Background

		DOD’s Use of Dual-Hatting

“Dual-hatting” is a term used to describe a position in which an incumbent  officer has responsibilities in two organizations simultaneously—usually to  that officer’s particular military service, and to a joint, combined, or  international organization or activity. DOD officials told us that dual- hatting senior leaders is a relatively common practice within DOD to help  align authorities, improve mission effectiveness, and use a senior leader’s  experience and expertise while balancing the scope of responsibility.  Some prominent examples of dual-hatting include the Commander of  U.S. Northern Command also serving as the Commander of the North  American Aerospace Defense Command; and the Commander of U.S.  European Command also serving as the Supreme Allied Commander  Europe (that is, the commander of military operations conducted by the  North Atlantic Treaty Organization). Additionally, the Air Force and Navy  commanders who support U.S. European Command are dual-hatted as  service component commanders for U.S. Africa Command.

		The Dual-Hat Leadership of NSA/CSS and CYBERCOM

When the Secretary of Defense directed CYBERCOM’s establishment in  2009, he also recommended to the President that the position of Director  of NSA be assigned the responsibility for leading this new command.  DOD officials told us the dual-hat leadership arrangement originated to  allow CYBERCOM to use NSA/CSS infrastructure and tools to carry out  its mission more quickly and to establish unity of command and effort for  DOD in the cyberspace domain. As the sole leader of these  organizations, the dual-hatted leader is responsible for a broad set of  roles and responsibilities, as outlined below in table 1.
Since its establishment, CYBERCOM has operated as a sub-unified  command organized under U.S. Strategic Command, and this  arrangement continues as of April 2017. The National Defense  Authorization Act for Fiscal Year 2017 included a provision directing the  President to establish CYBERCOM as a unified combatant command.  When the President and DOD implement this provision, CYBERCOM will  no longer be organized under U.S. Strategic Command. Figure 1 below  depicts the NSA/CSS and CYBERCOM leadership arrangement, as of  April 2017, and where those offices fit within DOD’s organization. The  figure also provides an overview of CYBERCOM’s 133 Cyber Mission  Force Teams, which carry out particular parts of CYBERCOM’s mission.
As CYBERCOM has matured, leaders—including Congress, the  President, the Director of National Intelligence, and the current leader of  NSA/CSS and CYBERCOM—have discussed the concept of ending the  dual-hat leadership of the two organizations, such that one individual  would lead NSA/CSS and another individual would lead CYBERCOM.  Section 1642 of the National Defense Authorization Act for Fiscal Year  2017 enumerated a number of conditions that the Secretary of Defense  and the Chairman of the Joint Chiefs of Staff must jointly certify before the  dual-hat leadership arrangement for NSA and CYBERCOM can be  terminated. While DOD officials have considered ending the dual-hat  leadership arrangement, as of April 2017, the department has not decided  whether to do so.

		DOD Components with Cybersecurity Responsibilities

To establish a cybersecurity program to protect and defend DOD  information and information technology, DOD has assigned some of its  components and senior officials with cybersecurity responsibilities,  summarized in table 2 below.

		Key DOD Strategic Cybersecurity Guidance

DOD has issued guidance to support the implementation of its  cybersecurity capabilities. Table 3 below lists key DOD strategic-level  cybersecurity documents and includes a description of each document,  as well as the component organization(s) primarily responsible for their  implementation.

	Advantages and Disadvantages of the Dual-Hat Arrangement, and Actions That Could Mitigate Potential Risks Associated with Ending the Arrangement

Officials from various DOD components identified advantages and  disadvantages of the dual-hat leadership of NSA/CSS and CYBERCOM.  Additionally, DOD and Congress have identified actions that could  mitigate the risks associated with ending the dual-hat leadership  arrangement. As of March 2017, DOD officials informed us that DOD had  not determined whether it would end the dual-hat leadership arrangement  and was reviewing the steps and funding necessary to meet the  requirements established in the law.

		Advantages and Disadvantages of the Dual-Hat Leadership Arrangement

According to officials, DOD does not have an official position on the  advantages and disadvantages of the dual-hat leadership arrangement of  NSA/CSS and CYBERCOM. Through responses to interviews and  questionnaires, officials from DOD components provided their  perspectives on the advantages and disadvantages associated with the  dual-hat leadership arrangement as summarized in table 4, below.

		DOD Components and Congress Have Identified Actions That Could Mitigate Potential Risks Associated with Ending the Dual-Hat Leadership Arrangement

			Actions Identified by DOD Component Officials to Mitigate Potential Risks Associated with Ending the Dual-Hat Leadership Arrangement

