Survey on the Physical Security of Federal Facilities

U.S. Government Accountability Office

Introduction

	The U.S. Government Accountability Office (GAO), the evaluation arm of Congress, has been asked by Congress to review how agencies approach the physical security of non-military federal facilities that the Federal Protective Service (FPS) is not responsible for protecting. As part of this study, GAO is surveying chief security officers at federal executive branch agencies. The results of this survey, along with other information we obtain during the course of our study, will help inform a written report to Congress. Your participation is essential for us to provide Congress with a comprehensive understanding of physical security at federal facilities that FPS does not protect. Responding to these questions should take about 60 to 90 minutes and can be completed over multiple sittings. Your responses can be saved and accessed at a later date. You may need to consult with your agency's facilities manager or other physical security staff to answer some of the questions. To learn more about completing the questionnaire, printing your responses, and whom to contact if you have questions, click here for help. If you are unsure of how to respond to a question, please contact us for assistance. Important definitions used throughout the survey can also be found here. The results of this survey generally will be provided in summary form in our report. Individual answers may be discussed in the report, but they will not include any information that could be used to identify individuals' or agencies' names. GAO is not authorized to withhold information from Congress or a court. Should we receive a congressional request or court order for information about your individual responses to this survey, we will notify you and provide you an opportunity to express concerns to the requester or court prior to disclosure. Thank you for your time and assistance.

	(View responses)

Section 1: Organization and Administration

1.	Is the Federal Protective Service responsible for ALL aspects of physical security at ALL of the ______ facilities? Facilities refer to buildings located in U.S. states and territories, and includes offices, post offices, hospitals, prisons and detention centers, schools, museums, family housing, dormitories and barracks, warehouses, buildings used for industrial purposes such as for production or manufacturing, buildings used for service activities such as maintenance and repair, buildings that house communication systems, buildings that house aircraft or ship navigation and traffic aids, laboratories, and other institutionally used buildings. Physical security includes but is not limited to conducting threat and risk assessments of facilities, recommending risk-based countermeasures aimed at preventing incidents at facilities, proactively patrolling facilities, responding to incidents, conducting criminal investigations, and exercising arrest authority.

		Yes. The Federal Protective Service is responsible for ALL aspects of physical security at ALL of your agency's facilities. This survey is not applicable to you. (click here to skip to question 41)
		No. The Federal Protective Service is NOT responsible for ALL aspects of physical security at ALL of your agency's facilities. This survey is applicable to you.
	(View responses)

2.	Does the ______ have each of the following?

	a. Organizational components (components are subordinate entities such as bureaus, administrations, or other operating divisions)
		Yes
		No
	b. Regional or district offices that have a supervisory or coordinating role over subordinate facilities in a limited geographic region
		Yes
		No
	(View responses)

	Important note: We understand that physical security practices can vary across agency components, regions or districts, or facilities. For the remaining questions in the survey, unless otherwise noted, please report on the ______ overall practices for all facilities that the Federal Protective Service is not responsible for protecting.

	(View responses)

3.	Which organizational level in the ______ has primary responsibility for each of the following aspects of physical security services? We are interested in the organizational level that is primarily responsible for each of the following. However, you may select more than one response if responsibility is shared equally among levels. For definitions of agency, component, and facility, click here.

	(View responses)

Risk Assessment

Organizational level
(check all that apply):

If other organizational level, please specify:

	Assessing the extent to which a facility is critical to the mission of the agency
	(View responses)

			Agency
			Component
			Region or district
			Facility
			Not applicable; this is not done.
			Other (please specify): →
	(View responses)


	(View responses)

	Determining a facility's risk level by identifying potential threats and vulnerabilities
	(View responses)

			Agency
			Component
			Region or district
			Facility
			Not applicable; this is not done.
			Other (please specify): →
	(View responses)


	(View responses)

Budgeting and resource allocation

Organizational level
(check all that apply):

If other organizational level, please specify:

	Developing the security budget proposal for an individual facility
	(View responses)

			Agency
			Component
			Region or district
			Facility
			Not applicable; this is not done.
			Other (please specify): →
	(View responses)


	(View responses)

	Approving the security budget for an individual facility
	(View responses)

			Agency
			Component
			Region or district
			Facility
			Not applicable; this is not done.
			Other (please specify): →
	(View responses)


	(View responses)

	Making security staffing decisions at individual facilities
	(View responses)

			Agency
			Component
			Region or district
			Facility
			Not applicable; this is not done.
			Other (please specify): →
	(View responses)


	(View responses)

Leveraging technology

Organizational level
(check all that apply):

If other organizational level, please specify:

	Making decisions on the technologies to use to enhance security and mitigate risks at individual facilities
	(View responses)

