25 of 50 states certified compliance with the national prison sexual abuse standards in FY 2025 — the prison victimization rate has not moved since 2007

What is happening?

An estimated 4.1 percent of people held in state and federal prisons reported being sexually victimized in the prior 12 months, which the Bureau of Justice Statistics converts to about 49,300 people. The survey was fielded from March 2023 to March 2024 and published in December 2025. In local jails the figure was 4.0 percent, about 24,100 people, measured from February 2023 to February 2024. Together that is roughly 73,400 people in a single rolling year.

The prison figure is the fourth in a series and it has not moved. The National Inmate Survey measured 4.5 percent in 2007, 4.4 percent across 2008 and 2009, 4.0 percent across 2011 and 2012, and 4.1 percent across 2023 and 2024, and BJS marks no statistically significant difference among them. Jails went the other way. The three earlier jail rounds were 3.2 percent, 3.1 percent and 3.2 percent, and all three are significantly lower than the 4.0 percent measured in 2023 and 2024.

The standards themselves exist and are detailed. The Prison Rape Elimination Act of 2003 required the Attorney General to write them, and the Department of Justice published the final rule at 77 FR 37106 on 2012-06-20, effective 2012-08-20, covering adult prisons and jails, lockups, community confinement facilities and juvenile facilities. In that same rule the Department stated that PREA does not require state and local facilities to comply with the standards and does not enact a mechanism for the Department to direct or enforce such compliance. The single federal lever is a 5 percent reduction in certain formula grants, released each year by a certification that the governor of the state signs.

Whose problem is this?

The party that grades compliance is the executive branch of the state being graded. Nothing in the process places a federal reviewer between that signature and the money.

Where does this problem end?

The boundary matters here because the rule already exists and only the consequence is missing. What is absent is not a standard and not a measurement but anything that follows from failing either one.

What is the state now, and what should it be?

Now

The penalty, jurisdiction by jurisdiction, FY 2025

That total is computed here from published FY 2025 allocations using the formula the Department of Justice states, against a national state allocation pot of USD 199,222,278. The Department publishes no such total, and the allocation footnote warns that some listed amounts may already be net of a PREA adjustment.

Needs a new measurementthe target state: no source opened here names a victimization rate the system is trying to reach, a maximum acceptable rate, or a date by which anything should change. The statute, the standards, the 2012 rule, the BJS reports and the grant guidance are all silent on a target, so the 4.0 percent of 2011-12 and the 4.1 percent of 2023-24 are not measured against anything.

How big is it?

About 73,400 people at the low end and about 1.95 million at the high end, both as of the 2023-24 survey rounds.

The low end is harm already counted. BJS estimates 49,300 people in prisons and 24,100 in local jails reported sexual victimization in the prior 12 months. Within the prison figure about 28,100 reported victimization by another incarcerated person and about 26,600 by staff, with about 5,400 reporting both. Within the jail figure the split is about 13,200 and about 13,800, with about 2,900 reporting both.

The high end is exposure. The eligible universes were 1,182,587 people in 1,138 state prisons, 168,016 in 202 federal prisons, and 600,474 in 2,844 local jails, which adds to 1,951,077. The gap between the two ends is not uncertainty. One counts injury in a year and the other counts people standing in the space the enforcement lever does not reach. The three parts of the high end stand in different relations to that lever. The state prison population is inside the scope of the certification. The federal prison population is bound by the standards and unreachable by a grant penalty. The jail population is covered by the standards and categorically outside the certification, and it is the one whose rate rose.

Under what conditions does it arise?

1. The standards bind a facility and the penalty lands on a state treasury. A finding of not meeting a standard triggers a 180-day corrective action period and then a final determination from the auditor, and the regulation stops there. The only consequence beyond that is a reduction in formula grants paid to the state, which is a different party with a different budget and a different set of incentives.

2. The penalty is priced far below the behavior it is meant to buy. The Department of Justice estimated in 2012 that compliance would cost USD 468.5 million a year. The reduction it assesses is 3.42 percent of one allocation in its own worked example, and about USD 478,500 across every jurisdiction that declined in FY 2025.

3. The party that takes the test signs the result. The governor certifies. Audits reach one-third of facilities in a year, the governor is required only to consider them, nothing restricts what other information may be used, and no federal review of a certification exists.

4. A large share of the exposed population sits outside the lever by category. The certification covers only facilities under the operational control of the state executive branch. County and city jails are excluded, they held 600,474 people in the survey universe, and the term operational control is undefined in the standards.

What has been tried?

One of these attempts changed the size of the lever rather than the conduct it aims at. The 2016 statute took one grant program out of reach and closed the exit that had let a state answer without certifying, and across the three annual lists opened here the number taking the reduction rose from 3 to 6 to 8 while the number certifying stayed flat at 26, 26 and 25.