In response to the National Defense Authorization Act for Fiscal Year  2017, President Obama supported elevating CYBERCOM to a unified  combatant command and stated that NSA/CSS and CYBERCOM should  have separate leaders who are able to devote themselves to each  organization’s respective missions and responsibilities, but who should  continue to leverage the shared capabilities and synergies developed  under the dual-hat arrangement. As of April 2017, DOD officials told us  that the department supports elevating CYBERCOM to a unified  combatant command, but recognizes that there are potential risks in  ending the dual-hat leadership arrangement. Prior to the passage of the  National Defense Authorization Act for Fiscal Year 2017, DOD  components, such as CYBERCOM and the Joint Staff, had already  developed internal lists of conditions and prerequisites that could mitigate  risks prior to ending the dual-hat leadership arrangement. These  considerations were presented to senior leadership within the respective  components to help inform their positions on ending the dual-hat  leadership arrangement.
According to DOD officials, discontinuing the dual-hat arrangement would  require DOD to put the necessary policies and processes in place to  continue the mutually beneficial partnership between NSA/CSS and  CYBERCOM. Specifically, the arrangement in conjunction with support  agreements has enabled CYBERCOM to leverage the capability  development, personnel, facilities, infrastructure, testing capabilities, and  business processes of NSA/CSS to support CYBERCOM operations.  DOD officials also cited the potential for less communication between  CYBERCOM and NSA/CSS and slower decision-making if the leadership  arrangement were ended. Table 5 below lists the various actions reported  to us by officials from DOD components that could mitigate risks  associated with ending the dual-hat command structure of NSA/CSS and  CYBERCOM, as well as the status of these actions, as of March 2017.  According to DOD officials, many of these factors relate as much to the  growth and maturation of CYBERCOM as they do the dual-hat status.
Separate from actions identified by select DOD components, Congress  has requested information from the department and required it to meet  specific conditions and to certify that the termination of the dual-hat  arrangement, if pursued by DOD, will not pose risks to the military  effectiveness of CYBERCOM that are unacceptable to the national  security interests of the United States. Specifically, House Report 114- 537 accompanying a bill for the National Defense Authorization Act of  Fiscal Year 2017 and House Report 114-573 accompanying a bill for the  Intelligence Authorization Act of Fiscal Year 2017 directed the Secretary  of Defense to provide the House defense and intelligence committees  with a briefing and an assessment of the dual-hat command by November  1, 2016. According to the committee direction, DOD was to address the  following:  1.  roles and responsibilities, including intelligence authorities, of each  2.  assessment of the current impact of the dual-hat relationship,  including both advantages and disadvantages;  3.  recommendations on courses of action for separating the dual-hat  command relationship between the Commander of CYBERCOM and  the Director of the NSA/Chief of CSS, if appropriate;  4.  suggested timelines for carrying out such courses of action; and  5.  recommendations for legislative actions, as necessary.
DOD did not perform this briefing and assessment. Performing this  assessment would have provided DOD with an opportunity to articulate its  perspectives on the advantages and disadvantages of the dual-hat  leadership arrangement. Further, it would have allowed DOD to present  its preferred course of action in relation to separating the leadership of  NSA/CSS and CYBERCOM. DOD officials told us that they believed the  assessment they were directed to provide to the House defense and  intelligence committees in November 2016 was no longer necessary,  based on Section 1642 of the National Defense Authorization Act for  Fiscal Year 2017. However, while the act did not include the same  briefing and assessment requirement identified in the two House reports,  the act also did not cancel the committee direction. In addition, the  briefing requirement still exists, as evidenced by the explanatory  statement accompanying the Intelligence Authorization Act for Fiscal Year  2017, for DOD to brief and provide an assessment of the dual-hat  leadership arrangement.
According to Section 1642 of the National Defense Authorization Act for  Fiscal Year 2107, DOD cannot terminate the dual-hat leadership  arrangement until the Secretary of Defense and the Chairman of the Joint  Chiefs of Staff jointly certify that the termination will not pose risks to the  military effectiveness of CYBERCOM that are unacceptable to the  national security interests of the United States. Section 1642 also  requires DOD to conduct an assessment that, among other things,  evaluates CYBERCOM’s operational dependence on NSA and evaluates  each organization’s ability to carry out its roles and responsibilities independently. In addition, Section 1642 requires DOD to determine  whether the following conditions have been met before deciding to end  the dual-hat leadership arrangement:
Robust operational infrastructure has been deployed that is sufficient  to meet the unique cyber mission needs of CYBERCOM and NSA,  respectively.
Robust command and control systems and processes have been  established for planning, deconflicting, and executing military cyber  operations.
The tools and weapons used in cyber operations are sufficient for  achieving required effects.
Capabilities have been established to enable intelligence collection  and operational preparation of the environment for cyber operations.
Capabilities have been established to train cyber operations  personnel, test cyber capabilities, and rehearse cyber missions.
The cyber mission force has achieved full operational capability.
Office of the Under Secretary of Defense for Intelligence and Joint Staff  officials told us that they regularly discuss matters related to ending the  dual-hat leadership arrangement of NSA/CSS and CYBERCOM.  However, as of April 2017, DOD’s senior leaders had not decided  whether the dual-hat leadership should be ended, and the department  was reviewing the steps and funding necessary to meet the statutory  requirement of Section 1642.

	DOD’s Implementation of Key Strategic Cybersecurity Guidance Reflects Varied Progress

DOD’s implementation of key strategic cybersecurity guidance—the DOD  Cloud Computing Strategy, The DOD Cyber Strategy, and the DOD  Cybersecurity Campaign—to help manage and focus its cybersecurity  efforts has varied. The department has implemented the cybersecurity  objectives identified in the DOD Cloud Computing Strategy, and it has  made progress in implementing The DOD Cyber Strategy and DOD  Cybersecurity Campaign. However, the department’s process for  monitoring implementation of The DOD Cyber Strategy has resulted in  the closure of tasks as implemented before the tasks were fully  implemented. In addition, the DOD Cybersecurity Campaign lacked  timeframes for completion and a process to monitor progress, which  together provide accountability to ensure implementation.