			Agency
			Component
			Region or district
			Facility
			Not applicable; this is not done.
			Other (please specify): →
	(View responses)


	(View responses)

Strategic human capital management

Organizational level
(check all that apply):

If other organizational level, please specify:

	Allocating security staffing resources across facilities
	(View responses)

			Agency
			Component
			Region or district
			Facility
			Not applicable; this is not done.
			Other (please specify): →
	(View responses)


	(View responses)

	Identifying skills and certifications security guards and security managers must possess
	(View responses)

			Agency
			Component
			Region or district
			Facility
			Not applicable; this is not done.
			Other (please specify): →
	(View responses)


	(View responses)

	Conducting exercises and drills to train security staff
	(View responses)

			Agency
			Component
			Region or district
			Facility
			Not applicable; this is not done.
			Other (please specify): →
	(View responses)


	(View responses)

Monitoring and Oversight

Organizational level
(check all that apply):

If other organizational level, please specify:

	Tracking whether risk assessments of individual facilities have been conducted
	(View responses)

			Agency
			Component
			Region or district
			Facility
			Not applicable; this is not done.
			Other (please specify): →
	(View responses)


	(View responses)

	Comparing risk assessments across facilities
	(View responses)

			Agency
			Component
			Region or district
			Facility
			Not applicable; this is not done.
			Other (please specify): →
	(View responses)


	(View responses)

	Tracking whether countermeasures have been implemented at individual facilities
	(View responses)

			Agency
			Component
			Region or district
			Facility
			Not applicable; this is not done.
			Other (please specify): →
	(View responses)


	(View responses)

	Monitoring the implementation of countermeasures across facilities
	(View responses)

			Agency
			Component
			Region or district
			Facility
			Not applicable; this is not done.
			Other (please specify): →
	(View responses)


	(View responses)

	Using incident data to measure the performance of security programs at individual facilities
	(View responses)

			Agency
			Component
			Region or district
			Facility
			Not applicable; this is not done.
			Other (please specify): →
	(View responses)


	(View responses)

	Assessing whether security policies and procedures at individual facilities are appropriate
	(View responses)

			Agency
			Component
			Region or district
			Facility
			Not applicable; this is not done.
			Other (please specify): →
	(View responses)


	(View responses)

	Monitoring compliance with policies and procedures at individual facilities
	(View responses)

			Agency
			Component
			Region or district
			Facility
			Not applicable; this is not done.
			Other (please specify): →
	(View responses)


	(View responses)

	Testing the skill levels of security personnel
	(View responses)

			Agency
			Component
			Region or district
			Facility
			Not applicable; this is not done.
			Other (please specify): →
	(View responses)


	(View responses)

	Overseeing security contractor performance, if applicable
	(View responses)

			Agency
			Component
			Region or district
			Facility
			Not applicable; this is not done.
			Other (please specify): →
	(View responses)


	(View responses)

Information sharing and coordination of security efforts

Organizational level
(check all that apply):

If other organizational level, please specify:

	Disseminating threat information to security managers at individual facilities
	(View responses)

			Agency
			Component
			Region or district
			Facility
			Not applicable; this is not done.
			Other (please specify): →
	(View responses)


	(View responses)

	Disseminating best practices to security managers at individual facilities
	(View responses)

			Agency
			Component
			Region or district
			Facility
			Not applicable; this is not done.
			Other (please specify): →
	(View responses)


	(View responses)

	Formally coordinating with state and local government agencies
	(View responses)

			Agency
			Component
			Region or district
			Facility
			Not applicable; this is not done.
			Other (please specify): →
	(View responses)


	(View responses)

4.	Please use the space below if you would like to elaborate on how responsibility for physical security services is organized within the ______.

	(View responses)

5.	For which of the following aspects of its physical security services does the ______ have responsibility unified under one manager at the agency level? *(check all that apply)*

		Its risk assessment approach
		Allocating resources based on the results of risk assessments
		Monitoring and oversight of security programs at individual facilities
		Information sharing and coordination of security efforts
	(View responses)

6.	For which of the following aspects of its physical security services does the ______ have documented agency-wide guidelines? *(check all that apply)*

		Its risk assessment approach
		Allocating resources based on the results of risk assessments
		Monitoring and oversight of security programs at individual facilities
		Information sharing and coordination of security efforts
	(View responses)

7.	For which of the following aspects of its physical security services does the ______ provide agency-wide training or exercises? *(check all that apply)*

		Its risk assessment approach
		Allocating resources based on the results of risk assessments
		Monitoring and oversight of security programs at individual facilities
		Information sharing and coordination of security efforts
	(View responses)

8.	If you would like to provide additional comments on the organization and administration of ______ physical security program, please use the box below.