What was found?

Why is it still unsolved?

Enforcement absent — the standards are national, the measurement is national, and the only consequence is a fraction of one formula grant, released each year by a signature from the party being measured.

A standard with no consequence is a description. The Department of Justice put both halves of that sentence in the same document in 2012: it published the standards and stated that PREA neither requires state and local facilities to comply with them nor gives the Department a mechanism to direct or enforce compliance. What exists instead is a condition on money. A facility found not to meet a standard gets a 180-day corrective action period and then a final determination from the auditor, and there the regulation stops. No provision escalates from that point. A further audit is available at the expense of the agency being audited, and the auditor it would retain is selected and paid by that same agency under a conflict rule that carves out, by name, compensation for prior and for subsequent PREA audits.

The second part is price. The Department estimated in 2012 that complying nationally would cost about USD 6.9 billion over 2012 through 2026, or USD 468.5 million a year. The penalty for not complying is a 5 percent reduction that the Department itself works out at 3.42 percent of a state allocation, because the mandatory pass-through is carved out before the reduction applies. On a USD 3,000,000 allocation that is USD 102,500. Across the eight jurisdictions that declined in FY 2025 it comes to about USD 478,500 in total, roughly one-thousandth of the annual cost of compliance the Department itself estimated. Declining is not a hard decision when the invoice for refusing sits three orders of magnitude below the invoice for agreeing.

The third part is why the pattern holds rather than merely being weak. The certification is signed by the governor of the state being certified, covers only facilities under the operational control of the state executive branch, and may rest on the one-third of facilities audited that year. The Department has written that the term operational control is not defined in the standards and that the determination is left to the discretion of the governor, so the scope of the lever is set by the person the lever points at. County and city jails fall outside by category, they held 600,474 people in the survey universe, and they are the population whose rate rose. Meanwhile the numbers that describe the problem never meet: about 73,400 people said it happened to them in 2023-24, about 36,264 allegations reached an administrator in 2020, and about 2,351 of those were substantiated. The audit and certification machinery runs on the smallest of the three. A facility can appear on the BJS high-rate list and pass its audit in the same year, and both documents are correct, because they are not measuring the same thing and no rule requires anyone to reconcile them.

What observation would mean it is solved?

Candidates — (a) the measured victimization rate falls across consecutive survey rounds in both prisons and jails (b) every state certifies full compliance and those certifications survive some form of external review (c) a finding of not meeting a standard carries a consequence that does not depend on the audited agency asking for it.

(a) alone is the slowest and the least controllable. Twelve years passed between the third and fourth prevalence measurements, the response rate among people in custody was 55.8 percent in prisons and 44.6 percent in jails, and BJS states that the relative extent of underreporting and false reporting is unknown. A fall in the rate could be a fall, or it could be a change in who answered. The measurement also arrives too rarely to function as feedback on any policy.

(b) alone counts signatures. The certification is self-declared, may rest on one-third of facilities, excludes county and city jails by category, and carries no federal review. Half the states already certify, and the prison rate has not moved across four survey rounds.

(c) alone is closest to the mechanism and still not sufficient. A consequence at the facility level would reach the federal prisons a grant lever cannot touch and the local jails a certification does not cover, but it would still run on administrative records that substantiate about 6.5 percent of allegations. The three have to be read together, and (a) has to be read against the response rate of the round that produced it.

What is it connected to?

Fills with researchimmigration detention under the separate Department of Homeland Security rule, juvenile facilities whose prevalence measure has been dormant since 2018, conditions litigation under 42 U.S.C. 1983 together with the exhaustion requirement of the Prison Litigation Reform Act, and the same pattern of a national standard with no attached remedy in other custodial systems. Relation type and evidence grade were not confirmed in this round.