		DOD Has Implemented the Four Cybersecurity Objectives of the 2012 DOD Cloud Computing Strategy

DOD has implemented the four cybersecurity objectives of the 2012 DOD  Cloud Computing Strategy. In July 2012, the DOD CIO issued the DOD  Cloud Computing Strategy, which laid the groundwork for accelerating  cloud adoption in the department, consistent with the Federal Cloud  Computing Strategy. The DOD Cloud Computing Strategy includes four  objectives aimed at enhancing the department’s cybersecurity, as listed in  table 6 below, along with DOD’s status in implementing the objectives.
In March 2016 DOD issued the DOD Cloud Computing Security  Requirements Guide, which outlines the security controls and  requirements necessary for using cloud-based solutions. According to  DOD officials, the Cloud Computing Security Requirements Guide is the  basis for authorizing commercial cloud service providers in the DOD  environment and is closely aligned with the Federal Risk and  Authorization Management Program—the fundamental cloud approval  process for the federal government. This guide establishes a  standardized infrastructure for cloud-based services, continuous  monitoring, and identity and access management. According to DOD CIO  officials, DOD has approved more than 50 commercial cloud networks for  various levels of use based on this guidance. Additionally, in October  2016, DOD finalized the Defense Federal Acquisition Regulation  Supplement interim rule on network penetration reporting and contracting  for cloud services, which further standardized infrastructure requirements  for cloud service providers. In April 2017, DOD also submitted a Data  Center Optimization Strategic Plan, as required by the Office of  Management and Budget, which lays out the number of data centers  DOD expects to close through fiscal year 2018 as well as estimated cost  savings associated with those closures. The plan DOD submitted shows  that the department closed more than 150 data centers in fiscal year 2016  and planned to close more over the following 2 years, which would help  reduce network seams through network and data center consolidation.

		DOD Has Taken Some Actions on All Cybersecurity Tasks Supporting The DOD Cyber Strategy, but the Current Process for Monitoring Implementation Limits Oversight of Tasks to Completion

