Additionally, NIST Order 5301.00 delegates responsibility to review standards activities and participation across several levels of NIST management. Although these actions may help identify gaps in NIST's participation in standards development activities as well as identify gaps in the measurement services it provides, it is not clear how or whether they fulfill the periodic review of the effectiveness of NIST's participation in documentary standards activities that the ADLP is to conduct under NIST's standards participation policy. We will update our evaluation of NIST's implementation of this recommendation when the agency provides additional information on how the activities described above fulfill the effectiveness review called for by NIST's policy, or provides information documenting that the ADLP has conducted such a review.