	(View responses)

Section 2: Sources Used to Inform Physical Security Programs

	Important note: We understand that physical security practices can vary across agency components, regions or districts, or facilities. For the remaining questions in the survey, unless otherwise noted, please report on the ______ overall practices for all facilities that the Federal Protective Service is not responsible for protecting.

	(View responses)

9.	Does the ______ use each of the following as a source to inform its physical security program?
	(select one response per row)
	(View responses)

		Yes	No	Don't know
	Federal statutes or regulations specific to your agency (View responses)
	Federal statutes or regulations of broader applicability (View responses)
	Statutes or regulations issued by regional, state, or local authorities (View responses)
	Institutional knowledge or subject matter expertise at your agency regarding physical security (View responses)
	Standards issued by the private sector (e.g., International Standards Organization, American National Standards Institute, ASIS International, etc.) (View responses)
	Standards issued by other federal agencies (e.g., Department of Defense, Department of State, etc.) (View responses)
	Standards issued by the Interagency Security Committee (ISC) (View responses)
	Other (please specify in 9a below): (View responses)

9a.	If use other source, please specify:

	(View responses)

	A design basis threat* is a profile of the type, composition, capabilities, and motivation of an adversary upon which the physical security of a facility is based.*

	(View responses)

10.	If the ______ uses federal statutes or regulations SPECIFIC TO YOUR AGENCY, how does this source inform each of the following aspects of physical security? *(select one response per row)*

		Check box on the left if you do not use or don't know if you use federal statutes or regulations SPECIFIC TO YOUR AGENCY to inform your physical security program, and then
	click here to skip to question 11
	(View responses)

		Largely informs	Somewhat informs	Minimally informs	Does not inform	Don't know
	Identifying aspects of facilities--such as perimeters, entrances, windows, facades, restricted areas, and mail handling--that may need physical security measures (View responses)
	Determining design basis threat (View responses)
	Conducting risk assessments (View responses)
	Determining appropriate countermeasures (View responses)
	Identifying performance measures for physical security (View responses)
	Addressing multi-tenant security situations (e.g., facility security committees) (View responses)
	Determining the core competencies federal security specialists at your agency should possess (View responses)
	Other (please specify in 10a below): (View responses)

10a.	If use for another aspect, please specify:

	(View responses)

11.	If the ______ uses federal statutes or regulations of BROADER APPLICABILITY, how does this source inform each of the following aspects of physical security? *(select one response per row)*

		Check box on the left if you do not use or don't know if you use federal statutes or regulations of BROADER APPLICABILITY to inform your physical security program, and then
	click here to skip to question 12
	(View responses)

		Largely informs	Somewhat informs	Minimally informs	Does not inform	Don't know
	Identifying aspects of facilities--such as perimeters, entrances, windows, facades, restricted areas, and mail handling--that may need physical security measures (View responses)
	Determining design basis threat (View responses)
	Conducting risk assessments (View responses)
	Determining appropriate countermeasures (View responses)
	Identifying performance measures for physical security (View responses)
	Addressing multi-tenant security situations (e.g., facility security committees) (View responses)
	Determining the core competencies federal security specialists at your agency should possess (View responses)
	Other (please specify in 11a below): (View responses)

11a.	If use for another aspect, please specify:

	(View responses)

12.	If the ______ uses STATUTES OR REGULATIONS ISSUED BY REGIONAL, STATE, OR LOCAL AUTHORITIES, how does this source inform each of the following aspects of physical security? *(select one response per row)*

		Check box on the left if you do not use or don't know if you use STATUTES OR REGULATIONS ISSUED BY REGIONAL, STATE, OR LOCAL AUTHORITIES to inform your physical security program, and then
	click here to skip to question 13
	(View responses)

		Largely informs	Somewhat informs	Minimally informs	Does not inform	Don't know
	Identifying aspects of facilities--such as perimeters, entrances, windows, facades, restricted areas, and mail handling--that may need physical security measures (View responses)
	Determining design basis threat (View responses)
	Conducting risk assessments (View responses)
	Determining appropriate countermeasures (View responses)
	Identifying performance measures for physical security (View responses)
	Addressing multi-tenant security situations (e.g., facility security committees) (View responses)
	Determining the core competencies federal security specialists at your agency should possess (View responses)
	Other (please specify in 12a below): (View responses)

12a.	If use for another aspect, please specify:

	(View responses)

13.	If the ______ uses INSTITUTIONAL KNOWLEDGE OR SUBJECT MATTER EXPERTISE AT YOUR AGENCY, how does this source inform each of the following aspects of physical security? *(select one response per row)*

