The Finding
In March 2025, GAO published Federal Protective Service: Actions Needed to Address Critical Guard Oversight and Information System Problems (opens in a new tab) (GAO-25-108085). The Federal Protective Service (FPS), a Department of Homeland Security (DHS) component, oversees about 13,000 contract guards at about 2,500 federal facilities. GAO examined the Post Tracking System (PTS) that FPS began deploying to guard companies in 2018.
PTS was meant to confirm that a guard is credentialed and on post, capture billable hours, and alert building tenants to shortages. In April 2022 testing, PTS did not complete 782 of 1,487 selected tasks needed to meet system requirements. GAO notes that the count includes duplicates, because a task required for several test cases is counted for each.
GAO made four recommendations. Recommendation 4, a priority recommendation, went to the DHS Chief Information Officer: determine whether to terminate and replace PTS or make corrective actions to the existing system, including a schedule for giving tenants timely communication of guard shortages.
Why It Keeps Happening
FPS built PTS on commercial off-the-shelf software that it configured, and it expected to need only minor changes. GAO reported that FPS stopped updating the system's integrated master schedule in 2021 and is uncertain when PTS will be fully implemented. FPS reported spending about $27 million on development and implementation from fiscal 2013 through 2024.
Daily use is where the gaps show. Of 92 guard contracts, 61 require PTS, yet GAO found none of the contractors can use it as the system of record for validating guard credentials or billing. The paper-based system PTS was built to replace still holds that role. The FPS Help Desk logged about 76,000 requests for technical help in 2022 and 2023, plus over 31,000 requests for waivers so guards could log in.
PTS also does not talk to the systems around it. GAO reported that PTS is not interoperable with those systems, so FPS staff transfer data into it by hand.
Tenants feel it first. Required alerts, including a notice within 5 minutes of a check-in or check-out and a notice when a post is unstaffed during operating hours, are not working reliably. IRS told GAO it closed 30 Taxpayer Assistance Centers for a full day since fiscal 2022 for lack of contract guards. SSA reported 510 instances of closed offices.
Why It Matters to Your Bid
Recommendation 4 asks the DHS CIO for a decision, and decisions need evidence. A prime pursuing FPS or DHS guard-management work, or a DHS modernization task that touches PTS, will face evaluators who have read this report. They know the requirement gap, the manual data handling, and the absence of a tenant-notice schedule.
Expect the technical volume to be read for three things. Evaluators look for an offeror that treats "fix or replace" as a scored choice, not a default to rebuild. They look for a plan that keeps posts verified and billing correct while the change happens, since the paper process is still the record. And they look for reauthorization on the schedule from the start, so the change does not leave a system without an authorization.
An independent assessment gives the agency an unconflicted map. The evidence belongs to DHS, whoever executes the work afterward. This brief names kinds of requirements, not a specific solicitation, and no open FPS solicitation is cited here.
Technical Approach
The method below comes from Avalon's Application Modernization service, scoped to one named system and to the assessment, disposition, and roadmap phases. It describes how the work is done, at the methodology level.
- Baseline the system as it runs. Inventory the PTS application, its configuration and licensing, the contractor-supplied tablets, the PIV sign-in path, and the wireless dependency. Map every interface, including the sources that feed PTS, and mark which transfers are manual. Build a run-cost baseline and review security posture against the current SSP and POA&M.
- Trace the unmet requirements to causes. Take the failed tasks and group each by cause: application defect, configuration, interface, device or network, or process. Remove duplicate counts so the agency sees how many distinct requirements remain unmet.
- Score a disposition per component. Rate each component retain, rehost, replatform, refactor, rearchitect, rebuild, or replace or retire, against mission criticality, technical health, cost, and compliance exposure, with the evidence kept so the CIO can defend the decision. Components may land differently. The answer to GAO can be "correct these, replace those."
- Plan the increments around tenant notice. Build the roadmap as sequenced increments, strangler-fig style, with new services running alongside PTS while the paper record stays in force. Put the 5-minute check-in alert and the unstaffed-post alert early, with rollback criteria at each cutover. Add funding phasing and a reauthorization checkpoint for each change that triggers reassessment under NIST SP 800-37.
- Write the decommission plan now. Cover data retention, license termination, and infrastructure closeout for whatever PTS components retire.
Avalon does not authorize the system or assess it as an independent assessor. The authorizing official decides.
What "Fixed" Looks Like
GAO has not published closure evidence for this recommendation, so these are targets, not GAO criteria.
- A written DHS CIO decision, fix or replace by component, backed by scored evidence and a cost baseline.
- A schedule, with dates, for delivering timely tenant notice of guard shortages.
- A distinct count of unmet requirements, each tied to a cause and an owner.
- Interfaces that no longer depend on manual data transfer, or a dated plan to remove them.
- A reauthorization checkpoint for each change, and a dated point at which PTS can serve as the system of record.
Status Check
Open as of GAO's last update, May 2026. DHS concurred with all four recommendations. For recommendation 4, GAO noted that DHS said in May 2026 it was still determining whether to correct or replace PTS. Recommendations 1 to 3, on FPS covert testing, are also open, and recommendation 3 is a priority recommendation.
Teaming Fit
| Field | Detail |
|---|
| NAICS | 541512, 541511 |
| Avalon's sub role | Single-system application assessment, evidence-scored disposition, and increment roadmap with reauthorization checkpoints under the prime's modernization task |
| Small-business status | Small business; HUBZone (in progress) |
| Likely vehicles | GSA MAS (SIN 54151S IT Professional Services); GSA OASIS+; GSA Alliant 3 |
If FPS or DHS guard-management modernization is in your capture plan, Avalon teams as the sub that turns PTS requirement failures into a scored disposition, a tenant-notice schedule, and a roadmap with reauthorization built in.