POLAR SATELLITES

NOAA Faces Challenges 

and Uncertainties that 

Could Affect the Availability 

of Critical Weather Data

Statement of David A. Powner 

Director, Information Technology Management Issues

Testimony 

Before the Subcommittee on 

Environment, Committee on Science, 

Space, and Technology, House of 

Representatives

For Release on Delivery 

Expected at 10:00 a.m. ET

Thursday, July 7, 2016

GAO-16-773T

United States Government Accountability Office
United States Government Accountability Office

Highlights of GAO-16-773T, a testimony 

before the Subcommittee on Environment,

Committee on Science, Space, and 

Technology, House of Representatives

July 7, 2016

POLAR SATELLITES

NOAA Faces Challenges and Uncertainties that Could 

Affect the Availability of Critical Weather Data

Why GAO Did This Study

Polar-orbiting satellites provide data 

that are essential to support weather 

observations and forecasts. NOAA is 

preparing to launch the second satellite 

in the JPSS program in March 2017, 

but a near-term gap in polar satellite 

coverage remains likely. Given the 

criticality of satellite data to weather 

forecasts and the potential impact of a 

satellite data gap, GAO added this 

area to its High-Risk List in 2013.

This statement addresses the status of 

the JPSS program and plans for future 

satellites, NOAA’s efforts to depict and 

update satellite timelines, and the 

JPSS program’s implementation of key 

information security protections. This 

statement is based on a May 2016 

report on JPSS and a draft report on 

satellite timelines. To develop the draft 

report, GAO reviewed agency 

procedures for updating satellite 

timelines, compared timelines to best 

practices and agency documentation, 

and interviewed officials.

What GAO Recommends

In its May 2016 report, GAO 

recommended that NOAA assess the 

costs and benefits of different launch 

decisions based on updated satellite 

life expectancies, and address 

deficiencies in its information security 

program. NOAA concurred with these 

recommendations. GAO’s draft report 

includes recommendations to NOAA to 

improve the accuracy, consistency, 

and documentation supporting updates 

to satellite timelines, and to revise and 

finalize its draft policy governing

timeline updates. This report is 

currently at the Department of 

Commerce for comment. 

What GAO Found

As highlighted in a May 2016 report, the National Oceanic and Atmospheric 

Administration’s (NOAA) Joint Polar Satellite System (JPSS) program has 

continued to make progress in developing the JPSS-1 satellite for a March 2017 

launch. However, the program has experienced technical challenges which have 

resulted in delays in interim milestones. In addition, NOAA faces the potential for 

a near-term gap in satellite coverage of 8 months before the JPSS-1 satellite is 

launched and completes post-launch testing (see figure). NOAA has also begun 

planning for future polar satellites. However, uncertainties remained on the best 

timing for launching these satellites, in part because of the potential for some 

satellites already in orbit to last longer. NOAA did not provide sufficient evidence 

that it had evaluated the costs and benefits of launch scenarios for these new 

satellites based on updated life expectancies. Until this occurs, NOAA may not 

make the most efficient use of investments in the polar satellite program.

Timeline for a Potential Gap in Polar Satellite Data in the Afternoon Orbit

Note: The afternoon orbit is one of three primary polar orbits providing needed coverage for 

numerical weather models.

As noted in a draft GAO report, NOAA publishes “flyout charts” depicting satellite 

timelines to support budget requests and appropriations discussions. The agency 

regularly updates its charts when key changes occur. However, the charts do not 

always accurately reflect data from other program documentation such as the 

latest satellite schedules or assessments of satellite availability. NOAA also has

not consistently documented its justification for chart updates or depicted

lifetimes for satellites beyond their design life, and has not finalized a policy for 

updating its charts. As a result, the information NOAA provides Congress on the 

flyout charts is not as accurate as it needs to be, which could result in less-thanoptimal decisions.

