U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office,

http://bookstore.gpo.gov. For more information, contact the GPO Customer Contact Center,

U.S. Government Printing Office. Phone 202–512–1800, or 866–512–1800 (toll-free). E-mail, gpo@custhelp.com.

i 

87–619 2014

[H.A.S.C. No. 113–87] 

INFORMATION TECHNOLOGY AND CYBER 

OPERATIONS: MODERNIZATION AND 

POLICY ISSUES IN A CHANGING 

NATIONAL SECURITY ENVIRONMENT 

HEARING 

BEFORE THE

SUBCOMMITTEE ON INTELLIGENCE, EMERGING 

THREATS AND CAPABILITIES 

OF THE

COMMITTEE ON ARMED SERVICES 

HOUSE OF REPRESENTATIVES 

ONE HUNDRED THIRTEENTH CONGRESS 

SECOND SESSION 

HEARING HELD 

MARCH 12, 2014 
(II) 

SUBCOMMITTEE ON INTELLIGENCE, EMERGING THREATS 

AND CAPABILITIES 

MAC THORNBERRY, Texas, Chairman 

JEFF MILLER, Florida 

JOHN KLINE, Minnesota 

BILL SHUSTER, Pennsylvania 

RICHARD B. NUGENT, Florida 

TRENT FRANKS, Arizona 

DUNCAN HUNTER, California 

CHRISTOPHER P. GIBSON, New York 

VICKY HARTZLER, Missouri 

JOSEPH J. HECK, Nevada 

JAMES R. LANGEVIN, Rhode Island 

SUSAN A. DAVIS, California 

HENRY C. ‘‘HANK’’ JOHNSON, JR., Georgia 

ANDRE ́ CARSON, Indiana 

DANIEL B. MAFFEI, New York 

DEREK KILMER, Washington 

JOAQUIN CASTRO, Texas 

SCOTT H. PETERS, California 

KEVIN GATES, Professional Staff Member 

MARK LEWIS, Professional Staff Member 

JULIE HERBERT, Clerk 
(III) 

C O N T E N T S 

CHRONOLOGICAL LIST OF HEARINGS 

2014 

Page 

HEARING: 

Wednesday, March 12, 2014, Information Technology and Cyber Operations: 

Modernization and Policy Issues in a Changing National Security Environment ...................................................................................................................... 1 

APPENDIX: 

Wednesday, March 12, 2014 ................................................................................... 23 

WEDNESDAY, MARCH 12, 2014 

INFORMATION TECHNOLOGY AND CYBER OPERATIONS: MODERNIZATION AND POLICY ISSUES IN A CHANGING NATIONAL SECURITY 

ENVIRONMENT 

STATEMENTS PRESENTED BY MEMBERS OF CONGRESS 

Langevin, Hon. James R., a Representative from Rhode Island, Ranking 

Member, Subcommittee on Intelligence, Emerging Threats and Capabilities 2 

Thornberry, Hon. Mac, a Representative from Texas, Chairman, Subcommittee on Intelligence, Emerging Threats and Capabilities ...................... 1 

WITNESSES 

Alexander, GEN Keith B., USA, Commander, United States Cyber Command 5 

Takai, Hon. Teresa M., Chief Information Officer, U.S. Department of Defense ...................................................................................................................... 3 

APPENDIX 

PREPARED STATEMENTS: 

Alexander, GEN Keith B. ................................................................................ 39 

Takai, Hon. Teresa M. ..................................................................................... 27 

DOCUMENTS SUBMITTED FOR THE RECORD: 

[There were no Documents submitted.] 

WITNESS RESPONSES TO QUESTIONS ASKED DURING THE HEARING: 

[There were no Questions submitted during the hearing.] 

QUESTIONS SUBMITTED BY MEMBERS POST HEARING: 

Mr. Carson ........................................................................................................ 55 

Mr. Kilmer ........................................................................................................ 56 

Mr. Peters ......................................................................................................... 61 

Mr. Thornberry ................................................................................................. 53 

(1) 

INFORMATION TECHNOLOGY AND CYBER OPERATIONS: 

MODERNIZATION AND POLICY ISSUES IN A CHANGING 

NATIONAL SECURITY ENVIRONMENT 

HOUSE OF REPRESENTATIVES, COMMITTEE ON ARMED SERVICES, SUBCOMMITTEE ON INTELLIGENCE, EMERGING

THREATS AND CAPABILITIES, Washington, DC, Wednesday, March 12, 2014. 

The subcommittee met, pursuant to call, at 3:30 p.m., in room 

2118, Rayburn House Office Building, Hon. Mac Thornberry (chairman of the subcommittee) presiding. 

OPENING STATEMENT OF HON. MAC THORNBERRY, A REPRESENTATIVE FROM TEXAS, CHAIRMAN, SUBCOMMITTEE ON 

INTELLIGENCE, EMERGING THREATS AND CAPABILITIES 

Mr. THORNBERRY. The subcommittee will come to order. 

The subcommittee meets today to examine issues related to information technology [IT] and cyber operations, both from a policy and 

budget perspective. 

