Recommendation: The TSA Administrator should establish quantifiable targets for the Surface Transportation Security Inspectors Program's activity-level performance measures. (Recommendation 1)

Agency: Department of Homeland Security: Transportation Security Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The TSA Administrator should update the BASE cybersecurity template to ensure it reflects cybersecurity key practices, including the Detect and Recover functions outlined in the NIST Cybersecurity Framework. (Recommendation 2)

Agency: Department of Homeland Security: Transportation Security Administration
Status: Open

Comments: TSA concurred with this recommendation and said it would take steps to implement it by updating the BASE Cybersecurity Security Action Item section to ensure it reflects the NIST Cybersecurity Framework Detect and Recover functions. When we confirm what actions TSA has taken in response to this recommendation, we will provide updated information.

Recommendation: The TSA Administrator should direct T&D and Security Operations to monitor for instances of TSO non-compliance by individual commercial airports across fiscal years that could potentially warrant corrective action at the headquarters level. (Recommendation 2)

Agency: Department of Homeland Security: Transportation Security Administration
Status: Open

Comments: In January 2020, TSA's formal comment letter in response to our draft report stated that T&D will begin recording instances of noncompliance and work with Security Operations to monitor trends at individual airports and with specific courses. TSA also reported that T&D had developed a repository in its iShare database for this information at the end of 2019 and the agency is currently testing various options for reporting and pulling data. Once options are chosen and incorporated into its standard operating procedures, TSA reports that T&D will begin sharing the reports with Security Operations on a monthly basis. In July 2020, TSA officials told us that T&D had begun sharing training compliance reports from their database with Security Operations and discussing the results with them on a monthly basis. This database allows T&D to recognize trends at individual airports and specific courses throughout the fiscal year. Going forward, this process will enable T&D to identify noncompliance trends across fiscal years. We will continue to montior these efforts to verify that the T&D is montioring trends across fiscal years and work with TSA towards closure of this recommendation.

Recommendation: The Executive Assistant Administrator / Director of FAMS should identify and utilize a suitable system that provides information about air marshals' medical qualification status. (Recommendation 1)

Agency: Department of Homeland Security: Transportation Security Administration: Office of Law Enforcement - Federal Air Marshal Service
Status: Open

Comments: DHS concurred with this recommendation and in January 2020, DHS officials stated that FAMS is evaluating case management software to track this information and plans to pursue funding for this effort in fiscal year 2021.This action, if fully implemented, should address the intent of the recommendation. When we confirm what actions DHS has taken in response to this recommendation, we will provide updated information.

Recommendation: The Executive Assistant Administrator / Director of FAMS should develop and implement a plan to assess the health and fitness of the FAMS workforce as a whole, including trends over time. (Recommendation 2)

Agency: Department of Homeland Security: Transportation Security Administration: Office of Law Enforcement - Federal Air Marshal Service
Status: Open

Comments: DHS concurred with this recommendation and in January 2020, DHS officials stated that FAMS had established a team to develop a plan for assessing workforce health and wellness issues. Adopting and implementing a plan that assesses the health and fitness of the FAMS workforce as a whole, should address the intent of the recommendation. When we confirm what actions DHS has taken in response to this recommendation, we will provide updated information.

Recommendation: The Executive Assistant Administrator / Director of FAMS should identify and implement a means to monitor the extent to which air marshals' actual shifts and rest hours are consistent with scheduling guidelines. (Recommendation 3)

Agency: Department of Homeland Security: Transportation Security Administration: Office of Law Enforcement - Federal Air Marshal Service
Status: Open

Comments: DHS concurred with this recommendation and in January 2020, DHS officials stated that FAMS will begin tracking air marshals' actual hours and examine the extent to which air marshals' actual and scheduled hours vary. This information could be helpful, for example, in assessing air marshals' schedule predictability. However, to address the intent of this recommendation, FAMS would need to monitor the extent that air marshals' actual work and rest hours are consistent with FAMS's scheduling guidelines. When we confirm what actions DHS has taken in response to this recommendation, we will provide updated information.

Recommendation: The Executive Assistant Administrator / Director of FAMS should take steps to reaffirm and strengthen efforts to prevent discrimination by, for example, updating and following through on its 2012 action plan and renewing leadership commitment to the plan's goals. (Recommendation 6)

Agency: Department of Homeland Security: Transportation Security Administration: Office of Law Enforcement - Federal Air Marshal Service
Status: Open

Comments: DHS concurred with this recommendation and in January 2020, DHS officials stated that FAMS plans to review the goals of its 2012 action plan and develop steps to strengthen efforts to prevent discrimination. These actions, if fully implemented, should address the intent of the recommendation. When we confirm what actions DHS has taken in response to this recommendation, we will provide updated information.

