prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 1.

Report 1: Cybersecurity incidents continue to impact federal entities and the information they maintain  According to OMB’s 2018 annual FISMA report to Congress, agencies reported 35,277 information security incidents to DHS’s U S  Computer Emergency Readiness Team (US-CERT) in fiscal year 2017  As shown in figure 1, these incidents involved threat vectors, such as web-based attacks, phishing attacks, and the loss or theft of computer equipment, among others  These incidents and others like them can pose a serious challenge to economic, national, and personal privacy and security  The following examples highlight the impact of such incidents: In March 2018, the Department of Justice reported that it had indicted nine Iranians for conducting a massive cybersecurity theft campaign on behalf of the Islamic Revolutionary Guard Corps  According to the department, the Iranians allegedly stole more than 31 terabytes of documents and data from more than 140 American universities, 30 U S  companies, and 5 federal government agencies, among other entities  In March 2018, a joint alert from DHS and the Federal Bureau of Investigation stated that, since at least March 2016, Russian government actors had targeted U S  government entities and critical infrastructure sectors, including the energy, nuclear, water, aviation, and critical manufacturing sectors  In June 2015, the Office of Personnel Management reported that an intrusion into its systems had affected the personnel records of about 4 2 million current and former federal employees  Then, in July 2015, the agency reported that a separate but related incident had compromised its systems and the files related to background investigations for at least 21 5 million individuals  The federal approach and strategy for securing information systems is prescribed by federal law and policy  FISMA sets requirements for effectively securing federal systems and information  In addition, the Federal Cybersecurity Enhancement Act of 2015 requires protecting federal networks through the use of federal intrusion prevention and detection capabilities  Further, Executive Order 13800, Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure, directs agencies to manage cybersecurity risks to the federal enterprise by, among other things, using the NIST Framework for Improving Critical Infrastructure Cybersecurity (cybersecurity framework)  FISMA was enacted to improve federal cybersecurity and clarify government-wide responsibilities  The law is intended to provide for improved oversight of federal agencies’ information security programs  Specifically, the law provides a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support federal operations and assets  The law is also intended to ensure the effective oversight of information security risks, including those throughout civilian, national security, and law enforcement agencies  FISMA assigns OMB and DHS oversight roles in ensuring federal agencies’ compliance with the law  Among other things, FISMA requires OMB to develop and oversee the implementation of policies, principles, standards, and guidelines on information security in federal agencies, except with regard to national security systems  The law also assigns OMB the responsibility of requiring agencies to identify and provide information security protections commensurate with assessments of risk to their information and information systems  The law further requires DHS to administer the implementation of agency information security policies and practices for non-national security information systems, in consultation with OMB, by developing, issuing, and overseeing implementation of binding operational directives; monitoring agency implementation of information security policies and practices; and convening meetings with senior agency officials to help ensure their effective implementation of information security policies and practices, among other things  FISMA assigned to NIST the responsibility for developing standards and guidelines that include minimum information security requirements  To this end, NIST has issued several publications to provide guidance for agencies in implementing an information security program  For example, NIST Special Publication (SP) 800-53 provides guidance to agencies on the selection and implementation of information security and privacy controls for systems  FISMA also assigns to the head of each executive branch agency, responsibility for providing information security protections commensurate with the risk and magnitude of harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency  The law also delegates to the agency chief information officer (CIO), or comparable official, the authority to ensure compliance with FISMA requirements  The CIO is responsible for designating a senior agency information security officer whose primary duty is information security  In addition, the law requires agencies to develop, document, and implement an agency-wide information security program to secure federal information systems  Specifically, these information security programs are to provide risk-based protections for the information and information systems that support the operations and assets of the agency  Further, FISMA requires agencies to comply with DHS binding operational directives, OMB policies and procedures, and NIST federal information processing standards  FISMA also has reporting requirements for OMB and federal agencies  Specifically, OMB is to report annually, in consultation with DHS, on the effectiveness of agency information security policies and practices, including a summary of major agency information security incidents and an assessment of agency compliance with NIST standards  Further, the law requires agencies to report annually to OMB, DHS, certain congressional committees, and the Comptroller General of the United States on the adequacy and effectiveness of their information security policies, procedures, and practices, as well as their compliance with FISMA  The Federal Cybersecurity Enhancement Act of 2015, among other things, sets forth authority for enhancing federal intrusion prevention and detection capabilities among federal entities  The act contains several provisions for DHS and OMB  Specifically, the act requires that DHS deploy, operate, and maintain capabilities to prevent and detect cybersecurity risks in network traffic traveling to or from an agency’s information system  DHS is to make these capabilities available for use by any agency  In addition, the act requires DHS to improve intrusion detection and prevention capabilities, as appropriate, by regularly deploying new technologies and modifying existing technologies  The act also requires OMB and DHS, in consultation with appropriate agencies, to review and update government-wide policies and programs to ensure appropriate prioritization and use of network security monitoring tools within agency networks, and to brief appropriate congressional committees  In May 2017, the President signed Executive Order 13800, which sets policy for managing cybersecurity risk as an executive branch enterprise  Specifically, it outlines actions to enhance cybersecurity across federal agencies and critical infrastructure to improve the nation’s cyber posture and capabilities against cybersecurity threats  To this end, the order states that the President will hold executive agency heads accountable for managing agency-wide cybersecurity risk and directs each executive agency to use the NIST cybersecurity framework to manage those risks  The cybersecurity framework, which provides guidance for cybersecurity activities, is based on five core security functions: Identify: Develop an organizational understanding to manage cybersecurity risk to systems, people, assets, data, and capabilities  Protect: Develop and implement appropriate safeguards to ensure delivery of critical services  Detect: Develop and implement appropriate activities to identify the occurrence of a cybersecurity event  Respond: Develop and implement appropriate activities to take action regarding a detected cybersecurity incident  Recover: Develop and implement appropriate activities to maintain plans for resilience and to restore capabilities or services that were impaired due to a cybersecurity incident  According to NIST, these five functions should be performed concurrently and continuously to address cybersecurity risk  In addition, when considered together, they provide a high-level, strategic view of the life cycle of an organization’s management of cybersecurity risk  Within the five functions are 23 categories and 108 subcategories that include controls for achieving the intent of each function  Appendix II provides a description of the cybersecurity framework categories and subcategories of controls  In February 2013, we reported that the government had issued a variety of strategy-related documents that addressed priorities for enhancing cybersecurity within the federal government, as well as for encouraging improvements in the cybersecurity of critical infrastructure within the private sector  However, we noted that no overarching cybersecurity strategy had been developed that articulated priority actions, assigned responsibilities for performing them, and set time frames for their completion  Accordingly, we recommended that the White House Cybersecurity Coordinator in the Executive Office of the President develop an overarching federal cybersecurity strategy that included all key elements of the desirable characteristics of a national strategy  These characteristics would include, among other things, milestones and performance measures for major activities to address stated priorities; cost and resources needed to accomplish stated priorities; and specific roles and responsibilities of federal organizations related to the strategy’s stated priorities  Since that time, the executive branch has made progress toward outlining a federal strategy for confronting cyber threats  For example, in September 2018, we reported that recent executive branch initiatives that identify cybersecurity priorities for the federal government provide a good foundation toward establishing a more comprehensive strategy  Nevertheless, we pointed out that additional efforts were needed to address all of the desirable characteristics of a national strategy that we recommended  Specifically, recently issued executive branch strategy documents did not include key elements of desirable characteristics that can enhance the usefulness of a national strategy as guidance for decision makers in allocating resources, defining policies, and helping to ensure accountability  For example, these strategy documents did not generally include: milestones and performance measures to gauge results; resources needed to carry out the goals and objectives; and clearly defined roles and responsibilities for key agencies, such as DHS, the Department of Defense, and OMB  Ultimately, we determined that a more clearly defined, coordinated, and comprehensive approach to planning and executing an overall strategy would likely lead to significant progress in furthering strategic goals and lessening persistent weaknesses  Subsequent to our September 2018 report, the President issued the National Cyber Strategy on September 20, 2018  The strategy builds upon Executive Order 13800 and describes actions that federal agencies and the administration are to take to, among other things, secure federal information systems  For example, the strategy states that the administration is expected to further enable DHS to secure federal department and agency networks, to include ensuring that DHS has appropriate access to agency information systems for cybersecurity purposes and can take and direct action to safeguard systems  In addition, the strategy states that the administration plans to continue with its existing efforts underway to transition agencies to shared services and infrastructure and that DHS is to have appropriate visibility into those services and infrastructure to improve cybersecurity posture  DHS’s Network Security Deployment (NSD) division manages cybersecurity programs that are intended to improve the cybersecurity posture of the federal government  Among these programs, NCPS provides a capability to detect and prevent potentially malicious network traffic from entering agencies’ networks  In addition, the Continuous Diagnostics and Mitigation (CDM) program provides tools to agencies intended to identify and resolve cyber vulnerabilities on an ongoing basis  Operated by DHS’s US-CERT, NCPS is intended to detect and prevent cyber intrusions into agency networks, analyze network data for trends and anomalous data, and share information with agencies on cyber threats and incidents  Deployed in stages, this system, operationally known as EINSTEIN, has provided increasing capabilities to detect and prevent potential cyberattacks involving the network traffic entering or exiting the networks of participating federal agencies  Table 1 provides an overview of the EINSTEIN deployment stages to date  In January 2016, we reported the projected total life-cycle cost of the program was approximately $5 7 billion through fiscal year 2018  In addition, according to the Federal CIO, Congress appropriated $468 million in fiscal year 2017 and $402 million in fiscal year 2018 for NCPS  In that report, we also noted that NCPS was partially, but not fully, meeting most of its stated system objectives  Although the system’s intrusion detection capabilities provided the ability to detect known patterns of malicious activity on agency networks, it was limited in its capabilities to identify potential threats using anomaly-based detection  We also reported that although DHS had developed metrics for measuring the performance of NCPS, the metrics did not gauge the quality, accuracy, or effectiveness of the system’s intrusion detection and prevention capabilities  The department had also identified needs for future capabilities, but had not defined requirements for the capability to detect threats entering and exiting cloud service providers  Further, DHS had not considered specific vulnerability information for agency information systems in making risk- based decisions about future intrusion prevention capabilities  Accordingly, we made nine recommendations to DHS to, among other things, enhance the NCPS capabilities for meeting its objectives and better define requirements for future capabilities  DHS agreed with each of our nine recommendations and indicated that it would take steps to address them  DHS’s CDM program provides federal agencies with tools and services that have the intended capability to automate network monitoring, correlate and analyze security-related information, and enhance risk- based decision making at agency and government-wide levels  These tools include sensors that perform automated scans or searches for known cyber vulnerabilities, the results of which can feed into a dashboard that, at an agency level, is intended to alert network managers and enable the agency to allocate resources based on the risk  Summary data from each participating agency’s dashboard is expected to be transmitted to the Federal Dashboard where the data can be used to inform decisions about cybersecurity risks across the federal government  There are four phases of CDM implementation: Phase 1—involves deploying products to automate hardware and software asset management, configuration settings, and common vulnerability management capabilities  According to the Cybersecurity Strategy and Implementation Plan, DHS purchased phase 1 tools and integration services for all participating agencies in fiscal year 2015  DHS plans to have all phase 1 tools deployed at participating agencies by the end of the second quarter of fiscal year 2019  Phase 2—intends to address privilege management and infrastructure integrity by allowing agencies to monitor users on their networks and to detect whether users are engaging in unauthorized activity  According to the Cybersecurity Strategy and Implementation Plan, DHS was to provide agencies with additional phase 2 capabilities throughout fiscal year 2016, with the full suite of CDM phase 2 capabilities delivered by the end of that fiscal year  However, according to the OMB FISMA Annual Report to Congress for Fiscal Year 2017, the CDM program began deploying Phase 2 tools and sensors during fiscal year 2017  DHS plans to have all phase 2 tools deployed at participating agencies by the end of fiscal year 2019  Phase 3—includes detection capabilities that are intended to assess agency network activity and identify any anomalies that may indicate a cybersecurity compromise  Full operating capability for phases 1, 2, and 3 is planned to be achieved by the end of fiscal year 2022  Phase 4—intends to provide tools to (1) protect data at rest, in transit, and in use; (2) prevent loss of data; and (3) manage and mitigate data breaches  According to CDM program officials, phase 4 has not been approved and no tools have been selected  An approach for protecting systems against cybersecurity compromise is for federal agencies to build successive layers of defense mechanisms at strategic points in their information technology infrastructures  This approach, commonly referred to as defense in depth, entails implementing a series of protective mechanisms so that if one mechanism fails to detect and prevent an attack, another will provide a backup defense  By utilizing defense in depth, federal agencies can reduce the risk of a successful cyberattack by implementing intrusion detection and prevention capabilities  NIST has developed guidelines for protecting agency information systems using intrusion detection and prevention capabilities  For example, NIST SP 800-53 recommends that agencies strategically deploy capabilities and perform monitoring of their systems to include observation of events occurring on their network and at the external boundary of their network  In addition, NIST SP 800-94 provides agencies with guidance in designing, implementing, configuring, securing, monitoring, and maintaining such capabilities  As part of their defense-in-depth approach and, as recommended by the NIST guidelines, agencies can deploy the following list of capabilities, among others, on their networks to detect and prevent an attack: Protecting email from intrusions: According to OMB, email, by way of phishing attacks, remains one of the most common threat vectors across the government  Methods for protecting email include encryption, false email alerts, and anti-spear-phishing training  Monitoring cloud services: Cloud vendors provide services to agencies, including Software as a Service, Platform as a Service, and Infrastructure as a Service  As agencies increasingly rely on cloud services, monitoring traffic to and from their cloud service providers helps to ensure that agencies detect malicious traffic  Using host-based intrusion prevention: Host-based intrusion prevention systems provide defense at an individual system or device level by protecting against malicious activities  Host-based capabilities include memory-based protection and application whitelisting  Monitoring external and internal traffic: Agencies can monitor external and internal traffic, including: encrypted traffic, traffic between workstations and servers on the network, and direct connections to outside entities such as universities  Monitoring traffic helps to ensure that agencies detect malicious activity  Using security information and event management: A security information and event management capability produces real-time alerts and notifications of significant security events  Security alerts and notifications can provide the agency with better situational awareness regarding possible intrusion activity  According to inspectors general, agency CIOs, and OMB reports on federal information security practices, many agencies were not effectively implementing the federal government’s approach and strategy to securing information systems as of fiscal year 2017  Agencies’ inspectors general determined that most of the 23 civilian CFO Act agencies did not have effective agency-wide information security programs  They also reported that agencies did not have effective information security controls in place, leading to deficiencies in internal control over financial reporting  In addition, the CIOs demonstrated that, during fiscal years 2016 and 2017, most agencies had not met all targets for the cybersecurity CAP goal for improving cybersecurity performance  Further, based on FISMA metrics reported for fiscal year 2017, OMB determined that 13 of the 23 agencies were managing risks to their enterprise, while the other 10 agencies were at risk of ineffectively identifying, protecting, detecting, responding to, and if necessary, recovering from cyber intrusions  Figure 2 summarizes agencies’ efforts to implement the government’s approach and strategy for securing information systems as of fiscal year 2017  Appendix III includes a table that provides an additional overview of the effectiveness of each agency’s implementation of the government’s approach and strategy to securing information systems  Inspectors general determined that more than half of the 23 civilian CFO Act agencies did not have effective agency-wide information security programs as of fiscal year 2017  Further, in agency financial statement audit reports for fiscal year 2017, inspectors general reported that, despite improvements being made in information security practices, most of the civilian CFO Act agencies continued to exhibit deficiencies in information security controls  As a result of these deficiencies, inspectors general reported material weaknesses or significant deficiencies in internal control over financial reporting  FISMA requires inspectors general to determine the effectiveness of their respective agencies’ information security programs  To do so, FISMA reporting instructions direct inspectors general to provide a maturity rating for agency information security policies, procedures, and practices related to the five core security functions established in the NIST cybersecurity framework, as well as for the agency-wide information security program  The ratings used to evaluate the effectiveness of agencies’ information security programs are based on a five-level maturity model, as described in table 2  According to this maturity model, Level 4 (managed and measurable) represents an effective level of security  Therefore, if an inspector general rates the agency’s information security program at Level 4 or Level 5, then that agency is considered to have an effective information security program  For fiscal year 2017, the inspectors general for 6 of the 23 civilian CFO Act agencies reported that their agencies had an effective agency-wide information security program  More specifically, for the 5 core security functions, most inspectors general reported that their agency was at Level 3 (consistently implemented) for the identify, protect, and recover functions, and at Level 2 (defined) for the detect and respond functions, as shown in figure 3  Inspectors general report on the effectiveness of agencies’ information security controls as part of the annual audits of the agencies’ financial statements  The reports resulting from these audits include a description of information security control deficiencies related to the five major control categories defined by the Federal Information System Controls Audit Manual (FISCAM)—access controls, configuration management, segregation of duties, contingency planning, and security management  The reports also identify the inspectors general’s designation of information security as a significant deficiency or material weakness in internal control over financial reporting systems  For fiscal year 2017, inspectors general continued to identify information security control deficiencies in each of the five major control categories across the 23 civilian CFO Act agencies  The number of agencies with deficiencies in the access control and contingency planning information security control categories decreased between fiscal years 2016 and 2017, according to the inspectors general  Nevertheless, the inspectors general reported that agencies continued to exhibit deficiencies in these two control categories  In addition, the number of agencies with deficiencies in the security management and segregation of duties control categories increased from the prior year  The number of agencies reported as having deficiencies in the configuration management control category remained the same  Figure 4 shows the number of agencies that reported deficiencies in each of the information security control categories for fiscal years 2016 and 2017  Overall, inspectors general for the 23 civilian CFO Act agencies reported progress in agencies’ information security practices for fiscal year 2017  Specifically, during that time, 17 inspectors general designated information security as either a significant deficiency (11) or material weakness (6) in internal control over financial reporting systems for their agencies  This is a decrease from the previous fiscal year when 19 inspectors general designated information security as a significant deficiency (12) or material weakness (7)  Reporting instructions contained in the fiscal year 2017 FISMA metrics directed CIOs to assess their agencies’ progress toward achieving outcomes that strengthen federal cybersecurity  To do this, CIOs evaluated their agencies’ performance in reaching targets for specific FISMA reporting metrics  According to the reporting instructions, certain metrics were selected to represent the administration’s cybersecurity CAP goal  These selected metrics allowed CIOs to evaluate their agencies progress in meeting targets for that goal  The cybersecurity CAP goal for fiscal years 2015 through 2017 was to improve cybersecurity performance by having an ongoing awareness of information security, vulnerabilities, and threats impacting the operating information environment; ensuring that only authorized users have access to resources and information; and implementing technologies and processes that reduce the risk of malware  The cybersecurity CAP goal consisted of three priority areas with a total of nine performance indicators  Each of the nine performance indicators had an expected level of performance, or target, for implementation  Table 3 shows the three priority areas and related performance indicators and targets of the cybersecurity CAP goal for fiscal years 2015 through 2017  According to agency CIO assessments for fiscal year 2017, 6 of the 23 agencies met all 9 targets for the cybersecurity CAP goal  More specifically, 8 agencies met all four targets for the information security continuous 16 agencies met the two targets for the identity, credential, and access management priority area; and 17 agencies met all three targets for the anti-phishing and