We are glad to have both General Alexander and Ms. Takai back 

with us again this year. 

These two issues are among the most challenging we face in national security. 

On the first, the full committee and all subcommittees have undertaken a 2-year effort to improve the acquisition practices of the 

Department of Defense [DOD]. While there are improvements to be 

made in all areas of contracting and acquisition, there is particular 

concern about how the Department can put up-to-date technology 

in the hands of the warfighter in a timely and cost-effective manner. 

This subcommittee has tried to keep a close watch on these 

issues over the years, but this broader reform effort, which we are 

pursuing cooperatively with the Senate and the Pentagon and industry, may give us opportunities to make improvements that have 

not been seriously pursued before, and we should take advantage 

of it. 

The second issue, of course, is cyber operations. This subcommittee has viewed as one of its primary responsibilities helping 

ensure that the military is as prepared as it can be to defend the 

Nation in cyberspace. It is one of the few areas of the budget where 

there is widespread agreement that we need to spend more. But we 

also want to see that all taxpayer funds are spent carefully and effectively, and we want to help develop policies and, frankly, the 

public education required to protect the Nation in this new domain 

of warfare. 
2 

Finally, I want to offer, on behalf of the people I represent and 

especially on behalf of the service men and women I represent, our 

tremendous gratitude to General Alexander for his service to the 

Nation. He retires at the end of this month, and this may well be 

his last or one of his last hearings. General Alexander has led the 

National Security Agency [NSA] since 2005 and then also Cyber 

Command [CYBERCOM] since its creation in 2010. 

These have been turbulent, challenging years, with a constant 

yet evolving terrorist threat and an explosion of cyber threats, as 

well as other national security challenges. Through it all, through 

terrorist plots, cyber intrusions of every description, not to mention 

intentional illegal disclosures of important national security information, he and the folks at NSA made sure that support for our 

troops in the field was a top priority. And we will never know how 

many of their lives were saved because of the professionalism, commitment, and focus of the people at NSA and CYBERCOM—qualities reflected in their commander. 

So, General, for all your service that has meant so much to the 

Nation and for all your openness and candor with this and other 

committees in the Congress, we thank you. 

I yield to the ranking member, Mr. Langevin. 

STATEMENT OF HON. JAMES R. LANGEVIN, A REPRESENTATIVE FROM RHODE ISLAND, RANKING MEMBER, SUBCOMMITTEE ON INTELLIGENCE, EMERGING THREATS AND CAPABILITIES 

Mr. LANGEVIN. Thank you, Mr. Chairman. 

Ms. Takai, it is a pleasure to welcome you back before the subcommittee. 

And, General Alexander, it is my duty to inform you that you 

have to endure one last go-round through the wringer before your 

well-earned retirement. 

But we are grateful that you are both here today. 

Information systems are obviously the lynchpin of everything 

that we do as a Nation, and the military is certainly no exception. 

IT continues to be a massive portion of our defense enterprise investment, and cyber operations are one of the only growth areas in 

the DOD budget. In today’s fiscal environment, there can be no 

higher validation of the importance of these missions. 

There is no shortage of critical discussion, of course, that we 

need to have this afternoon, so I am going to keep my comments 

pretty brief, but there are a few points I would like—that I would 

appreciate both of you addressing to the extent possible in your 

opening remarks and possibly at greater length in a classified session. 

The first is the adjustments that you have made in your respective jurisdiction with regard to the gravely damaging leaks of highly classified information by Edward Snowden. To the extent possible, I know all of us would appreciate hearing how the Department has shifted to protect and prevent such insider threats in the 

future and especially how we are spreading those lessons learned. 

And speaking of lessons learned, our recent unfortunate news 

about a particular IT program that was unsecured for months as 

a result of contract confusion raises again the complexities of con-
3 

tracting for IT and related services. Understanding that this is a 

continuing saga, I would appreciate knowing what sort of lessons 

are being drawn from this event and how you are working to prevent similar problems. 

Also, I think the committee could also benefit from an update on 

the creation of the mission teams and how both of you are handling 

the challenges of personnel retention and growth. In particular, 

General, how you are using the capabilities of the Reserve Component and, Ms. Takai, how you are dealing with the increased needs 

and challenges stemming from the Joint Information Environment 

[JIE] and the cloud security model. 

Given the proliferation of polymorphic malware and other advanced methodologies aimed at defeating traditional cyber defenses, I think we would be interested to know more about how the 

Department is defending against these threats until the Joint Information Environment comes on line. 

And, as both of you know, also I am very concerned about the 

security of the information systems underpinning of our critical infrastructure, especially those enterprises which support the Department of Defense. I would appreciate an update on what the Department is doing to work with and better secure those networks. 

And, finally, before we go into your statements and Member 

questions, I would just like to note for the record what an extraordinary career you have had, General Alexander. In your 40 years 

of service, going back to West Point, class of 1974, you have shown 

true dedication and commitment to America’s men and women in 

harm’s way. You have been a partner to this committee for the last 

9 years, and I found your testimony always to be very candid and 

forthcoming. 

