Coast Guard Shore Infrastructure: Processes for Improving Resilience Should Fully Align with DHS Risk Management Framework

The Coast Guard, within DHS, owns or leases more than 20,000 shore facilities such as piers, boat and air stations, and housing units at over 2,700 locations. This infrastructure is often positioned on coastlines where it is vulnerable to damage from extreme weather. Noting the importance of protecting critical infrastructure from such risks, in 2013 DHS updated its risk management guidance for enhancing infrastructure resilience—which is the ability to prepare and plan for, absorb and recover from, or successfully adapt to adverse events.

GAO was asked to review Coast Guard efforts to improve the resilience of its shore infrastructure. This report (1) describes Coast Guard actions to improve shore infrastructure resilience since 2005, and (2) examines the extent to which its processes to improve shore infrastructure resilience follow DHS's key steps for critical infrastructure risk management. GAO reviewed and analyzed Coast Guard guidance and data on assessed infrastructure and interviewed Coast Guard officials. GAO also compared Coast Guard policies, procedures, and actions to manage shore infrastructure against DHS's framework for managing risks to critical infrastructure.

Since 2005, the U.S. Coast Guard's main actions to improve resilience have been to repair or rebuild shore infrastructure to higher building standards after it has been damaged by extreme weather events. The Coast Guard has received more than $2 billion in supplemental appropriations since 2005 to improve resilience after severe storms (see figure). The Coast Guard has also developed new guidance requiring that repairs and new construction meet higher building standards to make it more resilient. Further, in 2015, the Coast Guard began an assessment of certain occupied buildings to identify their vulnerabilities to ten natural hazards, such as hurricanes and earthquakes. As of 2018, this assessment covered approximately 16 percent of the Coast Guard's shore infrastructure. The Coast Guard aims to complete the assessment in 2025.

Coast Guard processes to improve shore infrastructure resilience do not fully align with the Department of Homeland Security's (DHS) key steps for critical infrastructure risk management. These steps are described in DHS's Critical Infrastructure Risk Management Framework, which recommends that DHS components, among other things, identify critical infrastructure, assess risks, and implement risk management activities. While the Coast Guard has identified some vulnerable shore infrastructure through its ongoing assessment, it has not identified all shore assets that may be vulnerable, such as piers and runways; or assessed operational risks affecting its ability to complete missions with these assets. In addition, the Coast Guard has not taken steps to develop mitigation strategies for buildings already identified as vulnerable. Moreover, Coast Guard data show a growing backlog of at least $2.6 billion in recapitalization, new construction, and deferred maintenance projects that compete for finite funding. However, Coast Guard officials were unable to verify that they have consistently selected projects to also enhance resilience. Coast Guard officials stated that they have not used the DHS framework and have instead focused on implementing their ongoing vulnerability assessment. Fully aligning its processes with the DHS framework would better position the Coast Guard to reduce its future fiscal exposure to the effects of extreme weather events.

GAO recommends that the Coast Guard revise its processes for improving shore infrastructure resilience to more fully align with key steps of the DHS critical infrastructure risk management framework. This should include, for example, identifying critical infrastructure, assessing risks, and implementing risk management activities. DHS concurred with our recommendation.

The U.S. Coast Guard, within the Department of Homeland Security  (DHS), is the principal federal agency charged with ensuring the security  and safety of the high seas and other waters subject to U.S. jurisdiction.  To help carry out its missions, the Coast Guard owns or leases more than  20,000 shore facilities—such as piers, boat stations, air facilities, and  housing units—at more than 2,700 locations. However, this infrastructure  is often positioned along the nation’s coastlines and can be vulnerable to  damage from extreme weather and other natural disasters, such as  hurricanes, earthquakes, and tsunamis.

Hurricanes have destroyed or severely damaged multiple Coast Guard  facilities, leaving them unable to support mission objectives. For example,  hurricanes Katrina, Rita, and Wilma in 2005 caused significant damage to  Coast Guard facilities, and repairing this damage required an  appropriation of $266 million. More recent hurricanes, such as Harvey,  Irma, and Maria in 2017 have also severely damaged Coast Guard  facilities. Such events recently prompted Congress to direct the Coast  Guard to identify natural disaster risks and develop a plan to mitigate the  identified risks and improve the resiliency of stations. Further, the effects  of climate change may continue to damage infrastructure in the future and  result in increased costs to the Coast Guard. According to the U.S. Global  Change Research Program’s Fourth National Climate Assessment, the  observed and projected effects of climate change include increases in the  incidence of extremely high temperatures, heavy precipitation events, and  high tide flooding events along the coastline. The assessment states that  such effects are already being felt in the United States and are projected  to intensify in the future.

Over many years, we and others, such as the National Academies of  Sciences, Engineering, and Medicine (National Academies), have  reported on climate change issues. We have recommended enhancing  climate resilience as one strategy to help limit the federal government’s  fiscal exposure to disasters related to climate change. While enhancing  climate resilience can create additional costs up front, it could also reduce  potential future costs resulting from climate-related events. For example,  in a 2018 report, we found that investments in disaster resilience reduced  the damage and costs of subsequent severe weather events such as  hurricanes Harvey, Irma, and Maria. Similarly, the Congressional Budget  Office reported in April 2019 that the federal government could reduce the  damage caused by natural disasters by increasing the stringency of  building codes, by for example, requiring elevated buildings or placing  heating and cooling equipment on roofs in areas that are at risk of  flooding from extreme weather events.

DHS also recognized the importance of protecting critical infrastructure  from these and other risks. In 2013, it updated its National Infrastructure  Protection Plan (NIPP) guidance for critical infrastructure owners and  operators to emphasize security and resilience as the primary aim of  homeland security planning efforts for critical infrastructure. As part of  the NIPP, DHS established a five step risk management framework for  assessing critical infrastructure (DHS Critical Infrastructure Risk  Management Framework) and recommended that owners and operators  of critical infrastructure, whether private or public, use the framework to  identify priorities, articulate clear goals, mitigate risk, measure progress,  and adapt based on feedback and the changing environment.