GAO reported in May 2016 that, although NOAA has established information 

security policies in key areas recommended by guidance, the JPSS program has 

not yet fully implemented them. Specifically, while the program has implemented 

multiple relevant security controls, it has not yet fully implemented almost half of 

the recommended security controls, did not have all of the information it needed 

when assessing security controls, and has not addressed key vulnerabilities in a 

timely manner. Furthermore, NOAA has experienced 10 key information security 

incidents related to the JPSS ground system, including incidents regarding 

unauthorized access to web servers and computers. Until NOAA addresses 

these weaknesses, the JPSS ground system remains at high risk of compromise.

View GAO-16-773T. For more information, 

contact David A. Powner at (202) 512-9286 or 

pownerd@gao.gov
Letter

Page 1 GAO-16-773T 

Chairman Bridenstine, Ranking Member Bonamici, and Members of the 

Subcommittee:

Thank you for the opportunity to participate in today’s hearing on an 

important satellite acquisition program within the Department of 

Commerce’s National Oceanic and Atmospheric Administration (NOAA). 

In 2010, NOAA initiated the Joint Polar Satellite System (JPSS) program 

with assistance from the National Aeronautics and Space Administration 

(NASA). NOAA launched the first satellite in the JPSS program in 

October 2011, and plans to launch the next satellite by March 2017.

NOAA also plans to launch other similar satellites in the future.

The JPSS program is critical to the United States’ ability to maintain the 

continuity of data required for weather forecasting. According to officials 

at NOAA, a gap in polar satellite data would result in less accurate and 

timely weather forecasts and warnings of extreme events, such as 

hurricanes, storm surges, and floods. Such degradation in forecasts and 

warnings would place lives, property, and our nation’s critical 

infrastructures in danger. Given the criticality of satellite data to weather 

forecasts, the possibility of a satellite data gap, and the potential impact of 

a gap, we added this area to our High-Risk List in 2013 and it remained 

on the High-Risk List in 2015.1

This statement summarizes a recently issued report and key findings from 

a draft report on (1) the status of the JPSS program and plans for future 

satellites, (2) NOAA’s efforts to depict and update satellite timelines; and 

(3) the JPSS program’s implementation of key information security 

protections. Specifically, this statement is based on a May 2016 report 

detailing NOAA’s progress on the JPSS satellite program with respect to 

schedule and key risks, its efforts to plan and implement a follow-on polar 

satellite program, and the JPSS program’s implementation of key 

 1

Every 2 years, at the start of a new Congress, we call attention to agencies and program 

areas that are high risk due to their vulnerabilities to fraud, waste, abuse, and 

mismanagement, or are most in need of transformation. See GAO, High Risk Series: An 

Update, GAO-13-283 (Washington, D.C.: Feb. 14, 2013) and High Risk Series: An 

Update, GAO-15-290 (Washington, D.C.: Feb. 11, 2015). 

Letter
Page 2 GAO-16-773T 

information security protections.2 More detailed information on our 

objectives, scope, and methodology can be found in the issued report. 

This statement is also based on a draft report that includes the results of 

work we performed for the House Committee on Appropriations for 

information on NOAA’s efforts to depict and update polar satellite timeline 

information. For our draft report, we reviewed NOAA policies, procedures, 

and documentation on recent updates to its satellite timelines, compared 

the timeline updates to other agency documentation and support 

materials, and interviewed agency officials. We reviewed information from 

the draft report with agency officials and made technical changes as 

appropriate. This draft report is currently at the Department of Commerce 

for official comment. We expect to issue the report by September 2016.

The work upon which this statement was based was conducted in 

accordance with generally accepted government auditing standards. 

Those standards require that we plan and perform the audit to obtain 

sufficient, appropriate evidence to provide a reasonable basis for our 

findings and conclusions based on our audit objectives. We believe that 

the evidence obtained provides a reasonable basis for our findings and 

conclusions based on our audit objectives.

Since the 1960s, the United States has operated polar-orbiting satellite 

systems that obtain environmental data to support weather observations 

and forecasts. These data are processed to provide graphical weather 

images and specialized weather products. Data from polar satellites are

also the predominant input to numerical weather prediction models, which 

are a primary tool for forecasting weather days in advance—including 

forecasting the path and intensity of hurricanes. These weather products 

and models are used to predict the potential impact of severe weather so 

that communities and emergency managers can help prevent and 

mitigate its effects.