And I am sure that certainly there were times when it would 

have been much easier just simply to probably just call it a career 

and move on to retirement, but you have persisted and accomplished truly remarkable things when it comes to investments in 

our cryptologic platform, standing up the Nation’s first sub-unified 

command for cyber while fighting for the means to build our Nation’s cyber force and the development—and developing the capability for our Nation to defend itself in cyberspace, all done during 

very turbulent and transformational times. 

So, General, with that, a grateful Nation salutes you for your inspired service. I echo the comments of the chairman. And I personally wish you the very best in your retirement, in this next chapter 

in your life, and I hope that we will stay in touch. Thank you. 

I yield back, Mr. Chairman. 

Mr. THORNBERRY. Thank you. 

Ms. Takai, if you would like to summarize your opening statement. And, without objection, your full statements will be made 

part of the record. 

STATEMENT OF HON. TERESA M. TAKAI, CHIEF INFORMATION 

OFFICER, U.S. DEPARTMENT OF DEFENSE 

Ms. TAKAI. Thank you very much. I appreciate it. 

Well, first of all, Mr. Chairman and members of the subcommittee, thank you for the opportunity to be here today. It is a 

great honor to be here with my cyber team member. And General 
4 

Alexander and I have worked very closely, and I very much have 

appreciated all the support that he has provided to me and to my 

organization. 

I would like to just touch on a few things, and I would like to 

perhaps answer at least some subset of the questions that were 

raised. I would like to give you an overview of where we are on JIE 

and then certainly can address a couple of the items that were discussed there. And I know we are going to talk about those more. 

I would just, as an opening, mention that we are submitting and 

you have our fiscal year 2014 IT budget request, which is $37.7 billion. With that, we are holding our cyber investment, and our cyber 

investment will be $5.2 billion of that. And I think, as you know, 

that is a variety of both infrastructure and defense as well as other 

areas. 

So let me just talk a minute about JIE. I think all of you know 

that it is really an ambitious effort to realign and restructure the 

way our networks are constructed, operated, and defended. And it 

really is there to enable U.S. Cyber Command to be able to operate 

and defend on our networks. 

The challenge is, it is an alignment of an existing vast set of networks. It is going to change the way we assemble, configure, and 

use new and legacy information technologies. It is actually going to 

change also our operations. It will consist of enterprise-level network operation centers that will reduce the complexity and ambiguity of being able to actually see our networks. Our core data centers—as you know, we are reducing our data centers over the 

FYDP [Future Years Defense Program] to almost half of what we 

have today, and all of that within a standard single security architecture that will reduce the plethora of tools and configurations 

that we have. 

And the ultimate beneficiary of JIE is really the commander in 

the field. It is also going to allow for more innovative integration 

of information technologies and, as a part of that, will actually 

help, we believe, in the question that you raised on the fit with the 

acquisition strategies. It will actually lay an infrastructure in place 

that we believe will actually help the speed of acquisition without 

necessarily meaning that we have to change acquisition processes 

per se. 

Again, all of this in light of our cybersecurity program. I would 

just highlight a couple of other things. We are working with our 

defense industrial base partners on a cybersecurity informationsharing program. I highlight that because I think it is an example 

of what is possible from an information-sharing perspective. And 

General Alexander has been a continued advocate for it, and I 

think it does pave the way for other areas that we want to work 

on. 

As it relates to the insider-threat question, we work very closely 

with USD(I) [Under Secretary of Defense for Intelligence], the intelligence organization, they’re really the lead on insider threat. 

But I think as you have seen from some of our actions, one of my 

roles has been to work with them to put out policy, very closely 

then followed by U.S. Cyber Command putting out specific direction, in terms of reinforcing some areas, you know, like the remov-
5 

able media, but also reinforcing policies in terms of who is on our 

network. 

But, ultimately, for insider threat, it is really going to be our 

Joint Information Environment and really tightening down, being 

able to see on our network but also being able to see who is there 

and, if in fact we have an issue, being able to catch it and contain 

it very quickly. So we are looking at a set of steps that is not only 

a single action but steps that will take place over time. 

Another item that I wanted to mention is that I think there is 

a perception that JIE is something that is out there in the future. 

In fact, we are implementing elements of JIE as we go. And we will 

certainly talk more about our data center consolidation, our implementation of many elements of our single security architecture. 

And while this is going to take a period of time, I wouldn’t want 

to leave the impression that this is all in the future and that we 

are not working with it and working to that right now. 

A couple of other items that I would mention if, in fact, we have 

time to talk about them: I do have responsibility for a position 

navigation and timing strategy, which I think is becoming critically 

important, particularly as we look at it in light of potential 

cybersecurity threats to that area of technology. And then, finally, 

I think as you know, we are responsible for the Department’s spectrum strategy, and there may be some questions. 

So, with that, I will leave you with that summary. And, again, 

we appreciate the opportunity to be here. 

[The prepared statement of Ms. Takai can be found in the Appendix on page 27.] 

Mr. THORNBERRY. Great. Thank you. 