DOD has taken some actions on all 22 cybersecurity-related tasks  identified in The DOD Cyber Strategy, although it has closed some tasks  before they were fully implemented. The purpose of The DOD Cyber  Strategy, issued in April 2015, is to guide the development of DOD’s  cyber forces and strengthen cyber defense and cyber deterrence  postures. This strategy, according to DOD, presents an aggressive,  specific plan for leaders from across the department to take action and  hold their organizations accountable to achieve the strategy’s objectives.  The DOD Cyber Strategy sets prioritized strategic goals and objectives  for DOD’s cyber activities and missions to achieve over the ensuing five  years (that is, through 2020). The Office of the Under Secretary of  Defense for Policy; Office of the Principal Cyber Advisor to the Secretary  of Defense; the Office of the Under Secretary of Defense for Acquisition,  Technology, and Logistics; and the Joint Staff work with the DOD  components to prioritize and oversee the implementation of this strategy  and its objectives and to assign responsibility for managing each  objective. In a June 2015 memorandum, then Secretary of Defense  Ashton Carter identified the implementation of The DOD Cyber Strategy  as one of his top priorities and stated that the department should ensure  that the outcomes articulated in the strategy were achieved.
DOD has taken actions on all 22 of the tasks associated with the  cybersecurity goal of the strategy that focuses on network defense,  mission assurance, and security of the defense industrial base. For  example, the Office of the Undersecretary of Defense for Acquisition,  Technology, and Logistics and the Office of the Undersecretary of  Defense for Intelligence formed a working group—the joint acquisition  protection and exploitation cell—that links intelligence,  counterintelligence, and law enforcement agents with acquisition program  managers to prevent and mitigate data loss and theft. This working group  ensures that federal acquisition rules and guidance mature over time in a  manner consistent with standards, and it establishes an analysis  capability to improve protection of controlled technical information and  other critical information department-wide. In another example, DOD has  adopted activities that include both regulatory and voluntary programs to  improve the cybersecurity of defense industrial base companies.  Companies maintaining covered defense information or providing critical  support are now contractually required to report cyber incidents and use  security standards identified in a National Institute of Standards and  Technology special publication on protecting controlled unclassified  information in nonfederal information systems. In addition, in October  2015, DOD modified eligibility criteria for participants in the defense  industrial base cybersecurity information sharing program. Since this  revision, DOD officials reported that program participation expanded from  124 to 207 industry partners.
While DOD has taken some actions on all 22 cybersecurity tasks, we  found that it has closed some tasks before they were fully implemented.  This increases the risk that DOD will not fully implement those tasks, and  also increases the risk that leadership will not be aware of delays or  complications related to fully implementing The DOD Cyber Strategy.  Specifically, the Principal Cyber Advisor has closed tasks when that office  confirms that the DOD component primarily responsible for  implementation has begun taking action on the tasks and follow-on work  to complete the tasks has been integrated into existing DOD processes,  operations, or policies. For example, DOD closed the task that required  the department to assess the cybersecurity of current and future weapon  systems. According to The DOD Cyber Strategy, DOD is to assess and  initiate cybersecurity improvements for existing weapon systems;  mandate cybersecurity requirements for future weapon systems; and  update acquisition and procurement policies to promote effective  cybersecurity. The Deputy Principal Cyber Advisor approved closing this  task in The DOD Cyber Strategy monitoring process when the Under  Secretary of Defense for Acquisition, Technology, and Logistics submitted  a plan to Congress that was required by a provision in the National  Defense Authorization Act for Fiscal Year 2016 and established a process  to develop cybersecurity requirements for future weapon systems. In  response to both The DOD Cyber Strategy task and the provision in the  National Defense Authorization Act for Fiscal Year 2016, DOD—under  the leadership of the Office of the Under Secretary of Defense for  Acquisition, Technology, and Logistics—initiated assessments of its  existing weapon systems. In addition to initiating these assessments and  establishing a process to develop cybersecurity requirements for future  weapon systems, the office updated acquisition and procurement policies  to promote effective cybersecurity by adding an enclosure to its  acquisition guidance, entitled Cybersecurity in the Defense Acquisition  System. All three of these efforts demonstrate that DOD has taken  actions toward implementing this one task.
However, while DOD has taken actions to implement this task, we found  that the task had not been fully implemented. Officials from the Office of  the Under Secretary of Defense for Acquisition, Technology, and  Logistics acknowledged that the task had not been fully implemented and  that the office was on schedule for completing the initial 136 assessments  by December 31, 2019, as required by statute. Similarly, DOD has made  progress toward establishing cybersecurity requirements for future  weapon systems, but the effort is not complete. In January 2017, the Joint  Staff issued a memorandum that established a process requiring weapon  systems to incorporate cyber resilience as they are designed and built.  The process is undergoing a one-year trial period and is scheduled to be  reassessed in 2018.
In addition, once tasks have been closed by the Principal Cyber Advisor,  DOD has not continuously monitored task implementation; rather,  monitoring occurs on a case-by-case basis. For example, officials from  the office of the Principal Cyber Advisor told us that the office approved  the closure of a task to enhance the protection for critical acquisition  programs and technology on the condition that the Office of the Under  Secretary of Defense for Acquisition, Technology, and Logistics provide  regular reports on progress in order to allow the Principal Cyber Advisor  to track progress and provide assistance when necessary. Further, the  officials from the office of the Principal Cyber Advisor told us that the  office reserves the right to re-open or initiate reviews of closed tasks; as  of April 2017, the office had not re-opened any closed tasks.
We have previously determined that DOD components do not  consistently implement cybersecurity-related actions that are identified in  DOD directives, instructions, or memorandums from senior DOD  officials. In 2014, we reported on DOD’s continuity planning and cyber  resiliency efforts. DOD closed a related cyber resiliency task identified in  The DOD Cyber Strategy after the department issued interim guidance for  incorporating cyber resilience into DOD component continuity of  operations plans; and DOD directed all of its components to establish or  update their continuity of operations plans to include cyber resiliency  measures by December 2017. While issuing a memorandum may have  initiated the process, the task has not been fully implemented.
The Office of Management and Budget’s Management Responsibility for  Enterprise Risk Management and Internal Control provides guidance for  management to identify risks and establish internal controls, as  appropriate, to provide reasonable assurance that objectives are  achieved and discusses the responsibility to continuously monitor the  effectiveness of those internal controls. Standards for Internal Control in  the Federal Government explains that in defining objectives management  should clearly define what is to be achieved, how it will be achieved, and  the timeframes for achievement. Further, the standards state that  ongoing monitoring should be built into an entity’s operations and be  performed continually.
Based on these internal control standards, DOD’s process is not sufficient  to ensure the completion or implementation of tasks. Unless DOD  modifies its process for deciding whether a task identified in The DOD  Cyber Strategy is implemented, the department may not be able to  ensure that the outcomes articulated in the strategy are achieved.

		DOD Has Made Progress in Implementing the DOD Cybersecurity Campaign but Does Not Have Timeframes and Monitoring