Recommendation: The TSA Administrator should develop performance goals for its Insider Threat Program that assess progress achieving the strategic objectives in the insider threat strategic plan. (Recommendation 2)

Agency: Department of Homeland Security: Transportation Security Administration
Status: Open

Comments: In May 2020, TSA published its strategic framework, the TSA Insider Threat Roadmap, for mitigating insider threats in the transportation sector. The Roadmap contains three overarching strategic priorities and specific objectives for each of these priorities to refine and continue to improve its efforts to detect, deter, and mitigate insider threats. TSA described that its next steps will be to develop implementation plans for each of these priorities and objectives, including detailed plans of actions with timelines and performance measures to assess its progress achieving the Roadmap's priorities and objectives. We will continue to monitor TSA's efforts to implement our recommendation.

Recommendation: The Secretary of Homeland Security should ensure that the Undersecretary for Management develops an oversight process to confirm that programs' schedule goals are developed and updated in accordance with GAO's Schedule Assessment Guide, to include ensuring traceability between APB schedule goals and IMSs. (Recommendation 1)

Agency: Department of Homeland Security: Office of the Secretary
Status: Open

Comments: In providing comments on this report, DHS concurred with our recommendation and stated that the Management Directorate's Office of Program Accountability and Risk Management (PARM) developed a checklist based on GAO's Schedule Assessment Guide, among other things, to evaluate programs' IMSs. PARM also plans to develop guidance on schedules which is intended to assist the Component Acquisition Executives (CAE) and acquisition program staff responsible for building IMSs and APBs. In July 2020, PARM officials reported that the schedule checklist was already being used to evaluate and ensure program IMSs adhered to GAO's Schedule Assessment Guide. In addition, PARM officials are updating and drafting guidance on schedules to assist CAEs and program staff when building IMSs and APBs. As of July 2020, PARM was still in the process of executing these efforts.

Recommendation: The Secretary of Homeland Security should ensure that the Undersecretary for Management revises the schedule development guidance in the Systems Engineering Life Cycle Guidebook to state clearly that an IMS should be used as the basis for APB schedule goals. (Recommendation 2)

Agency: Department of Homeland Security: Office of the Secretary
Status: Open

Comments: DHS concurred with our recommendation and stated that Management Directorate's Office of Program Accountability and Risk Management (PARM) was in the process of revising the Systems Engineering Life Cycle Guidebook and would clarify the language relating to IMSs to ensure guidance is consistent. As of July 2020, PARM was still in the process of revising the Systems Engineering Life Cycle Guidebook.

Recommendation: The TSA Administrator should update TSA guidance for developing and approving screening technology explosives detection standards to reflect designated procedures, the roles and responsibilities of stakeholders, and changes in the agency's organizational structure. (Recommendation 1)

Agency: Department of Homeland Security: Transportation Security Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The TSA Administrator should require and ensure that TSA officials document key decisions, including testing and analysis decisions, used to support the development and consideration of new screening technology explosives detection standards. (Recommendation 2)

Agency: Department of Homeland Security: Transportation Security Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The TSA Administrator should require and ensure that TSA officials document their assessments of risk and the rationale—including the assumptions, methodology, and uncertainty considered—behind decisions to deploy screening technologies. (Recommendation 3)

Agency: Department of Homeland Security: Transportation Security Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The TSA Administrator should develop a process to ensure that screening technologies continue to meet detection requirements after deployment to commercial airports. (Recommendation 4)

Agency: Department of Homeland Security: Transportation Security Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The TSA Administrator should implement the process it develops to ensure that screening technologies continue to meet detection requirements after deployment to commercial airports. (Recommendation 5)

Agency: Department of Homeland Security: Transportation Security Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The TSA Administrator should clarify roles and responsibilities for all offices involved in the coordination of surface transportation exercises, including when these offices are to coordinate, as part of the planned revision of the Surface Division's Internal Operating Procedure for I-STEP. (Recommendation 1)

Agency: Department of Homeland Security: Transportation Security Administration
Status: Open

Comments: TSA concurred with the recommendation and will develop a standard operating procedure to clarify the roles and responsibilities for all offices involved in the coordination of surface transportation exercises, including when these offices are to coordinate, in conjunction with the planned revision of I-STEP's Surface Division Internal Operating Procedure. As part of this, TSA initiated a Surface Exercise Steering Group in January 2020 to clarify surface roles and responsibilities and to discuss a new approach for coordination of surface exercises. TSA estimates completing these actions by September 30, 2020.