General. 

STATEMENT OF GEN KEITH B. ALEXANDER, USA, 

COMMANDER, UNITED STATES CYBER COMMAND 

General ALEXANDER. Chairman, Ranking Member, distinguished 

members of the committee, it is an honor and privilege to be here 

for what we hope, or at least one of us hopes, is our last appearance before the committee in uniform. 

I thought I would talk about two things: first, a little bit about 

the threat. Because I think it is important to couch what our country will face in a construct of the threat that we are going to face. 

The target, exploitation, and theft of our personal data highlights 

some of the threats that go on in industry every day. But our Defense Department systems are scanned by adversaries about 

250,000 times an hour, on average, for vulnerabilities. 

And when you look at it, look at the amount of disruptive attacks, exploitations, and now destructive attacks that have hit the 

world. In August of 2012, Saudi Aramco was hit with one of the 

first destructive attacks, where the data on over 30,000 systems 

was destroyed. Since then, our financial networks have been hit 

with hundreds of disruptive distributed denial-of-service attacks, 

we have seen South Korea hit with destructive attacks where data 

was wiped off their banks, and I believe there are worse things to 

come. 

It was interesting, out in RSA [annual cybersecurity conference], 

over the last couple weeks—we briefly talked about it. How bad 
6 

can cyber attacks get? How about burning the internal components 

of a machine, whether PC or Mac, to a crisp, setting it on fire? So 

they actually demonstrated that out there. So that you can go all 

the way from disrupting to destroying the data to destroying the 

equipment itself. 

From our perspective, there are a number of things that we have 

to put in place to stop this. So we came up with five key things 

to address this threat. And I believe we are going to have to move 

on on that as a Nation. And this is where, Chairman, I would really push the committee to help the Department and the rest of the 

government to move forward. 

First, we have to get a defensible architecture. The architecture 

that we have, our dependence on something we call Joint Information Environment, really gets us a step in that direction. 

And the reason that is so important, when you look at DOD’s 

networks, we have 15,000 enclaves. It is very difficult to ensure 

that one of those doesn’t get penetrated. And if they get into one, 

they are free to roam around all of them, and that creates a problem. Oftentimes, adversaries will get into a network and be there 

for a while, on the civilian side up to 9 months, before they are detected. We can’t afford to have that happen in our government networks. More importantly, that is the road in for more disruptive 

and destructive attacks. Because once they get in, they can then do 

things to the network, like disrupt and destroy it. 

So, a defensible architecture. 

Trained and ready force. One of the good parts about Cyber Command being at NSA, I think the training of our forces is going extremely well. We have trained almost 900 people. We have 900 

more, roughly, in training right now. By the end of this year, that 

means we will have 1,800 trained and ready personnel in teams 

that cover from our Cyber Protection Teams all the way up to the 

National Mission Force. 

And those personnel from across all the services are being 

trained to the same standards that we set at NSA. It is important 

that people who operate in these networks are trained to that same 

standard; it is extremely important. And it is the same for the 

Guard and the Reserve. 

So just to take that off for a minute, so the exercises that we do, 

CYBER FLAG and CYBER GUARD, are ways that we can hone 

our command and control and ensure that our teams, both in the 

Active and Reserve, are being trained to those standards. So one 

of the things we set up with the Reserve and the National Guard 

is to train them to just that standard and then try to set your 

teams up to match what the Active Component is doing. 

Authorities. Here is where we need your help. We need cyber legislation. We need the ability to reach out and hear from industry 

when they are being attacked at network speed—the government, 

not just NSA and Cyber Command, but FBI [Federal Bureau of Investigation] and DHS [Department of Homeland Security]. So we 

have to have cyber legislation that goes beyond where the Electronic Communications Privacy Act, ECPA, and the Stored Communications Act prevent some of those sharings from going on, and 

we have to have that. 
7 

Command and control. We have to have the right command and 

control structure, seamless command and control, from the President all the way down through the SecDef [Secretary of Defense], 

DNI [Director of National Intelligence]; everybody understands how 

we are going to do this in time of crisis. That has to be set up 

ahead of time. 

And, finally, you have to be able to see what is going on in cyberspace. If you are going to use forces to defend this Nation, they 

have to have a common picture of how they are going to do it. If 

you ask anybody to draw a diagram of what the attack looks like, 

get four different people, have them sit at different desks, you will 

get four different pictures. That means you have no coherent defense. We have to have a common picture that people can see to 

defend it. 

Finally, I would just end by saying it has been a privilege and 

honor to work with Ms. Teri Takai as the DOD CIO [Chief Information Officer]. She has been a great partner, always there to help 

us and always helpful. 

So, Chairman, thank you very much. 

Thanks, Teri. 

[The prepared statement of General Alexander can be found in 

the Appendix on page 39.] 

Mr. THORNBERRY. Thank you. I appreciate the comments that 

both of you made. 

We will go as far as we can with the questions until the votes 

are called. And we will do everybody on the 5-minute rule, starting 

now. 