malware defense priority area  In addition, CIOs reported that agencies were making progress in meeting the targets for the nine performance indicators for fiscal years 2016 and 2017, with increases in the number of agencies meeting the targets within each of the three priority areas  However, although the number of agencies that met the targets in individual priority areas showed a net increase, not all agencies maintained their status  For example, the CIO for one agency reported meeting all three targets for the anti-phishing and malware defense priority area in fiscal year 2016, but reported that the agency only met two of the three targets in fiscal year 2017  Figure 5 shows the number of agencies that reported meeting each of the targets within the individual cybersecurity CAP goal priority areas for fiscal years 2016 and 2017  Although the CIOs for only six agencies reported meeting each of the targets associated with all nine performance indicators for the three cybersecurity CAP goal priority areas, the CIOs at an additional eight agencies reported meeting each target for two of the three priority areas  Specifically, one CIO reported that its agency met each of the targets for the (1) information security continuous monitoring and (2) identity, credential, and access management priority areas; another CIO reported that its agency met each of the targets for the (1) information security continuous monitoring and (2) anti-phishing and malware defense priority areas; and the CIOs at six other agencies met each of the targets for the (1) identity, credential, and access management and (2) anti-phishing and malware defense priority areas  In fiscal year 2018, the President’s Management Agenda replaced the three cybersecurity-focused CAP goal priority areas with updated performance indicators, most of which are to be met by 2020: 1  the manage asset security priority area is similar to the information security continuous monitoring priority area from the previous CAP goal and has a focus on understanding the assets and users on agency networks  In addition to hardware asset and software asset management, this priority area includes performance indicators for authorization and mobile device management  2  the limit personnel access priority area focuses on issues of access management  This area includes performance indicators for using automated access management and managing access for privileged network and high-impact system users  The privileged network access management performance indicator is a continuation of the identity, credential, and access management priority area of the previous cybersecurity CAP goal  Therefore, agencies are expected to complete this metric by the end of the fiscal year 2018 FISMA reporting year  3  the protect networks and data priority area, which is similar to the anti-phishing and malware defense priority area from the previous cybersecurity CAP goal, has three new performance indicators: intrusion detection and prevention, exfiltration and enhanced defenses, and data protection  Appendix IV describes the updated cybersecurity-focused CAP priority areas and performance indicators in more detail  In Executive Order 13800, the President directed OMB, in coordination with DHS, to assess and report to the executive branch on the sufficiency and appropriateness of federal agencies’ processes for managing cybersecurity risks  For these risk management assessments, OMB leveraged the FISMA metrics reported by agency CIOs and inspectors general for fiscal year 2017  The metrics addressed domains that correspond with the five core security functions identified in the cybersecurity framework  Table 4 lists these domains and their relationship to the core functions  Based on OMB’s evaluation of these domains, agency risk management processes related to the five core security functions and overall agency enterprise fell into one of the following three rating categories: managing risk: required cybersecurity policies, procedures, and tools are in use and the agency actively manages cybersecurity risks; at risk: some essential policies, processes, and tools are in place to mitigate overall cybersecurity risk, but significant gaps remain; and high risk: key fundamental cybersecurity policies, processes, and tools are either not in place or not deployed sufficiently  For fiscal year 2017, OMB reported that not all agencies were managing risk  When considering each of the five core security functions, OMB reported that most of the 23 agencies were at risk or at high risk with regard to the identify and protect core security functions  Less than half of the 23 agencies were at risk with regard to the detect, respond, and recover core security functions  Overall, OMB determined that 13 agencies were managing risk and that the remaining 10 agencies were at risk of not effectively identifying, protecting, detecting, responding to, and if necessary, recovering from cyber intrusions  Figure 6 shows OMB’s risk management assessment ratings by core security function across the 23 agencies for fiscal year 2017  DHS and OMB, as required by law and policy, have taken various actions to facilitate the agencies’ use of intrusion detection and prevention capabilities to secure federal systems  For example, DHS has developed an intrusion assessment plan, deployed NCPS to offer intrusion detection and prevention capabilities to agencies, and is providing tools and services to agencies to monitor their networks through its CDM program  However, NCPS still had limitations in detecting certain types of traffic and agencies were not sending all appropriate traffic through the system  Further, CDM was behind at meeting planned implementation dates, and agencies have requested additional training and guidance for these services  OMB has taken steps to improve upon agencies’ capabilities, but has not completed a policy and strategy to do so, or fully reported on its assessment of agencies’ capabilities  The Federal Cybersecurity Enhancement Act of 2015 requires DHS, in coordination with OMB, to develop and implement an intrusion assessment plan to proactively detect, identify, and remove intruders in agency information systems on a routine basis  The act also requires that the plan be updated, as necessary  In December 2016, DHS documented its Intrusion Assessment Plan  In the plan, DHS outlined tools, platforms, resources, and ongoing work that the department provides, and that are intended to help agencies detect, identify, and remove intruders on their networks and systems  The intrusion assessment plan also outlines a defense-in-depth strategy, which utilizes multiple layers of cybersecurity and deploys multiple capabilities in combination, to secure agencies’ networks and information systems  For example, the plan calls for DHS to implement NCPS to provide a perimeter defense for the networks of federal civilian executive branch agencies, while the agencies are to deploy their own intrusion detection and prevention capabilities inside their networks  DHS submitted its intrusion assessment plan to OMB in January 2017  The Federal Cybersecurity Enhancement Act of 2015 also requires DHS to deploy, operate, and maintain a capability to detect cybersecurity risks and prevent network traffic associated with such risks from transiting to or from an agency information system  In addition, the act requires that DHS make regular improvements to intrusion detection and prevention capabilities by deploying new technologies and modifying existing technologies  Further, the act requires agencies to use this capability on all information traveling between their information systems and any information system other than an agency information system  DHS developed NCPS, operationally known as EINSTEIN, to provide the capabilities to detect and prevent potentially malicious network traffic from entering agency networks  Consistent with recommendations we made to DHS in January 2016, DHS has taken actions to improve these capabilities and has other actions underway  For example, the department determined that enhancing NCPS’s current intrusion detection approach to include functionality that would detect deviations from normal network behavior baselines would be feasible  In addition, according to DHS officials, the department was operationalizing functionality intended to identify malicious activity in network traffic otherwise missed by signature-based methods  determined that developing enhancements to current intrusion detection capabilities to facilitate the scanning of Internet Protocol Version 6 (IPv6) traffic would be feasible  According to DHS officials, the department has developed plans to fully support IPv6 for several of its NCPS intrusion detection capabilities  Further, the department has developed implementation schedules and begun roll-out of the enhancements  updated the tool it uses to manage and deploy intrusion detection signatures to include a mechanism to clearly link signatures to publicly available, open-source information  developed clearly defined requirements for detecting threats on agency internal networks and at cloud service providers to help better ensure effective support of information security activities  According to DHS officials, the department was also continuing pilot activities with cloud service providers to enhance protections of agency assets  developed processes and procedures for using vulnerability information, such as data from the CDM program as it becomes available, to help ensure the department is using a risk-based approach for the selection/development of future NCPS intrusion prevention capabilities  Nevertheless, NCPS continues to have known limitations in its ability to identify potential threats  For example: NCPS does not have the ability to effectively detect intrusions across multiple types of traffic  Specifically, DHS determined that developing enhancements to current intrusion detection capabilities to facilitate the scanning of traffic related to supervisory control and data acquisition (SCADA) control systems would not be feasible  However, according to DHS officials, the department is exploring capabilities that are intended to provide critical, cross-sector, real-time visibility into critical infrastructure companies that utilize SCADA systems  In addition, DHS determined that the scanning of encrypted traffic would not be feasible  Nevertheless, according to its officials, the department performed research on potential architectural, technical, and policy mitigation strategies that could provide both the protection and situational awareness for encrypted traffic  The department has actions under way to continue its research in this area  DHS does not always explicitly ask agencies for feedback or confirmation of receipt of NCPS-related notification  While the department had drafted a standard operating procedure related to its incident notification process, the policy did not instruct DHS analysts specifically to include a solicitation of feedback from agencies within the notification  Further, US-CERT could not provide any information regarding the timetable for when these procedures would take effect  Metrics for NCPS, as provided by DHS, do not provide information about how well the system is enhancing government information security or the quality, efficiency and accuracy of supporting actions  Without the deployment of comprehensive measures, DHS cannot appropriately articulate the value provided by NCPS  While the department had taken actions to develop new measures, these measures did not provide a qualitative or quantitative assessment of the system’s ability to fulfill the system’s objectives  NSD did not provide guidance to agencies on how to securely route their information to their Internet service providers  Without providing network routing guidance, NSD has no assurance that the traffic it sees constitutes all or only a subset of the traffic the customer agencies intend to send  As shown in table 5, as of October 2018, the department had implemented five of the nine recommendations and was in the process of implementing the remainder  However, until DHS completes implementation of the remaining recommendations, the effectiveness of NCPS’s intrusion detection and prevention capabilities may be hindered  In addition, the 23 civilian CFO Act agencies had implemented NCPS capabilities to varying degrees  In a March 2018 report, OMB reported that 21 (about 91 percent) of the 23 agencies had implemented the first two iterations of the NCPS capabilities  In addition, 15 (about 65 percent) of the 23 agencies had implemented all three NCPS capabilities, as shown in table 6 below  However, agencies did not route all network traffic for all information traveling between their information systems and any information system other than an agency information system through NCPS sensors  For example, officials at 13 of 23 agencies stated that not all of their agency external network traffic flowed through NCPS  To illustrate, officials at one agency estimated that 20 percent of their external network traffic did not flow through the system  In addition, 4 of the agencies in our review previously cited several challenges in routing all of their traffic through NCPS intrusion detection sensors, including capacity limitations of the sensors, agreements with external business partners that use direct network connections, interagency network connections that do not route through Internet gateways, use of encrypted communications mechanisms, and backup network circuits that are not used regularly  NSD officials stated that agencies are responsible for routing their traffic to the intrusion detection sensors, and DHS does not have a role in that aspect of NCPS implementation  As a result, potential cyberattacks may not be detected or prevented for a portion of the external traffic at federal agencies  As noted above, we previously recommended that DHS work with agencies to better ensure the complete routing of information to NCPS sensors  The Federal Cybersecurity Enhancement Act of 2015 requires DHS to include, in the efforts of the department to continuously diagnose and mitigate cybersecurity risks, advanced network security tools to improve the visibility of network activity and to detect and mitigate intrusions and anomalous activity  According to DHS officials, the department is addressing the requirement to improve the visibility of network activity by including advanced network security tools as a part of CDM phase 3  In April 2018, we testified that DHS had previously planned to provide 97 percent of federal agencies with the services they needed for CDM phase 3 in fiscal year 2017  In addition, according to OMB’s annual FISMA report for fiscal year 2017, the CDM program was to continue to incorporate additional capabilities, including phase 3, in fiscal year 2018  However, DHS now expects initial operational capabilities to be in place for phase 3 in fiscal year 2019  The department has awarded contracts of approximately $3 26 billion to support its Dynamic and Evolving Federal Enterprise Network Defense (also known as DEFEND) aspect of the CDM program, which is to include phase 3  DEFEND also is to provide coverage for existing agency deployments  According to DHS documentation, the task orders associated with DEFEND are to be issued between the second quarter of fiscal year 2018 and the second quarter of fiscal year 2024  FISMA requires that DHS provide operational and technical assistance to agencies in implementing policies, principles, standards, and guidelines on information security  Toward this end, DHS has available training and guidance related to the implementation of the capabilities of NCPS (i e , EINSTEIN) and CDM  Specifically: According the DHS officials, the department offers training and guidance to agencies on EINSTEIN 1 implementation  For example, DHS established a program in which the Software Engineering Institute will provide training and mentoring to agencies looking to enhance their understanding of, and proficiency with, the EINSTEIN 1 capability (e g , network traffic information)  NCPS program officials stated that agencies can use this service, which is available at no charge to them, on an unlimited basis as long as the requests relate to EINSTEIN 1  According to the officials, training and guidance related to EINSTEIN 2 and EINSTEIN 3 Accelerated is limited because DHS intentionally restricts the amount of data provided to agencies  According to DHS officials, the department also offers training and guidance to assist agencies with the implementation and use of resources associated with the CDM program, including webinars, guides, and computer-based training  The DEFEND contracts that the department awarded also include a mechanism for agencies to procure specialized tailored training, such as on the use of CDM tools  The department also offers customer advisory forums every other month that agencies are invited to attend  According to CDM program officials, the program’s governance, among other topics, is commonly discussed during these forums  Further, the department provides agencies with guidance, such as various governance documents, best practices, and frequently asked questions, through a web portal that is made available by OMB  In addition, US-CERT offers the CDM training program, which is to provide CDM implementation resources  Nevertheless, most agencies told us that they wanted DHS to provide more training and guidance as it relates to their implementation of the capabilities made available by NCPS and CDM  Specifically, Officials from 16 of 23 agencies reported that they wanted to receive additional training on NCPS capabilities  For example, officials at 5 agencies stated that they would like to receive training related to using network traffic information, understanding alerts, or implementing capabilities for cloud services  The officials also stated that they wanted training specific to agency security personnel  Officials from 19 of 23 agencies stated that they wanted to receive additional guidance related to NCPS’s capabilities, but not all of the 19 provided specific details  For example, officials from at least 3 agencies stated that they wanted additional guidance such as, “how to” documents, descriptions of architecture details, or guidance documents that explain NCPS’s capabilities so that agencies can gauge the gap between the security that the system provides and the security being provided by their own agency’s capabilities  Officials from 21 of 23 agencies reported that they wanted to receive additional training on implementing CDM at their agencies  For example, officials from 7 agencies suggested that additional training on the use of the tools would be beneficial  Officials from 22 of 23 agencies stated that they wanted additional guidance as it relates to CDM implementation  For example, officials from one agency stated that they would like examples of best practices and successful deployments  These requests for additional training and guidance demonstrate that agencies are either unaware of the available training and guidance, or that the training may not meet their needs  Until DHS coordinates with agencies to determine if additional training and guidance are needed, agencies may not be able to fully realize the benefits of the capabilities provided by the NCPS and CDM programs  Although OMB took steps to report on agencies’ implementation of intrusion detection and prevention capabilities, it did not report on all required actions  For example, the office did not submit DHS’s intrusion plan to Congress as required by the Federal Cybersecurity Enhancement Act of 2015  In addition, OMB provided various reports to Congress that described agencies’ intrusion detection and prevention capabilities, but the reports did not always include all information required by the act  Further, OMB developed a draft policy and strategy that were intended to improve agency capabilities, but it had not finalized these documents  The Federal Cybersecurity Enhancement Act of 2015 requires OMB to submit the intrusion assessment plan developed by DHS to the appropriate congressional committees no later than 6 months after the date of enactment of the act  The act also required OMB to submit to Congress a description of the implementation of the intrusion assessment plan and the findings of the intrusion assessments conducted pursuant to the intrusion assessment plan no later than 1 year after the date of enactment of the act, and annually thereafter  Although DHS developed and documented an intrusion assessment plan, which described a defense-in-depth approach to security, OMB did not submit the plan to Congress, as called for in the act  Even though DHS submitted the plan to OMB in January 2017, OMB had not submitted it to Congress as of October 2018 (21 months after DHS submitted the plan and 28 months past the due date)  On the other hand, OMB did submit its own reports to Congress which generally described elements of the implementation of DHS’s intrusion assessment plan and intrusion assessment findings  In September 2017, OMB issued its analysis of agencies’ implementation of intrusion detection and prevention capabilities, or more specifically, agencies’ implementation of the various versions of NCPS  In addition, the office’s annual FISMA report, issued most recently in March 2018, generally covered elements of the intrusion assessment plan  OMB personnel within the Office of the Federal CIO believed that these two reports, along with a process the office had initiated to validate incidents across the government, addressed the requirement for OMB to submit to Congress a description of the implementation of the intrusion assessment plan and the findings of the intrusion assessments conducted pursuant to the plan  However, the September 2017 and March 2018 reports did not address other elements described in DHS’s intrusion assessment plan  For example, OMB did not describe agency roles associated with segmenting their networks, identifying key servers based on threat and impact, ensuring all applications are appropriately tracked and configured, and categorizing and tagging data based on threat and impact  While OMB has provided important information to congressional stakeholders through its own reports, until it submits the plan and addresses all elements described in DHS’s intrusion assessment plan, it will continue to be remiss in providing timely and sufficiently detailed information regarding the intrusion assessment plan to congressional stakeholders to support their oversight responsibilities  The Federal Cybersecurity Enhancement Act of 2015 also required that OMB submit an analysis of agencies’ application of the intrusion detection and prevention capabilities to Congress no later than 18 months after the date of enactment of the act, and annually thereafter  OMB was to include a list of federal agencies and the degree to which each agency had applied the intrusion detection and prevention capabilities in this analysis  As discussed previously in this report, OMB issued its analysis of agencies’ implementation of intrusion detection and prevention capabilities in September 2017  However, the analysis did not include the degree to which agencies had applied the intrusion detection and prevention capabilities  For example, the analysis did not reflect that not all agencies were using this capability on all information traveling between their systems and any system other than an agency system, as required by the act  Until OMB includes the degree to which agencies have applied intrusion detection and prevention capabilities in its analysis, it cannot provide congressional stakeholders with an accurate portrayal of the extent to which the capabilities are detecting and preventing potential intrusions  The Federal Cybersecurity Enhancement Act of 2015 further required that the Federal Chief Information Officer, within OMB, submit a report to Congress no earlier than 18 months after the date of enactment, but no later than 2 years after that date, assessing the intrusion detection and intrusion prevention capabilities that DHS made available to agencies  The act required that the report address (1) the effectiveness of DHS’s system used for detecting, disrupting, and preventing cyber-threat actors, including advanced persistent threats, from accessing agency information and agency information systems; (2) whether the intrusion detection and prevention capabilities, continuous diagnostics and mitigation, and other systems deployed are effective in securing federal information systems; (3) the costs and benefits of the intrusion detection and prevention capabilities, including as compared to commercial technologies and tools, and including the value of classified cyber threat indicators; and (4) the capability of agencies to protect sensitive cyber threat indicators and defensive measures if they were shared through unclassified mechanisms for use in commercial technologies and tools  In a report issued in September 2018 (about 8 months past the required due date), the Federal Chief Information Officer provided Congress an assessment of intrusion detection and intrusion prevention capabilities across the federal enterprise  The report pointed out, among other things, that agencies did not possess or properly deploy capabilities to detect or prevent intrusions or minimize the impact of intrusions when they occur  In addition, the report acknowledged the need to improve the effectiveness of intrusion detection and intrusion prevention capabilities and stated that OMB would track performance through the CAP goal and annual FISMA reports  However, the report did not address all of the requirements specified in the act  For example, the report did not address whether DHS’s system (i e , NCPS) was effective in detecting advanced persistent threats  In addition, the report did not include a comparison of the costs and benefits of the intrusion detection and prevention capabilities versus commercial technologies and tools, or the value of classified cyber threat indicators  Further, the report did not address the capability of agencies to protect sensitive cyber threat indicators and defensive measures  Until OMB updates the Federal CIO report to address all of the requirements specified in the act, it will continue to be remiss in providing timely and sufficiently detailed information, such as that related to costs and benefits, among other elements in the act, to congressional stakeholders to support their oversight responsibilities  In addition to OMB’s responsibilities in the Federal Cybersecurity Enhancement Act of 2015, OMB has initiated plans for further improving agencies’ intrusion detection and prevention capabilities  In response to a tasking in Executive Order 13800, the Director of the American Technology Council coordinated the development of a report to the President from the Secretary of DHS, the Director of OMB, and the Administrator of the General Services Administration, regarding