What GAO Found The U.S. Department of Agriculture (USDA) has taken few actions to enhance the resilience of farms and forests to the climate-related risks of diseases and pests, and funding and staffing supporting those actions have decreased.In late 2023, USDA officials told GAO that the risks of diseases and pests had not been fully integrated into the department’s climate resilience planning at all levels and that USDA planned to do so in the future. At that time, USDA provided limited information and technical assistance on individual diseases and pests to farmers and land managers. For example, USDA’s Climate Hubs provided some support for research on the effects of climate change on specific diseases and pests and developed models for forecasting potential outbreak risks, including the southern pine beetle. However, key programs that provide information and assistance to farmers and land managers to help manage the climate-related risks of diseases and pests—such as USDA’s Climate Hubs—have lost staff and face planned funding cuts. In April 2026, GAO requested updated information from USDA about the status and impact of these cuts, but the department did not provide the information. Examples of Climate-Related Risks of Diseases and Pests Development and implementation of a national strategy would help USDA enhance the resilience of farms and forests to the climate-related risks of diseases and pests, according to GAO’s analysis of relevant literature and interviews with knowledgeable stakeholders. A nationwide assessment to identify and assess these climate-related risks is a necessary first step to developing a national strategy to enhance resilience to diseases and pests. A national strategy, informed by a nationwide risk assessment, could help USDA direct its resources effectively to ensure that farmers and land managers get the information they need to enhance their resilience. It could also help limit federal fiscal exposure to climate-related risks to the federal crop insurance program and other disaster assistance appropriations. Further, a national strategy could inform congressional decision-making by identifying USDA’s capacity needs to ensure the strategy is implemented effectively. Why GAO Did This Study Diseases and pests have large economic impacts on U.S. natural resources—including agricultural lands and forests. From 1960 through 2020, invasive species, including diseases and pests, cost the U.S. agricultural and forestry sectors at least $550 billion. According to experts, climate change will expand or shift the range of diseases and pests. This creates fiscal exposure—long-term costs and uncertainty regarding future spending—for federal crop insurance and disaster assistance programs. For example, the fiscal year 2024 Analytical Perspectives volume of the President’s Budget—the most recent analysis of the federal crop insurance program’s fiscal exposure to climate change—estimated the federal government could spend an additional $300 million to $2.2 billion annually on crop insurance payments because of changes in the climate. GAO was asked to review federal efforts to enhance the resilience of farms and forests to climate-related risks of diseases and pests. This report examines (1) USDA’s efforts in this area and (2) options to enhance them. GAO reviewed laws, regulations, and agency guidance related to diseases and pests; analyzed literature; interviewed 84 knowledgeable stakeholders including USDA, state, and local officials and academic researchers; and conducted site visits to eight states to observe the impacts of selected diseases and pests.

What GAO Found GAO found that the Federal Emergency Management Agency (FEMA) —a component within the Department of Homeland Security (DHS)— partially followed leading practices for risk assessment and information quality during the development, operation, and maintenance of the National Risk Index (NRI). The figure below lists these practices. FEMA took steps to define and disseminate information about the purpose and scope of the NRI and provided additional information on the methodologies and data used to inform the index. However, FEMA did not consider what information users (e.g., emergency managers) would need to tangibly apply NRI results when making decisions about how to reduce risk. Moreover, FEMA did not explain how users should apply NRI information in conjunction with other FEMA risk tools to generate effective risk insights. Lack of information about how to apply results undermines the NRI’s perceived utility. FEMA took steps to use diverse sources to design the NRI, including consulting relevant sources and subject matter experts. FEMA also followed an established process to verify and validate hazard calculations and risk scores. However, FEMA did not consistently use sensitivity analyses to verify the model’s outputs or inform significant changes to data sources and methodologies. Conducting such analyses would enhance understanding of factors that could affect NRI results, such as methodological choices that could lead to over- or under-estimation of specific aspects of hazard risk. Disclosing results of any such analyses conducted would also enhance user understanding of how those factors could affect risk scoring in their specific circumstances. FEMA established a process to communicate and engage with subject matter experts on future updates to NRI data. However, FEMA does not have an established mechanism to systematically collect ongoing user feedback and use it for continuous NRI improvement. Without such a mechanism, FEMA does not have the information it needs to assess whether the tool provides valuable information to its users to address their hazard mitigation planning needs. Why GAO Did This Study Natural disasters have become more costly and frequent. Jurisdictions can use the NRI to help address disaster risk. It is the only national-level index that combines disaster loss with social vulnerability and community resilience measures to score risk, according to FEMA officials. GAO was asked to review the extent to which FEMA has applied leading practices to the NRI. This report examines leading practices for (1) defining the purpose of risk information; (2) designing a sound model and ensuring information quality; and (3) engaging with relevant stakeholders. GAO consulted federal sources and international standards to develop leading practices for assessing risk. GAO then analyzed FEMA’s actions against these practices. GAO analyzed technical documentation and interviewed FEMA officials to assess practices. GAO also interviewed emergency management stakeholders from select states for user perspectives.