You requested that we assess Coast Guard actions and processes to  improve the resilience of its shore infrastructure to better manage future  damage from extreme weather events. In this report, we (1) describe  actions the Coast Guard has taken since 2005 to improve the resilience  of its shore infrastructure to natural disasters, and (2) examine the extent  to which Coast Guard processes to improve shore infrastructure  resilience to natural disasters align with key steps from the DHS Critical  Infrastructure Risk Management Framework.

For both objectives, we obtained data from the Coast Guard on the  locations and replacement value of its infrastructure as well as the  scope, methodology, and results of the shore infrastructure vulnerability  assessment the Coast Guard conducted from 2015 through 2018. We  also reviewed our prior work on the Coast Guard’s shore infrastructure  where we examined its Procurement, Construction, and Improvements  backlog of projects from fiscal years 2012 through 2018, as well as its  depot-level maintenance backlog as of March 2018. Where applicable,  we updated that information with the most recent available information for  this report. We assessed the reliability of the Coast Guard’s data by  interviewing agency officials responsible for maintaining these data, and  reviewed documentation, such as database manuals, to understand the  procedures for entering and maintaining the data. We determined that the  data were sufficiently reliable for the purposes of reporting on the  replacement value and locations of Coast Guard infrastructure. For both  objectives, we also reviewed budget documents, such as the  Congressional Budget Justifications for fiscal years 2012 through 2020, to  examine how the Coast Guard budgeted for its Procurement,  Construction, and Improvements funds.

To identify Coast Guard actions since 2005 to improve the resilience of  its shore infrastructure to natural disasters, we reviewed Coast Guard  documents, including guidance on shore facility planning, a study on  Coast Guard resiliency reconstruction efforts following Hurricanes  Katrina, Ike, and Sandy, four annual reports on the Coast Guard’s shore  infrastructure for 2015 through 2018, the Coast Guard’s Congressional  Budget Justifications for fiscal years 2012 through 2020, and related  laws. We also reviewed Coast Guard documentation on building  planning and the restoration of facilities damaged or destroyed by  hurricanes. We interviewed Coast Guard Headquarters and field  officials responsible for civil engineering, risk management, and shore  infrastructure planning. We also interviewed personnel from the Coast  Guard’s Facilities Design and Construction Center, a unit responsible for,  among other things, designing Coast Guard buildings, and ensuring they  comply with relevant buildings codes and engineering standards.

To evaluate the extent to which Coast Guard processes to improve shore  infrastructure resilience to natural disasters align with key steps from the  DHS Critical Infrastructure Risk Management Framework, we analyzed  Coast Guard and DHS guidance, manuals, plans, and studies related to  resilience processes. We verified with Coast Guard officials that these  documents described all elements of the Coast Guard’s processes to  improve shore infrastructure resilience. We also interviewed officials from  Coast Guard Headquarters and the Shore Infrastructure Logistics Center  to obtain their perspectives on Coast Guard actions to improve the  resilience of its shore facilities. We assessed the Coast Guard’s  processes to improve shore infrastructure resilience against the five key  steps of the DHS Critical Infrastructure Risk Management Framework: (1)  set goals and objectives, (2) identify infrastructure, (3) assess and  analyze risks, (4) implement risk management activities, and (5) measure  effectiveness.

We conducted this performance audit from July 2018 to September 2019  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

The Coast Guard owns or leases more than 20,000 shore facilities  consisting of various types of buildings and structures. According to Coast  Guard guidance, a building is generally defined as a fully enclosed  structure that is affixed to the ground, in which personnel work or live, or  where equipment is stored. A structure is generally defined as any other  construction affixed to the ground that does not meet the definition of a  building. The Coast Guard’s shore infrastructure is organized into 13  asset types, known as asset lines. Table 1 provides information on 11 of  these asset lines, including examples, numbers of assets, and their  replacement value as of 2018.

We reported in February 2019 that the Coast Guard faced  recapitalization, new construction, and deferred maintenance backlogs for  its shore infrastructure totaling at least $2.6 billion as of 2018 and that its  backlogs increased by $300 million since fiscal year 2012. Moreover,  according to the Coast Guard Civil Engineering program’s 2018 annual  report, about 46 percent of the Coast Guard’s shore infrastructure was  beyond its overall service life. In 2018, the Coast Guard rated its  overall shore infrastructure condition as a C- based on criteria it derived  from standards developed by the American Society of Civil Engineers.  In addition, some asset lines such as the industrial asset line, whose  assets are generally mission-critical, were rated lower. Table 2 shows  information about Coast Guard asset lines, including the rate at which the  Coast Guard reported that these assets were functioning past their  service life, and the condition grades assigned by the Coast Guard for  fiscal year 2018.

Coast Guard Roles and Processes for Managing Shore Infrastructure

According to Coast Guard guidance, the Office of Civil Engineering and  the Shore Infrastructure Logistics Center each play a role in managing the  Coast Guard’s infrastructure by assessing risks and helping to mitigate  damage from natural disasters or other events. The Office of Civil  Engineering is responsible for setting Coast Guard-wide civil engineering  policy, which includes facility planning, design, construction,  maintenance, and disposal. The Shore Infrastructure Logistics Center is  to establish project priorities for the acquisition, programmed depot  maintenance, major repair, and modification of shore facilities. This center  is also responsible for implementing the Coast Guard’s shore  infrastructure policies.