the modernization of federal information technology (IT)  The report, Report to the President on Federal IT Modernization, identified actions that OMB should take for (1) prioritizing the modernization of high-risk, high-value assets and (2) modernizing the Trusted Internet Connection (TIC) program and NCPS to improve protections, remove barriers, and enable commercial cloud migration  For example, OMB was to take the following actions subsequent to the December 13, 2017 report issuance date: Within 60 days: Update a TIC policy to address challenges with agencies’ perimeter-based architectures, such as the modernization of NCPS  In addition, introduce a “90 day sprint” during which approved projects would pilot proposed changes in TIC requirements  Within 90 days: Update the annual FISMA and CAP goal metrics to focus on those critical capabilities that were most commonly lacking among agencies and focus oversight assessments on high-value assets  Within 120 days: In conjunction with DHS, develop a strategy for optimally realigning resources across agencies to reduce the risk to high-value assets and respond to cybersecurity incidents for those assets  OMB has taken steps toward implementing several, but not all, of these actions  For example, it introduced a “90 day sprint” and, according to knowledgeable OMB staff, the outcomes of this action are directly informing changes in TIC requirements  In addition, OMB updated the annual FISMA and CAP goal metrics by including several metrics that focus on high-value assets  The updated FISMA and CAP goal metrics went into effect in April 2018  However, while OMB had taken steps toward updating the TIC policy and developing a strategy for optimally realigning resources, the policy and strategy were in draft and had not yet been finalized as of October 2018  The agency did not specify a time frame for finalizing the policy and strategy  Until OMB finalizes the TIC policy and the strategy for optimally realigning resources, the enhancements offered through the policy and strategy are unlikely to be realized  FISMA requires agencies to provide information security protections to prevent unauthorized access to their systems and information  Officials from the 23 selected agencies reported to us that they generally took steps to meet this requirement by augmenting the tools and services provided by DHS with their own intrusion detection and prevention capabilities  However, agencies did not consistently implement five key capabilities specified by DHS and NIST guidance  In addition, most of the agencies did not fully implement any of the phases of DHS’s CDM program that is intended to improve their capabilities to detect and prevent intrusions  Binding Operational Directive (BOD) 18-01 instructs agencies to enhance email security  These enhancements include enabling encrypted email transmission, ensuring that receiving mail servers know what actions the agency would like taken when an email falsely claims to have originated from the agency, and removing certain insecure protocols, among others  The final deadline for implementing all BOD 18-01 requirements was October 16, 2018  Additionally, NIST SP 800-53 Revision 4 recommends that security awareness training include training on how to recognize and prevent spear-phishing attempts  As of September 2018, only 2 of the 23 agencies reported implementing all of the email requirements  For the remaining 21 agencies: 9 agencies stated that their agency had plans to implement all enhancements by the October 2018 deadline, 1 agency was uncertain whether it would meet the deadline, and 11 stated they would not be able to meet the deadline  By contrast, the majority of agencies (22 of 23) reported that they had trained staff on spear-phishing exercises, as recommended by NIST SP 800-53 Revision 4  Officials at the remaining agency told us that the agency planned to have spear-phishing exercises in fiscal year 2019  Such training should help ensure that phishing will be a less effective attack vector against the majority of agencies  While agencies benefit from secure protocols and spear-phishing training, implementing the remaining BOD 18-01 email requirements would provide additional protection to agency information systems  NIST recommends that federal agencies deploy intrusion detection and prevention capabilities  These capabilities include monitoring cloud services, using host-based intrusion prevention systems, monitoring external and internal network traffic, and using a security information and event management (SIEM) system  However, in our semi-structured interviews of the 23 agencies, officials told us that they often had not implemented many of these capabilities  Such inconsistent implementation exposes federal systems and the information they contain to additional risk  As part of their continuing oversight efforts, OMB and DHS can use the information below to work with agencies to identify obstacles and impediments affecting the agencies’ abilities to implement these capabilities  NIST SP 800-53 Revision 4 states that agencies should monitor and control communications at the external boundary of the network  However, as of June 2018, fewer than half of the agencies that used cloud computing services were monitoring cloud traffic  Specifically: 10 of 22 agencies that used Infrastructure as a Service were monitoring inbound and outbound Infrastructure as a Service traffic, 7 of 21 agencies that used Platform as a Service were monitoring inbound and outbound Platform as a Service traffic, and 10 of 23 agencies that used Software as a Service were monitoring inbound and outbound Software as a Service traffic  Without monitoring traffic to and from cloud service providers, agencies risk a greater chance of malicious cloud activity detrimentally affecting agency information security  NIST SP 800-53 Revision 4 states that agency internal monitoring may be achieved by utilizing intrusion prevention capabilities  These capabilities include using host-based intrusion prevention systems to provide defense at an individual system or device level by protecting against malicious activities  Host-based capabilities include memory-based protection and application whitelisting  As of June 2018, officials at the 23 agencies reported the following to us: 16 agencies used host-based intrusion prevention capabilities, 15 agencies used memory-based protection, and 8 agencies used host-based application whitelisting  Until host-based intrusion protections are fully deployed, agencies will be at greater risk of malicious activity adversely affecting agency operations  NIST SP 800-53 Revision 4 also states that agencies should monitor and control communications at the external boundary of the network and at key internal boundaries (e g , network traffic)  NIST guidance also stated that an agency should deploy monitoring devices strategically within the network to detect essential information  However, the agencies in our review did not always monitor external and internal traffic  For example, of the 23 agencies: 5 reported that they were not monitoring inbound or outbound direct connections to outside entities  11 reported that they were not persistently monitoring inbound encrypted traffic  8 reported that they were not persistently monitoring outbound encrypted traffic  In addition, 13 agencies reported they were not using a network-based session capture solution  Of the 10 agencies that reported using this solution, officials from 2 agencies stated that they were not capturing workstation-to-workstation connections  Without thorough monitoring of external and internal traffic, agencies will have less assurance that they are aware of compromised or potentially compromised traffic within their network  NIST SP 800-53 Revision 4 states that agencies should establish enhanced monitoring capabilities  Such capabilities should include automated mechanisms that collect and analyze incident data for increased threat and situational awareness  According to NIST, a security information and event management (SIEM) system analyzes data from different sources and identifies and prioritizes significant events  Sources of data used by SIEM systems include logs from database systems, network devices, security systems, web applications, and workstation operating systems  Of the 23 agencies that we reviewed, 21 reported using a SIEM capability  Over half of the agencies employing a SIEM used one or more of their logs to match against known vulnerabilities and advanced persistent threats, as well as to create real-time alerts  For example, of the 21 agencies: 14 agencies reported collecting database logs, but only 7 agencies reported using the logs to match against known vulnerabilities and persistent threats and to create real-time alerts; 20 agencies reported collecting network logs, but only 13 agencies reported using them to match against known vulnerabilities and persistent threats and to create real-time alerts; 21 agencies reported collecting security logs, but only 13 reported using them to match against known vulnerabilities and persistent threats and to create real-time alerts; 15 agencies reported collecting web application logs, but only 9 agencies reported using them to match against known vulnerabilities and persistent threats and to create real-time alerts; and 13 agencies reported collecting workstation logs, but only 8 agencies reported using them to match against known vulnerabilities and persistent threats and to create real-time alerts  Only 5 agencies collected all 5 types of logs and used them to match against known vulnerabilities and persistent threats and to create real- time alerts  By not fully using SIEM capabilities, agencies will have less assurance that relevant personnel will be aware of possible weaknesses or intrusions  To further enhance their intrusion detection and prevention capabilities, the 23 civilian CFO Act agencies were in the process of implementing DHS’s CDM program  As previously discussed, Phase 1 of the program involves deploying products to automate hardware and software asset management, configuration settings, and common vulnerability management capabilities  Phase 2 intends to address privilege management and infrastructure integrity by allowing agencies to monitor users on their networks and to detect whether users are engaging in unauthorized activity  Phase 3 is intended to assess agency network activity and identify any anomalies that may indicate a cybersecurity compromise  As of June 2018, most agencies had not fully implemented any of the three phases  As shown in Figure 7, 15 agencies had partially implemented phase 1, 21 had partially or not yet begun to implement phase 2, and none of the agencies had fully implemented phase 3  Agencies’ implementation status has been affected, at least in part, due to delays in DHS’s deployment of the program phases  As a result, federal systems will remain at risk until the program is fully deployed  Many agencies have not effectively implemented the federal approach and strategy for securing information systems  For example, the inspectors general for 17 of the 23 selected agencies reported that their agencies had not effectively implemented their information security programs and had significant information security deficiencies associated with internal control over financial reporting  In addition, CIOs for 17 agencies reported not meeting all nine targets for the cybersecurity cross- agency priority goal  Further, OMB determined that that only 13 of the 23 agencies were managing risks to their overall enterprise, while the other 10 agencies were at risk  Until agencies more effectively implement the government’s approach and strategy, federal systems will remain at risk  DHS and OMB have initiatives underway that are intended to further improve agencies’ security posture  However, although DHS had provided training and guidance for NCPS and CDM, agencies expressed the need for more  In addition, OMB had also not finalized its policy and strategy aimed at addressing challenges with perimeter security and protecting high value assets, respectively  OMB had also not provided useful information to Congress, such as a description of agencies’ implementation of DHS’s intrusion assessment plan, the degree to which agencies are using NCPS, a complete analysis of agencies’ implementation of DHS’s intrusion assessment plan, or the costs and benefits of using commercial tools  Although agencies’ officials reported various efforts underway to enhance their agency’s intrusion detection and prevention capabilities, implementation efforts across the federal government were not consistent  OMB and DHS can use the information provided in this report to work with agencies to identify obstacles and impediments affecting the agencies’ abilities to implement these capabilities  We are making a total of nine recommendations, including two to DHS and seven to OMB  Specifically: The Secretary of DHS should direct the Network Security Deployment division to coordinate further with federal agencies to identify training and guidance needs for implementing NCPS and CDM  (Recommendation 1) The Secretary of DHS should direct the appropriate staff to work with OMB to follow up with agencies to identify obstacles and impediments affecting their abilities to implement intrusion detection and prevention capabilities  (Recommendation 2) The Director of OMB should submit the intrusion assessment plan to the appropriate congressional committees  (Recommendation 3) The Director of OMB should report on implementation of the defense- in-depth strategy described in the intrusion assessment plan, including all elements described in the plan  (Recommendation 4) The Director of OMB should update the analysis of agencies’ intrusion detection and prevention capabilities to include the degree to which agencies are using NCPS  (Recommendation 5) The Director of OMB should direct the Federal CIO to update her report to Congress to include required information, such as detecting advanced persistent threats, a comparison of the costs and benefits of the capabilities versus commercial technologies and tools, and the capability of agencies to protect sensitive cyber threat indicators and defense measures  (Recommendation 6) The Director of OMB should establish a time frame for finalizing the Trusted Internet Connections policy intended to address challenges with agencies’ perimeter-based architectures and issue it when finalized  (Recommendation 7) The Director of OMB should establish a time frame for finalizing the strategy for realigning resources across agencies to protect high- value assets and issue it when finalized  (Recommendation 8) The Director of OMB should direct the Federal CIO to work with DHS to follow-up with agencies to identify obstacles and impediments affecting their abilities to implement intrusion detection and prevention capabilities  (Recommendation 9) We provided a draft of this report to OMB and the 23 civilian CFO Act agencies, including DHS, covered by our review  In response, OMB provided comments via email, and DHS and three other agencies (the Department of Commerce, Social Security Administration, and U S  Agency for International Development) provided written comments, which are reprinted in appendices V through VIII, respectively  The 19 remaining agencies (the Departments of Agriculture, Education, Energy, Health and Human Services, Housing and Urban Development, the Interior, Justice, Labor, State, Transportation, the Treasury, and Veterans Affairs; as well as the Environmental Protection Agency, General Services Administration, National Aeronautics and Space Administration, National Science Foundation, Nuclear Regulatory Commission, Office of Personnel Management, and Small Business Administration) stated via email that they had no comments  In its comments, which the OMB liaison provided to GAO via email on December 7, 2018, OMB did not state whether it agreed or disagreed with the seven recommendations that we made to it  Rather, according to the liaison, OMB agreed with the facts in our draft report, but found that the report did not reflect the agency’s rationale for not submitting the DHS intrusion assessment plan to Congress and a report on the implementation of the plan, as required by the Federal Cybersecurity Enhancement Act of 2015  The liaison stated that OMB is working closely with DHS to provide strategic direction in assessing gaps in, and modernizing, the manner in which intrusion detection and prevention capabilities are delivered to the federal government  Further, in a subsequent email on December 10, 2018, OMB said it believes the Federal CIO’s September 2018 report to Congress, along with data provided in OMB’s fiscal year 2017 FISMA report to Congress, achieves the outcomes sought by the Federal Cybersecurity Enhancement Act of 2015 and demonstrates OMB's continuous engagement with DHS across the evolution of the intrusion detection and prevention program  As stated in our report, we acknowledge that OMB has provided important information to congressional stakeholders through its reports  However, OMB’s reports did not cover all outcomes described in the act  For example, as we pointed out, these reports did not fully address implementation of the defense-in-depth strategy described in DHS’s intrusion assessment plan  In addition, although OMB reported on several elements required by the Federal Cybersecurity Enhancement Act of 2015, it did not report on all of the required elements  For example, the reports did not address whether DHS’s NCPS was effective in detecting advanced persistent threats  The reports also did not include a comparison of the costs and benefits of the intrusion detection and prevention capabilities versus commercial technologies and tools, or the value of classified cyber threat indicators  Further, the reports did not address the capability of agencies to protect sensitive cyber threat indicators and defensive measures  Accordingly, we maintain that our recommendations for OMB to report on required elements in the Federal Cybersecurity Enhancement Act of 2015 are warranted  In addition, OMB suggested that we revise our recommendations to the agency to include a shared responsibility with DHS to help drive desired outcomes  However, six of the seven recommendations we are making to OMB are related to specific OMB responsibilities cited in either the Federal Cybersecurity Enhancement Act of 2015 or the Report to the President on Federal IT Modernization  As such, we believe the recommendations are appropriately addressed to OMB  Furthermore, our recommendations do not prevent OMB from working with DHS to implement them  Our seventh recommendation to OMB—to work with DHS to follow up with agencies to identify obstacles and impediments affecting their abilities to implement intrusion detection and prevention capabilities—includes a shared responsibility with DHS  OMB also provided technical comments, which we incorporated into the report, as appropriate  Subsequent to providing initial comments on our draft report, OMB issued a memorandum intended to provide a strategy for realigning resources across agencies to protect high-value assets  This action addresses our recommendation 8, which called for the Director of OMB to establish a time frame for finalizing the strategy for realigning resources across agencies to protect high-value assets, and to issue the strategy when finalized  In its comments, DHS stated that it concurred with the two recommendations we made to the department  DHS stated that it expects to implement the recommendations in 2019  The Department of Commerce commented that the report was reasonable and that the department agreed with the findings and recommendations  In its comments, the Social Security Administration stated that protecting its networks and information is a critical priority  According to the agency, it continued to make improvements in fiscal year 2018, such as improvements and progress in securing applications, leveraging the cloud, managing its assets and vulnerabilities, strengthening its network and incident response capabilities, improving its security training, and enhancing the overall effectiveness of its cybersecurity program  Finally, the U S  Agency for International Development commented that its inspector general had improved the agency’s capability maturity ratings for core security functions in fiscal year 2018  The agency also pointed out that it was the only selected agency in which fiscal year 2017 indicators of effectiveness in implementing the federal approach and strategy for securing information systems were all positive (as noted in Appendix III)  We are sending copies of this report to appropriate congressional committees, the Director of OMB, the heads of the 23 civilian CFO Act agencies and their inspectors general, and other interested congressional parties  In addition, the report is available at no charge on the GAO website at http://www gao gov  If you or your staff have any questions about this report, please contact Gregory C  Wilshusen at (202) 512-6244 or wilshuseng@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report  GAO staff who made key contributions to this report are listed in appendix IX  The Federal Cybersecurity Enhancement Act of 2015, which was enacted December 18, 2015, included a provision for GAO to report on the effectiveness of the federal government’s approach and strategy for securing agency information systems, including intrusion detection and prevention capabilities  The objectives of our review were to assess: (1) the reported effectiveness of selected agencies’ implementation of the federal government’s approach and strategy to securing agency information systems; (2) the extent to which the Office of Management and Budget (OMB) and the Department of Homeland Security (DHS) have facilitated the use of intrusion detection and prevention capabilities to secure federal agency information systems; and (3) the extent to which selected agencies reported implementing intrusion detection and prevention capabilities  Selected agencies for our review were the 23 civilian agencies covered by the Chief Financial Officers Act of 1990 (CFO Act)  We did not include the Department of Defense because the Federal Cybersecurity Enhancement Act of 2015 only pertains to civilian agencies  Because we focused our work on the 23 civilian agencies, results from these reviews are not generalizable to the entire federal government  To assess the reported effectiveness of agencies’ implementation of the federal government’s approach and strategy to securing agency information systems, we described the federal government’s approach and strategy by summarizing the Federal Information Security Modernization Act of 2014 (FISMA), Executive Order 13800, Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure, and the National Institute of Standards and Technology’s (NIST) Framework for Improving Critical Infrastructure Cybersecurity (cybersecurity framework)  assessed the reported effectiveness of agencies’ implementation of the approach and strategy by reviewing annual reports from OMB and the inspectors general (IG) of the 23 civilian CFO Act agencies regarding the reported implementation of FISMA for fiscal year 2017  We described the IG reported maturity levels, including the Office of Inspectors General FISMA Reporting Metrics definition of “effectiveness ” These maturity levels are based on security domains aligned with the five core functions in NIST’s cybersecurity framework  We also summarized IG reported conclusions on the effectiveness of agencies’ information security programs for fiscal year 2017  reviewed the fiscal year 2016 and 2017 financial statement audit reports for each of the 23 civilian CFO Act agencies to identify the extent to which any significant deficiencies or material weaknesses related to information security over financial systems had been reported and to identify information security control weaknesses reported by the IGs  identified whether agencies had met the targets for the cybersecurity- focused cross-agency priority goal for fiscal years 2016 and 2017 by examining agency-reported performance metrics for fiscal years 2016 and 2017  evaluated OMB’s agency risk management assessment ratings to make a determination on how agencies were managing risk to their enterprise  These conclusions were based on FISMA metrics, and are aligned with the five core security functions defined in the cybersecurity framework  interviewed knowledgeable OMB officials and staff to obtain their views on the reported effectiveness of the federal government’s approach and strategy to securing agency information systems  To assess the extent to which OMB and DHS have facilitated the use of intrusion detection and prevention capabilities to secure federal agency information systems, we determined the extent OMB and DHS fulfilled their requirements described in the Federal Cybersecurity Enhancement Act of 2015 by collecting and reviewing artifacts from OMB and DHS and comparing them to the provisions outlined in the act  We also interviewed knowledgeable officials from OMB and DHS regarding their efforts to fulfill their requirements described in the act  determined the effectiveness of corrective actions taken by DHS to address nine previously reported recommendations we made in our report related to NCPS  Specifically, we collected appropriate artifacts and assessed the artifacts against the criteria used in that report, and determined the extent to which the actions taken by DHS met the intent of the recommendations, and we met with DHS staff responsible for the remediation activities and obtained their views of the status of actions taken to address the recommendations  held semi-structured interviews with knowledgeable officials from the 23 civilian CFO Act agencies  During these interviews, we obtained the agency’s views on whether they need more training and guidance from DHS for NCPS and CDM  We also interviewed knowledgeable officials and staff at DHS to obtain their views on how DHS had improved the intrusion detection and prevention capabilities it provides to federal agencies  We also interviewed DHS officials to obtain their views on the training and guidance that the department makes available to agencies  To assess the extent to which selected agencies reported implementing intrusion detection and prevention capabilities, we described the reported intrusion detection and prevention capabilities implemented by the 23 civilian CFO Act civilian agencies by summarizing implemented intrusion detection and prevention capability information obtained from the semi-structured interviews at the 23 civilian CFO Act agencies described above; identifying the extent to which the 23 civilian CFO Act agencies were in compliance with DHS’s binding operating directive (BOD) pertaining to enhanced email and web security (BOD 18-01) by collecting and summarizing Cyber Hygiene Trustworthy Email reports from the 23 agencies and determining the extent to which the agencies had taken required actions to implement the BOD  During the semi-structured interviews, we also obtained the agency’s views and experiences with other programs and services provided by DHS, including the extent to which agencies had implemented the tools offered by the department’s Continuous Diagnostics and Mitigation (CDM) program  To determine the reliability of submitted data and obtain clarification about agencies’ processes to ensure the accuracy and completeness of data used in their respective FISMA reports, we analyzed documents and conducted interviews with officials from 6 of the 23 civilian CFO Act agencies  To select these six agencies, we sorted agency fiscal year 2017 information technology budget data from highest to lowest amount and then divided the data into three tiers: high spending, medium spending, and low spending  We then randomly selected two agencies from each of the three tiers  The selected agencies were the Departments of Agriculture, Commerce, Housing and Urban Development, Transportation, and Veterans Affairs, and the U S  Agency for International Development  While not generalizable to all agencies, the information we collected and analyzed about the six selected agencies provided insights into various processes in place to produce FISMA reports  Based on this assessment, we determined that the data were sufficiently reliable for the purposes of our reporting objectives  We conducted this performance audit from December 2017 to December 2018 in accordance with generally accepted government auditing standards  Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives  We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives  The National Institute of Standards and Technology established the cybersecurity framework to provide guidance for cybersecurity activities within the private sector and government agencies at all levels  The cybersecurity framework consists of five core functions: identify, protect, detect, respond, and recover  Within the five functions are 23 categories and 108 subcategories that define discrete outcomes for each function, as described in table 7  The federal approach and strategy for securing information systems is prescribed by federal law and policy, including the Federal Information Security Modernization Act of 2014 and the presidential executive order on Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure  Accordingly, federal reports describing agency implementation of this law and policy, and reports of related agency information security activities, indicated the effectiveness of agencies’ efforts to implement the federal approach and strategy  Table 8 summarizes the reported effectiveness of the 23 civilian Chief Financial Officers Act of 1990 agencies to implement the government’s approach and strategy to securing information systems  The President’s Management Agenda identifies cross-agency priority (CAP) goals to target areas where multiple agencies must collaborate to effect change  The agenda issued in fiscal year 2018 established an information technology modernization goal that includes a cybersecurity objective with specific priority areas and performance indicators  This cybersecurity-focused goal is intended to drive progress in the government’s efforts to modernize information technology to increase productivity and security  Figure 8 describes the 3 updated cybersecurity- focused cross-agency priority areas and 10 performance indicators  Each federal agency is expected to meet one of the 10 new performance indicators by the end of fiscal year 2018 and the remainder by 2020  In addition to the individual named above, Jeffrey Knott (assistant director), Daniel Swartz (analyst-in-charge), David Blanding, Chris Businsky, Kristi Dorsey, Di’Mond Spencer, Priscilla Smith, and Edward Varty made key contributions to this report  West Coile, Franklin Jackson, and Chris Warweg also provided assistance 