DOD has made some progress in implementing the seven objectives  required by the DOD Cybersecurity Campaign; however, the department  does not have established timeframes for achieving full implementation.  In June 2015, the DOD CIO; the Under Secretary of Defense for  Acquisition, Technology, and Logistics; and the Commander of  CYBERCOM initiated a DOD Cybersecurity Campaign to identify specific  actions that drive commanders and DOD senior leaders to enforce full  cybersecurity compliance and accountability across the department.  According to the DOD Cybersecurity Campaign, its goals are to educate  commanders, civilian leaders, and all personnel responsible for the  cybersecurity of the DOD information network on the risk to the mission.  The three senior DOD leaders identified seven objectives to enable  commanders and DOD senior leaders to enforce full cybersecurity  compliance and accountability across the department. Table 7 below lists  each of these objectives and shows our determination of the status of  their implementation.
As noted in the table above, DOD has implemented two of the objectives  identified in the DOD Cybersecurity Campaign. Specifically, in February  2017, the DOD Information Security Risk Management Committee  finalized a charter establishing a Platform Information Technology  Cybersecurity Working Group to focus on the cybersecurity of DOD  platform information technology systems, including but not limited to  weapon systems and industrial control systems. According to the charter,  this working group—chaired by the DOD CIO; the Under Secretary of  Defense for Acquisition, Technology, and Logistics; and the Commander  of CYBERCOM—will provide expertise on the cybersecurity of platform  information technology systems across DOD. A working group official  explained that platform information technology is currently applicable to  special purpose systems controlled and operated solely by technology,  including industrial control systems.
The department has also implemented the DOD Cybersecurity Campaign  objective to develop a framework for defensive cyberspace operations  concept of operations that integrates defensive cyberspace operations  and DOD information operations across the DOD information network  forces. Specifically, in March 2017, the commander of CYBERCOM  approved operational guidance titled, Defensive Cyberspace Operations.  The operational guidance is applicable to CYBERCOM, all of its  supporting elements, and all DOD components performing defensive  cyberspace operations. Among other things, the guidance requires  defensive cyberspace operations to be integrated with other cyberspace  operations and information related activities. An official from CYBERCOM  told us that the operational guidance came from the work to develop a  concept of operations and was intended to address DOD’s need for  guidance on defensive cyberspace operations.
DOD has also developed processes and procedures to monitor the  implementation of four of the five DOD Cybersecurity Campaign  objectives that are in the process of being implemented. Specifically, the  DOD Cybersecurity Culture and Compliance Initiative monitors the  department’s efforts in implementing two DOD Cybersecurity Campaign  objectives—(1) execute priority initiatives for individual cybersecurity  awareness, and (2) develop and implement a program to reinforce the  traits and attributes of a healthy cybersecurity culture. In addition, DOD  uses the Cybersecurity Scorecard to monitor two other DOD  Cybersecurity Campaign objectives that are in progress—development of  a DOD Cybersecurity Scorecard and the execution of the DOD  Cybersecurity Discipline Implementation Plan. According to DOD CIO  officials, the Cybersecurity Scorecard has allowed for better oversight of  DOD components’ implementation of key cybersecurity measures and  provides a forum for elevating issues to the Secretary of Defense.  However, the scorecard is not fully implemented throughout the DOD  components, and DOD continues to work on automating data collection to  improve the data’s reliability. Additionally, recognizing the importance of  resource prioritization, DOD CIO officials told us that the next phase is to  move to a risk-based scorecard, which DOD expects to have  implemented by March 2019.
While DOD has taken steps to implement the DOD Cybersecurity  Campaign objectives that are still in process, the department does not  know when it will achieve full implementation for one of the objectives  because the department did not establish a timeframe for completing or  monitoring it to help ensure accountability for full implementation.  Specifically, the department does not have timeframes for the objective  associated with transitioning to commander-driven operational risk  assessments for cybersecurity readiness.
DOD has begun implementing the objective to shift the focus of its  existing Command Cyber Readiness Inspection process to an operational  cybersecurity readiness assessment. Specifically, the Defense  Information Systems Agency and the Joint Force Headquarters-DOD  Information Network are leading an effort to transition the department  from a compliance-based Command Cyber Readiness Inspection process  to an operational risk-based inspection focused on missions,  vulnerabilities, and threats—currently referred to as the Command Cyber  Operational Readiness Inspection process—as the initial phase of  CYBERCOM’s broader Command Cyber Readiness Inspection  improvement initiative. According to the Joint Force Headquarters-DOD  Information Network, the results of the new inspection process will be  expressed in terms of risk to the mission and the department’s  information network, unlike the previous readiness inspection process,  which expressed results as pass or fail. DOD officials indicated that the  new operational risk assessments will better allow DOD components to  relate their cyber vulnerabilities to their mission. The department has  piloted the new process in three organizations; however, DOD has not  established a timeframe for implementation or identified a process to hold  DOD leaders accountable for implementing these assessments across  the department.
The Office of Management and Budget’s Management Responsibility for  Enterprise Risk Management and Internal Control requires agencies to  implement risk management in coordination with a number of internal  control processes, including those contained in Standards for Internal  Control in the Federal Government. Standards for Internal Control in the  Federal Government highlight the need to (1) define objectives in specific  terms, to include how objectives are to be achieved and timeframes for  their achievement; and (2) enforce accountability by evaluating  performance and holding organizations accountable. Until the DOD  CIO; the Under Secretary of Defense for Acquisition, Technology, and  Logistics; and the Commander of CYBERCOM establish a timeframe for  completing and a process for monitoring the objective associated with  cybersecurity readiness assessments, DOD may be unable to assess its  progress in achieving the objective, or to determine when it will achieve  the strategic goals and objectives of the DOD Cybersecurity Campaign.

	DOD Has Implemented Fifteen of Twenty-seven Cybersecurity Recommendations from Prior GAO Reports

As of March 2017, DOD had implemented 15 of the 27 cybersecurity  recommendations (56 percent) we made in fiscal years 2011 through  2016. DOD is continuing to take actions to address 11 open  recommendations, and 1 recommendation has been closed as not  implemented. DOD’s 56 percent implementation rate is slightly lower than  the government-wide 60 percent rate for implementing recommendations  aimed at improving the security of federal systems and information.  Table 8 below shows our analysis of the implementation status of the 27  cybersecurity recommendations.