According to its guidance, the Coast Guard makes procurement,  construction, and improvements funding decisions for its shore  infrastructure through enterprise-level planning boards that meet twice a  year. These planning boards are to prioritize Coast Guard shore  infrastructure needs based on expected appropriations and other  prioritization factors or considerations, such as damage caused by natural  disasters or the Coast Guard’s need to construct new shore infrastructure  or recapitalize existing facilities. The boards are responsible for  evaluating potential shore infrastructure projects that have been  assessed, ranked, and recommended by Coast Guard managers of  various asset lines. For example, aviation asset line managers may  recommend to the planning boards aviation-related shore infrastructure  projects, such as the recapitalization of runways, landing areas, and  hangars.

Climate Change Effects and Extreme Weather

According to the National Academies, climate change poses serious risks  to many of the physical and ecological systems on which society  depends, although the exact details cannot be predicted with certainty.  Moreover, the effects and costs of extreme weather events, such as  floods and droughts, are expected to increase in significance as they  become more common and intense because of climate change. For  example, the National Oceanic and Atmospheric Administration (NOAA)  has reported that eight of the 10 costliest tropical cyclones in U.S. history  occurred in recent years—from 2005 to 2017.

DOD documented seven effects commonly associated with climate  change and their potential effects on its infrastructure and operations (see  table 3). Although the Coast Guard operates on a smaller scale, it  maintains many of the same types of infrastructure as DOD, and these  infrastructure are also situated in coastal and riverine locations, and thus  subject to the same potential effects from extreme weather events. For  example, Coast Guard facilities along the East and Gulf coasts of the  United States are vulnerable to hurricanes—which NOAA projects will  increase in frequency and severity because of climate change—and may  cause flooding or wind damage to Coast Guard infrastructure.

Coast Guard infrastructure is also vulnerable to natural disasters that are  not associated with climate change. For example, Coast Guard facilities  situated on the West Coast, Hawaii and Alaska, are located on or near  historic earthquake fault lines. As a result, this infrastructure is more likely  to be damaged by earthquakes than infrastructure located elsewhere in  the country, according to the Coast Guard.

According to Coast Guard officials, it can take months and sometimes  years to repair or replace Coast Guard facilities damaged by severe  natural disasters. For example, as shown in Figure 1, Coast Guard  facilities at Station Port Aransas in Texas suffered significant damage  during Hurricane Harvey in 2017. As of April 2019, the Coast Guard was  working to demolish these damaged facilities so they could be replaced  by one facility that is resilient to hurricanes.

DHS Critical Infrastructure Risk Management Framework

DHS established its Critical Infrastructure Risk Management Framework  to guide critical infrastructure owners and operators, from both the public  and private sector, in investing limited resources to protect critical  infrastructure. As shown in Figure 2, the framework consists of five  steps that involve (1) setting goals and objectives, (2) identifying  infrastructure, (3) assessing and analyzing risk, (4) implementing risk  management activities, and (5) measuring the effectiveness of actions  taken to address identified risks.

According to DHS, agency decision makers can use this framework to  prioritize investments, develop plans, and allocate resources for critical  infrastructure in a risk-informed way. The framework is based on risk  management activities, which call for cost-effective use of resources by  taking protective actions that offer the greatest mitigation of risk for any  given expenditure. According to the NIPP, a risk management approach  that aligns with the five key steps can help guide organizational decision  making and prioritize actions to more effectively achieve desired  outcomes.

Coast Guard Has Rebuilt Some Damaged Facilities and Is Conducting a Vulnerability Assessment of Selected Buildings

Since 2005, the Coast Guard has taken actions to improve the resilience  of at least 15 storm-damaged shore facilities and has rebuilt them to new  standards largely by using supplemental appropriations provided for this  purpose. The Coast Guard has also developed new guidance to increase  the likelihood that new or recapitalized buildings will withstand natural  disasters and follows updated state and local building codes, which a  senior Coast Guard official told us led to more resilient buildings, thus  limiting risks to Coast Guard personnel and operations. In 2015, the  Coast Guard’s Civil Engineering program initiated a formal assessment of  owned and occupied Coast Guard buildings to determine which were  vulnerable to 10 natural disasters, which, according to agency officials, it  aims to complete in 2025.

Coast Guard Has Received Supplemental Appropriations to Rebuild Some Damaged Facilities

Since 2005, the Coast Guard has taken actions to improve the resilience  of its shore infrastructure, largely by using supplemental appropriations  for rebuilding facilities damaged by major storms. Specifically, from  December 2005 through June 2019, the Coast Guard was appropriated  about $2 billion in supplemental funds to, among other things, rebuild or  relocate 15 facilities damaged by hurricanes. During this time, the Coast  Guard has relocated facilities further inland or to higher ground, upgraded  facilities to be more resilient, and designed new facilities with features to  protect them from natural disasters. The 2016 and 2017 hurricane  seasons were particularly destructive, and the Coast Guard received  $719 million in supplemental funding to restore facilities damaged by  Hurricanes Matthew, Harvey, Irma, and Maria. Figure 3 below shows  Coast Guard shore infrastructure, and associated replacement values,  located along the East and Southeast coasts of the United States and the  general paths of selected hurricanes in those regions since 2005.

The Coast Guard has used supplemental funding to rebuild or relocate at  least 15 damaged facilities to enhance their resilience. To improve the  resilience of its facilities when rebuilding after hurricanes, Coast Guard  officials reported that they generally either relocated the facility inland for  better protection from extreme weather or modified the facility to be more  resilient by elevating it to protect it from storm surge and flooding. For  example:

Station Houston, Texas. After this station was damaged by  Hurricane Ike in 2008, the Coast Guard determined that this station’s  boathouse could not be built above the local floodplain and still meet  mission requirements. As a result, the Coast Guard took steps to  protect the boathouse from future water damage by using water  resistant materials in its construction, elevating its electrical and  telecommunications systems above the flood plain, and placing the  heating, ventilation, and air conditioning systems on the roof of the  building.

Sector Houston-Galveston, Texas. After being damaged by  Hurricane Ike in 2008, this regional command facility was relocated  further inland to provide the new facility with greater protection from  extreme weather. It was also designed to withstand wind speeds of up  to 115 miles per hour.