Report 2:  In addition, HHS has data that could be useful for tracking progress in these areas (see table 1)  However, HHS has not adopted specific performance measures with targets specifying the magnitude of the increases HHS hopes to achieve through its efforts to expand access to MAT, and by when  For example, HHS has not established a long-term target specifying the percentage increase in the number of prescriptions for buprenorphine HHS would like to achieve, which would help to show whether efforts by HHS and others are resulting in sufficient progress in increasing prescriptions for this MAT medication  HHS has also not chosen a specific method of measuring treatment capacity or established targets associated with it, which would help to show whether a sufficient number of providers are becoming available to evaluate and treat patients who may benefit from MAT  Without specifying these performance measures and associated targets, HHS will not have an effective means to determine whether its efforts are helping to expand access to MAT  The lack of such performance measures with associated targets is inconsistent with federal internal control standards that specify that management should define objectives and evaluate results  According to these standards, using performance information such as performance measures can help agencies monitor results and determine progress in meeting program goals  In the context of HHS’s efforts to expand access to MAT, establishing appropriate performance measures with associated targets would allow HHS to determine whether its efforts are making sufficient progress or whether they need to be improved  Gauging this progress is particularly important, given the large nationwide MAT treatment gap identified in 2015 between the total number of individuals who could benefit from MAT and the limited number who can access it based on provider availability  This gap was estimated at nearly 1 million people as of 2012, and according to HHS officials and other stakeholders, lack of providers continues to be a challenge  Until HHS establishes performance measures with associated targets for the factors related to access to MAT, the department will be unable to evaluate its progress expanding access to MAT for opioid use disorders  In addition, as of August 2017, HHS has not finalized its approach for the planned evaluation activities, including timeframes  ASPE officials said that timeframes for a finalized evaluation approach had not been established because they were still working with RTI to finalize the evaluation approach given the new leadership priorities  When we spoke with the officials, they provided us with a draft evaluation schedule that covered the contract period ending September 2018  As of October 2017, HHS had not provided a finalized evaluation approach or schedule  Federal internal controls call for management to establish and operate monitoring activities and evaluate results  Without an implementation timeframe for the evaluation’s activities, HHS increases the risk that its evaluation of its agencies’ efforts will not be completed as expeditiously as possible, including an evaluation of HHS’s efforts to expand access to MAT  Officials from selected state health departments and behavioral health agencies, private health insurers, and national associations reported using several different efforts to help expand patients’ access to MAT for opioid use disorders  All of the stakeholders we interviewed reported conducting outreach efforts to communicate information about the importance of MAT and how to access it, or providing training to educate providers on prescribing MAT medications  Efforts by states  State health officials we spoke to described several planned or ongoing efforts to expand access to MAT, some of which are supported by federal funding, including federal grant programs  Officials from all five selected states told us that they are offering outreach to and training for providers to help expand access to MAT  For example, several state officials told us that they are promoting training to (1) encourage physicians to obtain authorization (DATA 2000 waivers) to prescribe buprenorphine and (2) encourage physicians with waivers to treat patients up to their patient limit or to request a higher patient limit  According to the stakeholders, all five selected states have implemented or are planning to implement a health care delivery model or approach that will expand access to MAT  Specifically, these models or approaches focus on integrating the use of MAT into primary care settings  For example, health officials from three states described use of a hub-and-spoke model  This model generally involves centralized intake and initial management of patients at a “hub” (e g , an OTP) and then connecting these patients to community providers at “spokes” (e g , primary care clinics) for ongoing care, with ongoing support provided by the hub as needed  Additionally, officials from two states described offering remote MAT-related consultations through telehealth that connects patients in rural areas with addiction specialists  According to a 2017 Healthcare Fraud Prevention and Partnership whitepaper, telehealth expands the reach of the addiction professional workforce and the existing pool of MAT providers, and it supports remote forms of behavioral therapy to make trained professionals more accessible to those in underserved or isolated communities  Officials from three states described focusing their MAT expansion efforts in various settings, such as in the criminal justice setting and emergency room departments  State health officials from four of the five states told us that programs in their states are using peer specialists (individuals who have successfully recovered from substance abuse disorders) in emergency rooms and other settings to engage with addicted patients and refer them to addiction specialists or behavioral health counselors  Officials from the selected states said that some of these and other efforts are funded through federal sources, such as MAT expansion grants awarded by SAMHSA, or with state funds to the extent they are available  Efforts by private health insurers  Officials from private health insurers reported that they are expanding access to MAT through outreach or training for providers and through the following three efforts: Eliminating the need for prior authorization to prescribe MAT medications  Officials from three insurers reported removing prior authorization requirements for MAT medications, thereby making it easier for patients to access needed MAT medications more readily, rather than undergoing a waiting period for approval to receive the medications  Other private health insurers told us that they continue to require prior authorization, intended for safety reasons and to reduce drug misuse, and officials from one insurer told us that they will allow a patient to access a limited amount of MAT medications for a period of 24 to 72 hours while making a determination about the appropriate treatment services for the patient  Modifying health benefit coverage  Officials from one private health insurance plan told us that the company is redesigning the benefit coverage for methadone and has removed member copays  This effort is intended to make MAT medications more affordable and allow members who are not able to use buprenorphine to have an alternative, such as methadone, that is not cost-prohibitive  Incentivizing providers and health insurance plan members to use MAT  Officials from four private health insurance plans described plans to offer incentives to providers or patients to use MAT  For example, officials from three health plans stated that they are offering alternative payment models or paying higher rates to providers that offer MAT, and another private health insurer is offering incentives to its members who are enrolled in behavioral health programs that provide access to MAT  Efforts by national associations  Officials we interviewed from the national associations—including the American Society of Addiction Medicine, the National Governors Association, and the Association of State and Territorial Health Officials—told us that they are helping to expand access to MAT through outreach and training for their members and by developing tools and resource guides for their members  An official from one association told us that it shares federal grant announcements, including those that are focused on expanding access to MAT, with its members  Officials from another association said it provides training to providers on how to appropriately prescribe MAT medications  In addition, officials from one association told us that they developed an opioid-related road map that identifies examples of strategies—including MAT—that state policymakers can use in their ongoing efforts to address the opioid epidemic  Examples of strategies include reducing the stigma associated with MAT through educating the public and potential providers  Another strategy in the road map is changing payment policies to expand access to MAT services, such as ensuring that Medicaid and other state health programs adequately cover all MAT medications and behavioral interventions and encouraging or requiring commercial health plans to adopt similar policies  HHS funds grant programs and has taken other steps to expand access to MAT, which has been shown to be effective in reducing the prevalence of opioid use disorders and with them, the likelihood of drug overdoses  HHS’s Opioid Initiative began in 2015, and the grants that support it are ongoing, so it is likely too early to determine how effective HHS’s efforts have been in expanding access to MAT and in meeting HHS’s other priorities related to addressing the opioid epidemic  According to HHS, access to MAT can be measured in terms of the number of prescriptions for MAT and by the treatment capacities of OTPs and practitioners who are authorized to prescribe buprenorphine  Our review suggests, however, that HHS may not be ready to perform this evaluation  While HHS told us that it may evaluate the effectiveness of its efforts in the future, the department has not established performance measures with targets that would specify the results that HHS hopes to achieve through its efforts, and by when  Furthermore, HHS has not established timeframes for the activities that will make up its planned evaluation of whether HHS’s efforts have been implemented as intended  Without performance measures with targets and evaluation timeframes, HHS increases the risk that the evaluation will not be completed in a timely manner or that HHS will not know whether its MAT- related efforts are successful or whether new approaches are needed  The evaluation is particularly important, given the hundreds of millions of dollars HHS has invested in its MAT-related grant programs  We are making the following two recommendations to HHS  The Assistant Secretary for Planning and Evaluation should establish performance measures with targets related to expanding access to MAT for opioid use disorders  (Recommendation 1) The Assistant Secretary for Planning and Evaluation should establish timeframes in its evaluation approach that specify when its evaluation of efforts to expand access to MAT will be implemented and completed  (Recommendation 2) We provided a draft of this report to HHS for review, and HHS provided written comments, which are reprinted in appendix II  HHS also provided technical comments, which we incorporated as appropriate  In its written comments, HHS concurred with both of our recommendations  Specifically, for our first recommendation to establish performance measures with targets related to expanding access to MAT for opioid use disorders, HHS stated that developing such measures is appropriate and that the department will continue to work to develop robust performance measures, including measures related to MAT, as part of its overall Opioid Strategy, which includes the department’s most recent efforts to address the opioid epidemic  For our second recommendation to establish timeframes in its evaluation approach that specify when its evaluation of efforts to expand access to MAT will be implemented and completed, HHS agreed that timeframes are important to any evaluation  HHS noted that its evaluation is being conducted under a 2-year contract that is scheduled to end in September 2018  HHS has also provided us with a draft evaluation schedule  We clarified in our report, however, that HHS has not yet provided a finalized approach for the planned evaluation or a finalized schedule establishing timeframes for the activities that will make up the evaluation  Until it finalizes its evaluation approach and establishes related timeframes, HHS increases the risk that it will not complete its planned evaluation by September 2018  We are sending copies of this report to the HHS, and appropriate congressional committees  In addition, the report will be available at no charge on the GAO website at http://www gao gov  If you or your staff have questions about this report, please contact me at (202) 512-7114 or curdae@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report  Major contributors to this report are listed in appendix III  According to the Department of Health and Human Services, a diversion control plan is a set of documented procedures intended to reduce the possibility that controlled substances will be transferred or used illicitly  Opioid treatment programs (OTPs) and practitioners who prescribe buprenorphine at the highest patient level through a Drug Addiction Treatment Act of 2000 (DATA 2000) waiver are required to have these plans  OTPs are programs that may administer or dispense medication- assisted treatment (MAT) for people diagnosed with an opioid use disorder, including the use of methadone and buprenorphine  In addition, under a DATA 2000 waiver, practitioners may prescribe buprenorphine for patients, up to a 30-, 100-, or 275 patient limit  An OTP must maintain a current diversion control plan that contains specific measures to reduce the possibility of diversion of controlled substances from legitimate treatment use  Per federal guidelines, the goal of the diversion control plan is to reduce the scope and significance of diversion and its impact on communities  The guidelines state that each OTP’s diversion control plan should make every effort to balance diversion control against the therapeutic needs of the individual patient  They also state that diversion control plans should address at least four general areas of concern: program environment, dosing and take-home medication, prevention of multiple program enrollment, and prescription medication misuse  The guidelines include details about each of these areas: Program environment: Diversion in the program environment can be deterred and detected by regular surveillance and the monitoring of areas in and around the program, where opportunities for diversion may exist  A visible human presence at a program’s location gives community members the opportunity to approach staff with concerns and communicates the program’s commitment to assuring a safe environment and a positive impact on the surrounding community  Dosing and take-home medication: In the area of dosing and take- home medication, diversion control encompasses careful control of inventory, attentive patient dosing, and close supervision of take- home medication  Observing a patient take his or her dose and having each of them drink and speak after dosing are fundamental components of diversion control  Take-home dosing should be provided with careful attention to regulatory compliance and the therapeutic benefit and safety these regulations are meant to promote  Prevention of multiple program enrollment: Reasonable measures should be taken to prevent patients from enrolling in treatment provided by more than one clinic or individual practitioner  An OTP, after obtaining patient consent, may contact other OTPs within a reasonable geographic distance (100 miles) to verify that a patient is not enrolled in another OTP  Misuse of prescription medication: The misuse of prescription medication has become an area of great concern nationally and impacts diversion control planning at OTPs  All OTP physicians and other healthcare providers, as permitted, should register to use their respective state’s prescription drug monitoring program (PDMP) and query it for each newly admitted patient prior to initiating dosing  The PDMP should be checked periodically (for example, quarterly) through the course of each individual’s treatment and, in particular, before ordering take-home doses as well as at other important clinical decision points  SAMHSA’s best-practice guidelines for using buprenorphine for treating opioid use disorders include multiple references to diversion, including monitoring for diversion, storage of this medication to minimize diversion, and use of formulations that may be less likely to be diverted  Specifically, the best practices state that, when possible, practitioners should use the combination buprenorphine/naloxone product, which increases safety and decreases the likelihood of diversion and misuse  Further, physicians who request and receive a waiver to prescribe buprenorphine to treat up to 275 patients outside of an OTP are required to have a diversion control plan  According to an HHS official, as of July 13, 2017, roughly 3,330 of the over 39,000 practitioners with a waiver had a 275-patient limit waiver  The majority of these practitioners, just over 27,000, have a 30-patient limit  According to SAMHSA guidance, the diversion plan should contain specific measures to reduce the possibility of diversion of buprenorphine from legitimate treatment use and should assign specific responsibilities of the medical and administrative staff of the practice setting for carrying out these measures  Further, the guidance states that the plan should address how: the environment at the practice setting can prevent onsite diversion; to prevent diversion with regard to dosing and take-home medication; and to prevent patients from receiving a prescription from more than one practitioner and later diverting some of the prescribed medication  Elizabeth H  Curda, Director, (202) 512-7114 or curdae@gao gov  In addition to the contact name above, Will Simerl, Assistant Director; Natalie Herzog, Analyst-in-Charge; La Sherri Bush; and Emily Wilson made key contributions to this report  Also contributing were Muriel Brown, Krister Friday, Sandra George, and Christina Ritchie 

ground_truth: Federal agencies are dependent on information systems to carry out operations. The risks to these systems are increasing as security threats evolve and become more sophisticated. To reduce the risk of a successful cyberattack, agencies can deploy intrusion detection and prevention capabilities on their networks and systems. GAO first designated federal information security as a government-wide high-risk area in 1997. In 2015, GAO expanded this area to include protecting the privacy of personally identifiable information. Most recently, in September 2018, GAO updated the area to identify 10 critical actions that the federal government and other entities need to take to address major cybersecurity challenges. The federal approach and strategy for securing information systems is grounded in the provisions of the Federal Information Security Modernization Act of 2014 and Executive Order 13800. The act requires agencies to develop, document, and implement an agency-wide program to secure their information systems. The Executive Order, issued in May 2017, directs agencies to use the National Institute of Standards and Technology's cybersecurity framework to manage cybersecurity risks. The Federal Cybersecurity Enhancement Act of 2015 contained a provision for GAO to report on the effectiveness of the government's approach and strategy for securing its systems. GAO determined (1) the reported effectiveness of agencies' implementation of the government's approach and strategy; (2) the extent to which DHS and OMB have taken steps to facilitate the use of intrusion detection and prevention capabilities to secure federal systems; and (3) the extent to which agencies reported implementing capabilities to detect and prevent intrusions. To address these objectives, GAO analyzed OMB reports related to agencies' information security practices including OMB's annual report to Congress for fiscal year 2017. GAO also analyzed and summarized agency-reported security performance metrics and IG-reported information for the 23 civilian CFO Act agencies. In addition, GAO evaluated plans, reports, and other documents related to DHS intrusion detection and prevention programs, and interviewed OMB, DHS, and agency officials. The 23 civilian agencies covered by the Chief Financial Officers Act of 1990 (CFO Act) have often not effectively implemented the federal government's approach and strategy for securing information systems (see figure below). Until agencies more effectively implement the government's approach and strategy, federal systems will remain at risk. To illustrate: As required by Office of Management and Budget (OMB), inspectors general (IGs) evaluated the maturity of their agencies' information security programs using performance measures associated with the five core security functions—identify, protect, detect, respond, and recover. The IGs at 17 of the 23 agencies reported that their agencies' programs were not effectively implemented. IGs also evaluated information security controls as part of the annual audit of their agencies' financial statements, identifying material weaknesses or significant deficiencies in internal controls for financial reporting at 17 of the 23 civilian CFO Act agencies. Chief information officers (CIOs) for 17 of the 23 agencies reported not meeting all elements of the government's cybersecurity cross-agency priority goal. The goal was intended to improve cybersecurity performance through, among other things, maintaining ongoing awareness of information security, vulnerabilities, and threats; and implementing technologies and processes that reduce malware risk. Executive Order 13800 directed OMB, in coordination with the Department of Homeland Security (DHS), to assess and report on the sufficiency and appropriateness of federal agencies' processes for managing cybersecurity risks. Using performance measures for each of the five core security functions, OMB determined that 13 of the 23 agencies were managing overall enterprise risks, while the other 10 agencies were at risk. In assessing agency risk by core security function, OMB identified a few agencies to be at high risk (see figure at the top of next page). DHS and OMB facilitated the use of intrusion detection and prevention capabilities to secure federal agency systems, but further efforts remain. For example, in response to prior GAO recommendations, DHS had improved the capabilities of the National Cybersecurity Protection System (NCPS), which is intended to detect and prevent malicious traffic from entering agencies' computer networks. However, the system still had limitations, such as not having the capability to scan encrypted traffic. The department was also in the process of enhancing the capabilities of federal agencies to automate network monitoring for malicious activity through its Continuous Diagnostics and Mitigation (CDM) program. However, the program was running behind schedule and officials at most agencies indicated the need for additional training and guidance. Further, the Federal CIO issued a mandated report assessing agencies' intrusion detection and prevention capabilities, but the report did not address required information, such as the capability of NCPS to detect advanced persistent threats, and a cost/benefit comparison of capabilities to commercial technologies and tools. Selected agencies had not consistently implemented capabilities to detect and prevent intrusions into their computer networks. Specifically, the agencies told GAO that they had not fully implemented required actions for protecting email, cloud services, host-based systems, and network traffic from malicious activity. For example, 21 of 23 agencies had not, as of September 2018, sufficiently enhanced email protection through implementation of DHS' directive on enhanced email security. In addition, less than half of the agencies that use cloud services reported monitoring these services. Further, most of the selected 23 agencies had not fully implemented the tools and services available through the first two phases of DHS's CDM program. Until agencies more thoroughly implement capabilities to detect and prevent intrusions, federal systems and the information they process will be vulnerable to malicious threats. GAO is making two recommendations to DHS, to among other things, coordinate with agencies to identify additional needs for training and guidance. GAO is also making seven recommendations to OMB to, among other things, direct the Federal CIO to update the mandated report with required information, such as detecting advanced persistent threats. DHS concurred with GAO's recommendations. OMB did not indicate whether it concurred with the recommendations or not.

prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 2.



Report 2: Beginning the summer 2013 through 2016, there were numerous reports in the media on sexual assault incidents in the U S  armed services  In many cases, such reports were followed by questions on what actions were taken by the Department of Defense (DOD), the Obama Administration, and Congress to address the issue  This report lists a comprehensive chronology of official activities in response to incidents of military sexual assault, as well as legislative action on the issue  The report is divided into three sections: the DOD and the Obama Administration's actions, congressional action, and legislation in the 113 th (2013-2014) and 114 th (2015-2016) Congresses  Also included is a resources section with related articles, hearings, and reports  Information in this report was compiled from the official government websites of DOD, the Obama White House and Congress gov for historical background and will not be updated  June 13, 2012 – DOD announced Army Major General Gary S  Patton as the new director of the Sexual Assault Prevention and Response Office (SAPRO)  September 25, 2012 – As part of the DOD's efforts to confront the crime of sexual assault in the military, then Secretary of Defense Leon Panetta announced improvements to prospective commander and senior enlisted training and a review of the initial military training environment in every service  December 21, 2012 – DOD released key findings from the Academic Program Year (APY) 2011-2012 Report on Sexual Harassment and Violence at the United States Military Service Academies  According to this report, the overall prevalence rate of unwanted sexual contact increased in all three military academies  From 2011 to 2012, the Air Force Academy in Colorado showed the largest increase in reported sexual assaults from 33 to 52 incidents  Sexual assaults at the Naval Academy in Annapolis, MD, increased from 11 to 15, and were up at the U S  Military Academy in West Point, NY, from 10 to 13  January 18, 2013 – DOD announced the release of the 2012 Workplace and Gender Relations Survey of Reserve Component Members   This report included rates of unwanted sexual contact, unwanted gender-related behaviors (i e , sexual harassment and sexist behavior), and gender discriminatory behaviors and sex discrimination reported by survey respondents during the past 12 months  March 7, 2013 – Defense Secretary Chuck Hagel, in a letter responding to Members of Congress, wrote that an internal review was being conducted of a decision by a senior Air Force commander, Lt  Gen  Craig Franklin, to overturn the sexual assault conviction of an Air Force fighter pilot, Lt  Col  James Wilkerson  Colonel Wilkerson was found guilty in November 2012 of aggravated sexual assault and was sentenced to one year in military prison  Lt  General Franklin's decision to overturn the findings of the court-martial freed Colonel Wilkerson, and allowed him to be reinstated in the Air Force  In his letter, Hagel said that while General Franklin's decision could not be overturned, he had asked Pentagon lawyers and the Secretary of the Air Force to review the way in which General Franklin decided the case  He also said he wanted a review of whether the military should change the way it handles sexual assault cases  April 2, 2013 – Secretary Chuck Hagel stated in a message to all DOD personnel on Sexual Assault Awareness and Prevention Month that, "Together, we must work every day to instill a climate that does not tolerate or ignore sexist behavior, sexual harassment, or sexual assault  These have no place in the United States military and violate everything we stand for and the values we defend " April 8, 2013 – Secretary Hagel announced that DOD's Office of General Counsel will review Article 60 of the Uniform Code of Military Justice (UCMJ) after an Air Force officer's court-martial conviction for sexual assault was dismissed using the authority provided by Article 60  May 6, 2013 – The Office of the Secretary of Defense released a 24-page memorandum from Secretary Hagel to all heads of the military services regarding DOD's 2013 Sexual Assault Prevention and Response Strategy, and the release of the Annual Report on Sexual Assault in the Military 2012 (2 volumes)  According to this report, in FY2012 (October 1, 2011, through September 30, 2012), the number of sexual assaults reported by members of the military rose 6% to 3,374  An anonymous survey of military personnel showed the number of service members who had experienced unwanted sexual contact could be as many as 26,000 but most never reported the incidents  That number is an increase over the 19,000 estimated assaults in 2011  These reports involved offenses ranging from abusive sexual contact to rape  May 7, 2013 – In a DOD press briefing, Defense Secretary Chuck Hagel and Major General Gary Patton, director of SAPRO, announced new series of actions to further DOD's sexual assault and prevention efforts  Hagel directed service chiefs to develop methods to hold all military commanders accountable for establishing command climates of dignity and respect in incorporating sexual assault prevention and victim care principles in their commands  May 7, 2013 – DOD announced the establishment of the Response Systems to Adult Sexual Assault Crimes Panel consisting of nine selected appointees  Secretary of Defense Hagel appointed five members to serve on the response systems panel, who joined four members appointed by the chairman and ranking member of the Senate Armed Services Committee, and the chairman and ranking member of the House Armed Services Committee  May 14, 2013 – The Army announced that an Army Sergeant First Class assigned to III Corps, Fort Hood, TX, was under investigation for pandering, abusive sexual contact, assault, and maltreatment of subordinates  May 15, 2013 – Returning from NATO meetings in Brussels, the Chairman of the Joint Chiefs of Staff, Army Gen  Martin E  Dempsey, told reporters that sexual assault in the Armed Forces constitutes a crisis in the military  He further stated that "We're losing the confidence of the women who serve that we can solve this problem, and that's a crisis " May 16, 2013 – At the White House, President Obama met with senior military leaders on the issue of sexual assault in the U S  Armed Forces  The President stated that not only is it "shameful and disgraceful" but also "dangerous to our national security " May 17, 2013 – During a press briefing, Defense Secretary Hagel and Chairman of the Joint Chiefs of Staff Army Gen  Martin Dempsey discussed their meeting with President Obama, Vice President Biden, and senior enlisted and officer leadership in the U S  military  Dempsey told the Armed Forces Press Service that he believes that the long wars in Iraq and Afghanistan may be factors in the growing incidents of sexual assault  He also stated that: "If a perpetrator shows up at a court-martial with a rack of ribbons and has four deployments and a Purple Heart, there is certainly a risk that we might be a little too forgiving of that particular crime " May 17, 2013 – In an interview, Air Force Chief of Staff, Gen  Mark Walsh, said that sexual assaults in his branch of the military typically involve alcohol use and can be traced to a lack of respect for women  "We have a problem with respect for women that leads to many of the situations that result in sexual assault in our Air Force," he told reporters in his Pentagon office  Walsh further stated that combatting the crisis is his top priority and that he reviews every reported case of sexual assault  May 22, 2013 – The Pentagon announced that DOD's sexual assault prevention staff would be exempt from furloughs  According to Pentagon spokeswoman, Cynthia O  Smith, "The full-time civilians working these programs and implementing policies will not be furloughed  This will ensure responsive victim care and ensure all the programs recently directed by Secretary Hagel are implemented swiftly and efficiently " May 24, 2013 – President Obama addressed graduates of the U S  Naval Academy in Annapolis, MD, and noted in his commencement speech that the misconduct of some in the military can endanger U S  forces and undermine U S  efforts to achieve security and peace worldwide  He further stated that those who commit sexual assault are not only committing a crime, they also "threaten the trust and discipline that make our military strong " May 25, 2013 – In a commencement speech at the U S  Military Academy at West Point, NY, Defense Secretary Chuck Hagel told graduates that they must be the generation of leaders that will commit to building a culture of respect for every member of the military  He stated that sexual harassment and sexual assault in the military "are a profound betrayal of sacred oaths and sacred trusts " He also quoted President Obama's remarks at the Naval Academy when he said, "these crimes have no place in the greatest military on earth " May 30, 2013 – Pentagon officials reaffirmed DOD's commitment to fighting sexual assault by launching the Safe HelpRoom at http://SafeHelpline org , a Sexual Assault Support Service for the DOD community  This new service allows victims to participate in moderated group chat sessions to connect with and support one another in a secure online environment  The Safe HelpRoom is in response to a need for peer support services identified by users of DOD's Safe Helpline for sexual assault victims  June 6, 2013 – In a speech at the 2013 Joint Women's Leadership Symposium, Navy Adm  James A  Winnefeld Jr , vice chairman of the Joint Chiefs of Staff, said plans to combat and eliminate sexual assault include a greater investment in specially trained sexual assault investigators and a push for more psychological, medical, and legal assistance for victims  The vice chairman also said officials will examine the scientific roots of behavioral factors associated with potential predators, which will assist sexual assault prevention efforts  June 7, 2013 – The Pentagon released a statement that Maj  Gen  Michael T  Harrison was suspended of his duties as the Commanding General of United States Army Japan and I Corps for failing in his duties as a commander to report or investigate an allegation of sexual assault  June 7, 2013 – Air Force officials announced Maj  Gen  Margaret H  Woodward has been assigned to direct the Air Force Sexual Assault Prevention and Response Office to replace Lt  Col  Jeffrey Krusinski, the former chief of the Air Force Sexual Assault Prevention and Response Program  He was arrested and charged by Arlington County, VA, police for allegedly being drunk and groping a woman in a parking lot one mile from the Pentagon  In the previous year, Maj  Gen  Woodward led the investigation of Air Force training in the wake of a sexual assault scandal centered at Lackland Air Force Base, Texas  June 27, 2013 – Defense Secretary Hagel met in person with the Sexual Assault Response Systems Review Panel for the first time  According to the Pentagon, "the panel will conduct an independent review and assessment of the systems used to investigate, prosecute, and adjudicate crimes involving sexual assault and related offenses under the Uniform Code of Military Justice, and will develop recommendations to improve the effectiveness of those systems " DOD established the panel in accordance with the National Defense Authorization Act (NDAA) for Fiscal Year 2013 ( P L  112-239 , Section 576 (a))  Previously, Hagel held a teleconference with panel members  July 3, 2013 – The Chief of the National Guard Bureau, Army Gen  Frank J  Grass, launched a comprehensive campaign designed to assist National Guard units in combating sexual assault as part of a military-wide effort to protect victims and eradicate the crime from the ranks  July 9, 2013 – DOD Inspector General (IG) released its report, Joint Warfighting and Readiness Evaluation of the Military Criminal Investigative Organizations Sexual Assault Investigations   The report evaluated the Military Criminal Investigative Organizations' (MCIOs') sexual assault investigations in 2010 to determine whether they were adequately investigated  The report found most MCIO investigations (89%) met or exceeded the investigative standards and returned only cases with significant deficiencies (11%) to the MCIOs for corrective action  July 18, 2013 – The Air Force adopted two new measures to eliminate sexual assault from within the ranks, including requiring mandatory discharge for airmen, officer or enlisted, who commit sexual assault, and requiring the Air Force's most senior commanders to review actions taken on these cases  In addition, the Air Force Academy is reviewing the results of a survey on sexual assault taken on June 24, 2013  Suggestions from survey respondents ranged from involving faculty with character coaching to a complete revamping of how the Air Force Academy trains its freshmen  July 18, 2013 – Secretary of the Navy Ray Mabus announced additional resources for investigators and a new initiative designed to enhance accountability and transparency across the Navy  Mabus approved nearly $10 million to hire more than 50 additional Naval Criminal Investigative Service (NCIS) Family and Sexual Violence Program personnel to shorten investigation times, and directed the Navy and Marine Corps to regularly publish online the results of each service's courts- martial  July 18, 2013 – The Air Force announced that airmen who commit sexual assaults will be discharged, and senior commanders must review actions taken on sexual assault cases under new Air Force initiatives as of July 2, 2013  August 15, 2013 – Defense Secretary Hagel announced seven new anti-sexual assault initiatives in a memo detailing "    absolute and sustained commitment to providing a safe environment in which every service member and DOD civilian is free from the threat of sexual harassment and assault," he wrote in a statement  "Our success depends on a dynamic and responsive approach  We, therefore, must continually assess and strive to improve our prevention and response programs " October 3, 2013 – Air Force Col  Alan R  Metzler, the deputy director for SAPRO, emphasized that the first step to stopping sexual assault in the military is through prevention but when prevention fails, new measures to improve victims' confidence and combat underreporting were needed  Metzler outlined the DOD Sexual Assault Advocate Certification Program (D-SAACP) and the Defense Sexual Assault Incident Database (DSAID), two initiatives set to improve the advocacy services provided to victims of sexual assault  November 9, 2013 – Army Maj  Gen  Gary S  Patton, director of DOD's SAPRO, reported on DOD's recent prevention and awareness successes before the Response Systems to Adult Sexual Assault Crimes Panel  He testified that new DOD initiatives to combat sexual assault helped create a 46% jump in victims reporting compared to the previous year  December 20, 2013 – President Obama instructed Defense Secretary Hagel and Chairman Dempsey to continue their efforts to make substantial improvements with respect to sexual assault prevention and response, including to the military justice system  He also directed that they report back with a full-scale review of their progress, by December 1, 2014  January 10, 2014 – Army Maj  Gen  Jeffrey J  Snow, the new SAPRO chief announced the release of the Annual Report to Congress on Sexual Harassment and Violence at the Military Service Academies   The report covered the 2012-13 academic year, and found in 2013, reports of sexual assault decreased at the U S  Military Academy at West Point, New York and the U S  Air Force Academy in Colorado Springs, Colorado  The number of reported incidents went up at the U S  Naval Academy in Annapolis, Maryland  January 30, 2014 – The independent Response Systems to Adult Sexual Assault Crimes Panel accepted a subcommittee recommendation that senior military commanders retain authority for referring these crimes to courts-martial  May 1, 2014 – DOD released the 2013 Annual Report on Sexual Assault in the Military   The report covered the period from Oct  1, 2012, through Sept  30, 2013, and revealed 5,061 reports of sexual assault in the Defense Department, a 50 percent jump from the previous year  More than 70 percent of all cases that the military had jurisdiction resulted in criminal charges  July 17, 2014 – DOD collaborated with the Justice Department's Office for Victims of Crime to develop a curriculum that expands on the skills learned in initial sexual assault response coordinator and sexual assault prevention and response victim advocate training  December 4, 2014 – Secretary Hagel released DOD's Report to the President of the United States on Sexual Assault Prevention and Response on its progress in addressing sexual assault in the military, and announced four directives to further strengthen the department's prevention and response program  According to this report, based on survey data, servicemembers experienced fewer sexual assaults in FY2014 than in FY2012, an estimated 19,000, down from 26,000  January 16, 2015 – Secretary Hagel at the Air Force Sexual Assault Prevention and Response Summit remarked that the fight to end sexual assault in the military must be "personal " He cited "encouraging progress" over the last year, but acknowledged more can be done, notably in areas such as social retaliation, which he said stems from the overall environment  February 11, 2015 – The annual report on sexual harassment and violence at the military service academies estimated that overall rates of unwanted sexual contact at the military service academies declined in Academic Program Year (APY) 2013-2014, decreased for both men and women, indicating that fewer sexual assaults occurred at the academies in APY 13-14 than in APY 11-12  February 19, 2015 – Health and criminal investigation experts spoke at the Army's Sexual Harassment/Assault Response Program Summit on the underreporting of male victims of sexual assault in the military due to factors such as shame and fear of being ostracized  March 26, 2015 – SAPRO head Army Maj  Gen  Jeffrey Snow monitored 50 initiatives put in place by past Defense secretaries Leon Panetta and Chuck Hagel  According to Snow, the most recent data, gathered last year, shows the past-year prevalence of sexual assault is down significantly, Snow said  Estimates indicate there were 6,000 to 7,000 fewer sexual assaults in 2014 than in 2012  May 1, 2015 – According to the 2014 RAND Military Workplace Stud y, "the percentage of active duty women who experienced unwanted sexual contact over the past year declined from 6 1% in 2012 to an estimated 4 3% in 2014  For active duty men, the estimated prevalence rate dropped from 1 2% in 2012 to 0 9% in 2014  Based on these rates, an estimated 18,900 service members experienced unwanted sexual contact in 2014, down from around 26,000 in 2012 " May 22, 2015 – Defense Secretary Ash Carter announced Army Maj  Gen  Camille M  Nichols will assume duties as director of SAPRO effective June 8, 2015  January 8, 2016 – DOD announced the release of the Annual Report on Sexual Harassment and Violence at the Military Service Academies for A cademic P rogram Y ear 2014-2015   Data in the report indicated the academies received 91 sexual assault reports during the academic year, an increase of 32 reports over the previous year  April 2 8 , 2016 – Defense Secretary Ash Carter announced a sexual assault retaliation prevention and response strategy aimed at how the department supports servicemembers who experience retaliation, while aligning prevention and response efforts across the services  May 5, 2016 – The annual report of the Defense Department's Sexual Assault Prevention and Response Program indicated that DOD's efforts are having an impact  In FY2015, service members made 6,083 reports of sexual assault – the same rate as the previous fiscal year, with four in 1,000 servicemembers reporting sexual assault despite a smaller active force size  In addition, 21 percent of those making restricted reports in fiscal 2015 chose to convert to unrestricted reports, enabling them to participate in the military justice process  September 19 , 2016 – The Naval Academy in Annapolis, MD, hosted an all-day training event to strengthen how military and civilian communities work together to support servicemembers who report sexual assault in a joint program between DOD and the Justice Department  October 19, 2016 – DOD released the 2016 Military Investigation and Justice Experience Survey that allowed servicemembers who have experienced sexual assault and elected to participate in the military justice process the opportunity to provide DOD with direct feedback on their experiences; and to improve the services and support servicemembers reporting sexual assault  December 15, 2016 – Defense Department officials announced the release of the "DOD Plan to Prevent and Respond to Sexual Assault of Military Men," designed to enhance outreach to military men and increase efforts to help them recover  The following information was compiled using Congress gov, Congressional Quarterly (CQ com), House gov, Senate gov, and Roll Call  See the section "Resources" for a list of congressional hearings, reports and other documents  January 23, 2013 – The House Armed Services Committee held a hearing on sexual misconduct at Lackland Air Force Base in San Antonio, TX  January 25, 2013 – H R  430 , Protect Our Military Trainees Act, was introduced  This legislation would have amended the Uniform Code of Military Justice to protect new members of the Armed Forces who are undergoing basic training from the sexual advances of the members of the Armed Forces responsible for their instruction  It also requires that violators be punished as a court-martial may direct  March 5, 2013 – H R  975 , the Servicemember Mental Health Review Act, was introduced  This bill would have amended Title 10, United States Code, to extend the duration of the Physical Disability Board of Review and to the expand the authority of such Board to review the separation of members of the Armed Forces on the basis of a mental condition not amounting to disability, including separation on the basis of a personality or adjustment disorder  This would have included a review of those victims who have suffered military sexual trauma  March 13, 2013 – S  548 , Military Sexual Assault Prevention Act of 2013, was introduced, read twice, and referred to the Senate Armed Services Committee  This legislation aimed to amend Title 10, United States Code, and to improve capabilities of the Armed Forces to prevent and respond to sexual assault and sexual harassment in the Armed Forces  March 13, 2013 – Victims of sexual assault in the military testified before a Senate panel examining the military's handling of sexual assault cases and stated that the "military justice system is broken " They urged Congress to make changes in the law that would stem the rape, sexual assault, and sexual harassment that they said are pervasive in the service branches  Several male Navy veterans testified before the Senate Armed Service Committee's military personnel panel investigating sexual assaults in the military  One recounted that he was raped in 2000 by a higher-ranking petty officer aboard a submarine  He told the committee that he carries permanent shame not for the sexual assault but over how the Navy forced him to leave  He stated in his testimony, "I carry my discharge as an official and permanent symbol of shame, on top of the trauma of the physical attack, the retaliation and its aftermath " March 20, 2013 – S  628 , Servicemember Mental Health Review Act, was introduced, read twice and referred to the Committee on Armed Services  Related to H R  975 , this bill would have amended Title 10, United States Code, to extend the duration of the Physical Disability Board of Review and to the expand the authority of such board to review the separation of members of the Armed Forces on the basis of a mental condition not amounting to disability, including separation on the basis of a personality or adjustment disorder  This would have included a review of those victims who may have suffered military sexual trauma  April 17, 2013 – H R  1593 , Sexual Assault Training Oversight and Prevention (STOP) Act, was introduced  This bill seeks to amend Title 10, United States Code, by establishing a Sexual Assault Oversight and Response Council and an enhanced Sexual Assault Oversight and Response Office "to improve the prevention of and response to sexual assault in the Armed Forces, and by requiring the appointment of a Director of Military Prosecutions for sexual-related offenses committed by a member of the Armed Forces " April 26, 2013 – A U S  senator reportedly put a hold on the nomination of Air Force Lt  Gen  Susan Helms, nominated