		Check box on the left if you do not use or don't know if you use INSTITUTIONAL KNOWLEDGE OR SUBJECT MATTER EXPERTISE AT YOUR AGENCY to inform your physical security program, and then
	click here to skip to question 14
	(View responses)

		Largely informs	Somewhat informs	Minimally informs	Does not inform	Don't know
	Identifying aspects of facilities--such as perimeters, entrances, windows, facades, restricted areas, and mail handling--that may need physical security measures (View responses)
	Determining design basis threat (View responses)
	Conducting risk assessments (View responses)
	Determining appropriate countermeasures (View responses)
	Identifying performance measures for physical security (View responses)
	Addressing multi-tenant security situations (e.g., facility security committees) (View responses)
	Determining the core competencies federal security specialists at your agency should possess (View responses)
	Other (please specify in 13a below): (View responses)

13a.	If use for another aspect, please specify:

	(View responses)

14.	If the ______ uses STANDARDS ISSUED BY THE PRIVATE SECTOR (e.g., International Standards Organization, ASIS International), how does this source inform each of the following aspects of physical security? *(select one response per row)*

		Check box on the left if you do not use or don't know if you use STANDARDS ISSUED BY THE PRIVATE SECTOR to inform your physical security program, and then
	click here to skip to question 15
	(View responses)

		Largely informs	Somewhat informs	Minimally informs	Does not inform	Don't know
	Identifying aspects of facilities--such as perimeters, entrances, windows, facades, restricted areas, and mail handling--that may need physical security measures (View responses)
	Determining design basis threat (View responses)
	Conducting risk assessments (View responses)
	Determining appropriate countermeasures (View responses)
	Identifying performance measures for physical security (View responses)
	Addressing multi-tenant security situations (e.g., facility security committees) (View responses)
	Determining the core competencies federal security specialists at your agency should possess (View responses)
	Other (please specify in 14a below): (View responses)

14a.	If use for another aspect, please specify:

	(View responses)

15.	If the ______ uses STANDARDS ISSUED BY OTHER FEDERAL AGENCIES (e.g., Department of Defense, Department of State), how does this source inform each of the following aspects of physical security? *(select one response per row)*

		Check box on the left if you do not use or don't know if you use STANDARDS ISSUED BY OTHER FEDERAL AGENCIES to inform your physical security program, and then
	click here to skip to question 16
	(View responses)

		Largely informs	Somewhat informs	Minimally informs	Does not inform	Don't know
	Identifying aspects of facilities--such as perimeters, entrances, windows, facades, restricted areas, and mail handling--that may need physical security measures (View responses)
	Determining design basis threat (View responses)
	Conducting risk assessments (View responses)
	Determining appropriate countermeasures (View responses)
	Identifying performance measures for physical security (View responses)
	Addressing multi-tenant security situations (e.g., facility security committees) (View responses)
	Determining the core competencies federal security specialists at your agency should possess (View responses)
	Other (please specify in 15a below): (View responses)

15a.	If use for another aspect, please specify:

	(View responses)

16.	If the ______ uses ISC STANDARDS, how does this source inform each of the following aspects of physical security? *(select one response per row)*

		Check box on the left if you do not use or don't know if you use ISC STANDARDS to inform your physical security program, and then
	click here to skip to question 18
	(View responses)

		Largely informs	Somewhat informs	Minimally informs	Does not inform	Don't know
	Identifying aspects of facilities--such as perimeters, entrances, windows, facades, restricted areas, and mail handling--that may need physical security measures (View responses)
	Determining design basis threat (View responses)
	Conducting risk assessments (View responses)
	Determining appropriate countermeasures (View responses)
	Identifying performance measures for physical security (View responses)
	Addressing multi-tenant security situations (e.g., facility security committees) (View responses)
	Determining the core competencies federal security specialists at your agency should possess (View responses)
	Other (please specify in 16a below): (View responses)

16a.	If use for another aspect, please specify:

	(View responses)

17.	Which of the following are reasons the ______ uses ISC standards to inform its physical security program for any facility?
	(select one response per row)
	(View responses)

		A reason	Not a reason	Don't know
	The ISC standards are applicable to your agency's work (View responses)
	The ISC standards are straight-forward and clear (View responses)
	Your agency is able to implement the ISC standards on a timely basis (View responses)
	Your agency is able to apply the ISC standards and meet security needs within budget (View responses)
	The ISC standards enable measurable and accountable performance reviews (View responses)
	Your agency is required to use ISC standards (View responses)
	Other (please specify in 17a below): (View responses)

17a.	If other reason, please specify:

	(View responses)

	After answering question 17,

	click here to skip to question 19
	(View responses)