Station Sandy Hook, New Jersey. After this station was damaged by  Hurricane Sandy in 2012, the old building was demolished and  replaced on the same site with a facility that was designed to be more  resilient. The station’s first floor was constructed with openings to  allow flood waters to pass beneath the station.

Station Sabine Pass, Texas. Following damage by Hurricane Ike in  2008, the Coast Guard rebuilt this station in 2013 to better withstand  floods and high winds (see fig. 4). The new station’s first floor was  elevated to a height that exceeds the projected depth of a 100-year  flood to protect station equipment. The station was also designed to  resist wind speeds up to 130 miles per hour—sufficient to withstand a  Category III hurricane.

The Coast Guard Has Updated Its Guidance to Reflect Higher Building Standards

The Coast Guard has also developed new guidance reflecting higher  building standards, and follows updated state and local building codes  which a senior Coast Guard official told us led to more resilient buildings.  In February 2017, the Coast Guard’s Civil Engineering program issued  engineering planning guidance intended to increase the likelihood that  new or recapitalized buildings would withstand natural disasters and that  the design of these buildings would minimize risks to Coast Guard  operations and personnel, among other things. This new guidance  contains the following requirements:

All new permanent, regularly occupied buildings will either be located  at least 2 feet above the Federal Emergency Management Agency’s  (FEMA) 100-year base flood elevation or meet the level of the 500- year base flood elevation for the proposed site location.

To account for storm surge, sea level rise, or periodic flooding,  buildings may also be constructed above this elevation as  necessary.

To ensure operational continuity and safety after a flood event, critical  building systems—such as utility and communications systems—are  to be located at least 3 feet above the 100-year base flood elevation.

Each site will be evaluated for vulnerability to natural hazards, such as  earthquakes, tornadoes, and wildfires. This evaluation will identify risk  to Coast Guard operations and personnel.

A senior Coast Guard official testified to Congress in November 2017 that  Coast Guard buildings rebuilt after being damaged by Hurricane Ike in  2008 suffered minimal damage from Hurricanes Harvey and Irma. The  official also said that the resilience of these buildings resulted from the  recapitalization efforts that made them more storm-resilient and allowed  them to align the buildings with modern building codes and standards.  Further, according to Coast Guard civil engineering officials, units  impacted by Hurricanes Harvey, Irma and Maria—which had been  recapitalized to resilient standards—returned to full mission capability  within 2 to 3 days and, in some instances, avoided damage or a loss of  mission capability as a result of more resilient construction. For example,  operations at Sector Houston-Galveston, which supports a wide range of  Coast Guard missions, were not interrupted during Hurricane Harvey,  allowing it to serve as the primary federal response hub during this  disaster.

A senior official from the Coast Guard Facilities Design and Construction  Center told us that state and local building codes, which have been  updated as a result of lessons learned from natural disasters, have also  led to more resilient Coast Guard buildings because the Coast Guard is  required to align its facilities standards with these codes. For example,  according to this official, Florida updated its building codes after  Hurricane Andrew in 1992, which resulted in more resilient buildings in  this state.

In December 2018, the Coast Guard Civil Engineering program issued  updated planning guidance for reconstructing facilities damaged by  Hurricanes Matthew, Harvey, Irma, and Maria in 2016 and 2017.  According to this guidance, new and renovated facilities are to  incorporate resilient construction techniques including, but not limited to,  hurricane resistant construction and design, and infrastructure resiliency.  These facilities are to have the ability to return to full operations after an  event, minimizing any major reconstruction and long-term mission impact.  In addition, when the Coast Guard builds a new facility or renovates an  existing one that directly supports Coast Guard natural disaster response  efforts, that facility is to be built to a higher resiliency level to increase the  likelihood that it will remain operational during a natural disaster.

Coast Guard Began Assessing Certain Buildings for Vulnerabilities to Natural Disasters in 2015 and Aims to Complete the Assessment in 2025

In 2015, the Coast Guard’s Civil Engineering program initiated a formal  vulnerability assessment of owned and occupied Coast Guard buildings,  and according to Coast Guard officials they aim to complete this  assessment in 2025. The Coast Guard calls this assessment the Shore  Infrastructure Vulnerability Assessment. According to Coast Guard  documentation, its focus was to determine the vulnerability of these  buildings and Coast Guard personnel to natural disasters. Further, the  assessment results are intended to assist with contingency planning by  identifying which Coast Guard facilities are likely to remain operational  after a natural disaster.

According to its documentation, this vulnerability assessment is to be  completed in two phases. During Phase I, completed in 2018, the Coast  Guard analyzed 3,214 buildings, or approximately 16 percent of its  infrastructure, for vulnerabilities to disasters such as floods, earthquakes,  and hurricanes. To conduct its analysis, Coast Guard officials analyzed  the vulnerability of these buildings to 10 natural disasters using  information from other government agencies and professional  organizations. For example, the Coast Guard assessed its vulnerability to  flooding using FEMA, National Weather Service information, state  sources and websites. This analysis identified Coast Guard-wide  infrastructure vulnerabilities to coastal risks such as shoreline loss,  coastal erosion and earthquakes, as well as tsunami risks on the West  Coast of the United States, Alaska, Guam, and Hawaii, and immediate  and serious flood risks in Puerto Rico and the Gulf and East Coasts. The  Phase I report recommended that Coast Guard units and contingency  planners consider these vulnerabilities when preparing contingency plans  or making capital investments in Coast Guard facilities.

Although the Shore Infrastructure Vulnerability Assessment Phase I  report identified multiple vulnerabilities to sixty-eight percent of the  assessed infrastructure, Coast Guard Civil Engineering program officials  told us they were unable to conclusively determine whether approximately  1,500 assessed buildings were vulnerable to hurricane winds,  earthquakes, or tornadoes—leading officials to conclude that they needed  to conduct further structural analysis. Accordingly, Coast Guard Civil  Engineering program officials initiated plans for Phase II of the  assessment, which involves more detailed structural analyses of 1,500 buildings to determine whether they can withstand either earthquakes or  tornado and hurricane winds, depending on the building.