to serve as vice commander of the U S  Space Command  Earlier in February 2012, Gen  Helms rejected the recommendation of legal counsel and overturned the conviction of an Air Force captain who had been found guilty of aggravated sexual assault of a female lieutenant  May 7, 2013 – S  871 , Combating Military Sexual Assault Act of 2013, was introduced, read twice and referred to the Committee on Armed Services  This legislation would have aimed to provide any victim with a special military lawyer who would assist them throughout the process, prohibit sexual contact between instructors and trainees during and within 30 days of completion of basic training or its equivalent, and ensure that sexual assault response coordinators are available to help members of the National Guard and Reserve  May 7, 2013 – H R  1864 , to amend Title 10, United States Code, would have required an Inspector General investigation of allegations of retaliatory personnel actions taken in response to making protected communications regarding sexual assault, was introduced and referred to the House Armed Services Committee  This bill would have required the Inspector General of the Department of Defense (DOD), the Department of Homeland Security (DHS) with respect to the Coast Guard, or any of the military departments to investigate allegations of retaliatory personnel actions taken in response to making protected communications regarding alleged instances of rape, sexual assault, or other forms of sexual misconduct in violation of the Uniform Code of Military Justice  May 7, 2013 – At the Senate Armed Services Committee, Subcommittee on Personnel hearing Gen  Mark Welsh, the Air Force's Chief of Staff, told the committee that he and Air Force Secretary Michael Donley were "appalled" by the charges against Lt  Col  Jeffrey Krusinski, branch chief of the Air Force's Sexual Assault and Prevention Office  He was arrested and charged by Arlington County, VA, police for allegedly being drunk and groping a woman in a parking lot one mile from the Pentagon  "Sexual assault prevention and response efforts are critically important to us," Welsh said  "It is unacceptable that this occurs anywhere, at any time, in our Air Force " May 8, 2013 – H R  1867 , the Better Enforcement for Sexual Assault Free Environments (BE SAFE) Act of 2013, was introduced, read twice, and referred to the House Armed Services Committee  This bill would have amended Title 10, United States Code, "to require an Inspector General investigation of allegations of retaliatory personnel actions taken in response to making protected communications regarding sexual assault " This bill would ensure those found guilty of rape, sexual assault, sodomy, or an attempt to commit any of those crimes, are—at a minimum—dismissed or dishonorably discharged from the military  The five-year statute of limitations within the military's justice system for sexual assault cases would be eliminated, and legal assistance services available to victims would be expanded  May 8, 2013 – In a hearing of the Defense Subcommittee of the Senate Appropriations Committee, senators questioned the Air Force's top leaders over rising sexual assaults in the military  Some senators cited DOD statistics from the Annual Report on Sexual Assault in the Military 2012 on the number of incidents of sexual assaults the same week Lt  Col  Jeffrey Krusinski, Chief of the Air Force's Sexual Assault Prevention and Response Branch, was arrested and charged with sexual battery  May 9, 2013 – A hearing of the Defense Subcommittee of the House Appropriations Committee on the Air Force budget was held  Witnesses included Michael Donley, Secretary of the Air Force, and General Mark Welsh, Air Force Chief of Staff  Members of the committee questioned them on Defense Secretary Hagel's review of the decision by Lt  Gen  Craig Franklin to dismiss Lt  Col  James Wilkerson's sexual assault conviction  May 14, 2013 – H Res  213 , a resolution to establish the "Special Committee on Sexual Assault and Abuse in the Armed Forces" was introduced  A "Dear Colleague" memorandum urged support of this legislation referencing Gen  Martin Dempsey's denouncement of military sexual assault as a "crisis" and the need for Congress to address this problem in a "deeper, more comprehensive manner " This Special Committee would have included 19 members appointed by the Speaker and Minority Leader, as well as chairman and ranking members of the committees on Armed Services, Appropriations, Judiciary, and Oversight and Government Reform  May 14, 2013 – H R  1960 , a bill to authorize appropriations for FY2014 for military activities of the Department of Defense, for military construction, and for defense activities of the Department of Energy, to prescribe military personnel strengths for such fiscal year, and for other purposes, was introduced  The FY2014 NDAA addressed the issue of sexual assault in the military by establishing minimum sentencing guidelines for any service members found guilty of sexual assault as well as other provisions  May 15, 2013 – H R  1986 , Sexual Assault Nurse Examiner (SANE) Deployment Act, was introduced  This bill would have provided for the assignment of Sexual Assault Nurse Examiners-Adult/Adolescent to brigades and equivalent units of the Armed Forces  May 15, 2013 – H R  2002 , Combating Military Sexual Assault Act of 2013, was introduced and referred to the House Committee on Armed Services  This bill was related to S  871 , and would have provided any sexual assault victim with a special military lawyer who would assist them throughout the process, prohibit sexual contact between instructors and trainees during and within 30 days of completion of basic training or its equivalent, and ensure that sexual assault response coordinators (SARCs) are available to help members of the National Guard and Reserve  May 16, 2013 – H R  2016 , Military Justice Improvement Act of 2013, was introduced and referred to the Committee on Armed Services  This bill would have required "a commanding officer who receives a report of a sexual-related offense involving a member in such officer's chain of command to act immediately upon such report by way of referral to the appropriate criminal investigative office or service " This bill was related to S  538 , Military Sexual Assault Prevention Act of 2013, and S  967 , Military Justice Improvement Act of 2013  May 16, 2013 – S  967 , Military Justice Improvement Act of 2013, was introduced, read twice, and referred to the Committee on Armed Services  This bill would have required a commanding officer who receives a report of a sex-related offense involving a member in such officer's chain of command to act immediately upon such report by way of referral to the appropriate criminal investigative office or service  May 21, 2013 – S  992 , a bill to provide for offices on sexual assault prevention and response under the Chiefs of Staff of the Armed Forces, to require reports on additional offices and selection of sexual assault prevention and response personnel, and for other purposes  This bill was read twice and referred to the Committee on Armed Services  May 22, 2013 – A House panel passed a number of changes in sexual assault prevention programs that limited commander discretion in reducing or dismissing rape and assault charges and expanded support services for victims  The House Armed Services Subcommittee on Military Personnel approved the personnel issues as part of H R  1960 , the FY2014 NDAA bill  May 22, 2013 – The Senate Appropriations Subcommittee on Defense held a hearing on the Army's FY 2014 Budget Request  Witnesses included Secretary of the Army, John McHugh and Chief of Staff of the Army, General Raymond T  Odierno  Army Secretary McHugh announced at this hearing that the service will soon require soldiers being considered for sexual assault prevention jobs to undergo behavioral-health evaluations as a way of screening out potential sex offenders from these high-profile positions  This was in response to a senator's question about the criteria for sexual assault prevention jobs  McHugh said that service record and availability are the only criteria commanders are using to fill these jobs since sexual-assault prevention positions do not fall under any military occupational specialty and lack career incentives  May 23, 2013 – S  1032 , Better Enforcement for Sexual Assault Free Environments Act of 2013, was introduced, read twice and referred to the Committee on Armed Services  This bill would amend Title 10, United States Code, to make certain improvements in the Uniform Code of Military Justice related to sex-related offenses committed by members of the Armed Forces  June 4, 2013 – The uniformed chiefs of the Army, Navy, Air Force, Marine Corps, and Coast Guard appeared before a hearing of the Senate Armed Services Committee, Subcommittee on Military Personnel  These military leaders acknowledged that despite a "zero tolerance" for sexual abuse, they had neglected the "epidemic" in the ranks by not always monitoring subordinate commanders  Chairman of the Joint Chiefs of Staff, Army Gen  Martin Dempsey pointed to competing demands and pressures of fighting two wars in Iraq and Afghanistan, as a justification for lack of adequate monitoring  The Service Chiefs voiced support for legislative changes that would take tougher action against offenders and provide more support for victims of military sexual assault  They opposed a legislative proposal that would remove unit commanders' legal power to oversee major criminal cases and transfer that authority to uniformed prosecutors  The Army Chief of Staff, Gen  Ray Odierno, noted that taking away commanders' authority in matters of military justice would adversely impact discipline and that "we cannot, however, simply 'prosecute' our way out of this problem  At its heart, sexual assault is a discipline issue that requires a culture change " June 4, 2013 – S  1092 was introduced, read twice, and referred to the Senate Armed Services Committee  This bill would have amended Title 10, United States Code, to require an Inspector General investigation of allegations of retaliatory personnel actions taken in response to making protected communications regarding sexual assault  June 6, 2013 –would allow victims of sexual assault to apply for a permanent change The House Armed Services Committee passed H R  1960 , the NDAA for FY2014, by a vote of 59-2  According to the Committee's Fact Sheet, "the FY14 NDAA of station or unit transfer, while authorizing the Secretary of Defense to inform commanders of their authority to remove or temporarily reassign service members who are the alleged perpetrators of sexual assault  It also requires the provision of victims' counsels, qualified and specially trained lawyers in each of the services, to be made available to provide legal assistance to the victims of sex-related offenses  The FY14 NDAA adds rape, sexual assault, or other sexual misconduct to the protected communications of service members with a Member of Congress or an Inspector General " June 14, 2013 – The House passed H R  1960 , the NDAA for FY2014 by a vote of 315 to 108 (Roll no  244)  This bill includes a provision protecting victims of sexual assault in the Armed Forces as protected communications under military whistle-blower laws, to shield victims against retaliatory actions  The measure seeks to encourage more victims to report assaults, rape and other forms of sexual misconduct  June 17, 2013 – H R  2397 , "Department of Defense Appropriations Act, 2014," was introduced and referred to the House Committee on Appropriations  It was reported as an original measure, H Rept  113-113   Lawmakers wrote in this committee report that they were "outraged by the pervasive problem of sexual assault in the Armed Forces  Sexual assault is not just an issue in the military; it is an epidemic  To address it, the Committee believes that there must be a culture change at every level of the military, from the most senior leadership to the most junior ranks " Included was a measure that would provide $182 million for the Pentagon's Sexual Assault Prevention and Response Office (SAPRO) and for an expansion of a victim's counseling program  For FY2013, the programs received $95 million  The bill included $25 million that was not requested by the administration in a transfer account to expand assistance across the Defense Department  June 20, 2013 – S  1197 , NDAA for Fiscal Year 2014, was introduced in the Senate  This bill would have authorized "appropriations for fiscal year 2014 for military activities of the Department of Defense, for military construction, and for defense activities of the Department of Energy, to prescribe military personnel strengths for such fiscal year, and for other purposes," and referred to the Committee on Armed Services  The original measure was reported to the Senate in Report No  113-44 and placed on the Legislative Calendar under General Orders (Calendar No  91)  Included in this bill was Title V—Military Personnel Policy, Subtitle E—Sexual Assault Prevention and Response and Military Justice  June 27, 2013 – H R  1864 , a bill "To amend Title 10, United States Code, to require an Inspector General investigation of allegations of retaliatory personnel actions taken in response to making protected communications regarding sexual assault," was agreed to/passed in the House, 423-0 (Roll no  294)  July 18, 2013 – Army Gen  Martin E  Dempsey, the chairman of the Joint Chiefs of Staff, and Navy Adm  James A  Winnefeld Jr , the vice chairman, in a hearing before the Senate Armed Services Committee said that commanders should retain responsibility for prosecuting service members accused of sexual assault, and taking that authority away could harm good order and discipline  July 2 2 , 2013 – H R  2777 , Stop Pay for Violent Offenders Act, was introduced "to amend Title 10, United States Code, to authorize the Secretaries of the military departments to suspend the pay and allowances of a member of the Armed Forces who is held in confinement pending trial by court-martial or by civil authority for any sex-related offense or capital offense " July 24, 2013 – H Amdt  408 to H R  2397 , an amendment to provide funds to identify individuals who were separated from the military on the grounds of a disorder subsequent to reporting a sexual assault and, if appropriate, correcting their record  This amendment (A065) was agreed to by voice vote  July 24, 2013 – H R  2397 , "Department of Defense Appropriations Act, 2014," was passed/agreed to in House, 315 - 109 (Roll no  414)  October 22, 2013 – H R  3304 , the NDAA for FY2014, was introduced in the House  As introduced, the bill would have provided for a defense counsel interview of victim of an alleged sex-related offense in presence of trial counsel, counsel for the victim, or a Sexual Assault Victim Advocate, prohibition on service in the Armed Forces by individuals who have been convicted of certain sexual offenses, Coast Guard regulations regarding request for permanent change of station or unit transfer by victim of sexual assault, temporary administrative reassignment or removal of an active duty member accused of committing a sexual assault, Inspector General investigation of allegations of retaliatory personnel actions taken in response to making protected communications regarding sexual assault, compliance tracking of commanding officers in conducting organizational climate assessments for purposes of preventing and responding to sexual assaults, advancement of submittal deadline for report of independent panel on assessment of military response systems to sexual assault, retention of certain forms on sexual assault, timely access to Sexual Assault Response Coordinators by the National Guard and Reserves, and qualifications and selection of Department of Defense sexual assault prevention and response personnel and required availability of Sexual Assault Nurse Examiners  It also would establish commanding officer actions regarding sexual assault reports, an eight-day incident reporting requirement in response to unrestricted report of sexual assault in which the victim is a member of the Armed Forces, and curricula that addresses the prevention of sexual assault at the military service academies  December 26, 2013 – H R  3304 , the NDAA for FY2014 became P L  113-66   As enacted, the bill included more than two dozen provisions to address an epidemic of sexual assault in the military in Title XVII—Sexual Assault Prevention and Response and Related Reforms, Subtitle A—Reform of Uniform Code of Military Justice  February 26, 2014 – Dr  Karen S  Guice, principal deputy assistant secretary of defense for health affairs, and other Defense Department officials testified before the Senate Armed Services Committee's personnel subcommittee on the relationship between military sexual assault survivors and the subsequent development of suicide and post-traumatic stress disorder  April 9, 2014 – H R  4435 , the Howard P  "Buck" McKeon National Defense Authorization Act for Fiscal Year 2015, was introduced in the House  The bill would have applied Title XVII of the National Defense Authorization Act for Fiscal Year 2014 ( P L  113-66 ; 127 Stat  950) to the military service academies, consulted with victims of sexual assault regarding victims' preference for prosecution of offense by court-martial or civilian court, created a confidential review of characterization of terms of discharge for victims of sexual offenses, revised requirements relating to DOD policy on retention of evidence in a sexual assault case to allow return of personal property upon completion of related proceedings, required the DOD Inspector General to review separation of members who made unrestricted reports of sexual assault, and would have created a deadline for submission of report containing results of review of Office of Diversity Management and Equal Opportunity role in sexual harassment cases  Prior to passing in the House, the House Armed Services Committee rejected an amendment from Congresswoman Speier that would have removed the military chain of command from decisions to prosecute sexual assault cases and other major crimes, except offenses that are unique to the military  She offered an alternative proposal, which would have only removed commanding officers' prosecutorial discretion for instances of sexual assault, that was also rejected by a 28-34 vote  It was received in the Senate, read twice, and placed on Senate Legislative Calendar under General Orders  Calendar No  425  June 2, 2014 — S  2410 , the Carl Levin National Defense Authorization Act for Fiscal Year 2015, was introduced in the Senate  It was placed on Senate Legislative Calendar under General Orders  Calendar No  402  The bill included measures on military justice such as enhancing sexual assault prevention and response, the application of P L  113-66 , Title XVII to military academies, and the collaboration between the Departments of Justice and Defense  December 19 , 2014 — H R  3979 , the Carl Levin and Howard P  "Buck" McKeon National Defense Authorization Act for Fiscal Year 2015, was signed as P L  113-291   Subtitle D—Military Justice, Including Sexual Assault and Domestic Violence Prevention and Response addressed the following: modification of DOD policy on retention of evidence in a sexual assault cases to permit return of personal property upon completion of related proceedings; requirements relating to Sexual Assault Forensic Examiner; analysis and assessment of disposition of most serious offenses; a plan for limited use of certain information on sexual assaults in restricted reports by military criminal investigative organizations; the establishment of a Defense Advisory Committee on Investigation, Prosecution, and Defense of Sexual Assault in the Armed Forces; confidential review of the terms of discharge of sexual assault survivors; deadline for submission of report containing results of review of Office of Diversity Management and Equal Opportunity role in sexual harassment cases; and applied Title XVII of the NDAA for Fiscal Year 2014 ( P L  113-66 ; 127 Stat  950) to the military service academies  January 13, 2015 — S  178 , the Justice for Victims of Trafficking Act of 2015 was introduced in the Senate  Title V of this bill "Military Sex Offender Reporting" stipulates that the Secretary of Defense shall provide the Attorney General information about sex offenders in the military to be included in the National Sex Offender Registry and the Dru Sjodin National Sex Offender Public Website  It became P L  114-22 on May 29, 2015  February 3, 2015 — H R  677 , American Heroes COLA Act of 2015, was introduced in the House, passed on February 9, and the next day was received in the Senate, read twice, and referred to the Committee on Veterans' Affairs  Section 6 proposed that veterans whose claims were being reviewed again in relation to a previously denied claim relating to military sexual trauma be given priority, among other claims  February 12, 2015 — H R  956 , the Military Track, Register and Alert Communities Act of 2015 (Military TRAC Act) was introduced in the House and referred to the House Armed Services Committee's Subcommittee on Military Personnel on November 23  This bill intended to require DOD to maintain a sex offender registry of individuals convicted of certain sex offenses under the Uniform Code of Military Justice or of other military offenses appropriate for sex offender registration purposes  April 13, 2015 — H R  1735 , the National Defense Authorization Act for Fiscal Year 2016, was introduced in the House  Subtitle D addressed military justice, including sexual assault and domestic violence prevention and response  April 24, 2015 — H R  2029 , the Consolidated Appropriations Act, 2016 was introduced in the House and later became P L  114-113   Section 8057 specified that "$25,000,000 shall be for continued implementation and expansion of the Sexual Assault Special Victims' Counsel Program " May 14, 2015 — S  1356 , the National Defense Authorization Act for Fiscal Year 2016 was introduced in the Senate and later became P L  114-92 on November 25, 2015  Subtitle D "Military Justice, Including Sexual Assault and Domestic Violence Prevention and Response" amended the Uniform Code of Military Justice, authorized Special Victims' Counsel for civilian DOD employees, required the DOD to develop a policy to standardize the training for Special Victims' Counsel, required the establishment of Defense Advisory Committee on Investigation, Prosecution, and Defense of Sexual Assault in the Armed Forces within 90 days, required the development of a plan to improve prevention and response to sexual assaults of male members of the Armed Forces, required the establishment of a strategy to prevent retaliation against Armed Forces members who report or intervene on behalf of sexual assault victims, and authorized the President to modify Rule 304(c) of the Military Rules of Evidence to conform to the rules governing the admissibility of the corroboration of admissions and confessions in the trial of criminal cases in the U S  district courts  June 11, 2015 — S  1558 , Department of Defense Appropriations Act, 2016, was introduced in the Senate  The bill would have required specified O&M funds to be used for continued implementation and expansion of the Sexual Assault Prevention and Response Program  June 11, 2015 — S  1567 , a bill to amend Title 10, United States Code, to provide for a review of the characterization or terms of discharge from the Armed Forces of individuals with mental health disorders alleged to affect terms of discharge, was introduced in the Senate  The bill proposed to address medical evidence reviews for former members applying for relief from the terms of their discharge due to military sexual trauma among other conditions  June 11, 2015 — S Amdt  1578 to S Amdt  1463 in H R  1735 , National Defense Authorization Act for Fiscal Year 2016, was proposed in the Senate and later considered and defeated on June 16  This bill was intended to reform procedures for determinations to proceed to trial by court-martial for certain offenses under the Uniform Code of Military Justice  It did not achieve 60 votes in the Senate by Yea-Nay Vote  The final vote was 50 - 49  April 12, 2016 — H R  4909 , the NDAA for FY2017, was introduced in the House where it passed on May 18  On May 26, it was received in the Senate, read twice, and placed on Senate Legislative Calendar under General Orders  Calendar No  502  April 18, 2016 — H R  4991 , the Prevent Retaliation and Open up Transparency to Expand Care for Troops (PROTECT) Act of 2016, was introduced in the House and later referred to the House Armed Services' Subcommittee on Military Personnel  The bill intended to amend the Uniform Code of Military Justice to establish the offense of retaliation with provisions that would permit any person intent on retaliating against anyone for reporting or planning to report a criminal offense to be punished as a court-martial may direct  May 18, 2016 — S  2943 , the National Defense Authorization Act for Fiscal Year 2017, was introduced in the Senate and became P L  114-328 on December 23  Subtitle D specified requirements for the review by a discharge review board of claims by former members asserting post-traumatic stress disorder (PTSD) or traumatic brain injury (TBI) in connection with combat or sexual trauma  Subtitle E "Military Justice and Legal Assistance Matters" required an annual report on sexual assault and response efforts, required Sexual Assault Prevention and Response Office to establish evaluation metrics and best practices in the prevention of and response to retaliation, and modified the definition of sexual harassment for the purposes of investigations of complaints of harassment by commanding officers  Title XXXV "Maritime Matters" established requirements for policies and training regarding sexual harassment and sexual assault prevention and response at the U S  Merchant Marine Academy and required the Inspector General of the Department of Transportation to submit a report to Congress about the sexual harassment and sexual assault prevention and response program at the U S  Merchant Marine Academy  Title LIV "Court-Martial Jurisdiction" specified the sexual offenses over which general courts-martial have exclusive jurisdiction  Title LX "Punitive Articles" created a new section of the Uniform Code of Military Justice addressing accountability for sexual misconduct committed by recruiters and trainers during the various phases within the recruiting and basic military training environments, revised the definition of ''sexual act'' with respect to the offenses of rape and sexual assault  May 19, 2016 — H R  5293 , Department of Defense Appropriations Act, 2017, was introduced in the House, passed on June 16, received in the Senate the next day, where it received a motion to proceed to consideration  The bill would have required O&M funds to be used for continued implementation