Polar-orbiting satellites circle the earth in a nearly north-south orbit, 

providing global observation of conditions that affect the weather and 

climate. Each satellite makes about 14 orbits a day. As the earth rotates 

 2

GAO, Polar Weather Satellites: NOAA Is Working to Ensure Continuity but Needs to 

Quickly Address Information Security Weaknesses and Future Program Uncertainties,

GAO-16-359 (Washington, D.C.: May 17, 2016). 

Background
Page 3 GAO-16-773T 

beneath it, each polar-orbiting satellite views the entire earth’s surface 

twice a day.

Currently, the polar-orbiting satellites that are considered primary 

satellites for providing input to weather forecasting models are a 

NOAA/NASA satellite (called Suomi National Polar-orbiting Partnership, 

or S-NPP), two Department of Defense (DOD) satellites, and a series of 

European satellites. These satellites cross the equator in early morning, 

mid-morning, and early afternoon orbits, with S-NPP in the early 

afternoon orbit. NOAA, the Air Force, and a European weather satellite 

organization also maintain older satellites that provide limited backup to 

these operational satellites. Figure 1 illustrates the current operational 

polar satellite constellation.

Figure 1: Configuration of Operational Polar Satellites

Note: DMSP – Defense Meteorological Satellite Program; Metop – Meteorological Operational; S- NPP – Suomi National Polar-orbiting Partnership.

According to NOAA, 80 percent of the data assimilated into its National 

Weather Service numerical weather prediction models that are used to 

produce weather forecasts 3 days and beyond are provided by polarorbiting satellites. Specifically, a single afternoon polar satellite provides 

NOAA 45 percent of the global coverage it needs for its numerical 
Page 4 GAO-16-773T 

weather models. NOAA obtains the rest of the polar satellite data it needs 

from other satellite programs, including DOD’s early morning satellites 

and the European mid-morning satellite.

NOAA is currently executing a major satellite acquisition program to 

replace existing polar satellite systems that are nearing the end of their 

expected life spans. NOAA established the JPSS program in 2010 after a 

prior tri-agency program was disbanded due to technical and 

management challenges, cost growth, and schedule delays.3 The JPSS 

program guided the development and launch of the S-NPP satellite in 

20114 and is responsible for two other planned JPSS satellites, known as 

JPSS-1 and JPSS-2. The current anticipated launch dates for these two 

satellites are March 2017 and December 2021, respectively. More 

recently, NOAA has also begun planning the Polar Follow-On (PFO) 

program, which is to include the development and launch of a third and 

fourth satellite in the series in July 2026 and July 2031, respectively. 

These are planned to be nearly identical to the JPSS-2 satellite.

NOAA has organized the JPSS program into flight and ground projects 

that have separate areas of responsibility. The flight project includes a set 

of five instruments, the spacecraft, and launch services. The ground 

project consists of ground-based systems that handle satellite 

communications and data processing. The ground system’s versions are 

numbered; the version that is currently in use is called Block 1.2, and the 

new version that is under development is called Block 2.0. Among other 

things, Block 2.0 is to enable the JPSS ground system to support both the 

S-NPP and all planned JPSS satellites.

Since 2012, we have issued reports on the JPSS program that 

highlighted technical issues, component cost growth, management 

 3

The National Polar-orbiting Operational Environmental Satellite System was a tri-agency 

program made up of NOAA, the Department of Defense, and NASA. It was disbanded in 

2010. 

4

S-NPP was originally planned as a demonstration satellite, but due to schedule delays 

that had the potential to lead to satellite data gaps, NOAA made the decision to use it as 

an operational satellite. This means that the satellite’s data are used for climate and 

weather products.

Overview of JPSS 

Program
Page 5 GAO-16-773T 

challenges, and key risks.5 In these reports, we made 15 

recommendations to NOAA to improve the management of the JPSS 

program. These recommendations included addressing key risks, 

establishing a comprehensive contingency plan consistent with best 

practices, and addressing weaknesses in information security practices.