Recommendation: The Administrator of TSA should document which rule review process TSA I&A uses (exigent or standard) for each new rule or rule change; (Recommendation 2)

Agency: Department of Homeland Security: Transportation Security Administration
Status: Open

Comments: DHS concurred with this recommendation and agreed to document which rule review process TSA I&A uses (exigent or standard) for each new rule or rule change. In March 2020, TSA updated its SOP to require that the selected rule review process be documented for each new rule and rule change. TSA's policy change is a positive first step, but to fully address this recommendation, TSA will need to demonstrate that the selected rule review process is now being documented.

Recommendation: The Administrator of TSA should explore additional data sources measuring the effectiveness of Silent Partner and Quiet Skies rules. (Recommendation 3)

Agency: Department of Homeland Security: Transportation Security Administration
Status: Open

Comments: DHS concurred with this recommendation and, in May 2020, DHS officials stated that they are reviewing data sources and assessing potential ways to assess the effectiveness of Quiet Skies and Silent Partner screening rules. DHS officials stated that they plan to fully address this recommendation by December 2020.

Recommendation: The TSA Administrator should periodically review, and as appropriate, update the 2010 Pipeline Security and Incident Recovery Protocol Plan to ensure the plan reflects relevant changes in pipeline security threats, technology, federal law and policy, and any other factors relevant to the security of the nation's pipeline systems. (Recommendation 5)

Agency: Department of Homeland Security: Transportation Security Administration
Status: Open

Comments: DHS concurred with this recommendation and stated that TSA will periodically review, and as appropriate, update the 2010 Pipeline Security and Incident Recovery Protocol Plan to ensure the plan reflects relevant changes in pipeline security threats, technology, federal law and policy, and any other factors relevant to the security of the nation's pipeline systems. In October 2019, TSA officials reported that they were in the process of reviewing the 2010 Pipeline Security and Incident Recovery Protocol Plan and anticipated completing the review by December 2019. However, this review was delayed and we will continue to monitor TSA's efforts to implement this recommendation.

Recommendation: The Administrator of TSA should assess Security Operations guidance for applying root causes for test failures, and identify opportunities to clarify how they should be applied. (Recommendation 4)

Agency: Department of Homeland Security: Transportation Security Administration
Status: Open

Comments: TSA concurred with this recommendation and said it would take steps to implement it. In March 2020, TSA officials reported that they are developing new guidance to help testers identify and record root causes for covert test failures. Once TSA completes this guidance and GAO has been provided a copy for review, we will close this recommendation.

Recommendation: The Administrator of TSA should explore and pursue methods to assess the deterrent effect of TSA's passenger aviation security countermeasures; such an effort should identify FAMS—a countermeasure with a focus on deterring threats—as a top priority to address. (Recommendation 1)

Agency: Department of Homeland Security: Transportation Security Administration
Status: Open

Comments: DHS concurred with this recommendation and has begun taking steps intended to address it. In May 2018, officials with DHS's Requirements and Capabilities Analysis (RCA) reported conducting a literature review to identify ways DHS might be able to measure deterrence. ORCA officials reported looking to published studies and other agencies to identify data sources and methods, and were in the process of developing a model to assess the deterrent value of various aviation security countermeasures. In July 2019, TSA officials reported that they were continuing to develop this model which could better inform deployment of deterrence-related countermeasures. As of October 2020, DHS has provided no further updates on steps taken to implement this recommendation. To fully address this recommendation, TSA will need to fully develop this or another method to assess the deterrent effect of TSA's aviation security countermeasures.

Recommendation: To improve the awareness of how risk-significant radioactive sources are transported within the United States and to better determine whether Nuclear Regulatory Commission (NRC) is meeting its goal of providing reasonable assurance for preventing the theft or diversion of these dangerous materials, the Chairman of NRC should take actions to collect information from licensees on the number of shipments and mode of transport for such sources--for example, by identifying the extent to which an existing NRC database (e.g., the National Source Tracking System) may be used to capture this information.