and expansion of the Sexual Assault Prevention and Response (SAPR) Program  May 26, 2016 — S  3000 , Department of Defense Appropriations Act, 2017, was introduced in the Senate and placed on Senate Legislative Calendar under General Orders  Calendar No  500  The Senate Committee on Appropriations, Subcommittee on Department of Defense held several hearings prior from February-April  The bill would have required specified O&M funds to be used for continued implementation and expansion of the SAPR Program  DOD Directive No  6495 01  "Sexual Assault Prevention and Response (SAPR) Program," January 23, 2012, Incorporating Change 3, April 11, 2017, at http://www esd whs mil/Portals/54/Documents/DD/issuances/dodd/649501p pdf DOD Directive No  6495 02  "Sexual Assault Prevention and Response (SAPR) Program Procedures," March 28, 2013, Incorporating Change 3, May 24, 2017, at https://www esd whs mil/Portals/54/Documents/DD/issuances/dodi/649502p pdf DOD Inspector General (IG)  E valuation of the Military Criminal Investigative Organizations Sexual Assault Investigations, DODIG-2013-091, July 9, 2013, 104 p   at http://www dodig mil/reports html/Article/1118941/evaluation-of-the-military-criminal-investigative-organizations-sexual-assault/ Sexual Assault Prevention and Response Office (SAPRO) at https://www sapr mil/ Includes the full text of DOD Annual Reports, FY2004 - FY2016, and reports on Sexual Harassment and Violence at the U S  Military Service Academies, Academic Program Years (APY) 2005-2018  "Final 2014–2015 Academic Program Year Annual Report on Sexual Harassment and Sexual Assault at the United States Merchant Marine Academy," Maritime Administration, undetermined date, at https://www marad dot gov/wp-content/uploads/pdf/Final-2014-2015-SASH-Report pdf "Department of Transportation U S  Merchant Marine Academy Culture Audit, Deliverable 4  Final Report," U S  Merchant Marine Academy, December 2016, at https://cms dot gov/sites/dot gov/files/docs/mission/civil-rights/263966/dot-usmma-report pdf "Sexual Assault Prevention and Response (SAPR) Program," United States Coast Guard, LMI, December 2016, at https://media defense gov/2017/Mar/29/2001723560/-1/-1/0/CIM_1754_10E PDF "Preliminary 2015-2016 Academic Year Biennial Survey and Report on Sexual Harassment and Sexual Assault at the United States Merchant Marine Academy," Maritime Administration, January 12, 2017, at https://www marad dot gov/wp-content/uploads/pdf/Preliminary-2015-2016-SASH-Report pdf Military Justice: Oversight and Better Collaboration Needed for Sexual Assault Investigations and Adjudications , GAO-11-579, Jun 22, 2011, 42 p  http://www gao gov/products/GAO-11-579 Preventing Sexual Harassment: DOD Needs Greater Leadership Commitment and an Oversight Framework , GAO-11-809, Sep 21, 2011, 47 p  http://www gao gov/assets/590/585344 pdf Prior GAO Work on DOD's Actions to Prevent and Respond to Sexual Assault in the Military , GAO-12-571R, Mar 30, 2012, 40 p  http://www gao gov/assets/590/589780 pdf DOD Has Taken Steps to Meet the Health Needs of Deployed Servicewomen, but Actions Are Needed to Enhance Care for Sexual Assault Victims, GAO-13-182, January 29, 2013, 40 p  http://www gao gov/assets/660/651624 pdf Military Personnel: Actions Needed to Address Sexual Assaults of Male Servicemembers, Report to the Committee on Armed Services , GAO-15-284, March 19, 2015, 86 p  http://www gao gov/products/GAO-15-284 Sexual Assault: Actions Needed to Improve DOD's Prevention Strategy and to Help Ensure It Is Effectively Implemented, GAO-16-61, November 4, 2015, 59 p  http://www gao gov/products/GAO-16-61 DOD and Coast Guard: Actions Needed to Increase Oversight and Management Information on Hazing Incidents Involving Servicemembers, GAO-16-226, Feb 9, 2016, 74 p  http://www gao gov/products/GAO-16-226 The following news sources are listed in chronological order to make it easier to follow the numerous incidents of wide-spread misconduct reported in the media  Military com has ongoing news on military sexual assault at http://www military com/topics/sexual-assault   Montgomery, Nancy  "Johnson Found Guilty of Last Two Counts; Awaits Sentencing " Stars and Stripes , June 13, 2012, at http://www stripes com/news/johnson-found-guilty-of-last-two-counts-awaits-sentencing-1 180204 Carroll, Chris  "Air Force has Identified 31 Alleged Victims in Lackland Sex Abuse Scandal," Stars and Stripes, June 28, 2012, at http://www stripes com/news/air-force-has-identified-31-alleged-victims-in-lackland-sex-abuse-scandal-1 181597 Dao, James  "Instructor for Air Force Is Convicted in Sex Assaults," New York Times , July 20, 2012, at http://www nytimes com/2012/07/21/us/lackland-air-force-base-instructor-guilty-of-sex-assaults html?pagewanted=all&_r=0 Blansett, Susan and Hoffman, Michael  "Sexual Assault Cases Flood Military Courts," Military com, August 13, 2012, at http://www military com/daily-news/2012/08/13/sex-assault-cases-flood-military-courts html Risen, James  "Honor Betrayed: Attacked at 19 by an Air Force Trainer, and Speaking Out," New York Times , February 26, 2013, at http://www nytimes com/2013/02/27/us/former-air-force-recruit-speaks-out-about-rape-by-her-sergeant-at-lackland html?pagewanted=all Mulrine, Anne  "Seeking the Sex-Assault Solution," Air Force Magazine , April 2013, at http://www airforcemag com/MagazineArchive/Pages/2013/April%202013/0413solution aspx "5 Former Lackland Commanders Disciplined," Military com, May 2, 2013, at http://www military com/daily-news/2013/05/02/5-former-lackland-commanders-disciplined html Kime, Patricia  "Lawmakers Act Fast with New Legislation on Military Sexual Assault " Army Times , May 7, 2013  Shapira, Ian  "July Trial Set for Jeffrey Krusinski, Air Force Officer Accused of Sexual Battery " Washington Post , May 9, 2013, at https://www washingtonpost com/local/july-trial-set-for-air-force-officer-accused-of-sexual-battery/2013/05/09/8a21eb92-b8d9-11e2-92f3-f291801936b8_story html?utm_term= e0d4951e6573 Steinhauer, Jennifer  "Lawmakers, at White House, Discuss Sex Abuse in Military " New York Times , May 9, 2013, at http://www nytimes com/2013/05/10/us/politics/lawmakers-huddle-at-white-house-on-sex-abuse-in-military html?_r=0 Whitlock, Craig  "Pentagon Grapples with Sex Crimes by Military Recruiters," Washington Post , May 12, 2013, at http://articles washingtonpost com/2013-05-12/world/39210853_1_military-recruiters-sexual-abuse-army-reserve Sisk, Richard  "Assault Prevention NCO Investigated for Sex Crimes " Military com, May 15, 2013, at http://www military com/daily-news/2013/05/15/assault-prevention-nco-investigated-for-sex-crimes html Whitlock, Craig  "Some in Congress want Changes in Military Law as a Result of Sex Crimes," Washington Post , May 15, 2013, at http://www washingtonpost com/world/national-security/some-in-congress-want-changes-in-military-law-as-result-of-sex-crimes/2013/05/15/672a2a8a-bd8b-11e2-a31d-a41b2414d001_story html Sisk, Richard  "Sex Assault Crisis Pushes Senate to Overhaul UCMJ," Military com, May 16, 2013, at http://www military com/daily-news/2013/05/16/sex-assault-crisis-pushes-senate-to-overhaul-ucmj html Tilghman, Andrew  "Dempsey: DOD May Have Become 'Too Forgiving' of Sexual Assault," Army Times , May 17, 2013  Brady, Gen  Roger Brady (ret )  "Commentary: Telling Truths about Sexual Assault is Risky," Air Force Times , May  21, 2013  Salcedo, Michele  "Senator: Fire Commanders Allowing Sex Assault," Army Times, May 26, 2013  Tucker, Eric  "More Details Released on Annapolis Sex Assault Investigation: Allegations Made Against Three Football Players," Navy Times , May 30, 2013  Lardner, Richard  "Brass Seeks to Temper Military Justice Overhaul," Associated Press, June 3, 2013, at http://www military com/daily-news/2013/06/03/brass-seeks-to-temper-military-justice-overhaul html Cassata, Donna and Richard Lardner  "Sexual Assaults Force Changes to Military Justice," Associated Press, June 4, 2013, at http://www military com/daily-news/2013/06/04/sexual-assaults-force-changes-to-military-justice html Zengerle, Patricia  "U S  Lawmakers Act to Limit Military Authority in Sex Assault Cases," Reuters, June 5, 2013, at http://www reuters com/article/2013/06/05/us-usa-military-sexassault-congress-idUSBRE9541IG20130605 Cassata, Donna and Richard Lardner  " House OKs 2-Yr Jail Term for Military Sex Assault ," Associated Press, June 14, 2013, at http://www military com/daily-news/2013/06/14/house-oks-2-year-jail-term-for-military-sex-assault html Montgomery, Nancy  " After 2 decades of sexual assault in military, no real change in message ," Stars and Stripes , July 7, 2013, at https://www stripes com/news/after-2-decades-of-sexual-assault-in-military-no-real-change-in-message-1 229091 Steinhauer, Jennifer  "Complex Fight in Senate over Curbing Military Sex Assaults," New York Times , June 14, 2013, at http://www nytimes com/2013/06/15/us/politics/in-senate-complex-fight-over-curbing-sexual-military-assaults html?pagewanted=all Dao, James  "In Debate over Military Sexual Assault, Men Are Overlooked Victims," New York Times , June 23, 2013, at http://www nytimes com/2013/06/24/us/in-debate-over-military-sexual-assault-men-are-overlooked-victims html?pagewanted=all&_r=0 Sisk, Richard  "Military Tries to Sever Booze, Sex Assault Link," Military com, July 8, 2013, at http://www military com/daily-news/2013/07/08/military-tries-to-sever-booze-sex-assault-link html Watson, Julie  "Military Works to Change Culture to Combat Rape," Associated Press, July 15, 2013, at http://www military com/daily-news/2013/07/15/military-works-to-change-culture-to-combat-rape html Olson, Wyatt  "IG Review Finds Deficiencies in Sex Assault Cases," Stars and Stripes, July 16, 2013, at http://www military com/daily-news/2013/07/16/ig-review-finds-deficiencies-in-sex-assault-cases html Shanker, Thom  "New Support for Military in Sex Cases," New York Times , July 24, 2013, at http://www nytimes com/2013/07/25/us/politics/new-support-for-military-in-sex-cases html Taranto, James  "A Strange Sort of Justice at West Point," The Wall Street Journal, July 26, 2013, at https://www wsj com/articles/a-strange-sort-of-justice-at-west-point-1376453937 Cassata, Donna, "Senator Targets Military Law over Sexual Assault," Associated Press, July 29, 2013, at http://www military com/daily-news/2013/07/29/senator-targets-military-law-over-sexual-assault html?comp=7000023317843&rank=3 Groer, Annie  " Military brass claim progress in pursuing sexual assault cases ," Washington Post, August 1, 2013, at https://www washingtonpost com/blogs/she-the-people/wp/2013/08/01/military-brass-claim-progress-in-pursing-sexual-assault-cases/?utm_term= 72e55e7e218c Jennifer Koons  "Sexual Assault in the Military: Can the Pentagon stem the rise in incidents?" CQ Researcher , vol  23, no  29 (A ugust 9, 2013 ), p p  693-716   Laird, Lorelei  " Military lawyers confront changes as sexual assault becomes big news ," ABA (American Bar Association) Journal , September 2013, at http://www abajournal com/magazine/article/military_lawyers_confront_changes_as_sexual_assault_becomes_big_news/ Jelinek, Pauline  " Pentagon: Reports of Sexual Assault Up 46 Percent ," Associated Press, November 8, 2013, at http://www military com/daily-news/2013/11/08/pentagon-reports-of-sexual-assault-up-46-percent html Matthews, Michael F  " The Untold Story of Military Sexual Assault ," The New York Times, November 24, 2013, at http://www nytimes com/2013/11/25/opinion/the-untold-story-of-military-sexual-assault html " Men Sexually Assaulted in the Military Speak Out ," Baltimore Sun, December 20, 2013, at http://www military com/daily-news/2013/12/20/men-sexually-assaulted-in-the-military-speak-out html Kageyama, Yuri and Richard Lardner  "Documents Reveal Chaotic Military Sex-Abuse Record," Associated Press, February 10, 2014, at http://www military com/daily-news/2014/02/10/documents-reveal-chaotic-military-sex-abuse-record html Montgomery, Nancy  "AF Program Rare Bright Spot in Sex Assault Fight," Stars and Stripes , February 27, 2014, at http://www military com/daily-news/2014/02/27/air-force-program-rare-bright-spot-in-sex-assault-fight html Cox, Matthew  "Alcohol Policies Reviewed as Sex Assault Rises," Military com, May 1, 2014, at http://www military com/daily-news/2014/05/01/alcohol-policies-reviewed-as-sex-assault-rises html Burns, Robert  "Army Knocks 2-Star Down to 1-Star Rank," Associated Press, August 27, 2014, at http://www military com/daily-news/2014/08/27/army-knocks-2-star-down-to-1-star-rank html Milham, Matt  "Army: It's Good News That Sexual Assault Reports Are Up," Stars and Stripes , September 26, 2014, at http://www military com/daily-news/2014/09/26/army-its-good-news-that-sexual-assault-reports-are-up html Draper, Robert  The Military's Rough Justice on Sexual Assault," New York Times , November 26, 2014, at https://www nytimes com/2014/11/30/magazine/the-militarys-rough-justice-on-sexual-assault html Sisk, Richard  "Sexual Assault Reports Increase 8%, Pentagon Cites Progress," Military com, December 4, 2014, at http://www military com/daily-news/2014/12/04/sexual-assault-reports-increase-8-pentagon-cites-progress html Baldor, Lolita C  "Male Military Sex Assault Victims Slow to Complain," Associated Press, December 9, 2014, at http://www military com/daily-news/2014/12/09/male-military-sex-assault-victims-slow-to-complain html Roulo, Claudette  "Sexual Assault Rates Decrease at Military Service Academies," DOD News, Defense Media Activity, February 11, 2015, at http://archive defense gov/news/newsarticle aspx?id=128158 Pellerin, Cheryl  "DOD Honors Sexual Assault Response Coordinators," DOD News, April 23, 2015, at https://www defense gov/News/Article/Article/604510/ Rowe, Major Derek  "General courts-martial for sexual assault: How do they work?" Air Force News , April 28, 2015, at http://www af mil/News/Commentaries/Display/Article/586763/general-courts-martial-for-sexual-assault-how-do-they-work/ Sisk, Richard  "Military Sexual Assault Reports Increased 11 Percent Last Year," Military com, May 1, 2015, at http://www military com/daily-news/2015/05/01/military-sexual-assault-reports-increased-11-percent-last-year html Johnson, Lieutenant General Michelle D , U S  Air Force Academy superintendent; Vice Admiral Walter E  "Ted" Carter Jr , superintendent, U S  Naval Academy; Lieutenant General Robert L  Caslen, superintendent, U S  Military Academy; Rear Admiral James A  Helis, superintendent, U S  Merchant Marine Academy; Rear Admiral Sandra L  Stosz, superintendent, U S  Coast Guard Academy  "Lessons to Share: The five superintendents of federal service academies discuss how their institutions -- which faced scrutiny over sexual assault before many other colleges attracted such attention -- have responded to the issue," Inside Higher Ed, May 7, 2015, at https://www insidehighered com/views/2015/05/07/essay-how-federal-service-academics-prevent-and-punish-sexual-assault Tilghman, Andrew  "Military sexual assault claims: 1 in 20 lead to jail time," Military Times, May 13, 2015, at https://www militarytimes com/2015/05/13/military-sexual-assault-claims-1-in-20-lead-to-jail-time/ Schogol, Jeff  "Defense seeks dismissal of sexual assault case transferred to Washington," Air Force Times, October 17, 2015, at https://www airforcetimes com/news/your-air-force/2015/10/17/defense-seeks-dismissal-of-sexual-assault-case-transferred-to-washington/ Whitlock, Craig  "In the war against sexual assault, the Army keeps shooting itself in the foot," Washington Post, December 19, 2015, at https://www washingtonpost com/news/checkpoint/wp/2015/12/19/in-the-war-against-sexual-assault-the-army-keeps-shooting-itself-in-the-foot/?utm_term= d856136e939b Defense Media Activity  "Defense Department Proposes UCMJ Changes," DOD News, December 28, 2015, at https://www defense gov/News/Article/Article/638108/defense-department-proposes-ucmj-changes/ Losey, Stephen  "USAF launches new strategy to curb sexual assault," Air Force Times, December 30, 2015, at https://www airforcetimes com/news/your-air-force/2015/12/30/usaf-launches-new-strategy-to-curb-sexual-assault/ Kime, Patricia  "Sexual assault reporting rises at U S  service academies," Military Times , January 8, 2016, at https://www militarytimes com/news/your-military/2016/01/08/sexual-assault-reporting-rises-at-u-s-service-academies/ Larter, David B  "Navy sex assault victims may be eligible for early separation," Navy Times, January 20, 2016, at https://www navytimes com/news/your-navy/2016/01/20/navy-sex-assault-victims-may-be-eligible-for-early-separation/ Cox, John Woodrow  "Why sex assault reports have spiked at the Naval Academy, West Point and the Air Force Academy, Washington Post , March 11, 2016, at https://www washingtonpost com/news/checkpoint/wp/2016/03/11/why-sex-assault-reports-have-spiked-at-the-naval-academy-west-point-and-the-air-force-academy/?utm_term= a5e15f2f16f1 Whitlock, Craig, Thomas Gibbons-Neff  "Military bringing more charges against ofﬁcers for sexual assault," Washington Post, March 20, 2016, at https://www stripes com/news/us/military-bringing-more-charges-against-of%EF%AC%81cers-for-sexual-assault-1 400140# WeTFNOFRXUc Lardner, Richard  "Pentagon misled lawmakers on military sexual assault cases," Associated Press , April 18, 2016, at https://apnews com/23aed8a571f64a9d9c81271f0c6ae2fa/pentagon-misled-lawmakers-military-sexual-assault-cases Kheel, Rebecca  "Senators ask Obama to investigate whether Pentagon misled Congress," The Hill, April 19, 2016, at http://thehill com/policy/defense/276832-senators-ask-obama-to-investigate-pentagons-sexual-assault-comments Secretary of the Air Force Public Affairs  "Air Force report on sexual assault highlights program's progress," Air Force News , May 05, 2016, at http://www af mil/News/Article-Display/Article/752653/air-force-report-on-sexual-assault-highlights-programs-progress/ Tilghman, Andrew  "Military sex assault: Just 4 percent of complaints result in convictions," Military Times , May 5, 2016, at https://www militarytimes com/veterans/2016/05/05/military-sex-assault-just-4-percent-of-complaints-result-in-convictions/ Montgomery, Nancy  "US Military Court Addresses 'Incapable of Consent' to Sex Issue," Stars and Stripes , May 18, 2016, at http://www military com/daily-news/2016/05/18/us-military-court-addresses-incapable-of-consent-to-sex-issue html Losey, Stephen  "Military must do right by wrongly-discharged sexual assault victims, advocates say," Air Force Times , May 19, 2016, at https://www airforcetimes com/news/your-air-force/2016/05/19/military-must-do-right-by-wrongly-discharged-sexual-assault-victims-advocates-say/ Lyle, Amaani  "DoD Safe Helpline Offers Specialized Support to Sexual Assault Victims," DOD News, July 15, 2016, at https://dod defense gov/News/Article/Article/841166/dod-safe-helpline-offers-specialized-support-to-sexual-assault-victims/ Rein, Lisa  "Merchant Marine Academy under fire for sexual assault allegations," Stars and Stripes, August 12, 2016, at https://www stripes com/news/us/merchant-marine-academy-under-fire-for-sexual-assault-allegations-1 423595 Lyle, Amaani  "DoD Unveils Plan to Broaden Sexual Assault Support to Men," DOD News, Defense Media Activity, December 15, 2016, at https://www defense gov/News/Article/Article/1030795/dod-unveils-plan-to-broaden-sexual-assault-support-to-men/ The following sources are listed in alphabetical order by author  Burgess, Ann W , Donna M  Slattery, and Patricia A  Herlihy  "Military Sexual Trauma: A Silent Syndrome " Journal of Psychosocial Nursing & Mental Health Services 51, no  2 (2013): 20-6  D'Ambrosio-Woodward, Tricia  "Military Sexual Assault: A Comparative Legal Analysis of the 2012 Department of Defense Report on Sexual Assault in the Military: What It Tells Us, What It Doesn't Tell Us, and How Inconsistent Statistic Gathering Inhibits Winning the 'Invisible War '" Wisconsin Journal of Law, Gender & Society 29, no  2 (2014): 173-211  Farris, Coreen, Terry L  Schell and Terri Tanielian  Physical and Psychological Health Following Military Sexual Assault: Recommendations for Care, Research, and Policy   Santa Monica, CA: RAND Corporation, 2013  http://www rand org/pubs/occasional_papers/OP382 Firestone, Juanita M , J  M  Miller, and Richard Harris  "Implications for Criminal Justice from the 2002 and 2006 Department of Defense Gender Relations and Sexual Harassment Surveys " American Journal of Criminal Justice : AJCJ 37, no  3 (2012): 432-451  Gibson, Carolyn J , Kristen E  Gray, Jodie G  Katon, Tracy L  Simpson, and Keren Lehavot  "Sexual Assault, Sexual Harassment, and Physical Victimization during Military Service across Age Cohorts of Women Veterans " Women's Health Issues 26, no  2 (2016): 225-231  Harrell, Margaret C , Laura Werber, Marisa Adelson, Sarah J  Gaillot, Charlotte Lynch and Amanda Pomeroy  A Compendium of Sexual Assault Research   Santa Monica, CA: RAND Corporation, 2009  http://www rand org/pubs/technical_reports/TR617 Holland, Kathryn, Rabelo, Verónica, and Cortina, Lilia  Sexual Assault Training in the Military: Evaluating Efforts to End the 'Invisible War ' American Journal of Community Psychology 54, no  3/4 (2014): 289-303  Morral, Andrew R , Kristie Gore, and Terry L  Schell  Sexual Assault and Sexual Harassment in the U S  Military, Volume 1  Design of the 2014 RAND Military Workplace Study   Santa Monica, CA: RAND Corporation, National Defense Research Institute, 2014  https://www rand org/pubs/research_briefs/RB9841 html Morral, Andrew R , Kristie Gore, and Terry L  Schell  Sexual Assault and Sexual Harassment in the U S  military: Volume 2  Estimates for Department of Defense Service members from the 2014 RAND Military Workplace Study   Santa Monica, CA: RAND Corporation, National Defense Research Institute, 2015  https://www rand org/pubs/research_reports/RR870z2-1 html O'Brien, Carol, Jessica Keith, and Lisa Shoemaker  "Don't Tell: Military Culture and Male Rape " Psychological Services 12, no  4 (2015): 357-365  Stander, Valeria A  and Cynthia J  Thomsen  "Sexual Harassment and Assault in the U S  Military: A Review of Policy and Research Trends " AMSUS Military Medicine (Association of Military Surgeons of the United States) 181, no  1S (2016): 20-27  This chronological list of hearings was compiled from Congress gov and CQ com  U S  Congress, House Armed Services Committee, A Review of Sexual Misconduct by Basic Training Instructors at Lackland Air Force Base , 113 th Cong , 1 st sess , January 23, 2013, H A S C  No  113-2 (Washington, DC: GPO, 2013)  U S  Congress, House Appropriations Committee, Subcommittee on Defense, Department of Defense Appropriations for 2014 , Part 1, 113th Cong , 1 st sess , February 26, 2013 (Washington, DC: GPO, 2013)  U S  Congress, Senate Armed Services Committee, Subcommittee on Personnel, Testimony on Sexual Assault in the Military, 113 th Cong , 1 st sess , March 13, 2013, S  Hrg  113-303 (Washington, DC: GPO, 2013)  U S  Congress, Senate Appropriations Committee, Subcommittee on Defense, Department of Defense Appropriations for Fiscal Year 2014 , 113th Cong , 1 st sess , April 17, 2013 (Washington, DC: GPO, 2013)  U S  Congress, House Appropriations Committee, Subcommittee on Defense, Department of Defense Appropriations for 2014, Part 2 , 113th Cong , 1 st sess , April 24, 2013 (Washington, DC: GPO, 2013)  U S  Congress, Senate Appropriations Committee, Subcommittee on Defense, Department of Defense Appropriations for Fiscal Year 2014 , 113th Cong , 1 st sess , April 24, 2013 (Washington, DC: GPO, 2013)  U S  Congress, House Appropriations Committee, Subcommittee on Defense, President Obama's Fiscal 2014 Budget Proposal for the U S  Navy and Marine Corps , 113 th Cong , 1 st sess , May 7, 2013 (Washington, DC: GPO, 2013)  U S  Congress, Senate Armed Services Committee, D epartment of Defense Authorization for Appropriations for Fiscal Year 2014 and the Future Years Defense Program , 113 th Cong , 1 st sess , May 7, 2013 (Washington, DC: GPO, 2013)  U S  Congress, House Appropriations Committee, Subcommittee on Defense, President Obama's Fiscal 2014 Budget Proposal for the U S  Army , 113 th Cong , 1 st sess , May 8, 2013  (Washington, DC: GPO, 2013)  U S  Congress, Senate Appropriations Committee, Subcommittee on Defense, President Obama's Fiscal 2014 Budget Proposal for the U S  Air Force , 113 th Cong , 1 st sess , May 8, 2013 (Washington, DC: GPO, 2013)  U S  Congress, House Appropriations Committee, Subcommittee on Defense, President Obama's Fiscal 2014 Budget Proposal for the U S  Air Force , 113 th Cong , 1 st sess , May 9, 2013 (Washington, DC: GPO, 2013)  U S  Congress, Senate Appropriations Committee, Subcommittee on Defense, Department of Defense Appropriations for Fiscal Year 2014 , 113th Cong , 1 st sess , May 22, 2013 (Washington, DC: GPO, 2013)  U S  Congress, Senate Armed Services Committee, Pending Legislation Regarding Sexual Assaults in the Military , 113 th Cong , 1 st sess , June 4, 2013, S  Hrg  113–320 (Washington, DC: GPO, 2013)  U S  Congress, Senate Armed Services Committee, Subcommittee on Personnel, Markup of the National Defense Authorization Act for Fiscal Year 2014 , 113 th Cong , 1 st sess , June 11, 2013 (Washington, DC: GPO, 2013)  U S  Congress, Senate Appropriations Committee, Subcommittee on Defense, Department of Defense Appropriations for Fiscal Year 2014 , 113th Cong , 1 st sess , June 11, 2013 (Washington, DC: GPO, 2013)  U S  Congress, House Armed Services Committee, Subcommittee on Military Personnel, Women in Service Review s , 113 th Cong , 1 st sess , July 24, 2013, H A S C  No  113–50 (Washington, DC: GPO, 2013)  U S  Congress , Senate Armed Services Committee, Subcommittee on Personnel, The Relationships Between Military Sexual Assault, Post-Traumatic Stress Disorder and Suicide, and on Department of Defense and Department of Veterans Affairs Medical Treatment and Management of Victims of Sexual Trauma , 113 th Cong , 2 nd sess , February 26, 2014, S  Hrg  113-480 (Washington, DC: GPO, 2013)   U S  Congress, Armed Services Committee , Fiscal Year 2015 National Defense Authorization Budget Request from the Department of Defense , 113 th Cong , 2 nd sess , March 6 , 2014 (Washington, DC: GPO, 2014)  U S  Congress, House Armed Services Committee, Fiscal Year 2015 National Defense Authorization Budget Request from the Department of the Navy , 113 th Cong , 2 nd sess , March 12 , 2014 (Washington, DC: GPO, 2014)  U S  Congress, House Appropriations Committee, Subcommittee on Defense, Department of Defense Appropriations for 2015, Part 1 , 113 th Cong , 2 nd sess , March 13, 2014 (Washington, DC: GPO, 2014)  U S  Congress, House Armed Services Committee , Fiscal Year 2015 National Defense Authorization Budget Request from the Department of the Air Force , 113 th Cong  , 2 nd sess , March 14, 2014 (Washington, DC: GPO, 2014)  U S  Congress, House Armed Services Committee , Fiscal Year 2015 National Defense Authorization Budget Request from the Department of the Army , 113 th Cong , 2 nd sess , March 25 , 2014 (Washington, DC: GPO, 2014)  U S  Congress, Senate Appropriations Committee, Subcommittee on Defense , Department of Defense