Since earthquakes strike with essentially no warning, unlike hurricanes  and tornadoes, Coast Guard Civil Engineering program officials told us  that the Coast Guard considered them to be a greater threat to its  personnel and infrastructure. Accordingly, the Coast Guard decided that  Phase II of the assessment would prioritize structural analyses for  buildings it believes to be more susceptible to damage from earthquakes.  Further, it would prioritize the order in which it assesses these buildings  based on how critical the building is to Coast Guard operations, building  occupant density, and the overall age and condition of the building. The  Shore Infrastructure Vulnerability Assessment Phase II analysis began in  September 2018 with a contract for about $700,000 to determine if 15  buildings at multiple Coast Guard sites are vulnerable to earthquakes.  According to the contract, these assessments are to be completed in  October 2021.

Coast Guard Processes to Improve Shore Infrastructure Resilience Do Not Fully Align with Key Steps of DHS’s Critical Infrastructure Risk Management Framework

While the Coast Guard has taken steps to improve the resilience of its  shore infrastructure by rebuilding storm damaged facilities and initiating a  vulnerability assessment, its overarching processes to improve shore  infrastructure resilience are not fully aligned with the five steps of the DHS  Critical Infrastructure Risk Management Framework. As previously  mentioned, DHS established this framework to guide both public and  private resource investment decisions for protecting critical infrastructure.  Its five steps include (1) setting goals and objectives, (2) identifying  infrastructure, (3) assessing and analyzing risk, (4) implementing risk  management activities, and (5) measuring the effectiveness of actions  taken to address identified risks.

According to the first step of the DHS Critical Infrastructure Risk  Management Framework, organizations should define specific goals for  what they intend to accomplish and establish objectives to help them  achieve the goals (see text box). Organizations that establish broad  strategic goals for risk management can also benefit from translating  these goals into specific, measurable objectives to assess the extent to  which its actions actually reduce risk (see text box).

DHS Critical Infrastructure Risk Management Framework—Step 1  Organizations should define specific outcomes, conditions, end points,  or performance targets that collectively describe an effective and  desired risk management posture. By defining risk management goals  and expressing them in terms of the objectives and outcomes the  organization intends to accomplish, stakeholders, including those at all  levels of government and the private sector, would be better able to  tailor their risk management programs and activities to address  infrastructure resilience needs.

Our review of four key Coast Guard documents related to managing its  shore infrastructure showed that some of these documents refer to  resilience and identify it as an important factor to its operational success.  However, none of the documents we reviewed identified a measurable  goal or objective for improving shore infrastructure resilience. Instead, the  documents either include goals related to management of the shore  infrastructure program, or include no goals at all. Specifically:

The Coast Guard Shore Infrastructure Strategic Plan for 2017-2021  includes what it describes as performance and foundational goals,  including a foundational goal for improving resilience, contingency  preparedness, and response to natural hazards. However, the plan  does not link this foundational goal to a specific objective and  performance target that could guide Coast Guard actions to improve  shore infrastructure resilience. For example, an objective could be to  increase the percentage of mission critical buildings that are within or  above base flood elevations by a certain date, and annual targets  could be established to assess progress toward this goal.

The Coast Guard issued its agency-wide strategic plan in November  2018 which states that resilient shore infrastructure is directly  connected to Coast Guard operational readiness and successful  mission execution. The plan further stated that to meet its operational  needs, the Coast Guard will prioritize the repair or replacement of  degraded shore infrastructure that negatively affects operations or  hinders workforce readiness. However, this plan does not identify the  shore infrastructure resilience goals the Coast Guard hopes to  achieve or any objectives to measure progress toward these goals.  Moreover, this plan does not include goals or measures to guide such  prioritization. In February 2019, we reported that Coast Guard  Engineering program officials were not able to provide documents  showing how they had directed field units to prioritize the repair or  replacement of degraded shore infrastructure. In July 2019, the  Coast Guard was able to provide one planning document that was  specifically created to help manage its response to Hurricanes  Harvey, Irma, Maria, and Matthew that included guidance on  improving infrastructure resilience.

Based on our interviews with Coast Guard engineering program and  Shore Infrastructure Logistics Center officials, the Coast Guard is still  in the initial stages of incorporating resilience plans and objectives  into the shore infrastructure program. In July 2019, Civil Engineering  program officials told us that the Coast Guard had updated its Civil  Engineering Strategic Plan to direct its personnel to develop a  communication plan and resource strategy for infrastructure resiliency  projects based on the Shore Infrastructure Vulnerability Assessment’s  Phase II results. The Coast Guard provided us with a copy of this plan  in August 2019, and while this document includes two measures that  can be useful to account for actions taken, it did not include goals or  performance targets to guide the prioritization of resiliency projects,  and Civil Engineering program officials were not able to provide  documents showing how they had made decisions to incorporate  resilience into the repair and replacement of degraded shore  infrastructure.

Coast Guard officials also reported that they had initiated a separate  resilience effort in 2018 at the direction of DHS, which required all  operational components to participate in the development of the 2018  DHS Resilience Framework, and to develop individual component  resilience plans to guide its approach to resilience planning.  According to the Coast Guard, their plan was submitted to DHS in  August 2019. When we discussed this effort with Coast Guard  officials, they were able to provide few details about their efforts and  no documentation about their progress to date. We also discussed  this effort with DHS officials managing the process, but they were not  able to tell us whether this new endeavor will align with or compete for  resources with ongoing Coast Guard assessment processes.

According to the second step of the DHS Critical Infrastructure Risk  Management Framework, organizations should identify infrastructure  assets that are critical for security and national preparedness (see text  box).