General Alexander, I think this is the fourth time that you have 

testified before this subcommittee, because we rearranged jurisdiction and concentrated cyber in one subcommittee in 2011. So just 

give me a rough comparison between now and 4 years ago, how the 

threat has changed and how our capabilities have changed. You 

know, which has grown the fastest—you know, just kind of a 

rough, for the American people, what has changed in the last 4 

years on the threat and our capability. 

General ALEXANDER. Chairman, I think the—— 

Mr. THORNBERRY. Get the microphone a little closer. Thank you. 

General ALEXANDER. Or I could move up. 

I think the capabilities that have changed the most are the technical capabilities for the threat to attack and for us to defend. 

What is lagging is the authorities. 

So, to be specific, back in 2011, we pushed a memo up that said, 

here is what we think is going to happen, and, in fact, that did 

happen. So we actually were pretty close in defining the disruptive 

attacks that were to come. And we went to Secretary Panetta and 

said, here is what we think we need to do to defend against these. 

I now think we need to be ready for destructive attacks. And we 

have tools that can be used to defend against it, but we don’t have 

the authorities to see it, which means those tools would be useless. 

Think of this as a radar system. What we have is missiles that 

are coming in, cyber missiles that are coming in, and no way to see 

where they are going, so you have no way to shoot them down. You 

can see them land in civilian infrastructure and say, well, we could 

have stopped that one if we had only seen it. 
8 

So we have to have a way of seeing so that the Defense Department, FBI, and Homeland Security can act in the interest of the 

Nation. That is where I think that the biggest gap is. 

There are some tools and training that we are doing, but, actually, I think that is going pretty good. I think they are up—they 

are up where we would want them to be, in terms of being prepared to respond if authorized to do so. 

Mr. THORNBERRY. Okay. 

And just to be clear, when you say ‘‘destructive attack,’’ you 

mean data gets destroyed or the computer literally melts down, like 

happened at RSA? 

General ALEXANDER. Both. 

Mr. THORNBERRY. Yeah. Okay. 

Briefly, Ms. Takai, you talked a lot, which I appreciate, about the 

Joint Information Environment. One of my questions is, it has all 

the characteristics of a major program, yet it is a little vague on 

who is in charge. Who is in charge? 

Ms. TAKAI. Well, sir, I can answer that. I am in charge. The Secretary has signed out two memos actually directing me to implement JIE. 

Now, as part of that, though, clearly, our requirements in terms 

of what is necessary from JIE come from Cyber Command and the 

component cyber commanders to ensure that we are meeting their 

needs. We are taking it through our processes in the building, so 

it does have—and go through the Joint Staff processes to ensure 

that we have what we call validated requirements. 

And so, while it may not be a program of record, per se—and I 

will come back to that—it very much is using all of the processes 

in the building to make sure that, again, whether it is the size and 

scope of DOD, we have to make sure that we have a sustained program that isn’t dependent upon one person but, again, is a part of 

all the programs. 

Let me come back to why it is not a program of record. It is not 

a program of record because we are not seeking to look at a funding for the program, per se. Because, largely, today, about 50 percent of our overall IT spend is in sustainment dollars, effectively 

in our infrastructure and what it takes for that infrastructure to 

move forward. 

It is important that we take those moneys and direct those to the 

Joint Information Environment. And so, by doing that, we can ensure that we are not just adding technology, we are actually changing the underlying infrastructure. 

Second thing is that it is a long-term program. It involves not 

only the services but all the components. And each of them has to 

do it within their existing architecture. They have to come up with 

their own implementation plans. And, in fact, that is what they 

have submitted to me as of this month. 

Mr. THORNBERRY. Can you order a service to make a change? I 

mean, if you are in charge, do you have that authority? 

Ms. TAKAI. Yes, sir. 

Mr. THORNBERRY. If you have a validated requirement from the 

Joint—you can say, Air Force, Army, whoever, you do that. 

Ms. TAKAI. Yes, sir. 

Mr. THORNBERRY. Okay. 
9 

I want to go back to some of those legacy issues in a minute, but, 

at this point, I would yield back to Mr. Langevin. 

Mr. LANGEVIN. Thank you, Mr. Chairman. 

Along that same line, I guess, you know, I do have some concerns 

there, because, you know, how is the Congress and the Department, how are we expected to really have oversight visibility across 

this massive undertaking and, you know, the JIE, how will it interface with other ongoing initiatives? 

So I want to know, will the Department provide standard programmatic guidance, such as baselines, capabilities documents, 

cost estimates, and schedules? 

Ms. TAKAI. Yes, sir. We certainly can provide all of the underlying architecture documents, for instance, just to give you an example of the kinds of direction that we are giving to the services 

and the components in terms of the technical actions they are expected to take, number one. 

Number two, we do have an overall plan that takes us to the 

point that we are today. But by about the middle of next month, 

I will be taking the implementation plans that are coming in from 

the services and creating an overall master plan. And we are more 

than happy to share that with the subcommittee so that you can 

see what our direction is. And then, on a periodic basis, we can certainly come back in and show you the status of each of the components in terms of the progress that they are making. 