Appropriations for 2015 , 113th Cong , 2 nd sess , March 26 , 2014 (Washington, DC: GPO, 2014)  U S  Congress, House Appropriations Committee, Subcommittee , Department of Defense Appropriations for 2015 , Part 2, 113 th Cong , 2 nd sess , April 2, 2014, (Washington, DC: GPO, 2014)  U S  Congress, Senate Appropriations Committee, Subcommittee on Defense , Department of Defense Appropriations for 2015 , 113th Cong , 2 nd sess , April 2 , 2014 (Washington, DC: GPO, 2014)  U S  Congress, House Armed Services Committee , National Defense Priorities from the Members for the Fiscal Year 2015 National Defense Authorization Act , 113 th Cong  , 2 nd sess , April 9 , 2014 (Washington, DC: GPO, 2014)  U S  Congress, Senate Appropriations Committee, Subcommittee on Defense, Department of Defense Appropriations for Fiscal Year 2015 , 113th Cong , 2 nd sess , April 9, 2014 (Washington, DC: GPO, 2014)  U S  Congress, Senate Appropriations Committee, Subcommittee on Defense, Department of Defense Appropriations for Fiscal Year 2015 , 113th Cong , 2 nd sess , April 30, 2014 (Washington, DC: GPO, 2014)  U S  Congress, Senate Appropriations Committee, Subcommittee on Defense , Department of Defense Appropriations for 2015 , 113th Cong , 2 nd sess , June 18 , 2014 (Washington, DC: GPO, 2014)  U S  Congress, Senate Armed Services Committee , Department of Defense Authorization for Appropriations for Fiscal Year 2016 and the Future Years Defense Program , Part 1 , 114th Cong , 1 st sess , March 3 , 10 , 12 , 18 , 19, 26, April 4, 30 , 2015 (Washington, DC: GPO, 2015)  U S  Congress, Senate Armed Services , Department of Defense Authorization for Appropriations for Fiscal Year 2016 and the Future Years Defense Program , Part 7 Strategic Forces, 114 th Cong , 1 st sess , March 4, 25, April 15, 22, 29 , 2015 (Washington, DC: GPO, 2015)  U S  Congress, Senate Armed Services Committee, Department of Defense Authorization for Appropriations for Fiscal Year 2016 and the Future Years Defense Program , Part 3 Readiness and Management Support, 114 th Cong , 1 st sess , March 11, 25, April 22, 2015 (Washington, DC: GPO, 2015)  U S  Congress, Senate Armed Services Committee, The Current State of Readiness of U S  Forces in Review of the Defense Authorization Request for Fiscal Year 2016 and the Future Years Defense Program , 114 th Cong , 1 st sess , March 25, 2015 (Washington, DC: GPO, 2015)  U S  Congress, Senate Armed Services Committee, Department of Defense Authorization for Appropriations for Fiscal Year 2017 and the Future Years Defense Program , Part 1 , 114 th Cong , 2 nd sess , February 11, 23, March 3, 10, 15, 17, April 5, 7, 26, 2016 (Washington, DC: GPO, 2016)  U S  Congress, House Armed Services Committee, The Fiscal Year 2017 Na tional Defense Authorization Budget Request from the Department of Defense , 114 th Cong , 2 nd sess , March 22, 2016 (Washington, DC: GPO, 2016)  U S  Congress, Senate Armed Services Committee, Subcommittee on Strategic Forces, The Current State of Research, Diagnosis, and Treatment for Post-Traumatic Stress Disorder and Traumatic Brain Injury , 114 th Cong , 2 nd sess , April 20, 2016 (Washington, DC: GPO, 2016)  U S  Congress, House Committee on Armed Services, National Defense Authorization Act for Fiscal Year 2014 on H R 1960 with Additional and Dissenting Views, 113 th Cong , 1 st sess , H  Rept  113-102 (Washington, DC: GPO, 2013)  U S  Congress, House Committee on Appropriations, Department of Defense Appropriations Bill, 2014 to Accompany H R  2397 together with Additional Views, 113 th Cong , 1 st sess , H  Rept  113-113 (Washington, DC: GPO, 2013)  U S  Congress, Senate Committee on Armed Services, National Defense Authorization Act for Fiscal Year 2014 to accompany S  1197, 113 th Cong , 1 st sess , S  Rept  113-44 (Washington, DC: GPO, 2013)  U S  Congress, Senate Committee on Appropriations, Department of Defense Appropriations Bill, 2014 to accompany S 1429, 113 th Cong , 1 st sess , S  Rept  113-85 (Washington, DC: GPO, 2013)  U S  Congress, House Committee on Armed Services, First Annual Report on the Activities of the Committee on Armed Services for the One Hundred Thirteenth Congress , 113 th Cong , 1 st sess , H  Rept  113-309 (Washington, DC: GPO, 2013)  U S  Congress, House Committee on Armed Services, Howard P  "Buck" McKeon National Defense Authorization Act for Fiscal Year 2015 to accompany H R 4435, 113 th Cong, 2 nd sess , H  Rept  113-446 (Washington, DC: GPO, 2014)  U S  Congress, House Committee on Armed Services, Howard P  "Buck" McKeon National Defense Authorization Act for Fiscal Year 2015 supplemental report to accompany H R 4435, 113 th Cong  2 nd sess , H  Rept  113-446 part 2 (Washington, DC: GPO, 2014)  U S  Congress, Senate Committee on Armed Services, Carl Levin National Defense Authorization Act for Fiscal Year 2015 to accompany S 2410, 113 th Cong, 2 nd sess , S  Rept  113-176 (Washington, DC: GPO, 2014)  U S  Congress, House Committee on Appropriations, Department of Defense Appropriations Bill, 2015 to accompany H R 4870, 113 th Cong , 2 nd sess , H  Rept  113-473 (Washington, DC: GPO, 2014)  U S  Congress, Senate Committee on Appropriations, Department of Defense Appropriations Bill, 2015 to accompany H R 4870, 113 th Cong , 2 nd sess , S  Rept  113-211 (Washington, DC: GPO, 2014)  U S  Congress, House Committee on Armed Service, National Defense Authorization Act for Fiscal Year 2016 to accompany H R 1735, 114 th Cong , 1 st sess , H  Rept  114-102 (Washington, DC: GPO, 2015)  U S  Congress, Senate Committee on Armed Services, National Defense Authorization Act for Fiscal Year 2016 to accompany S 1376, 114 th Cong , 1 st sess , S  Rept  114-49 (Washington, DC: GPO, 2015)  U S  Congress, House Committee on Appropriations, Department of Defense Appropriations Bill, 2016 to accompany H R 2685, 114 th Cong , 1 st sess , H  Rept  114-139 (Washington, DC: GPO, 2015)  U S  Congress, Senate Committee on Appropriations, Department of Defense Appropriations Bill, 2016 to accompany S 1558, 114 th Cong , 1 st sess , S  Rept  114-63 (Washington, DC: GPO, 2015)  U S  Congress, House Conference Report, National Defense Authorization Act for Fiscal Year 2016 to accompany H R 1735, 114 th Cong , 1 st sess , H  Rept  114-270 (Washington, DC: GPO, 2015)  U S  Congress, House Committee on Armed Services, National Defense Authorization Act for Fiscal Year 2017 on H R 4909, 114 th Cong , 2 nd sess , H  Rept  114-537 (Washington, DC: GPO, 2016)  U S  Congress, Committee on Armed Services, National Defense Authorization Act for Fiscal Year 2017 to accompany S 2943, 114 th Cong, 2 nd sess , S  Rept  114-255 (Washington, DC: GPO, 2016)  U S  Congress, House Committee on Appropriations, Department of Defense Appropriations Bill, 2017 to accompany H R 5293, 114 th Cong , 2 nd sess , H  Rept  114-577 (Washington, DC: GPO, 2016)  U S  Congress, Senate Committee on Appropriations, Department of Defense Appropriations Bill, 2017 to accompany S 3000, 114 th Cong , 2 nd sess , S  Rept  114-263 (Washington, DC: GPO, 2016)  U S  Congress, House Conference Report, National Defense Authorization Act for Fiscal Year 2017 to accompany S  2943, 114 th Cong, 2 nd sess , H  Rept  114-840 (Washington, DC: GPO, 2016) 
Report 2:  In addition, HHS has data that could be useful for tracking progress in these areas (see table 1)  However, HHS has not adopted specific performance measures with targets specifying the magnitude of the increases HHS hopes to achieve through its efforts to expand access to MAT, and by when  For example, HHS has not established a long-term target specifying the percentage increase in the number of prescriptions for buprenorphine HHS would like to achieve, which would help to show whether efforts by HHS and others are resulting in sufficient progress in increasing prescriptions for this MAT medication  HHS has also not chosen a specific method of measuring treatment capacity or established targets associated with it, which would help to show whether a sufficient number of providers are becoming available to evaluate and treat patients who may benefit from MAT  Without specifying these performance measures and associated targets, HHS will not have an effective means to determine whether its efforts are helping to expand access to MAT  The lack of such performance measures with associated targets is inconsistent with federal internal control standards that specify that management should define objectives and evaluate results  According to these standards, using performance information such as performance measures can help agencies monitor results and determine progress in meeting program goals  In the context of HHS’s efforts to expand access to MAT, establishing appropriate performance measures with associated targets would allow HHS to determine whether its efforts are making sufficient progress or whether they need to be improved  Gauging this progress is particularly important, given the large nationwide MAT treatment gap identified in 2015 between the total number of individuals who could benefit from MAT and the limited number who can access it based on provider availability  This gap was estimated at nearly 1 million people as of 2012, and according to HHS officials and other stakeholders, lack of providers continues to be a challenge  Until HHS establishes performance measures with associated targets for the factors related to access to MAT, the department will be unable to evaluate its progress expanding access to MAT for opioid use disorders  In addition, as of August 2017, HHS has not finalized its approach for the planned evaluation activities, including timeframes  ASPE officials said that timeframes for a finalized evaluation approach had not been established because they were still working with RTI to finalize the evaluation approach given the new leadership priorities  When we spoke with the officials, they provided us with a draft evaluation schedule that covered the contract period ending September 2018  As of October 2017, HHS had not provided a finalized evaluation approach or schedule  Federal internal controls call for management to establish and operate monitoring activities and evaluate results  Without an implementation timeframe for the evaluation’s activities, HHS increases the risk that its evaluation of its agencies’ efforts will not be completed as expeditiously as possible, including an evaluation of HHS’s efforts to expand access to MAT  Officials from selected state health departments and behavioral health agencies, private health insurers, and national associations reported using several different efforts to help expand patients’ access to MAT for opioid use disorders  All of the stakeholders we interviewed reported conducting outreach efforts to communicate information about the importance of MAT and how to access it, or providing training to educate providers on prescribing MAT medications  Efforts by states  State health officials we spoke to described several planned or ongoing efforts to expand access to MAT, some of which are supported by federal funding, including federal grant programs  Officials from all five selected states told us that they are offering outreach to and training for providers to help expand access to MAT  For example, several state officials told us that they are promoting training to (1) encourage physicians to obtain authorization (DATA 2000 waivers) to prescribe buprenorphine and (2) encourage physicians with waivers to treat patients up to their patient limit or to request a higher patient limit  According to the stakeholders, all five selected states have implemented or are planning to implement a health care delivery model or approach that will expand access to MAT  Specifically, these models or approaches focus on integrating the use of MAT into primary care settings  For example, health officials from three states described use of a hub-and-spoke model  This model generally involves centralized intake and initial management of patients at a “hub” (e g , an OTP) and then connecting these patients to community providers at “spokes” (e g , primary care clinics) for ongoing care, with ongoing support provided by the hub as needed  Additionally, officials from two states described offering remote MAT-related consultations through telehealth that connects patients in rural areas with addiction specialists  According to a 2017 Healthcare Fraud Prevention and Partnership whitepaper, telehealth expands the reach of the addiction professional workforce and the existing pool of MAT providers, and it supports remote forms of behavioral therapy to make trained professionals more accessible to those in underserved or isolated communities  Officials from three states described focusing their MAT expansion efforts in various settings, such as in the criminal justice setting and emergency room departments  State health officials from four of the five states told us that programs in their states are using peer specialists (individuals who have successfully recovered from substance abuse disorders) in emergency rooms and other settings to engage with addicted patients and refer them to addiction specialists or behavioral health counselors  Officials from the selected states said that some of these and other efforts are funded through federal sources, such as MAT expansion grants awarded by SAMHSA, or with state funds to the extent they are available  Efforts by private health insurers  Officials from private health insurers reported that they are expanding access to MAT through outreach or training for providers and through the following three efforts: Eliminating the need for prior authorization to prescribe MAT medications  Officials from three insurers reported removing prior authorization requirements for MAT medications, thereby making it easier for patients to access needed MAT medications more readily, rather than undergoing a waiting period for approval to receive the medications  Other private health insurers told us that they continue to require prior authorization, intended for safety reasons and to reduce drug misuse, and officials from one insurer told us that they will allow a patient to access a limited amount of MAT medications for a period of 24 to 72 hours while making a determination about the appropriate treatment services for the patient  Modifying health benefit coverage  Officials from one private health insurance plan told us that the company is redesigning the benefit coverage for methadone and has removed member copays  This effort is intended to make MAT medications more affordable and allow members who are not able to use buprenorphine to have an alternative, such as methadone, that is not cost-prohibitive  Incentivizing providers and health insurance plan members to use MAT  Officials from four private health insurance plans described plans to offer incentives to providers or patients to use MAT  For example, officials from three health plans stated that they are offering alternative payment models or paying higher rates to providers that offer MAT, and another private health insurer is offering incentives to its members who are enrolled in behavioral health programs that provide access to MAT  Efforts by national associations  Officials we interviewed from the national associations—including the American Society of Addiction Medicine, the National Governors Association, and the Association of State and Territorial Health Officials—told us that they are helping to expand access to MAT through outreach and training for their members and by developing tools and resource guides for their members  An official from one association told us that it shares federal grant announcements, including those that are focused on expanding access to MAT, with its members  Officials from another association said it provides training to providers on how to appropriately prescribe MAT medications  In addition, officials from one association told us that they developed an opioid-related road map that identifies examples of strategies—including MAT—that state policymakers can use in their ongoing efforts to address the opioid epidemic  Examples of strategies include reducing the stigma associated with MAT through educating the public and potential providers  Another strategy in the road map is changing payment policies to expand access to MAT services, such as ensuring that Medicaid and other state health programs adequately cover all MAT medications and behavioral interventions and encouraging or requiring commercial health plans to adopt similar policies  HHS funds grant programs and has taken other steps to expand access to MAT, which has been shown to be effective in reducing the prevalence of opioid use disorders and with them, the likelihood of drug overdoses  HHS’s Opioid Initiative began in 2015, and the grants that support it are ongoing, so it is likely too early to determine how effective HHS’s efforts have been in expanding access to MAT and in meeting HHS’s other priorities related to addressing the opioid epidemic  According to HHS, access to MAT can be measured in terms of the number of prescriptions for MAT and by the treatment capacities of OTPs and practitioners who are authorized to prescribe buprenorphine  Our review suggests, however, that HHS may not be ready to perform this evaluation  While HHS told us that it may evaluate the effectiveness of its efforts in the future, the department has not established performance measures with targets that would specify the results that HHS hopes to achieve through its efforts, and by when  Furthermore, HHS has not established timeframes for the activities that will make up its planned evaluation of whether HHS’s efforts have been implemented as intended  Without performance measures with targets and evaluation timeframes, HHS increases the risk that the evaluation will not be completed in a timely manner or that HHS will not know whether its MAT- related efforts are successful or whether new approaches are needed  The evaluation is particularly important, given the hundreds of millions of dollars HHS has invested in its MAT-related grant programs  We are making the following two recommendations to HHS  The Assistant Secretary for Planning and Evaluation should establish performance measures with targets related to expanding access to MAT for opioid use disorders  (Recommendation 1) The Assistant Secretary for Planning and Evaluation should establish timeframes in its evaluation approach that specify when its evaluation of efforts to expand access to MAT will be implemented and completed  (Recommendation 2) We provided a draft of this report to HHS for review, and HHS provided written comments, which are reprinted in appendix II  HHS also provided technical comments, which we incorporated as appropriate  In its written comments, HHS concurred with both of our recommendations  Specifically, for our first recommendation to establish performance measures with targets related to expanding access to MAT for opioid use disorders, HHS stated that developing such measures is appropriate and that the department will continue to work to develop robust performance measures, including measures related to MAT, as part of its overall Opioid Strategy, which includes the department’s most recent efforts to address the opioid epidemic  For our second recommendation to establish timeframes in its evaluation approach that specify when its evaluation of efforts to expand access to MAT will be implemented and completed, HHS agreed that timeframes are important to any evaluation  HHS noted that its evaluation is being conducted under a 2-year contract that is scheduled to end in September 2018  HHS has also provided us with a draft evaluation schedule  We clarified in our report, however, that HHS has not yet provided a finalized approach for the planned evaluation or a finalized schedule establishing timeframes for the activities that will make up the evaluation  Until it finalizes its evaluation approach and establishes related timeframes, HHS increases the risk that it will not complete its planned evaluation by September 2018  We are sending copies of this report to the HHS, and appropriate congressional committees  In addition, the report will be available at no charge on the GAO website at http://www gao gov  If you or your staff have questions about this report, please contact me at (202) 512-7114 or curdae@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report  Major contributors to this report are listed in appendix III  According to the Department of Health and Human Services, a diversion control plan is a set of documented procedures intended to reduce the possibility that controlled substances will be transferred or used illicitly  Opioid treatment programs (OTPs) and practitioners who prescribe buprenorphine at the highest patient level through a Drug Addiction Treatment Act of 2000 (DATA 2000) waiver are required to have these plans  OTPs are programs that may administer or dispense medication- assisted treatment (MAT) for people diagnosed with an opioid use disorder, including the use of methadone and buprenorphine  In addition, under a DATA 2000 waiver, practitioners may prescribe buprenorphine for patients, up to a 30-, 100-, or 275 patient limit  An OTP must maintain a current diversion control plan that contains specific measures to reduce the possibility of diversion of controlled substances from legitimate treatment use  Per federal guidelines, the goal of the diversion control plan is to reduce the scope and significance of diversion and its impact on communities  The guidelines state that each OTP’s diversion control plan should make every effort to balance diversion control against the therapeutic needs of the individual patient  They also state that diversion control plans should address at least four general areas of concern: program environment, dosing and take-home medication, prevention of multiple program enrollment, and prescription medication misuse  The guidelines include details about each of these areas: Program environment: Diversion in the program environment can be deterred and detected by regular surveillance and the monitoring of areas in and around the program, where opportunities for diversion may exist  A visible human presence at a program’s location gives community members the opportunity to approach staff with concerns and communicates the program’s commitment to assuring a safe environment and a positive impact on the surrounding community  Dosing and take-home medication: In the area of dosing and take- home medication, diversion control encompasses careful control of inventory, attentive patient dosing, and close supervision of take- home medication  Observing a patient take his or her dose and having each of them drink and speak after dosing are fundamental components of diversion control  Take-home dosing should be provided with careful attention to regulatory compliance and the therapeutic benefit and safety these regulations are meant to promote  Prevention of multiple program enrollment: Reasonable measures should be taken to prevent patients from enrolling in treatment provided by more than one clinic or individual practitioner  An OTP, after obtaining patient consent, may contact other OTPs within a reasonable geographic distance (100 miles) to verify that a patient is not enrolled in another OTP  Misuse of prescription medication: The misuse of prescription medication has become an area of great concern nationally and impacts diversion control planning at OTPs  All OTP physicians and other healthcare providers, as permitted, should register to use their respective state’s prescription drug monitoring program (PDMP) and query it for each newly admitted patient prior to initiating dosing  The PDMP should be checked periodically (for example, quarterly) through the course of each individual’s treatment and, in particular, before ordering take-home doses as well as at other important clinical decision points  SAMHSA’s best-practice guidelines for using buprenorphine for treating opioid use disorders include multiple references to diversion, including monitoring for diversion, storage of this medication to minimize diversion, and use of formulations that may be less likely to be diverted  Specifically, the best practices state that, when possible, practitioners should use the combination buprenorphine/naloxone product, which increases safety and decreases the likelihood of diversion and misuse  Further, physicians who request and receive a waiver to prescribe buprenorphine to treat up to 275 patients outside of an OTP are required to have a diversion control plan  According to an HHS official, as of July 13, 2017, roughly 3,330 of the over 39,000 practitioners with a waiver had a 275-patient limit waiver  The majority of these practitioners, just over 27,000, have a 30-patient limit  According to SAMHSA guidance, the diversion plan should contain specific measures to reduce the possibility of diversion of buprenorphine from legitimate treatment use and should assign specific responsibilities of the medical and administrative staff of the practice setting for carrying out these measures  Further, the guidance states that the plan should address how: the environment at the practice setting can prevent onsite diversion; to prevent diversion with regard to dosing and take-home medication; and to prevent patients from receiving a prescription from more than one practitioner and later diverting some of the prescribed medication  Elizabeth H  Curda, Director, (202) 512-7114 or curdae@gao gov  In addition to the contact name above, Will Simerl, Assistant Director; Natalie Herzog, Analyst-in-Charge; La Sherri Bush; and Emily Wilson made key contributions to this report  Also contributing were Muriel Brown, Krister Friday, Sandra George, and Christina Ritchie 

ground_truth: This report focuses on previous activity in Congress regarding high profile incidents of sexual assault in the military during the summer 2013 through 2016. Included are separate sections on the official responses related to these incidents by the Department of Defense (DOD), the Obama Administration, and Congress including legislation during the 113th (2013-2014) Congress and 114th Congress (2015-2016). The last section is a resource guide for sources in this report and related materials on sexual assault and prevention during this period. This report will not be updated and supersedes CRS Report R43168, Military Sexual Assault: Chronology of Activity in Congress and Related Resources. For current information regarding Congress and issues on sexual assault in the military, see CRS Report R44944, Military Sexual Assault: A Framework for Congressional Oversight, by Kristy N. Kamarck and Barbara Salazar Torreon. For legislative initiatives in the 115th Congress, see CRS Report R44923, FY2018 National Defense Authorization Act: Selected Military Personnel Issues, by Kristy N. Kamarck, Lawrence Kapp, and Barbara Salazar Torreon and CRS Report R45343, FY2019 National Defense Authorization Act: Selected Military Personnel Issues, by Bryce H. P. Mendez et al.