What these sources do not say

• What an audit actually finds. Every audit report is required to be published by the audited agency, and the public directory indexes 3,804 of them for audits initiated on or after 2022-06-30 — with no count of how many found a facility compliant and no count of how many corrective action periods ended in continued non-compliance. The single number that would say whether the audit system detects anything does not exist in any source opened here.
• Who pays the auditor. The section that sets the audit cycle is silent on cost. The fact is recoverable only from two side clauses, one describing the retention of the auditor by the agency and one allowing a further audit at the expense of the agency. The conflict rule names the carve-out for repeat PREA-audit compensation without ever stating the arrangement that carve-out permits.
• The denominator behind 49,300. The report gives 4.1 percent and 49,300 and never states the population base. The stated eligible universe is 1,350,603, the base implied by the arithmetic is about 1,202,439, and a separate BJS release gives 1,254,200 at yearend 2023. The jail report has no such gap. No note in the prison report addresses it.
• The FY 2026 certification list. As of 2026-08-08 the Department page runs FY 2014 through FY 2025 and stops, and the FY 2026 filename returns 404. That is the first cycle with no assurance option, the year in which the 22 jurisdictions on the FY 2025 emergency-assurance list had to certify or take the reduction, and the statute requires the Attorney General to publish a list of grantees not in compliance no later than September 30 of each year.
• Where the withheld money goes. The allocation footnote says amounts may include a reduction for non-compliance and a bonus for compliance. Neither that footnote nor the grant guidance says whether the withheld share is redistributed to certifying states, held, or returned to the Treasury. A penalty with an unstated destination cannot be evaluated as an incentive.
• What follows from being named a high-rate facility, and from a ranking mandate never met. Seventeen prisons are named for 2023-24, and no statute, regulation or guidance opened here describes any consequence, follow-up, review or reporting obligation triggered by that listing. The status of the Review Panel on Prison Rape could not be verified either, because both departmental paths for it returned 404. PREA also requires an annual report ranking sampled institutions by incidence; BJS states that it cannot produce an exact ranking of all facilities as the statute requires and substitutes a high-rate and low-rate classification, and nothing opened here says what follows from four survey rounds over 19 years without that ranking.
• How the two series relate. About 73,400 self-reported victimizations in 2023-24 stand against 36,264 allegations and 2,351 substantiated incidents in 2020. The BJS activity report says only that estimates from its collections are not directly comparable. Nothing states what the gap means for whether the standards are working, and the enforcement machinery uses only the smaller number.

See the evidence

Most of the documents above were opened directly, and most are government publications rather than second-hand summaries. The two prevalence reports, the administrative-record tables, the data-collection activity report, the 2012 final rule, the statutory chapter and section, two of the audit standards, the grant guidance, the FY 2025 certification list, the FY 2025 allocation table and Public Law 118-71 were all opened as published government documents. Four rows carry no URL because the source could not be reached: the FY 2026 certification list is a 404, the departmental dashboard is a dead host, the consolidated regulation redirects to an access-control page, and the Review Panel pages are 404. Those rows are kept rather than dropped, because three of them are absences that matter to the finding. Two figures here are weaker than the rest and are marked as such rather than smoothed over. The total reduction of about USD 478,500 is arithmetic performed here on published per-jurisdiction allocations using the formula the Department states, it is not a Department total, it excludes reductions under the juvenile justice formula program, and the allocation footnote warns that some listed amounts may already be net of a PREA adjustment. The proposition that no incarcerated person can sue to enforce the standards rests on the structure of the chapter and on the statement of the Department in the 2012 rule, not on a court decision, because no decision was opened this round. Where sources disagree the disagreement is left visible rather than resolved: the prison report states an eligible universe of 1,350,603, its own arithmetic implies a base of about 1,202,439, and a separate BJS release gives 1,254,200 at yearend 2023, with nothing reconciling the three. This is a Path A output (research-based definition), so observation_refs is empty and provenance_mode: press-derived.

People affected

Estimated range 73,400–1,951,077 As of 2023-24

Sensitivity The width is not statistical uncertainty. The low bound counts harm reported in a single 12-month window and the high bound counts people held under the standards, so the two ends answer different questions and neither is a version of the other. What the low bound fails to count: jail turnover, because 600,474 is a single-day population and annual admissions are a large multiple of it, with no sourced admissions figure opened this round; repeat victimization, because the survey asks whether it happened and not how many times; juvenile facilities, lockups and community confinement facilities, which the standards cover and neither survey measures, and whose youth prevalence measure was last fielded in 2018; sexual harassment, which the prevalence survey does not measure at all although the administrative record counts it; people aged 16 and 17, who were sampled and then excluded from all analyses in both reports; and people in facilities that refused or were dropped, including four prisons in one state department of correction, eight prisons in another state, 39 reserve-sample prisons and 63 jails. The limit in the opposite direction is that the high bound counts exposure and not injury, that its two components are anchored three years apart because the prison frame comes from the 2016 Survey of Prison Inmates and the jail frame from the 2019 Census of Jails, and that the prison report never reconciles its own stated universe of 1,350,603 with the base of about 1,202,439 implied by 49,300 at 4.1 percent or with the 1,254,200 that a separate BJS release gives for yearend 2023.

Regional breakdown No source opened this round publishes state-level victimization estimates. BJS publishes facility-level high-rate and low-rate classifications rather than state totals, and states that it cannot produce the facility ranking the statute requires. The annual certification lists are published by jurisdiction, but they record whether a governor certified compliance, not how many people were affected.