As we reported in May 2016, the agency had implemented 2 

recommendations and was working to address the remainder. In 

particular, NOAA established contingency plans to mitigate the possibility 

of a polar satellite data gap and began tracking completion dates for its 

gap mitigation activities. NOAA has also taken steps such as performing 

a new schedule risk analysis, and adding information on the impact of 

space debris to its annual assessment of satellite availability. We have 

ongoing work reviewing the agency’s progress in implementing these 

open recommendations.

Over the past year, the JPSS program has made progress in developing 

the JPSS-1 satellite, but continues to face challenges as it approaches 

the early 2017 launch date. The program completed all instruments on 

the JPSS-1 satellite and integrated them on the spacecraft by early 2016. 

As of December 2015, the JPSS program reported that it remained on 

track to meet its committed launch date of March 2017.

However, as highlighted in our May 2016 report, the JPSS program

continues to face challenges as it approaches the early 2017 launch 

date.

6 Specifically, the JPSS program had experienced delays ranging 

from 3 to 10 months on key components since mid-2014, as well as 

technical challenges on both the flight and ground systems. For example, 

the program recently experienced multiple issues in completing a 

component on the spacecraft, called a gimbal,7 which moved the 

 5

See GAO-16-359; GAO, Polar Weather Satellites: NOAA Needs To Prepare for Nearterm Data Gaps, GAO-15-47 (Washington, D.C.: Dec. 16, 2014); Polar Weather Satellites: 

NOAA Identified Ways to Mitigate Data Gaps, but Contingency Plans and Schedules 

Require Further Attention, GAO-13-676 (Washington, D.C.: Sept. 11, 2013); and PolarOrbiting Environmental Satellites: Changing Requirements, Technical Issues, and 

Looming Data Gaps Require Focused Attention, GAO-12-604 (Washington, D.C.: June 

15, 2012).

6

See GAO-16-359.

7

A gimbal provides articulation for selected antennas responsible for transmitting stored 

data to communication satellites and ground systems.

NOAA Continues to 

Develop JPSS 

Satellites, but Faces 

Remaining 

Challenges and 

Uncertainties 

Regarding Future 

Decisions
Page 6 GAO-16-773T 

component’s planned completion date forward by almost a year before it 

was completed in March 2016. These issues in turn delayed the 

beginning of the JPSS-1 satellite’s environmental testing. The gimbal 

issue also was a factor in the program choosing to move back its launch 

readiness date—the date that the JPSS-1 satellite is planned to be ready 

for launch—from December 2016 to January 2017.

Regarding the JPSS ground system, the program experienced an 

unexpectedly high number of program trouble reports in completing the 

upgrade to Block 2.0, which is needed for security and requirements 

improvements in tandem with the JPSS-1 satellite’s launch. A key 

milestone related to this upgrade was recently delayed from January to 

August 2016.

While NOAA satellite timelines show continuous coverage in the 

afternoon orbit, the JPSS program still faces the potential for a near-term 

gap in satellite coverage. As we reported in May 2016, NOAA had 

increased the estimated useful life for S-NPP by up to 4 years. Under this 

new scenario, a near-term gap in satellite data would not be expected 

because S-NPP would last longer than the expected start of operations 

for JPSS-1.

However, subsequent NOAA documentation showed this 4-year period as 

“fuel limited life.” NOAA officials explained that this extended period is 

based on expected fuel availability, and does not take into account the 

likelihood that the instruments and spacecraft will fail before the satellite 

runs out of fuel. In other words, the extended useful life depicts the 

satellite’s maximum possible life, not its expected life.

As a result, the JPSS program continues to face a potential gap of 8 

months between the end of S-NPP’s expected life in October 2016, and 

when the JPSS-1 satellite is launched and completes post-launch testing 

in June 2017. Figure 2 shows the potential gap period.
Page 7 GAO-16-773T 

Figure 2: Timeline for a Potential Gap in Polar Satellite Data in the Afternoon Orbit

Note: The afternoon orbit is one of three primary polar orbits. A single afternoon polar satellite 

provides NOAA 45 percent of the global coverage it needs for its numerical weather models.