18.	Which of the following are reasons the ______ DOES NOT use ISC standards to inform its physical security program?
	(select one response per row)
	(View responses)

		A reason	Not a reason	Don't know
	Your agency has its own standards (View responses)
	Your agency is not required to use the standards (View responses)
	Your agency is not aware of the standards (View responses)
	The standards lack clarity (View responses)
	The standards lack comprehensiveness (View responses)
	The cost to fully apply the standards is too high (View responses)
	The time to fully apply the standards is too lengthy (View responses)
	The standards lack flexibility to meet your agency's needs (View responses)
	Other (please specify in 18a below): (View responses)

18a.	If other reason, please specify:

	(View responses)

19.	If you would like to provide additional comments on the sources used to inform the ______ physical security program, please use the box below.

	(View responses)

Section 3: Security Program - Policy Elements and Implementation

	Important note: We understand that physical security practices can vary across agency components, regions or districts, or facilities. For the remaining questions in the survey, unless otherwise noted, please report on the ______ overall practices for all facilities that the Federal Protective Service is not responsible for protecting.

	(View responses)

	A. Risk Assessment

	(View responses)

20.	How important, if at all, are each of the following factors when the ______ determines a facility's risk level?
	(select one response per row)
	(View responses)

		Extremely important	Very important	Moderately important	Somewhat important	Not important	Not considered
	Facility population (View responses)
	Facility size (View responses)
	Facility configuration (e.g., access points) (View responses)
	Mission criticality (View responses)
	Location (View responses)
	Consequences of specific undesirable events (e.g., assault, civil disobedience, explosive devices, etc.) (View responses)
	Local crime statistics (View responses)
	Specific threats to agency (View responses)
	Other (please specify in 20a below): (View responses)

20a.	If other factor, please specify:

	(View responses)

21.	The Department of Homeland Security's Interagency Security Committee (ISC) has developed a way to categorize facilities based on 5 risk levels. Approximately what percentage, if any, of the ______ facilities are in each of the following ISC risk levels, and after how many months must a risk assessment be conducted for facilities in each risk level?

	(View responses)

Risk level

Approximately what percentage of facilities are in each of these risk levels?

After how many months must a risk assessment be conducted for facilities in this risk level?

	Level I (Minimum)
	(View responses)

	%
	(View responses)

	months
	(View responses)

	Level II (Low)
	(View responses)

	%
	(View responses)

	months
	(View responses)

	Level III (Medium)
	(View responses)

	%
	(View responses)

	months
	(View responses)

	Level IV (High)
	(View responses)

	%
	(View responses)

	months
	(View responses)

	Level V (Very High)
	(View responses)

	%
	(View responses)

	months
	(View responses)

	No risk level identified
	(View responses)

	%
	(View responses)

	months
	(View responses)

	Risk level other than ISC used to categorize facilities (please respond to question 22 below)
	(View responses)

	%
	(View responses)

	N/A
	(View responses)

22.	If the ______ uses risk levels other than ISC to categorize any of its facilities, what categories does it use, approximately what percentages of its facilities are in each of those categories, and after how many months must a risk assessment be conducted for facilities in each risk level?

		Check box at left if your agency ONLY uses ISC risk levels to categorize its facilities, and then
	click here to skip to question 23
	(View responses)

What is the name of the category?

What is a brief description of this category?

Approximately what percentage of facilities are in each of these risk levels?

After how many months must a risk assessment be conducted for facilities in this risk level?


	(View responses)


	(View responses)

	%
	(View responses)

	months
	(View responses)


	(View responses)


	(View responses)

	%
	(View responses)

	months
	(View responses)


	(View responses)


	(View responses)

	%
	(View responses)

	months
	(View responses)


	(View responses)


	(View responses)

	%
	(View responses)

	months
	(View responses)


	(View responses)


	(View responses)

	%
	(View responses)

	months
	(View responses)


	(View responses)


	(View responses)

	%
	(View responses)

	months
	(View responses)


	(View responses)


	(View responses)

	%
	(View responses)

	months
	(View responses)

23.	If you would like to provide additional comments on the ______ risk assessments, please use the box below.

	(View responses)

	B. Human Capital Management

	(View responses)

24.	Does the ______ employ contract guards for any of its facilities, not including FPS contract guards?

		Yes
		No (click here to skip to question 27)
	(View responses)

25.	Approximately how many contracts does the ______ have that cover guard services? *(Enter number in box below)*
	contracts
	(View responses)

26.	About how many contracts' statements of work specify that the contracting officer's representatives or other agency personnel will use each of the following methods to ensure that the contracted entity has fulfilled its physical security duties?
	(select one response per row)
	(View responses)