Mr. LANGEVIN. Okay. I think that would be important so this 

doesn’t get away from us and we are providing the level of support 

that you need, as well, to make it effective. 

So as the areas like electronic warfare [EW] and cyber converge, 

are you satisfied with your level of coordination with the EW community in the Department? And how does that coordination take 

place? 

Ms. TAKAI. Well, sir, I am satisfied with the level of coordination, 

but I am—I do feel we are challenged to really keep up with being 

able to think through and meet the threat. That is something that 

we are continuing to work on. 

And from an EW standpoint, I think there are a number of areas 

that are going to converge, in terms of what we are doing from a 

cybersecurity standpoint and what we are doing from a JIE perspective. 

One of the things that we have just done, the Secretary has really directed me to set up a much stronger IT governance process 

that includes not only JIE but it includes all of the areas of technology. And one of things that we have recently done in our governance process is to restructure it. And in that restructuring, we 

have combined C2 [command and control] and cyber into a single 

governance process to try to drive the convergence that you are 

speaking of much closer than it is today. 

Mr. LANGEVIN. Thank you. 

General, do you have any thoughts on that? 

General ALEXANDER. Congressman, I think the one key thing is 

we do see electronic warfare and cyber coming closer together technically. You can see this because of the—our wireless environment 

is very much akin to what you have in terms of the early-warning 

radars, radio direction and ranging capabilities, going digital with 
10 

that, the ability to go over one link or the other, the jamming that 

goes on. You can actually jam, now, a distributed denial-of-service 

attack. You can do that in cyberspace; you can do that in EW. And 

I think we are going to have to push those together, because those 

effects are overlapping already, and we see that. 

And in dealing with the services, it was our assessment in 2010 

that you would start to bring all of these together into one domain. 

And I think we actually are going towards that and need to do 

that. 

Mr. LANGEVIN. Probably a good segue, then, to my next question. 

Giving the increasing role of cyber, are you still satisfied with 

CYBERCOM as a sub-unified command? And what would be the 

benefits and drawbacks of elevation as a full combatant command, 

as you see them? 

General ALEXANDER. So I think, as we have added on more 

teams, the requirement to go from sub-unified to unified is growing. And I think over the next year we have reached a tipping point 

where we are going to need to shift to a unified command. 

In 2007, we set out a framework of four options for the Secretary 

of what you should/could do for building a cyber command of some 

sorts. It started out with a sub-unified command, went to a unified 

command with two options: a SOCOM [Special Operations Command]-like model or a generic COCOM [combatant command]. We 

believe that the SOCOM-like model is where you need to go, which 

gives you the training and some of the acquisition authorities over 

the cyber lane specifics. So it is a SOCOM-like. 

And the fourth option was going to a service itself. I think it 

would be premature to consider doing that. I think you would really want to stop at a unified command and then say, so where to 

go? 

Why a unified command? Command and control from the President and the Secretary directly to that commander. In cyberspace, 

that speed is going to be absolutely important. And I think, as we 

add more teams and more complexity, STRATCOM’s [Strategic 

Command’s] ability to actually play in this will continue to go 

down. 

Now, to be completely candid, General Bob Kehler and now Admiral Haney, Cecil Haney, have been wonderful to work with. So 

there is no difference between us, and we both actually said the 

same thing at the Armed Services—the Senate Armed Services 

Committee hearing, as well. 

Mr. LANGEVIN. Very good. 

So, with that, I would yield back. I know I at least have a few 

seconds left. 

Thank you both. 

And again, General, thank you for your service, and wish you 

well. Thank you. 

Mr. THORNBERRY. Ms. Davis. 

Mrs. DAVIS. Thank you, Mr. Chairman. 

And to you, General Alexander, we wish you the very best. 

Thank you so much for your extraordinary service. 

And, Ms. Takai, thank you for being here, as well. 
11 

You know, you talked about the need for legislation and authorities. And some of that relates, of course, to the private sector and 

the willingness of the private sector to work together. 

What problems do you see in relation to that? We obviously know 

there is already a history that we need to deal with. You know, 

what does this look like, in your estimation? What do we need to 

do? 

General ALEXANDER. So the issue that we are wrestling with, I 

think, with the private sector is on two parts: How do we share 

data? I think that one we can actually resolve. And the next question is liability protection. And I think this is really the hard part. 

How do you set up the right liability protection framework? I know 

the Senate is actually working that one issue. 

I believe you are going to have to set up some liability protection 

for when the government and others share, in good faith, signatures that people employ that perhaps don’t act as they should 

have. So if I make a mistake giving industry a signature to protect 

them from malicious software and it also stops some other flow of 

traffic for a small period of time, the company that did what we 

asked them in good faith shouldn’t be sued for that. So I think 

those kinds of things have to be thought through. 

We have to have, though, a way for understanding when Wall 

Street, for example, is under attack. Right now, we get it after the 

fact or we get called up; it is not realtime. And, as a consequence, 

we can’t defend them. So that is the operational requirement, from 

my perspective. 