DHS Critical Infrastructure Risk Management Framework—Step 2  Organizations should identify assets, systems, and networks that  contribute to critical functionality, and collect information pertinent to  risk management, including analysis of dependencies and  interdependencies. Through this step, it is important to identify assets  that are both nationally significant and those that may not be significant  on a national level but are, nonetheless, important to state, local, or  regional critical infrastructure security and resilience and national  preparedness efforts.

We found that the Coast Guard identified many occupied buildings that  may be important to operations and assessed their vulnerability through  its Shore Infrastructure Vulnerability Assessment process, but this  process did not identify all shore infrastructure assets that are critical to  its missions or screen them for all vulnerabilities. Specifically, through the  Shore Infrastructure Vulnerability Assessment Phase I, the Coast Guard  identified and screened all occupied Coast Guard buildings over 1,000  gross square feet—about 16 percent of all Coast Guard infrastructure— for vulnerabilities to 10 natural disasters. The analysis found that  approximately 68 percent (2,200) of the 3,214 buildings it assessed are  vulnerable to certain natural disasters.

However, the initial screening did not include other mission critical  infrastructure, as the framework recommends, even though the loss of  such structures could also impact its ability to carry out its missions. For  example, the Coast Guard did not include structures in Phase I of the  Shore Infrastructure Vulnerability Assessment, such as aircraft runways,  and therefore has not determined whether such structures are vulnerable  to flooding following a severe storm, or which ones are at greatest risk for  such flooding. Phase II is also not expected to include these assets, as  Civil Engineering program officials stated it is not intended to identify any  additional infrastructure. Rather, in Phase II for example, Civil  Engineering program officials will determine whether roughly 45 percent  of the buildings on the West Coast that were screened in Phase I, are  vulnerable to earthquakes, as the results of Phase I were inconclusive for  these buildings.

This DHS framework step recommends that stakeholders identify assets  and networks that contribute to critical functionality and analyze their  dependencies and interdependencies. The Coast Guard has two such  measures to help identify the criticality of its shore infrastructure for  conducting its missions. The Mission Essentiality Index measure  classifies shore infrastructure assets into one of four tiers based on the  degree to which they are mission critical. Similarly, the Mission  Dependency Index scores building criticality based on how quickly the  loss of utilities would impact operations, and how difficult it would be to  relocate operations in advance of a natural disaster. Coast Guard  officials told us they used Mission Dependency Index scores to help  identify which buildings to include first during Phase II of the Shore  Infrastructure Vulnerability Assessment. However, they did not consider  either of these measures when they conducted the initial screening for  Phase I, which prevented operational risks from being fully considered.  Using this information at the beginning of its Shore Infrastructure  Vulnerability Assessment process could have provided the Coast Guard  with useful information to help it assess its critical infrastructure, as the  DHS framework recommends.

Coast Guard officials stated in July 2019 that they believe that the  mission critical assets collocated with the assessed buildings would have  the same vulnerabilities given their geographic proximity. While this may  be the case for structures that are collocated with assessed buildings,  unoccupied structures (such as piers and runways) may be built with  different requirements and building codes; consequently, they may differ  in the extent of their vulnerabilities to the same natural hazard threats.  Furthermore, the Shore Infrastructure Vulnerability Assessment Phase I  report did not demonstrate the extent to which Coast Guard structure are  collocated with the occupied buildings the Coast Guard analyzed. They  also told us that the Coast Guard has not tracked the performance of its  infrastructure, particularly piers and runways, because it has always been  able to find alternative means to continue operations. However, by  identifying all of its mission critical infrastructure that may be vulnerable to  natural disasters, the Coast Guard would be more fully informed of the  possible scenarios that could affect their capabilities in the event of a  natural disaster, and which infrastructure facilities are most likely to be  affected. Such information could also better position the Coast Guard to  plan for and execute mission operations from alternative locations if  needed.

According to the third step of the DHS Critical Infrastructure Risk  Management Framework, organizations should assess and analyze risks  to understand infrastructure vulnerabilities and threats, as well as the  potential consequences of an incident or known vulnerabilities (see text  box).

DHS Critical Infrastructure Risk Management Framework—Step 3  Organizations should assess and analyze risks, taking into consideration  the potential direct and indirect consequences of an incident, known  vulnerabilities to various potential threats or hazards, and general or  specific threat information. Risks can be assessed in terms of their  likelihood and potential consequences. This step supports an  assessment strategy that results in sound, scenario-based consequence  and vulnerability estimates, as well as an assessment of the likelihood  that the given threat or hazard will occur. Organizations should consider  potential harm to operations and impacts on mission in executing a  critical infrastructure risk management approach.

The Shore Infrastructure Vulnerability Assessment process is the Coast  Guard’s main action to formally assess and analyze its shore  infrastructure, according to Civil Engineering program officials. This  process was intended to help contingency planners anticipate which  infrastructure is likely to remain operational following a natural disaster,  and assist with operational and future capital investment decisions,  according to a senior Coast Guard official. We found that through this  process, the Coast Guard assessed and analyzed certain elements of risk  for its shore infrastructure, such as potential vulnerabilities of certain  infrastructure to multiple natural disasters—information which could help  inform its processes to improve resilience. However, the Coast Guard has  not identified the potential direct and indirect consequences posed by  natural disasters on its infrastructure, or the consequences associated  with its operational risks—that is, risks affecting its ability to carry out its  missions if shore infrastructure is damaged. Specifically:

Through Phase I of the Shore Infrastructure Vulnerability Assessment  process, the Coast Guard determined that its personnel and  operations are generally more vulnerable to certain threats. For  example, Phase I determined that about 880 assessed buildings may  be vulnerable to earthquakes, which according to the Coast Guard,  represent approximately 45 percent of its assessed buildings on the  West Coast. Similarly, it also identified about 800 buildings that may  be vulnerable to tornadoes and approximately 1,000 buildings  vulnerable to hurricanes. However, the Coast Guard has not analyzed  the potential consequences of damage to the infrastructure that it  identified as vulnerable. For example, it has not assessed the  economic losses associated with potential catastrophic disasters,  such as costs for rebuilding assets or taking other actions to respond  to and recover from natural disasters. Additionally, the Coast Guard  has not assessed long-term costs that could result from environmental  damage to its property caused by these events. Without also  determining consequence information, the Coast Guard is not  positioned to provide decision makers with the type of information the  DHS Critical Infrastructure Risk Management Framework  recommends for making cost effective risk management decisions.

