GAO: GSA Must Do More on Cybersecurity, Property Management

The Government Accountability Office on Wednesday stressed that while the General Services Administration has done better than the rest of the federal government in implementing recommendations to improve their performance, a number of critical issues remain unresolved.

In a letter to GSA Administrator Emily Murphy, Comptroller General Gene Dodaro commended GSA for its implementation of 92% of recommendations over the last five years, compared to only 77% governmentwide. But Dodaro noted that of five priority recommendations that have been open since February 2018, only two have been heeded.

The report comes at a time when the Trump administration is beginning a push for GSA to take over most of the core duties of the Office of Personnel Management, including protecting federal employees’ and job candidates’ privacy, and administration of federal retirement and health insurance programs. GAO found last week that OPM’s rate of resolving audit recommendations was only 38% over the last five years, well below the governmentwide average.

GSA highlighted four main open recommendations in its report, all focused either on real property management or cybersecurity in federal facilities. One recommendation relates to the effort to consolidate the headquarters of the Homeland Security Department, which GSA indicated it would implement by the end of 2019, but others more broadly affect agencies.

The recommendation with the greatest potential for governmentwide impact is that GSA look for a way to adopt the National Institute of Standards and Technology’s Framework for Improving Critical Infrastructure Cybersecurity at federal facilities. Although GSA has said it planned to recommend “the addition of language” to a fiscal 2018 survey, GAO said more must be done.

“To fully implement this recommendation, GSA, in cooperation with the Department of Homeland Security, should continue to work with respective sector partners, including the Government Coordinating Council, as appropriate, to develop methods for determining the level and type of adoption by entities across the government facilities sector.”

Dodaro stressed that the agency should explore ways to reduce leasing costs by loaning unobligated money from the Federal Buildings Fund to cover improvements needed at newly leased properties, which typically are funded via financing.

“GSA . . . indicated that loaning unobligated Federal Buildings Fund balances to agencies to cover tenants’ improvement expenses could reduce lease costs to tenant agencies,” GAO wrote. “However, it has indicated that making such loans would have to be weighed against competing priorities and require additional legislative authority.”

GAO analysts stressed that if the agency can find a way to implement this practice “safely,” it should develop a plan for Congress to consider.

“We confirmed in November 2018 that GSA had not yet developed the legislative proposal,” GAO wrote.

GSA also has not acted to fully implement a recommendation calling for a tool to examine the “total costs” associated with design choices in some new federal buildings.

“While GSA has updated its procedures for planning, designing and constructing new buildings to further consider operations and maintenance when making design choices, it has yet to develop a tool for estimating the costs of those choices,” GAO wrote.

Although GSA’s strong record of implementing GAO recommendations over the last five years could be auspicious in the event that the OPM-GSA merger goes forward, stakeholders have raised concerns that GSA’s practices may not be directly applicable, as GSA’s focus is on properties and transactions, while OPM performs a variety of human resources functions.