Mrs. DAVIS. Uh-huh. Will it take a major educational effort to do 

this? I guess I am trying to figure out how we get from A to B. 

General ALEXANDER. Well, I think the—my understanding is the 

House has pushed forward a bill on that already, at least did last 

year, and now—— 

Mrs. DAVIS. Yeah. 

General ALEXANDER [continuing]. The Senate needs to do the 

same. And I think the Senate has stated their intent to try to do 

that. So both the Intelligence Committee and the Armed Services 

Committee both have said that they want to do this. We had discussions with both of them, and all the Members say there is an 

imperative and a reason for doing this, we just have to go do it. 

They don’t want to wait for something bad to happen to say, I wish 

we had done that last week. 

Mrs. DAVIS. Right. Yeah. Okay, well, we are certainly going to 

be working on it, but I wondered if there is—if you have any more 

thoughts about, you know, really, how—I think there is so much 

concern in the public sector today that it makes it a little more difficult to move forward, and we all have to work on that. 

Did you have a comment, Ms. Takai? 

Ms. TAKAI. Yes. The one thing I would add is, again, back to 

some experience levels—and perhaps we can provide, you know, as 

this continues to unfold. I think one of the things, for instance, that 

we have been asked to do, in fact, as part of last year’s NDAA [National Defense Authorization Act], was to begin to collect information from all of the defense industrial base, not only those that are 

participating in our information-sharing program. 
12 

I think that is going to start to help. I mean, we are getting a 

lot of concern from the defense industrial base companies today, 

but I think, as we roll that out, as they understand how this information is going to be used, that they see the benefit. If it is anything like the program that we are running today, we are finding 

that the companies, once they get into it, are very enthusiastic 

about it. They see what they can gain by talking to each other, not 

necessarily just by talking to us. 

And so I know it is a small number, but, by the same token, our 

industrial base is fairly large. And, you know, perhaps we can use 

some of that information to sort of ease some of the concerns. 

Mrs. DAVIS. General Alexander. 

General ALEXANDER. Could I add? We have the technical ability 

today to apply signatures that defend the Department’s networks 

through our systems right now that we can push out in essentially 

realtime. That defends us at the gateway and provides us incredible defense against evolving threats. 

We see those evolving threats, we are protected. And we look 

over, and industry is not, and they get hit with that same threat. 

So by the time we get it to them, it is too late; they have already 

been impacted by it. 

Mrs. DAVIS. Uh-huh. Yeah. 

General ALEXANDER. So we have to have a way of sharing that 

at network speed. I think that is critical, especially when they go 

from exploit to disruptive attacks. We are going to have to have 

something like that. 

Mrs. DAVIS. Thank you. 

I was pleased to hear you say that the teams seem to be at least 

coming together in terms of the kind of training that is required. 

Because one of the concerns that we certainly have had in the last 

few years is how we really bring that kind of training to the front. 

And when we look at the Guard and Reserve, how do you see 

that? Because we know that budget constraints are going to mean 

that we may not be tapping the Guard and Reserve in the same 

way, certainly not in terms of ground troops, perhaps. But is this 

an area that—really, the States can be very helpful in the Guard 

and Reserve, as well, but it depends on the way it moves forward. 

How do you see that? 

General ALEXANDER. So we have sat down with NORTHCOM 

[Northern Command] Commander General Jacoby, with the head 

of the Reserves and National Guard, General Grass, Frank Grass, 

myself, and a number of the TAGs [The Adjutants General] and 

said, here is what we need to do as a starting. We have Cyber Protection Teams; here is the starting point and here is what you need 

for training. 

We do need to leverage the Guard and Reserve, form them in the 

same way we are so that we can use them as we need that and 

train them to that same standard. The reason I think it is important is many of these have tremendous skills that we should leverage—— 

Mrs. DAVIS. Absolutely. 

General ALEXANDER [continuing]. Especially when you look out 

around the country. Places like Washington and California have 
13 

people with tremendous skills—and Texas, of course, and Rhode Island. I didn’t want to miss those. Whew, that was close. 

Mr. LANGEVIN. I am listening. 

Mrs. DAVIS. Thank you. 

Mr. THORNBERRY. I thank the gentlewoman. And, actually, I 

think we may have some further discussion on that. 

Ms. Hartzler, do you have something right quick, or would you 

rather come back? We are down—let’s see. Only about 60 people 

have voted, but the clock shows 4 minutes, so we can—do you want 

to come back? 

Mrs. HARTZLER. If that is okay. 

Mr. THORNBERRY. Okay. 

Mrs. HARTZLER. Can I just ask—— 

Mr. THORNBERRY. Oh, yeah. Yeah, sure. Recognize the 

gentlelady. 

Mrs. HARTZLER. I just came from reading the Edward Snowden 

report, and I am sorry I was a little late, but I wanted to finish 

it. 

Are we going to have, are you aware of, a classified briefing just 

on that where I could ask specific questions following up, if you are 

aware? 