Agency: Nuclear Regulatory Commission
Status: Open

Comments: In its February 26, 2018 report to Congress on actions NRC has taken in response to GAO recommendations, NRC continued to disagree with the recommendation to expand its existing data collection requirements or to transition such information from its existing NRC databases to the NSTS. NRC stated that, as required by 10 CFR Part 37, "Physical Protection of Category 1 and Category 2 Quantities of Radioactive Material," the NRC currently collects the number of shipments and mode of transport for domestic transfers, and the import and export of Category 1 quantities of radioactive material. Additionally, under the provisions of 10 CFR Part 110, "Export and Import of Nuclear Material," the NRC stated that it collects the number of shipments and mode of transport for the import and export of shipments containing Category 2 or higher quantities of radioactive material. The NRC stated that it is the agency's position that the current information collected provides the NRC with an understanding of the potential modes of transport for Category 1 and 2 quantities of radioactive material and existing regulatory requirements provide robust protection for all such modes. The NRC stated that it does not consider the proposed additional information collection activity to be of sufficient safety or security benefit to justify the associated regulatory actions it would require. In August 2019, and again in August 2020, the NRC reaffirmed its disagreement with this recommendation and that it did not intend to take action to implement it. Despite its disagreement with this recommendation, we will continue to monitor whether NRC takes any actions that would result in addressing the concern GAO raised.

Recommendation: To determine whether CSA interventions influence motor carrier safety performance, the Secretary of Transportation should direct the FMCSA Administrator to identify and implement, as appropriate, methods to evaluate the effectiveness of individual intervention types or common intervention patterns to obtain more complete, appropriate, and accurate information on the effectiveness of interventions in improving motor carrier safety performance. In identifying and implementing appropriate methods, FMCSA should incorporate accepted practices for designing program effectiveness evaluations, including practices that would enable FMCSA to more confidently attribute changes in carriers' safety behavior to CSA interventions.

Agency: Department of Transportation
Status: Open

Comments: FMCSA has reviewed the methodology for its effectiveness model and identified many of the same limitations GAO discussed in its report. FMCSA also identified several approaches to address these limitations, including modifying its model to measure individual intervention types. However, as of July 2020, FMCSA had not implemented any of its proposed approaches.

Recommendation: To enable FMCSA management to monitor the agency's progress in achieving its effectiveness and efficiency outcomes for CSA interventions and balance priorities, the Secretary of Transportation should direct the FMCSA Administrator to establish and use performance measures to regularly monitor progress toward both FMCSA's effectiveness outcome and its efficiency outcome.

Agency: Department of Transportation
Status: Open

Comments: The Federal Motor Carrier Safety Administration (FMCSA) plans to establish an inventory of effectiveness and efficiency measures and monitor performance on an ongoing basis. FMCSA is working to modify its model to measure the effectiveness of individual intervention types. However, as of July 2020, it had not implemented any of its proposed modifications.

Recommendation: To better ensure that FAMS uses its resources to cover the highest-risk flights, in addition to considering risk when determining how to divide FAMS's international flight coverage resources among international destinations, the Director of FAMS should incorporate risk into FAMS's method for initially setting its annual target numbers of average daily international and domestic flights to cover.

Agency: Department of Homeland Security: Transportation Security Administration: Office of Law Enforcement - Federal Air Marshal Service
Status: Open

Comments: In May 2016, we found that FAMS officials considered risk when selecting specific domestic and international flights to cover, but they did not consider risk when deciding how to initially divide their annual resources between domestic and international flights. Rather, each year FAMS considered two variables--travel budget and number of air marshals--to identify the most efficient way to divide the agency's resources between domestic and international flights. As a result, we recommended that FAMS incorporate risk into FAMS's method for initially setting its annual target numbers of average daily international and domestic flights to cover. In March 2018, FAMS revised its deployment methodology to no longer set an annual target number of average daily international and domestic flights to cover. Rather, FAMS now prioritizes deploying air marshals on as many flights as possible with passengers who have been identified as potentially higher risk because they match TSA's intelligence-based screening rules, among other risk-based priorities. In August 2020, FAMS officials explained that they were evaluating their concept of operations and planned to more fully develop a risk basis for dividing its resources between international and domestic flights. By doing so, FAMS could better ensure it is targeting its limited resources to the highest risk flights and better aligning with FAMS's stated goal of using risk-based decisions to guide mission operations. As a result, this recommendation remains open.