What GAO Found The National Nuclear Security Administration (NNSA)—a separately organized agency within the Department of Energy (DOE)—and its eight contractor-managed and -operated sites engage in Strategic Partnership Projects (SPP). These projects allow NNSA sites to perform work for other federal agencies and nonfederal entities and for those entities to benefit from the significant public investment in the specialized facilities and scientific and technical expertise of NNSA sites. DOE requires NNSA sites to recover the full cost of the SPP through reimbursement from partners. SPP work was generally steady in fiscal years 2019 through 2024, with total reimbursed costs of almost $15 billion in constant fiscal year 2024 dollars. SPP at Sandia National Laboratories accounted for more than half of the total reimbursed costs of NNSA’s SPP, while Kansas City National Security Campus experienced the most growth in SPP during this period, both in costs and the number of SPP. The Department of Defense sponsored the most SPP, and NNSA categorized most SPP as related to national security. Strategic Partnership Projects by Project Type, Fiscal Years 2019 Through 2024 NNSA sites conduct SPP based on capabilities or statute, providing support for mission work or additional benefits. NNSA’s capabilities provide unique opportunities, sometimes otherwise unavailable, to SPP partners. NNSA sites also conduct some SPP due to statutory authorization or the special nature of the relationship between NNSA and the partner organization. SPP can also provide benefits either directly to mission work, operations, or through research insights. Specifically, SPP can provide opportunities for technical staff to enhance their skillsets and SPP partners contribute to facilities and capabilities maintenance. Decreases in NNSA sites’ capacity for SPP could impact NNSA’s and its partners’ ability to achieve their missions and result in NNSA paying more in indirect costs. For example, all nine SPP federal partners GAO interviewed said SPP was essential to their ability to complete their mission. They also said that, in many cases, NNSA’s sites are the only places for specific capabilities. In addition, SPP partners’ funds reduce the indirect costs NNSA must pay for its programs and related facilities. If NNSA needed to decrease its SPP work, NNSA’s costs would increase without the partners’ contributions, site representatives said, because NNSA would carry more of the costs to operate and maintain facilities and infrastructure. Representatives from some sites said they believed they have additional capacity for increases in SPP, while other sites have limited capacity. Why GAO Did This Study NNSA’s eight national laboratories, plants, and sites perform reimbursable work for outside entities through SPP. SPP provide value to both NNSA and its partners by leveraging capabilities that can result in mission-related scientific achievements. In recent years, NNSA’s workload for maintaining and modernizing the nation’s nuclear weapons stockpile has grown substantially, raising concerns about how much capacity NNSA has to conduct SPP. The Senate committee report accompanying the National Defense Authorization Act for Fiscal Year 2025 includes a provision for GAO to review SPP. GAO’s report examines (1) the extent to which NNSA sites have engaged in SPP and how this work may have changed in recent years, (2) why SPP work is conducted at NNSA sites and the impact of SPP activities on the execution of NNSA’s missions, and (3) the potential effects on NNSA facilities and SPP partners should NNSA need to rebalance SPP partnerships. GAO reviewed and analyzed NNSA and contractor data on SPP projects and documentation of SPP processes to determine the extent and nature of recent SPP. GAO conducted five site visits to understand the capabilities used by SPP at the sites. GAO also interviewed NNSA officials, contractor representatives, and SPP partners to discuss the types of SPP and the work’s connection to NNSA’s mission. For more information, contact Allison Bawden at BawdenA@gao.gov.