As the Coast Guard begins to conduct Phase II, it is unclear whether it  will include information on potential consequences in its assessment.  The Coast Guard initiated Phase II in September 2018 and intends to  assess about 1,500 buildings for vulnerabilities to natural disasters by  2025. Coast Guard officials stated that Phase II would entail following  civil engineering standards for conducting the assessments. These  assessments are expected to entail on-site contractor assessments of  about 1,500 buildings. In 2018, the first year of Phase II, the Coast  Guard contracted for an assessment of 15 buildings, and Shore  Infrastructure Logistics Center officials said they expect this  assessment to be completed in 2021. According to Civil Engineering  program officials, the purpose of Phase II is to understand whether  1,500 buildings identified in Phase I as inconclusive are indeed  vulnerable to certain natural hazards. This information can help Coast  Guard officials better understand the likelihood that vulnerabilities  exist, but the plan for Phase II does not support an assessment  strategy that results in sound, scenario-based consequence and  vulnerability estimates, as well as an assessment of the likelihood that  the given threat or hazard will occur or the operational risks that may  be affected, as this step recommends.

According to the fourth step of the DHS Critical Infrastructure Risk  Management Framework, organizations should implement risk  management activities by evaluating risk reduction methods that consider  countermeasures that result in controlling, accepting, transferring, or  avoiding risks (see text box).

DHS Critical Infrastructure Risk Management Framework—Step 4  Organizations should evaluate risk reduction methods by considering  countermeasures that result in controlling, accepting, transferring, or  avoiding risks. Approaches can include prevention, protection,  mitigation, response, and recovery activities. Ideally, the selection and  implementation of appropriate risk management activities helps to focus  planning, increase coordination, and support effective resource  allocation and incident management decisions.

We found that the Coast Guard identified thousands of infrastructure  vulnerabilities to natural disasters through its Shore Infrastructure  Vulnerability Assessment process, and has contracted for more detailed  structural analyses of the buildings with vulnerabilities that were deemed  inconclusive with respect to seismic and windstorm threats. However, the  Coast Guard has not taken action to mitigate risks for those buildings with  confirmed vulnerabilities. Our analysis of Phase I results showed that of  the 3,214 buildings the Coast Guard analyzed, 32 percent had two or  more identified vulnerabilities and an average Mission Dependency Index  of 34, and 10 percent had three or more identified vulnerabilities with an  average Mission Dependency Index of 38. The average Mission  Dependency Index score for all 3,214 buildings was 30. These results  indicate that the Coast Guard has data on buildings that may be more  vulnerable than others and have relatively greater mission value. Despite  the availability of this information, the Coast Guard has not taken steps to  develop a mitigation strategy for these buildings, as the DHS Critical  Infrastructure Risk Management Framework recommends. Coast Guard  officials stated that they had sufficient information from Phase I about how  their facilities would perform against eight of the ten disasters, so they  elected to further study those buildings with inconclusive results on  earthquakes and wind.

According to the DHS Critical Infrastructure Risk Management  Framework, risk assessments are to inform the selection and  implementation of mitigation activities and the establishment of risk  management priorities for organizations. Effective risk management  activities are comprehensive, coordinated, and cost-effective. The  framework further states that risk management decisions should be made  based on an analysis of the costs and other impacts, as well as the  projected benefits of identified courses of action—including the no-action  alternative if a risk is considered to be effectively managed already.

However, it is unclear whether and to what extent the civil engineering  staff and other decision makers consider the Shore Infrastructure  Vulnerability Assessment results as part of the planning board processes  where decisions are made about which infrastructure projects will be  prioritized for funding. Civil Engineering program officials told us that  hazard mitigation strategies will be employed for buildings determined to  be vulnerable, as the Coast Guard plans and executes major construction  and recapitalization projects through its existing planning board  processes. They also provided us with updated planning board guidance,  issued in March 2019, which directs Coast Guard officials to consider  improving shore infrastructure resilience as a significant factor in the  decision-making process. They also noted that the Coast Guard’s  updated policy described earlier requires compliance with higher building  standards, which helps ensure that newly constructed facilities will be  more resilient than the ones they replace.

Shore Infrastructure Logistics Center officials, however, were unable to  provide us with documentation showing whether and to what extent risk  reduction methods were considered during past planning board  processes. Furthermore, since they are not required to incorporate Shore  Infrastructure Vulnerability Assessment results into future planning board  decisions, it is unclear whether future Coast Guard planning boards will  be focused on addressing the most critical risks, or will consider resilience  as a factor when choosing projects to fund. This is of particular concern  since in at least 5 cases, the Coast Guard’s backlog list for Procurement,  Construction and Improvement projects includes boat stations that the  Coast Guard had previously identified as suitable for closure.

According to step five of the DHS Critical Infrastructure Risk Management  Framework, organizations should use metrics and other evaluation  procedures to measure progress and assess the effectiveness of efforts  to secure and strengthen the resilience of critical infrastructure (see text  box).

DHS Critical Infrastructure Risk Management Framework—Step 5  Organizations should use metrics and other evaluation procedures to  measure progress and assess the effectiveness of efforts to secure and  strengthen the resilience of critical infrastructure. They are an important  step in the critical infrastructure risk management process to enable  assessment of improvements in critical infrastructure security and  resilience.  They provide a basis for accountability, document actual  performance, promote effective management and provide a feedback  mechanism for informed decision making.