The June 2017 completion date also assumes a 3 month period for the 

JPSS-1 satellite’s on-orbit checkout. However, based on on-orbit 

checkout periods from past polar satellites, it is likely that checkout could 

take longer than this, potentially lengthening the gap. As a precedent, it 

took the JPSS program about 2 years to fully validate the highest-priority 

data products from the S-NPP satellite. If S-NPP unexpectedly fails 

sooner, or the JPSS-1 launch date is delayed, a longer gap could result.

In addition to its work in completing the JPSS-1 satellite, NOAA has 

begun planning for new satellites to ensure the future continuity of polar 

satellite data. In a new program, called the Polar Follow-On (PFO), NOAA 

plans to build two new satellites, JPSS-3 and JPSS-4, that are copies of 

the JPSS-2 satellite. Like JPSS-2, these satellites are to include all three 

key performance parameter instruments, as well as a fourth 

environmental sensor. NOAA plans to complete development of JPSS-3 

and JPSS-4 several years ahead of their planned launch date. In the 

nearer term, NOAA plans to build a smaller satellite that can provide a 

replacement for some data produced by one of the most essential JPSS 

instruments.

Uncertainties Remain on 

Key Future JPSS 

Development Dates
Page 8 GAO-16-773T 

NOAA’s decisions on what PFO will include are based on what the 

agency calls a robust constellation, creating a situation where it would 

take two failures to create a gap on data from key instruments, and where 

the agency would be able to restore full coverage in a year in the event of 

a failure.

We reported in May 2016 that NOAA has taken several steps in planning 

the PFO program, including establishing goal launch dates and high-level 

budget estimates. However, it had not completed formulation documents 

such as high-level requirements, a project plan, or budget information for 

key components.

In addition, uncertainties remain about whether early development of 

JPSS-3 and JPSS-4 is necessary to achieve robustness. For instance, in 

its initial calendar for PFO, NOAA considered lifetimes of 10 years or 

more for the JPSS-1 and JPSS-2 satellites, while NOAA charts used for 

budget justification continue to show only 7 year lifetimes. If satellites are 

likely to last longer than expected, there could be unnecessary 

redundancy in coverage. Until NOAA ensures that its plans for future 

polar satellite development are based on the full range of estimated lives 

of potential satellites, the agency may not be making the most efficient 

use of the nation’s sizable investment in the polar satellite program.

As a result of this uncertainty, we recommended that NOAA evaluate the 

costs and benefits of different launch scenarios for the JPSS PFO 

program, based on updated satellite life expectancies, to ensure satellite 

continuity while minimizing program costs. NOAA concurred and noted 

that it had evaluated the costs and benefits of different launch scenarios 

using the latest estimates of satellite lives as part of its budget 

submission. However, the agency did not provide sufficient supporting 

evidence or artifacts showing that it had evaluated costs and benefits of 

launch scenarios in this way.

NOAA’s National Environmental Satellite Data and Information Service 

(NESDIS) regularly publishes “flyout charts” for its satellites which depict 

timelines for the launch, on-orbit storage, and operational life of its 

satellites. Among other things, NOAA uses these charts to support budget 

requests, alert users when new satellites will be operational, and keep the 

public informed on plans to maintain satellite continuity.

In a draft report currently at the Department of Commerce for comment, 

we reported that NOAA has updated its polar flyout charts three times in 

NOAA’s Timelines for 

Current and Future 

NOAA Polar Satellites 

Are Not Consistently 

Accurate and Useful
Page 9 GAO-16-773T 

the last 2-and-a-half years. Key changes that can result in an update 

include adding newly planned satellites; removing a satellite that has 

reached the end of its life; and adjusting planned dates for when satellites 

are to launch, begin operations, or reach the end of their useful lives. 

Among the data NOAA uses in updating its charts are health status 

information of operational satellites, planned schedules for new satellites, 

and analysis from operational satellite experts.