		DOD Has Implemented More Than Half of Prior GAO Recommendations

As of March 2017, DOD had implemented 15 of the 27 cybersecurity  recommendations (56 percent) we made in fiscal years 2011 through  2016. Among them are the following:
Cyberspace Activities. In July 2011, we reported on DOD’s  organization and planning of cyberspace operations, including its  defensive and offensive efforts to address cybersecurity threats. DOD  lacked clear and complete guidance on command and control  responsibilities, and DOD did not have a comprehensive approach to  assess its cyberspace capability needs and prioritize capability  gaps. We made 4 recommendations to strengthen DOD’s  cyberspace doctrine and operations to better address cybersecurity  threats and ensure a more comprehensive approach to developing  and prioritizing the department’s cyberspace capability needs. DOD  has implemented those 4 recommendations. In 2011, DOD updated  its guidance related to cyberspace command and control  relationships. In May 2012, DOD issued a capability gap assessment  memorandum that includes DOD cyberspace capability gaps,  proposed mitigation actions, and estimated completion dates. In  February 2013, DOD issued a joint doctrine publication on cyberspace  operations. These actions allowed the department to take a more  comprehensive approach to its cyberspace capabilities and clarify its  cyberspace command and control relationships.
Cyberspace Budget Estimates. In July 2011, we reported that  DOD’s cybersecurity budget estimates did not include all full-spectrum  cyberspace operations, including computer network attack, computer  network exploitation, and classified funding costs. The department  also lacked a central organization or a methodology for collecting and  compiling budget information on cyberspace operations. We made 2  recommendations to improve DOD’s ability to develop and provide  consistent and complete budget estimates for its cyberspace  operations. DOD implemented these recommendations by issuing  new guidance for cyberspace operations budget submissions. The  new guidance documents enabled DOD to develop a single  cyberspace operations budget estimate that provides a complete  picture of its cyberspace operations investments.
Small Business Cybersecurity Efforts. In September 2015, we  recommended that DOD identify and disseminate cybersecurity  resources to defense small businesses, because DOD’s Office of  Small Business Programs had not done so. In their response to the  draft report, DOD officials stated that the department would implement  training events and education programs. Since then DOD has  implemented this recommendation by making a reference guide for its  workforce to use when engaging with small businesses. These steps  better position defense small businesses to protect their information  and networks from cyber threats.

		DOD Has Not Yet Implemented Critical and High-Priority Cybersecurity Recommendations

DOD has not yet implemented 12 recommendations we have made to  address cybersecurity weaknesses and strengthen its cyberspace  posture. These 12 recommendations include 6 that address critical issues  identified by The DOD Cyber Strategy and that we also previously  identified as a priority for implementing. Among the recommendations not  yet implemented (open, or closed as not-implemented) are the following:
Continuity of Operations. In April 2014, we found that some DOD  components had not developed continuity plans, conducted continuity  exercises, or established oversight to hold the components  accountable. Therefore, we made 4 recommendations to strengthen  DOD’s cyber continuity program by: (1) updating DOD’s continuity  guidance; (2) providing planning tools for exercises with cyber  degradation; (3) increasing oversight of the components; and (4)  evaluating its process for tasking the components and evaluating their  continuity readiness. DOD concurred with and subsequently took  actions to begin implementing the 4 recommendations; however, DOD  has not fully implemented these recommendations. For example,  DOD drafted an update to its defense continuity policy guidance, but  as of January 2017, the revisions had not been completed. Without  this guidance, it will be difficult for the DOD components to provide  reasonable assurance that the systems and networks needed to  maintain continuity of operations in a degraded cyber environment will  be reliable, accessible, or available within needed timeframes.
Insider Threat. In June 2015, we made 4 recommendations to  address challenges with DOD’s insider threat program—of which  DOD concurred with two, and partially concurred with two. DOD is  developing an insider threat implementation plan to address two of the  recommendations, but that plan has not yet been published. DOD  officials told us that the department is no longer taking action to  address our recommendation to evaluate the extent to which its  insider-threat programs address capability gaps. This  recommendation originated in part when DOD did not complete a  continuing analysis of gaps in security measures and of technology,  policies, and processes that are needed to increase the capability of  its insider-threat program to address these gaps, as required by  statute. This survey would have allowed DOD to define existing  insider-threat program capabilities; identify gaps in security measures;  and advocate for the technology, policies, and processes necessary  to increase capabilities in the future. In their comments to the draft  report, DOD officials stated that the department analyzes security  gaps each quarter through its self-assessments, which identify  program capability gaps. However, DOD has not evaluated and  documented the extent to which the current assessments describe  existing insider-threat program capabilities, as required by law.  Without a documented evaluation, the department will not know  whether its capabilities to address insider threats are adequate, or  whether the capabilities address statutory requirements.
Defense Civil Support. In April 2016, we found that DOD’s guidance  did not clearly define the roles and responsibilities of key DOD  entities—such as DOD components—for domestic cyber incidents.  For example, U.S. Northern Command’s Defense Support of Civil  Authorities response concept plan states that U.S. Northern  Command would be the supported command for a mission to support  civil authorities in responding to a domestic cyber incident. However,  other guidance directs and DOD officials confirmed that a different  command, CYBERCOM, would be responsible for supporting civil  authorities in the event of a domestic cyber incident. Therefore, we  made a recommendation that DOD issue or update guidance that  clarifies roles and responsibilities to support civil authorities in a  domestic cyber incident. DOD concurred with this recommendation.  As of April 2017, the department had not implemented this  recommendation, but officials indicated that they are in the process of  drafting guidance that will clarify these roles. Specifically, the  department is drafting a memorandum on defense support for cyber  incident response that DOD officials believe will clearly articulate how  DOD would support domestic cyber incident response efforts. DOD  also scheduled exercises and a workshop to help it prepare to support  civil authorities in the event of a cyber incident. However, until DOD  clarifies the roles and responsibilities of its key entities for cyber  incidents, it will remain unclear which DOD component or command  should be providing support to civil authorities in the event of a major  cyber incident.
We continue to believe that implementing these 12 recommendations  would improve DOD’s cyberspace posture. We will continue to monitor  DOD’s implementation of these recommendations, paying particular  attention to the 6 high-priority recommendations that are still not  implemented. Appendix I lists each report issued from fiscal years 2011  through 2016 that included recommendations for DOD, along with each  recommendation’s implementation status.