What GAO Found Based on data provided by the military services, GAO found that the services’ use of intergovernmental support agreements (IGSA) with state, local, and tribal government entities (public partners) for installation-support services increased from 45 across all DOD installations in 2018 to 316 in 2025. Officials from DOD, the Army and Navy, and selected military installations said they intend to promote future IGSA use. However, military services’ estimates of cost savings did not reflect best practices for cost estimation, which raises questions about their completeness and reliability. Further, the military services’ guidance related to estimating costs and cost savings did not include specific guidance for prospective IGSAs that provided multiple services to one or more installations. Selected cost estimates GAO reviewed did not fully consider the scope of services that could be performed at various locations under these agreements. Further, some agreements GAO reviewed did not have associated cost estimates or cost-benefit analyses. Without guidance, the military services may incorrectly estimate IGSA costs and have limited information that would help ensure prospective IGSAs are in the best interests of the military. Further, the Navy, Marine Corps, and Air Force did not have procedures to verify installations’ cost and cost savings estimates or revise them if needed. Without complete information on actual IGSA costs and cost savings, the services cannot verify that estimates reflect actual costs, in line with best practices. Public partners involved in nine of the 21 single-installation IGSAs that GAO reviewed used private contractors to perform some of or all the work. The McNamara-O’Hara Service Contract Act (SCA) requires employees providing services to the federal government to be paid in accordance with prevailing wage rates for such employees in their locality but does not apply to IGSAs. GAO compared minimum wages associated with a nongeneralizable sample of five positions performing work under IGSAs with the minimum wages that may be required for comparable work performed under the SCA. GAO found that the differences between the minimum wages varied. Comparison of Minimum Hourly Wages Offered by Public Partners to Minimum Hourly Wages Required Under the McNamara-O’Hara Service Contract Act (SCA) for Selected Similar Positions Public partner position Public partner wage SCA position SCA wage Percent difference Paralegal $23.92 Paralegal/legal assistant II $28.89 -17 percent Senior accounting/payroll specialist $21.47 Accounting clerk III $21.54 0 percent Driver I $15.36 Shuttle bus driver $18.98 -19 percent EMT transport crewmember $16.37 Emergency medical technician $18.84 -13 percent Stormwater environmental specialist 1 $39.84 Environmental technician $26.64 50 percent Source: GAO analysis of wage data provided from public partners and wage determinations from SAM.gov. | GAO-26-108092 Why GAO Did This Study In 2013, federal law authorized the military services to enter into IGSAs with state, local, and tribal government entities to receive, provide, or share installation-support services, such as utilities and waste management. GAO was asked to examine the military’s use and oversight of IGSAs, and the labor used under these agreements. This report provides information on the military’s use of IGSAs since 2018, the services’ monitoring of IGSA benefits, public partners’ use of contractors for work under IGSAs, and how wages paid under selected IGSAs may compare with those required for comparable work under the SCA. GAO reviewed IGSA-related guidance and analyzed data on IGSA use as of December 2025. Further, GAO reviewed documentation related to 21 IGSAs held by five installations selected based on factors such as military service involved and the number of IGSAs held. GAO also reviewed the cost-benefit analyses associated with 10 IGSAs for multiple services at one or more installations and compared these analyses to best practices for cost estimation. Further, GAO interviewed DOD and local government officials and compared wage information for selected positions under IGSAs to those wages that may be required for other types of agreements under the SCA.

What GAO Found In 2014, the Financial Crimes Enforcement Network (FinCEN)—a federal agency that helps combat financial crimes—issued guidance on how financial institutions can serve cannabis-related businesses (CRB) while complying with Bank Secrecy Act (BSA) requirements. This guidance instructs institutions to gather thorough information on CRB customers and file suspicious activity reports for certain transactions involving CRBs. Federal banking regulators help oversee institutions’ compliance with these requirements through BSA examinations. Financial institutions consider various factors when deciding whether to serve CRBs, according to GAO’s focus groups and interviews. Factors dissuading institutions from serving CRBs include potential legal and regulatory sanctions and the costs of complying with BSA requirements. Conversely, some institutions decide to serve CRBs to meet community needs or as a business opportunity. According to FinCEN data, the number of financial institutions that reported providing services to CRBs increased from 2015 to 2019 and then remained relatively steady through 2024. FinCEN requires institutions to include specific terms when filing suspicious activity reports on transactions involving CRBs. FinCEN data indicate that about 1,000 banks and credit unions filed such reports in 2024. These data do not identify how many institutions accept CRBs as ongoing customers as institutions may not report or may not know they are providing services to CRBs, or they may report providing services to a CRB in an occasional transaction but not accept CRBs as ongoing customers. In addition, some institutions filing these reports may only serve ancillary businesses, not plant-touching businesses that directly grow, manufacture, or sell cannabis. FinCEN Analysis of Numbers of Banks and Credit Unions Filing Selected Suspicious Activity Reports, Fiscal Years 2015–2024 Obtaining and maintaining financial services remain difficult for CRBs, according to CRB owners and managers. For