However, while NOAA regularly updates its charts and most of the data 

on them were aligned with other program documentation, the agency has 

not consistently ensured that its charts were accurate, supported by 

stringent analysis, and fully documented. Specifically:

• The charts were at times inconsistent with other program data. For 

example, in one out of 10 available instances for comparison, flyout 

chart data did not match underlying program data. JPSS program 

data as of April 2015 listed the JPSS-2 satellite launch as November 

2021, but the flyout chart from that month showed it 4 months earlier, 

in July 2021.

The flyout charts also inconsistently reflected data from annual 

satellite availability assessments performed by the JPSS program. In 

addition, weaknesses remained in the latest annual availability 

assessment from 2015. For example, NOAA assumed that JPSS-1 

data from key instruments will be available to users 3 months after 

launch. However, based on on-orbit checkout periods from past polar 

satellites, it is likely that checkout could take much longer than this, 

potentially lengthening the gap.

• NOAA did not consistently document the justification for updates to its 

polar satellite flyout charts. For example, the NOAA department 

responsible for providing summary packages for each flyout chart 

update provided justification for the key changes in only one of three 

documentation packages. Furthermore, standard summary 

documents, such as a routing list and information on the disposition of 

comments, were included for only one of the three documentation 

packages for polar flyout charts.

• NOAA also does not consistently depict how long a satellite might last 

once it is beyond its design life. For instance, NESDIS, the NOAA 

entity responsible for satellite operations, recently added a 4-year 

extension to the useful life of the S-NPP satellite. This extension was 

meant to depict maximum potential life, assuming all instruments and 

the spacecraft continue functioning. However, the agency did not 
Page 10 GAO-16-773T 

clearly define this term on its charts, thereby allowing readers to 

assume the agency expects the satellites to last through the end of 

the fuel-limited life period.

Also, as stated above, in its justification for funding for the PFO

program, NOAA considered lifetimes for JPSS-1 and JPSS-2 to be 

longer by several years when compared to the lifetimes listed on its 

flyout charts. Program officials indicated that the estimates they 

develop prior to a satellite’s launch are more conservative due to 

greater uncertainty at that stage. However, inconsistencies such as 

these have the effect of implying that some satellites will reach their 

end-of-life sooner or later than the agency anticipates.

Part of the reason for these process shortfalls is that NOAA has not 

finalized a policy with standard steps to follow when making chart 

updates. Consequently, the information that NOAA provides Congress on 

the flyout charts is not as accurate as it needs to be, which could result in 

less-than-optimal decisions. Furthermore, lack of communication of the 

potential ambiguities inherent in changes to satellite lifetimes could have 

major effects on future decision-making.

To address these weaknesses, our draft report includes a series of 

recommendations to NOAA, including requiring satellite programs to 

perform regular assessments of satellite availability, implementing a 

consistent approach to depicting satellites beyond their design lives, and 

revising and finalizing the policy for updating flyout charts.

Safeguarding federal computer systems and systems supporting national 

infrastructure is essential to protecting public health and safety. Federal 

law and guidance specify requirements for protecting federal information 

and information systems. In particular, the Federal Information Security 

Modernization Act of 2014 (FISMA) requires executive branch agencies 

to develop, document, and implement an agency-wide information 

security program.

The JPSS Program 

Needs to Address 

Critical Information 

Security Weaknesses
Page 11 GAO-16-773T 

FISMA also requires the National Institute of Standards and Technology 

(NIST)8 to develop standards and guidelines for agencies to use in 

categorizing their information systems and minimum requirements for 

each category. Accordingly, NIST developed a risk management 

framework of standards and guidelines to follow in developing information 

security programs. Figure 3 shows an overview of the steps in this 

framework, including components of the risk management lifecycle as 

well as key activities and artifacts.