	Conclusions

DOD continues to face complex and evolving cyberspace threats to its  networks and information. It has taken actions to implement the tasks and  objectives from the DOD Cloud Computing Strategy, The DOD Cyber  Strategy, and the DOD Cybersecurity Campaign. However, gaps in the  department’s processes for monitoring implementation of this guidance  limits DOD’s ability to monitor the status of, and hold organizations  accountable for, implementing key cybersecurity actions—such as its goal  to identify, prioritize, and defend its most important networks and data so  that it can carry out its missions effectively. DOD has made progress in  implementing the seven actions required by the DOD Cybersecurity  Campaign, but it does not know when it will achieve full implementation of  one of the six remaining actions. DOD’s continuing progress is highlighted  by CYBERCOM’s recent release of defensive cyber operations guidance  in accordance with one of the objectives of the DOD Cybersecurity  Campaign. Addressing the gaps in DOD’s plans and timeframes for  completing the remaining action will help DOD find and fix any root  causes of cybersecurity breaches. Failure to implement this objective  makes DOD vulnerable to cyber threats that may negatively affect  mission readiness and could hinder mission accomplishment.

	Recommendations for Executive Action

To ensure that DOD implements the tasks and objectives of key  cybersecurity guidance to strengthen its cybersecurity posture, we  recommend that the Secretary of Defense take the following two actions:
Direct the Principal Cyber Advisor to modify the criteria for closing  tasks from The DOD Cyber Strategy to reflect whether tasks have  been implemented, and to re-evaluate tasks that have been  previously determined to be completed to ensure that they meet the  modified criteria;
Direct the Commander of CYBERCOM, in coordination with the Under  Secretary of Defense for Acquisition, Technology, and Logistics and  DOD CIO, to establish a timeframe and monitor implementation of the  DOD Cybersecurity Campaign objective to develop cybersecurity  readiness assessments to help ensure accountability.

	Agency Comments and Our Evaluation

We provided a draft of our report to DOD for review and comment. In its  written comments, DOD partially concurred with both of our  recommendations. DOD’s written comments are reprinted in their entirety  in appendix II. DOD also provided technical comments, which we  incorporated into the report where appropriate.
DOD partially concurred with our recommendation to modify the criteria  for closing tasks from The DOD Cyber Strategy to reflect whether tasks  have been implemented and re-evaluate tasks that have previously been  determined to be completed to ensure that they meet the modified  criteria. The department stated that it has a robust process in place to  ensure that tasks are normalized within appropriate processes,  operations, and/or policies. DOD stated that it will implement internal  control standards to periodically reassess closed tasks and that the  department will re-evaluate the word “closed” as it relates to enduring  activities that have active efforts ongoing across the department. If DOD  implements these actions it will help ensure that the department monitors  the status of these cybersecurity tasks to completion and will meet the  intent of our recommendation.
DOD partially concurred with our recommendation to establish  timeframes and monitor implementation of the DOD Cybersecurity  Campaign objectives related to readiness assessments and a defensive  cyberspace concept of operations to help ensure accountability. The  department stated that CYBERCOM will coordinate with the necessary  components to develop timelines for implementing these objectives.  Further, the DOD CIO and the Under Secretary of Defense for  Acquisition, Technology, and Logistics will monitor the status of these  objectives to help ensure accountability. If DOD takes the actions it  outlined, it will meet the intent of our recommendation. Because  CYBERCOM provided us a copy of their recently published defensive  cyber operations guidance before completion of our audit, we adjusted  our recommendation to omit reference to a defensive cyberspace concept  of operations.
We are sending copies of this report to the appropriate congressional  committees, the Secretary of Defense, DOD’s Deputy Principal Cyber  Advisor, the Commander of CYBERCOM, the Acting Under Secretary of  Defense for Acquisition, Technology, and Logistics, and DOD’s Acting  Chief Information Officer.  In addition, the report is available at no charge  on the GAO website at http://www.gao.gov.
If you or your staff have any questions about this report, please contact  me at (202) 512- 9971 or kirschbaumj@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. Key contributors to this report are listed in  appendix III.

Appendix I: Status of Cybersecurity Recommendations Made to the Department of Defense (DOD), Fiscal Years 2011 through 2016

Table 9 below summarizes the status of the 27 cybersecurity  recommendations we made to DOD in 10 reports issued from fiscal years  2011 through 2016. We classify each recommendation as implemented,  open, or not-implemented. Open and not-implemented recommendations  are those that the agency has not yet taken sufficient steps to implement.  Open recommendations are recommendations that the agency is still  working toward implementing, while DOD is no longer taking actions on  the recommendation that is not implemented. The recommendations are  listed by report.