		All contracts	Some contracts	No contracts	Don't know
	Review training records and certifications (View responses)
	Conduct on-site inspections (View responses)
	Review each contracted entity's performance evaluations (View responses)
	Other (please specify in 26a below): (View responses)

26a.	If other method, please specify:

	(View responses)

27.	Does the ______ employ federal agency guards or police for any of its facilities, not including FPS guards?

		Yes
		No (click here to skip to question 29)
	(View responses)

28.	To ensure that the federal agency guards or police have fulfilled their physical security duties, does the ______ physical security policies require that it do the following for all, some, or no guards or police?
	(select one response per row)
	(View responses)

		All federal guards or police	Some federal guards or police	No federal guards or police	Don't know
	Review training records and certifications (View responses)
	Conduct on-site inspections (View responses)
	Review each guard's or officer's performance evaluations (View responses)
	Other (please specify in 28a below): (View responses)

28a.	If other method, please specify:

	(View responses)

29.	If you would like to provide additional comments on the ______ human capital management, please use the box below.

	(View responses)

	C. Monitoring and Oversight

	(View responses)

	Performance measures assist in the ongoing monitoring and reporting of program accomplishments, particularly progress toward pre-established goals. Performance measures for security programs could include the number of risk assessments performed versus planned, the number of drills conducted, client/customer satisfaction ratings, or incident response times.

	(View responses)

30.	Approximately what proportion of the ______ physical security performance measures are documented in agency-wide or component-level planning, budget, or performance reports?

		All the performance measures are documented in agency-wide or component-level planning, budget, or performance reports
		Most of the performance measures are documented in agency-wide or component-level planning, budget, or performance reports
		Some of the performance measures are documented in agency-wide or component-level planning, budget, or performance reports
		None of the performance measures are documented in agency-wide or component-level planning, budget, or performance reports (click here to skip to question 32)
		Don't know (click here to skip to question 32)
		Not applicable (click here to skip to question 32)
	(View responses)

31.	Of the physical security performance measures that are documented in the ______ agency-wide or component-level planning, budget, or performance reports, approximately what proportion of the performance measures have specific targets? For example, an agency might have a target of having all alarms during non-public service hours responded to within 20 minutes.

		All performance measures have specific targets
		Most performance measures have specific targets
		Some performance measures have specific targets
		No performance measures have specific targets
		Don't know
		Not applicable
	(View responses)

32.	Which of the following practices related to countermeasures does the ______ employ? *(check all that apply)*

		Establishment of target date for countermeasure implementation and tracking of progress
		Identification of countermeasures whose implementation is most behind in schedule
		Assigning importance values to countermeasures
		Identification of percentage of countermeasures whose implementation is on schedule
		Identification of important changes in status of countermeasure implementation
		Not applicable
		Other (please specify in 32a below)
	(View responses)

32a.	If other practice, please specify:

	(View responses)

33.	How does the ______ assess the effectiveness of countermeasures? *(check all that apply)*

		Your agency tests countermeasures on an established schedule
		Your agency tests countermeasures on a randomly sampled basis
		Your agency tests countermeasures on the basis of established test protocols and desired outcomes
		Not applicable
		Other (please specify in 33a below)
	(View responses)

33a.	If other practice, please specify:

	(View responses)

34.	How does the ______ maintain records on the status of each of the following activities at individual facilities?

	(View responses)

Activity

Records maintained in:
(check all that apply):

If maintained elsewhere, please specify:

	Risk assessments of individual facilities
	(View responses)

	Databases at the:
			Agency level
			Component level
			Regional or district level
			Individual facilities
			Not maintained
			Other (please specify): →
	Paper files at the:
			Agency level
			Component level
			Regional or district level
			Individual facilities
			Not maintained
			Other (please specify): →
	(View responses)


	(View responses)

	Countermeasure implementation at individual facilities
	(View responses)

	Databases at the:
			Agency level
			Component level
			Regional or district level
			Individual facilities
			Not maintained
			Other (please specify): →
	Paper files at the:
			Agency level
			Component level
			Regional or district level
			Individual facilities
			Not maintained
			Other (please specify): →
	(View responses)


	(View responses)

	Results of performance measures at individual facilities
	(View responses)

	Databases at the:
			Agency level
			Component level
			Regional or district level
			Individual facilities
			Not maintained
			Other (please specify): →
	Paper files at the:
			Agency level
			Component level
			Regional or district level
			Individual facilities
			Not maintained
			Other (please specify): →
	(View responses)


	(View responses)

35.	If you would like to provide additional comments on the ______ monitoring and oversight, please use the box below.

	(View responses)

	D. Information Sharing and Coordination of Security Efforts

	(View responses)

36.	Does the ______--including its components, regions or districts, or individual facilities--have written agreements to share information and/or coordinate security efforts with each of the following?