 8

The Federal Information Security Modernization Act of 2014, Pub. L. No. 113-283, 128 

Stat. 3073 (Dec. 18, 2014), largely supersedes the very similar Federal Information 

Security Management Act of 2002, Pub. L. No. 107-347, 116 Stat. 2899, 2946 (Dec. 17, 

2002). The 2002 act’s requirements that the National Institute of Standards and 

Technology establish standards and guidance for implementation of the act were not 

superseded and continue to apply.
Page 12 GAO-16-773T 

Figure 3: Overview of the National Institute of Standards and Technology’s Risk Management Framework for an Information 

Security Program

As we reported in May 2016, NOAA had established information security 

policies in key areas detailed by FISMA and recommended by NIST 

guidance and the JPSS program had made progress in implementing 

these policies.9 However, we found that the program had weaknesses in 

several areas related to its ground system which, if not addressed, could 

put the JPSS ground system at high risk of compromise.

• Key controls not fully implemented. The JPSS program, using 

NIST guidance on system categorization, identified its ground system 

as a high-impact system, meaning that a loss of confidentiality, 

 9

GAO-16-359.
Page 13 GAO-16-773T 

integrity, or availability could be expected to have a catastrophic effect 

on operations, and identified needed security controls based on this 

classification. However, the program had fully implemented only 53 

percent of required security controls, and had fully implemented 

controls in only one area.

• Limitations in controls assessment. The program developed an 

assessment plan to identify weaknesses in the controls established by 

the program, and implemented the assessment. However, the 

assessment had significant limitations, including inconsistencies in 

maintaining a valid inventory, uncertainty about the physical locations 

for program components, and a discrepancy between the inventory 

used for testing and the actual live inventory of the program’s 

systems.

• Delay in fixing critical weaknesses. In accordance with NOAA 

policy, the program established plans of action and milestones to 

address control weaknesses in both the current and future version of 

its ground system, and had made progress in addressing many of its 

security weaknesses through this process. However, many 

vulnerabilities remain unaddressed because the program did not 

comply with Department of Commerce policy to remediate critical and 

high-risk vulnerabilities within 30 days.

As of its 2015 assessment of program controls, the JPSS program 

had 146 critical and 951 high-risk vulnerabilities on the current 

iteration of the ground system, and 102 critical and 295 high-risk 

vulnerabilities on the next iteration of the ground system. 

Vulnerabilities remaining open include instances of outdated software, 

an obsolete web server, as well as more than 200 instances of use of 

outdated definitions used to scan and identify viruses. Figure 4 

graphically shows the number of open vulnerabilities on the current 

JPSS ground system over time.
Page 14 GAO-16-773T 

Figure 4: Open Vulnerabilities Identified on the Current Joint Polar Satellite 

System’s Ground System

Note: NOAA identifies vulnerabilities as critical, high, medium, and low risk. Critical and high-risk 

vulnerabilities pose an increased risk of compromise.

Without addressing these vulnerabilities in a timely manner, the 

program remains at increased risk of potential exploits.

• Security incidents reported but not consistently tracked. In 

accordance with NOAA policy, the JPSS program established a 

continuous monitoring plan to track security incidents and intrusions 

and to ensure that information security controls are working. 

Specifically, NOAA officials reported 10 medium and high-severity 

incidents related to the JPSS ground system, including incidents 

involving unauthorized access to web servers and computers, 

between August 2014 and August 2015. Of these, NOAA closed 6 

incidents involving hostile probes, improper usage, unauthorized 

access, password sharing, and other IT-related security concerns.

However, the agency did not consistently track all incidents. 

Specifically, there were differences between what is being tracked by 

the JPSS program, and what is closed by NOAA’s incident response 

team. For example, 2 of the 4 incidents that were recommended for 

closure by the JPSS program office are currently still open according 

to the incident report. Until NOAA and the JPSS program have a 

consistent understanding of the status of incidents, there is an 

increased risk that key vulnerabilities will not be identified or properly 

addressed.

To address these deficiencies, we recommended in our May 2016 report 

that the Secretary of Commerce direct the Administrator of NOAA to 
Page 15 GAO-16-773T 

establish a plan to address the limitations in the program’s efforts to test 

security controls, including ensuring that (1) any changes in the system’s 

inventory do not materially affect test results; (2) critical and high-risk 

vulnerabilities are addressed within 30 days, as required by agency 

policy; and (3) the agency and program are tracking and closing a 

consistent set of incident response activities.