example, CRBs may experience bank account closures, high fees for bank accounts, and high interest rates for business loans. Further, accepting customer payments is difficult largely because two major credit card companies prohibit cannabis purchases. In addition, CRB owners and managers reported that they and their employees face challenges accessing personal financial services due to their work in the cannabis industry. Why GAO Did This Study CRBs include state-licensed businesses that grow, manufacture, or sell cannabis products (plant-touching businesses), as well as businesses that support those operations, such as suppliers of growing equipment or providers of legal services (ancillary businesses). Financial institutions may be reluctant to serve CRBs because, with certain exceptions, cannabis is a controlled substance under federal law. As a result, serving these businesses poses legal risks and triggers ongoing BSA compliance obligations. GAO was asked to review issues related to financial institutions serving CRBs. This report examines (1) the guidance and oversight federal agencies provide to financial institutions on serving state-sanctioned CRBs, (2) factors that affect financial institutions’ decisions about serving CRBs, and (3) challenges CRBs and their employees face in accessing financial services. GAO reviewed relevant agency guidance and documents, obtained FinCEN’s analysis of data on suspicious activity reports for CRB-related transactions filed from 2015 through 2024, and reviewed literature on CRBs’ access to banking. GAO also conducted nine focus groups and 11 interviews involving a total of 74 financial institutions (selected to represent different asset sizes, institution types, and policies on serving CRBs). Participants were the BSA officer or cannabis banking program manager for each institution. GAO also conducted eight focus groups with owners and managers from 51 CRBs (selected to represent different business sizes and types). Finally, GAO interviewed agency officials, financial and cannabis industry associations, and other interest groups (selected for their expertise or public comments on banking CRBs). For more information, contact Courtney LaFountain at lafountainc@gao.gov.

What GAO Found The Department of Homeland Security’s (DHS) Cybersecurity and Infrastructure Security Agency (CISA) is the sector risk management agency (SRMA) for the U.S. chemical sector, responsible for implementing programs to assist facility owners and operators in identifying and mitigating security risks. In 2007, DHS established a regulatory program to mitigate security risks for high-risk chemical facilities. As part of this program, CISA required facilities to vet their personnel and certain unescorted visitors for terrorist ties against the U.S. government’s terrorist watchlist. Vetting against the U.S. terrorist watchlist is an inherently governmental function that the private sector cannot perform on its own; therefore, CISA set up a process with options facilities could use for such vetting. Authorization for the regulatory program lapsed in July 2023. The program, including personnel vetting, was discontinued. High-risk chemical facilities are now responsible for identifying and mitigating their own security risks. According to CISA officials and selected private sector stakeholders GAO interviewed, losing access to the terrorist vetting process is the most significant challenge high-risk facility owners and operators have faced since the discontinuation of CISA’s regulatory program and it has left a gap in chemical facility security that poses substantial risks. The statutory authority that establishes SRMA responsibilities specifies that SRMAs are to implement security programs to assist stakeholders in identifying and mitigating risks to their assets and systems. As of May 2026, CISA said it was exploring whether the agency’s SRMA authority could be used to set up a vetting process. Without federal options for the terrorist vetting of personnel, facility owners and operators lack a critical tool to protect their facilities from an insider terrorist attack and from potential disruptions to critical national supply chains. From fiscal years 2024 to 2025, the number of CISA active personnel dedicated to chemical sector activities declined from 214 (96 percent of authorized positions) to 52 (25 percent of authorized positions). The active personnel did not include full-time personnel scheduled to separate from CISA by the end of calendar year 2025 through deferred resignations programs. CISA said the reductions have necessitated reducing or eliminating services, such as most on-site facility assessments, but also said the agency continues to offer other services, such as security training and cybersecurity guidance. Selected private sector stakeholders told GAO that CISA’s personnel reductions and the loss of experienced staff have reduced their contact with CISA regarding facility security vulnerabilities. Chemical Facility Warehouse and Operations Why GAO Did This Study According to DHS, as of 2025, more than 89 million people lived or worked within 2 miles of a U.S. facility using high-risk chemicals. DHS estimates that should high-risk chemicals be weaponized, it could cause significant harm to surrounding populations, from fatalities within the facility to the equivalent impact of a nuclear explosion. GAO was asked to examine DHS’s efforts to mitigate security risks to the U.S. chemical sector. This report addresses, among other issues, CISA and sector stakeholder assessments of sector security following the discontinuation of a facility regulatory program, effects of the lack of a federal terrorist vetting process for chemical facility personnel, and effects of fiscal year 2025 reductions in CISA personnel on sector support services. GAO reviewed relevant statutes, CISA guidelines and procedures, and CISA data on full-time authorized positions and active agency personnel for fiscal years 2024 and 2025. GAO interviewed CISA officials; conducted site visits to five chemical facilities; and interviewed private sector stakeholders, including representatives from the private sector coordinating council, three industry associations, and six chemical companies.