	(View responses)

Entity

Written agreements to:
(check all that apply):

	Local governmental entities including law enforcement agencies
	(View responses)

			Share information on security risks and threats
			Coordinate security efforts (e.g., emergency response)
			Not applicable
	(View responses)

	State governmental entities including law enforcement agencies
	(View responses)

			Share information on security risks and threats
			Coordinate security efforts (e.g., emergency response)
			Not applicable
	(View responses)

	Components within your agency
	(View responses)

			Share information on security risks and threats
			Coordinate security efforts (e.g., emergency response)
			Not applicable
	(View responses)

	Other facility occupants (in multi-tenant situations)
	(View responses)

			Share information on security risks and threats
			Coordinate security efforts (e.g., emergency response)
			Not applicable
	(View responses)

	Federal Protective Service
	(View responses)

			Share information on security risks and threats
			Coordinate security efforts (e.g., emergency response)
			Not applicable
	(View responses)

	Joint Terrorism Task Force
	(View responses)

			Share information on security risks and threats
			Coordinate security efforts (e.g., emergency response)
			Not applicable
	(View responses)

	Other federal agencies
	(View responses)

			Share information on security risks and threats
			Coordinate security efforts (e.g., emergency response)
			Not applicable
	(View responses)

	Other (please specify in 36a below):
	(View responses)

			Share information on security risks and threats
			Coordinate security efforts (e.g., emergency response)
			Not applicable
	(View responses)

36a.	If other entity, please specify:

	(View responses)

37.	If you would like to provide additional comments on the ______ information sharing and coordination of security efforts, please use the box below.

	(View responses)

Section 4: Challenges and Best Practices

	Important note: We understand that physical security practices can vary across agency components, regions or districts, or facilities. For the remaining questions in the survey, unless otherwise noted, please report on the ______ overall practices for all facilities that the Federal Protective Service is not responsible for protecting.

	(View responses)

38.	For facilities the ______ is responsible for protecting, how challenging, if at all, are each the following?
	(Select one response per row)
	(View responses)

		Extremely challenging	Very challenging	Moderately challenging	Somewhat challenging	Not challenging	No opinion
	Physical Security Management Balancing the need for improved security with other operational needs and competing interests (View responses)
	Managing and tracking agencywide funding for physical security (View responses)
	Defining roles and responsibilities for all stakeholders involved in protecting your facilities (View responses)
	Determining the appropriate amount of resources (staff and equipment) needed to protect your facilities (View responses)
	Balancing a multi-year funding process with security needs that can change rapidly (View responses)

		Extremely challenging	Very challenging	Moderately challenging	Somewhat challenging	Not challenging	No opinion
	Risk Assessment and Allocation of Resources Conducting risk assessments (View responses)
	Completing risk assessments at individual facilities with the frequency required by your policies or directives (View responses)
	Obtaining the results of facility risk assessments in their entirety (View responses)
	Conducting risk assessments consistently across all facilities (View responses)
	Comparing risks across facilities (View responses)
	Allocating resources based on results of risk assessments (View responses)
	Tracking the implementation of security recommendations based on risk assessments (View responses)

		Extremely challenging	Very challenging	Moderately challenging	Somewhat challenging	Not challenging	No opinion
	Human Capital Management Training security personnel on security polices/procedures or equipment (View responses)
	Ensuring that security personnel have the appropriate expertise and certifications in physical security (View responses)
	Retaining and developing staff (View responses)
	Managing security personnel (i.e., conducting human capital and performance management activities) (View responses)
	Obtaining funding for security personnel (View responses)

		Extremely challenging	Very challenging	Moderately challenging	Somewhat challenging	Not challenging	No opinion
	Monitoring and Oversight Overseeing security efforts at individual facilities (View responses)
	Evaluating the performance of your agency's security program using assessments, performance measures, and testing (View responses)
	Implementing a central database for capturing and managing physical security information (for example to collect, aggregate, and manage risk assessments; status and progress of countermeasure implementation; and contractor performance) (View responses)

		Extremely challenging	Very challenging	Moderately challenging	Somewhat challenging	Not challenging	No opinion
	Information Sharing and Coordination of Security Efforts Agreeing on countermeasures in multi-tenant facilities (View responses)
	Coordinating security efforts within agency (i.e., across components, regions or districts, and/or facilities) (View responses)
	Sharing threat and risk information within agency (i.e., across components, regions or districts, and/or facilities) (View responses)
	Coordinating security efforts with other federal agencies (View responses)
	Sharing threat and risk information with other federal agencies (View responses)
	Coordinating security efforts and sharing threat and risk information with state and local governments (View responses)