NOAA concurred with our recommendations. Regarding critical and highrisk vulnerabilities, NOAA noted that the JPSS program would continue to 

follow agency policy allowing its authorizing official to accept risks when 

remediation cannot be performed as anticipated. However, the program 

did not have documentation from the authorizing official accepting the risk 

of a delayed remediation schedule for critical and high-risk vulnerabilities.

In summary, NOAA is making progress in developing and testing the 

JPSS-1 satellite as it moves toward a March 2017 launch date, but 

continues to experience issues in remaining ground system development, 

and faces a potential near-term data gap in the period before this satellite 

becomes operational. In addition, NOAA is planning to launch a future set 

of satellites to ensure continuity of future satellite data, but it is uncertain 

which launch timing will best meet the agency’s criteria for a robust 

constellation. Without ensuring that its plans for future satellite 

development are based on the full range of estimated lives of potential 

satellites, the agency may not be making the most efficient use of the 

nation’s sizable investment in the polar satellite program.

Further, findings from a draft report show that NOAA’s efforts to depict 

and update key polar satellite information, such as timelines and 

operational life, need to be improved. Its flyout charts, used to inform 

users of potential gaps and support budget requests, did not always 

accurately reflect current program data or consistently present key 

information, such as a satellite’s lifetime once beyond its original design 

life. This is in part because NOAA has not finalized a policy that includes 

standard steps for updating its charts. Until NOAA addresses these 

shortfalls, it runs an increased risk that its flyout charts will mislead 

Congress and may lead to less-than-optimal decisions.

As a part of JPSS ground system development, NOAA has established 

policies in key information security areas called for by guidance. 

However, the program has not fully implemented the policy in several 

areas. For example, the program fully implemented just over half of its 

required security controls, a recent security assessment itself had 
Page 16 GAO-16-773T 

significant limitations, and the program has not remediated critical and 

high-risk vulnerabilities in a timely manner. Until NOAA addresses these 

weaknesses, the JPSS ground system remains at high risk of 

compromise.

Chairman Bridenstine, Ranking Member Bonamici, and Members of the 

Subcommittee, this completes my prepared statement. I would be 

pleased to respond to any questions that you may have at this time.

If you have any questions on matters discussed in this testimony, please 

contact David A. Powner at (202) 512-9286 or at pownerd@gao.gov. 

Other contributors include Colleen Phillips (Assistant Director), Shaun 

Byrnes (Analyst-in-Charge), Christopher Businsky, Torrey Hardee, Lee 

McCracken, and Umesh Thakkar.

GAO Contacts and 

Staff 

Acknowledgments

(100963)
This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately.
The Government Accountability Office, the audit, evaluation, and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and 

policies; and provides analyses, recommendations, and other assistance 

to help Congress make informed oversight, policy, and funding decisions. 

GAO’s commitment to good government is reflected in its core values of 

accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no 

cost is through GAO’s website (http://www.gao.gov). Each weekday 

afternoon, GAO posts on its website newly released reports, testimony, 

and correspondence. To have GAO e-mail you a list of newly posted 

products, go to http://www.gao.gov and select “E-mail Updates.”

The price of each GAO publication reflects GAO’s actual cost of 

production and distribution and depends on the number of pages in the 

publication and whether the publication is printed in color or black and 

white. Pricing and ordering information is posted on GAO’s website, 

http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537.

Orders may be paid for using American Express, Discover Card, 

MasterCard, Visa, check, or money order. Call for additional information.

Connect with GAO on Facebook, Flickr, Twitter, and YouTube.

Subscribe to our RSS Feeds or E-mail Updates. 

Listen to our Podcasts and read The Watchblog.

Visit GAO on the web at www.gao.gov.

Contact:

Website: http://www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470

Katherine Siggerud, Managing Director, siggerudk@gao.gov, (202) 512-

4400, U.S. Government Accountability Office, 441 G Street NW, Room 

7125, Washington, DC 20548

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548

GAO’s Mission

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Phone

Connect with GAO

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Congressional 

Relations

Public Affairs

Please Print on Recycled Paper.