What GAO Found In April 2025, GAO identified 13 priority recommendations for the Department of State. Since then, State has implemented six of those recommendations, and GAO removed the priority status from two recommendations. In September 2026, GAO identified an additional four priority recommendations, bringing the total to nine. GAO is highlighting the following two areas that warrant timely and focused attention:  Managing fraud risks, and  Strengthening oversight of U.S. security assistance. Addressing GAO’s recommendations in these areas would help determine whether Ukraine used direct budget support funding as intended and support Congressional oversight of U.S. security assistance. Taking action to implement all of GAO’s open priority recommendations would help enhance the efficiency and effectiveness of operations across State. Why GAO Did This Study Priority open recommendations are the GAO recommendations that warrant priority attention from heads of key departments or agencies because their implementation could save large amounts of money; improve congressional or executive branch decision-making on major issues; eliminate mismanagement, fraud, and abuse; or make progress toward addressing a high risk or duplication issue, among other benefits. Since 2015, GAO has sent letters to selected agencies to highlight the importance of implementing such recommendations. For more information, contact Kimberly Gianopoulos at gianopoulosk@gao.gov.

What GAO Found During the rulemaking process, agencies are generally required to issue a notice of proposed rulemaking (NPRM) and seek public comment before issuing a final rule. They can expedite the process and forgo this requirement when they find good cause that the process would be impracticable, unnecessary, or contrary to the public interest. This can occur, for example, when agencies are responding to natural disasters or public health emergencies. Agencies cited good cause reasons for expedited rulemaking for about 71 percent of major interim final rules GAO reviewed and that agencies published between January 20, 2013, and January 20, 2025. This is consistent with GAO’s 2012 report, which found that 77 percent of major rules issued without an NPRM cited good cause for doing so. GAO found that the use of expedited rulemaking increased during the peak of the COVID-19 pandemic in 2020 and 2021. There was little variation in use during non-pandemic years from January 20, 2013, through January 20, 2025, as agencies issued between two and 10 major rules without an NPRM per year. During the pandemic agencies expedited the issuance of 55 rules in response to COVID-19. Agencies cited good cause for 41 of these rules. Number of COVID-19 and Non-COVID-19 Major Rules Reviewed Using Expedited Rulemaking, by Year, Jan. 20, 2013–Jan. 20, 2025 Agencies reported on the economic effects of 66 percent of the rules that GAO reviewed. COVID-19 related rules were less likely to include this information due to the emergency nature of the rules. Agencies requested public comments for 99 percent of the interim final rules that GAO reviewed and received comments on 94 percent of these rules. This is an increase from GAO’s 2012 report which found agencies requested comments for 63 percent of major rules issued without an NPRM. Why GAO Did This Study On average, agencies publish over 2,000 final regulations each year to achieve goals such as ensuring access to food and healthcare services and addressing national emergencies. The Administrative Procedure Act establishes the basic procedural requirements agencies generally must follow when issuing regulations, including providing the public with an opportunity to comment on proposed rules. Public participation can improve the quality of rules, ensure fair treatment, and promote accountability. However, providing for public participation might not be appropriate in every situation before issuing a final rule and agencies may find good cause that notice-and-comment procedures are impracticable, unnecessary, or contrary to the public interest. GAO was asked to provide information on the frequency, reasons, and trends for agencies issuing final rules without an NPRM. This report addresses (1) how frequently agencies found good cause to issue rules without an NPRM; (2) the extent to which the effect of the COVID-19 pandemic led to changes in issuing rules without prior notice-and-comment; and (3) the extent to which agencies assessed the rules’ economic benefits, among other things. GAO reviewed 116 major interim final and 12 direct final rules published between January 20, 2013, and January 20, 2025. GAO also reviewed associated documents for the rules, relevant laws, executive orders, and guidance related to waiving notice-and-comment, and agencies’ use of regulatory flexibility during the pandemic. For more information, contact Lisa Van Arsdale at vanarsdalel@gao.gov.