Appendix II: Comments from the Department of Defense

Appendix III: GAO Contact and Staff Acknowledgments

	GAO Contact

	Staff Acknowledgments

In addition to the individual named above, Tommy Baril, Assistant  Director; Tracy Barnes; John Beauchamp; Lon Chin; Pamela Davidson;  Ashley Houston; Jason Kelly; Amie Lesser; Randy Neice; and Cheryl  Weissman made key contributions to this report.

Related Unclassified GAO Products

Defense Department Cyber Efforts: Definitions, Focal Point, and  Methodology Needed for DOD to Develop Full-Spectrum Cyberspace  Budget Estimates. GAO-11-695R. Washington, D.C.: July 29, 2011.
Defense Department Cyber Efforts: DOD Faces Challenges In Its Cyber  Activities. GAO-11-75. Washington, D.C.: July 25, 2011.
Defense Department Cyber Efforts: More Detailed Guidance Needed to  Ensure Military Services Develop Appropriate Cyberspace Capabilities.  GAO-11-421. Washington, D.C.: May 20, 2011.
Defense Cyber Efforts: Management Improvements Needed to Enhance  Programs Protecting the Defense Industrial Base from Cyber Threats.  GAO 12-762SU, August 3, 2012.
Defense Cybersecurity: DOD Needs to Better Plan for Continuity of  Operations in a Degraded Cyber Environment and Provide Increased  Oversight. GAO-14-404SU, April 1, 2014.
Insider Threats: DOD Should Strengthen Management and Guidance to  Protect Classified Information and Systems. GAO-15-544, June 2, 2015.
Defense Infrastructure: Improvements in DOD Reporting and  Cybersecurity Implementation Needed to Enhance Utility Resilience  Planning. GAO-15-749, July 23, 2015.
Defense Cybersecurity: Opportunities Exist for DOD to Share  Cybersecurity Resources with Small Businesses. GAO-15-777,  September 24, 2015.
Civil Support: DOD Needs to Clarify Its Roles and Responsibilities for  Defense Support of Civil Authorities during Cyber Incidents. GAO-16-332,  April 4, 2016.
Defense Civil Support: DOD Needs to Identify National Guard’s Cyber  Capabilities and Address Challenges in Its Exercises. GAO-16-574,  September 6, 2016.

Summary:
Why GAO Did This Study

DOD acknowledges that malicious cyber intrusions of its networks have negatively affected its information technology systems, and that adversaries are gaining capability over time. In 2010, the President re-designated the director of the NSA as CYBERCOM's commander, establishing a dual-hat leadership arrangement for these agencies with critical cybersecurity responsibilities.
House Reports 114-537 and 114-573 both included provisions for GAO to assess DOD's management of its cybersecurity enterprise. This report, among other things, examines (1) DOD officials' perspectives on the advantages and disadvantages of the dual-hat leadership arrangement of NSA/CSS and CYBERCOM, and actions that could mitigate risks if the leadership arrangement ends, and (2) the extent to which DOD has implemented key strategic cybersecurity guidance. GAO analyzed DOD cybersecurity strategies, guidance, and information and interviewed cognizant DOD officials.

What GAO Found

Officials from Department of Defense (DOD) components identified advantages and disadvantages of the “dual-hat” leadership of the National Security Agency (NSA)/Central Security Service (CSS) and Cyber Command (CYBERCOM) (see table). Also, DOD and congressional committees have identified actions that could mitigate risks associated with ending the dual-hat leadership arrangement, such as formalizing agreements between NSA/CSS and CYBERCOM to ensure continued collaboration, and developing a persistent cyber training environment to provide a realistic, on-demand training capability. As of April 2017, DOD had not determined whether it would end the dual-hat leadership arrangement.
DOD's progress in implementing key cybersecurity guidance—the DOD Cloud Computing Strategy , The DOD Cyber Strategy , and the DOD Cybersecurity Campaign —has varied. DOD has implemented the cybersecurity elements of the DOD Cloud Computing Strategy and has made progress in implementing The DOD Cyber Strategy and DOD Cybersecurity Campaign . However, DOD's process for monitoring implementation of The DOD Cyber Strategy has resulted in the closure of tasks before they were fully implemented; for example, DOD closed a task that, among other things, would require completing cyber risk assessments on 136 weapon systems. Officials acknowledged they are on track to complete the assessments by December 31, 2019, but as of May 2017, the task was not complete. Unless DOD modifies its process for deciding whether a task identified in its Cyber Strategy is implemented, it may not be able to achieve outcomes articulated in the strategy. Also, DOD lacks a timeframe and process for monitoring implementation of the DOD Cybersecurity Campaign objective to transition to commander-driven operational risk assessments for cybersecurity readiness. Unless DOD improves the monitoring of its key cyber strategies, it is unknown when DOD will achieve cybersecurity compliance.

What GAO Recommends

GAO recommends that DOD take the following two actions: (1) modify its criteria for closing tasks from The DOD Cyber Strategy ; and (2) establish a timeframe and monitoring for implementing an objective of the DOD Cybersecurity Campaign to transition to commander-driven operational risk assessments for cybersecurity readiness. DOD partially concurred with these recommendations and identified actions it plans to take. If implemented, GAO believes these actions would satisfy the intent of the recommendations.