We found that the Coast Guard has identified some specific measures,  but they are too narrow to measure the agency’s progress or assess the  effectiveness of its efforts to improve its shore infrastructure resilience.  For example, the Coast Guard established metrics to count the number  and dollar value of certain projects to improve resilience, such as seismic  improvement or floodplain adaptation projects, that the Civil Engineering  program plans and accomplishes each year. While these measures can  be useful to account for actions taken and funds invested in these  particular actions, they do not indicate whether the resilience of Coast  Guard shore infrastructure has improved or is improving as a result of the  actions being measured.

Coast Guard officials told us that they have not used the DHS Critical  Infrastructure Risk Management Framework to guide actions to improve  the resilience of its critical infrastructure because they have instead  focused on implementing the Shore Infrastructure Vulnerability  Assessment to provide them information they intend to use to influence  resource investment decisions in the future. However, without a complete  understanding of the vulnerabilities of its infrastructure and the  consequences to Coast Guard operations if it is damaged, the Coast  Guard risks questionable recapitalization investments for its resilience  when selecting projects to fund from its $2.6 billion maintenance  backlogs. Given that the five steps of the DHS Critical Infrastructure Risk  Management Framework are intended to guide decision making and  prioritize actions to more effectively achieve desired outcomes, having  processes that fully align with the five key steps of the framework would  provide greater assurance that the Coast Guard is investing its shore  infrastructure resources to manage potential damage and expenses from  extreme weather events in the future.

The Coast Guard’s shore infrastructure program includes a range of  facilities and structures that are vital to the agency’s ability to fulfill its  missions, and it constitutes a significant fiscal commitment that requires  ongoing investment to maintain. By nature of their mission and location,  many facilities and structures are vulnerable to potentially catastrophic  natural disasters that are projected to occur more frequently and have  required over $2 billion in supplemental funding over recent years to  replace or repair. The Coast Guard faces the difficult decision of  determining how best to invest its limited resources in improving the  resilience of its shore infrastructure to better manage the costs of  repairing or replacing such infrastructure after natural hazards occur.

DHS’s Critical Infrastructure Risk Management Framework provides a  decision making approach that can help ensure risk-informed resource  investments, but the Coast Guard has not fully aligned its processes for  improving shore infrastructure resilience with any of the five steps  outlined in this framework. The Coast Guard’s Shore Infrastructure  Vulnerability Assessment process is the agency’s main approach to  understanding shore infrastructure vulnerabilities, but this process is  limited in scope and not expected to be completed until at least 2025. For  the Coast Guard’s planning board processes, officials were unable to  verify that they have consistently considered resilience as a significant  factor when selecting projects or that they plan to do so in the future. This  is of particular concern given the current condition of Coast Guard shore  infrastructure and the existing $2.6 billion backlogs of infrastructure  maintenance and recapitalization projects that compete for finite funding.  By fully aligning its processes with DHS’s recommended risk  management framework for critical infrastructure, the Coast Guard would  be better positioned to reduce its future fiscal exposure to the effects of  catastrophic natural disasters.

The Commandant of the Coast Guard should ensure that the Deputy  Commandant for Mission Support implements risk management  processes that more fully align with the five key steps outlined in DHS’s  Critical Infrastructure Risk Management Framework to better guide  agency shore infrastructure investment decisions. This should include (1)  setting goals and objectives, (2) identifying critical infrastructure, (3)  assessing and analyzing risks and costs, (4) implementing risk  management activities, and (5) measuring the effectiveness of actions  taken. (Recommendation 1)

We provided a draft of this report to DHS for review and comment. In its  comments, reproduced in appendix I, DHS concurred with our  recommendation. DHS, through the Coast Guard, also provided technical  comments, which we incorporated as appropriate.

DHS concurred with the intent of our recommendation to formalize its  shore infrastructure risk management processes, and stated that it plans  to make progress towards implementing GAO’s recommendation  concurrently with the development and implementation of its Component  Resilience Plan, in accordance with the recently mandated DHS  Resilience Framework. It intends to complete these efforts by the end of  2021. The Coast Guard also intends to develop, by July 2020, goals and  objectives for measuring the effectiveness of actions taken to identify  resilience readiness gaps and resource needs. We will continue to  monitor these efforts.

We are sending copies of this report to the appropriate congressional  committees, the Secretary of the Department of Homeland Security, and  other interested parties. In addition, the report is available at no charge on  the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact  me at (202) 512-3841 or AndersonN@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix II.

Appendix I: Comments from the Department of Homeland Security

Appendix II: GAO Contact and Staff Acknowledgements

Nathan J. Anderson, (202) 512-3841 or andersonn@gao.gov.

In addition to the contact above, Dawn Hoff (Assistant Director), Landis  Lindsey (Analyst-in-Charge), Michael Armes, John Bauckman, Jason  Berman, Chuck Bausell, Rick Cederholm, Kendall Childers, John  Crawford, Billy Commons, Andrew Curry, Dominick Dale, Elizabeth  Dretsch, Shannon Finnegan, Michele Fejfar, Peter Haderlein, Eric  Hauswirth, Susan Hsu, Michael Pinkham, John Mingus, and Jan  Montgomery, made key contributions to this report.

The Coast Guard has more than 20,000 shore facilities—such as boat stations and piers—that are often vulnerable to damage from natural disasters such as hurricanes and earthquakes.

While the Coast Guard has improved some of its facilities to make them more resilient, it can do more to stay on top of the risk. For example, DHS’s guidance suggests prioritizing projects by how crucial the asset is to the mission. The Coast Guard, however, hasn’t assessed the majority of its infrastructure—including piers, which are mission critical.

We recommended that the Coast Guard improve how it assesses and prioritizes its resilience projects.