		Extremely challenging	Very challenging	Moderately challenging	Somewhat challenging	Not challenging	No opinion
	Leveraging Technologies Testing security technologies to determine their effectiveness in reducing vulnerabilities (View responses)
	Obtaining funding for security technologies (View responses)
	Evaluating the cost-effectiveness and efficiency of technologies (View responses)
	Obtaining sufficient guidance on security technologies (View responses)

		Extremely challenging	Very challenging	Moderately challenging	Somewhat challenging	Not challenging	No opinion
	Other challenge (please specify in 38 below): (View responses)

38a.	If other challenge, please specify:

	(View responses)

39.	Does the ______ have any best practices that could be used by other agencies to address any of the potential challenges identified in question 38?

	(View responses)

40.	If you would like to provide additional comments on the challenges or best practices related to the ______ physical security program, please use the box below.

	(View responses)

Section 5: Building Portfolio

	Important Note: This section asks questions about the characteristics of buildings that are federally owned, leased from non-federal entities, or otherwise managed. Please consult with facilities management personnel at your agency if necessary. Most of this information should be contained in your agency's submission to the Federal Real Property Profile (FRPP).

	(View responses)

41.	How many buildings did the ______ report as being owned, leased from non-federal entities, or otherwise managed in FY 2011, as reported in the FRPP? Buildings are those located in U.S. states and territories that your agency reported as being owned, leased from non-federal entities, or otherwise managed. Buildings that are otherwise managed are those that are state government-owned, foreign government-owned, or are museum trusts. Buildings include offices, post offices, hospitals, prisons and detention centers, schools, museums, family housing, dormitories and barracks, warehouses, buildings used for industrial purposes such as for production or manufacturing, buildings used for service activities such as maintenance and repair, buildings that house communication systems, buildings that house aircraft or ship navigation and traffic aids, laboratories, and other institutionally used buildings. Please do not include real property classified as land or structures in the FRPP. Please enter a 0 (zero) if your agency does not have any buildings in a category.

	(View responses)

Number of buildings

	a. Owned:
	(View responses)


	(View responses)

	b. Leased from non-federal entities:
	(View responses)


	(View responses)

	c. Otherwise managed:
	(View responses)


	(View responses)

42.	How many of the buildings included in your response to question 41 were used predominantly for each the following purposes in FY 2011? These are the FRPP's predominant use categories for buildings. Please enter a 0 (zero) if your agency does not have any buildings in a category. If you are unable to determine the number of buildings in a category, please check "unable to determine." For a list of the FRPP definitions of each category, click here

	(View responses)

Predominant use

Number of buildings

Unable to determine

	Offices:
	(View responses)


	(View responses)


	(View responses)

	Post Offices:
	(View responses)


	(View responses)


	(View responses)

	Hospitals:
	(View responses)


	(View responses)


	(View responses)

	Prisons and Detention Centers:
	(View responses)


	(View responses)


	(View responses)

	Schools:
	(View responses)


	(View responses)


	(View responses)

	Museums:
	(View responses)


	(View responses)


	(View responses)

	Other Institutional Uses:
	(View responses)


	(View responses)


	(View responses)

	Family Housing:
	(View responses)


	(View responses)


	(View responses)

	Dormitories/Barracks:
	(View responses)


	(View responses)


	(View responses)

	Warehouses:
	(View responses)


	(View responses)


	(View responses)

	Industrial:
	(View responses)


	(View responses)


	(View responses)

	Service:
	(View responses)


	(View responses)


	(View responses)

	Communications Systems:
	(View responses)


	(View responses)


	(View responses)

	Navigation and Traffic Aids:
	(View responses)


	(View responses)


	(View responses)

	Laboratories:
	(View responses)


	(View responses)


	(View responses)

	All Other (please specify in 42a below):
	(View responses)


	(View responses)


	(View responses)

42a.	If other predominant use, please specify:

	(View responses)

43.	Approximately what percentage of the leased buildings included in your response to question 41b (those leased from non-federal entities) also housed non-federal entities in FY11?

		None
		1 to 10 percent
		11 to 20 percent
		21 to 30 percent
		31 to 40 percent
		41 to 50 percent
		51 to 60 percent
		61 to 70 percent
		71 to 80 percent
		81 to 90 percent
		91 to 99 percent
		100 percent
		Unable to determine
	(View responses)

44.	If you would like to provide additional comments on the ______ building portfolio, please use the box below.

	(View responses)

45.	Which ______ official provided responses to this survey?

	(View responses)

	Name: (View responses)
	Title: (View responses)
	Phone: (View responses)
	E-mail: (View responses)