Mr. THORNBERRY. If I could respond, this hearing is focused on 

Cyber Command. This subcommittee will have an intelligence 

briefing that will have a closed portion, where we can go deeply 

into the damage done to our national security, having nothing to 

do with NSA, that Mr. Snowden has done. So we will definitely go 

into more detail on that. 

Mrs. HARTZLER. Yeah. I will hold my questions. 

Mr. THORNBERRY. Okay, great. Thank you. 

With that, if you all will excuse us, we have to run and vote. If 

you all will come with me, we will look for a place for you to at 

least try to use the phone and computer so you can make use of 

the time when we are away. 

And, with that, the subcommittee stands in recess. 

[Recess.] 

Mr. THORNBERRY. The subcommittee will come back to order. 

And, again, let me thank everybody for their patience during that 

long series of votes. 

Let me ask a few questions as other Members are coming back. 

General Alexander, I was interested in your answer to Mr. 

Langevin’s question about elevating Cyber Command. Admiral Jim 

Stavridis, retired, who is now the dean at the Fletcher School, 

somebody I respect a great deal, has written an article that says 

cyber is at a place where the Air Force was in 1947; it needs to 

be its own service. It is similar to SOCOM, but it is different, in 

that it all takes place in one domain, whereas SOCOM draws from 

different domains and, therefore, has to have elements from all the 

other services. 

And so his argument is this is the new domain of warfare and 

we need to treat it as such, with the seriousness, with the promotion, with the dedication that we decided to do with the Air 

Force in 1947. What do you say to that? 

General ALEXANDER. Well, I think that is one of the options that 

we actually looked at. I think, for the current period, for now, for 
14 

the next several years, that we need to have an integrated cyber 

capability that goes into the services. 

And the reason that I am not yet where he, Petraeus, and a couple others are is I think that, in places like Iraq, if we were to 

imbed cyber capabilities at the brigade level, which we will need 

to do, you need to have service participation in that, not a separate 

service as an external person coming in, but an imbedded, organic 

capability to that brigade itself. 

So I think, as we go forward—but they need to be trained to a 

standard. They need to know how that force works. So it is analogous to the way the cryptologic system works. We have 

cryptologists who go down to the brigade who are trained to a certain level. We have them in the air, and we have them at sea. All 

of them are trained together and they act as one system, but they 

have them by service. 

So I think the next correct step would be go to a unified, pause, 

and then see if it makes sense to take the step beyond there. And 

I think that kind of a deliberate approach, make sure we don’t go 

too far and then have to collapse back. 

Mr. THORNBERRY. Okay. I appreciate it. 

Ms. Takai, I want to go back to some discussions you were having, I think, with Mr. Langevin. One of the things I hear from folks 

who are IT providers to the Department of Defense is they have to 

take into account all these legacy systems. And nobody else in the 

world, you know, has some of the systems DOD still operates, but 

they have to make sure that whatever they provide to DOD is compatible with or works with these legacy systems. 

Everybody agrees, someday you move beyond that. But, to me, 

the hard question is, when do you force moving beyond the legacy 

systems and when do you, kind of, Band-Aid and incur the extra 

cost to deal with the legacy systems? How do you deal with that? 

Ms. TAKAI. Well, there are two answers to that question, one of 

which is about the actual operation of the legacy systems, and the 

second, which is about the data-sharing implications of the legacy 

systems. 

Well, one of the things that we are doing is each of the services, 

just by virtue of their efficiencies effort, is going through to eliminate some of these redundant legacy systems. And they have, in 

fact, made significant progress in cutting the number down. 

But one of the things that we will be continuing to do, particularly with some of the new direction that the Secretaries directed 

out, in terms of my role with business systems, is to continue to 

reduce the number of redundant legacy systems so that we cut the 

complexity down. 

The second piece, however, which is particularly a challenge for 

anyone needing to come in, is the interfaces and the need to be 

able to use data that is in the legacy systems, and it means you 

have to deal with the old technology. And one of the things that 

we are looking at is how to get the data from the legacy systems 

in a way that you can, in fact, information-share and yet not have 

to deal with all the old technology. 

So the solution is really a combination of those two—really, those 

two steps forward. 
15 

Mr. THORNBERRY. Let me ask you the same question I asked you 

before. Can you make those things happen? If the services are 

dragging their feet and they say, oh, we are comfortable with this 

system, it is what we have always used, we don’t want to go 

through retraining our people, can you make it happen? 

Ms. TAKAI. Well, yes, sir. I have to impose some fairly draconian 

measures, in some cases. And we have not had to go to that point; 

the services are actually moving in that direction. Because, as I 

say, they have a challenge right now with being able to, from an 

IT perspective, maintain all of that technology going forward. 

So, fortunately, we haven’t had to go to those kinds of measures. 

By basically organizing and also putting the authority in the hands 

of all of the CIOs, including the service CIOs, we have been able 

to make progress. 

Mr. THORNBERRY. Okay. Thank you. 

Mr. Kilmer. 

Mr. KILMER. Thank you, Mr. Chairman. 

And thank you both for being here. 

General Alexander, thanks for your service. 

And, Ms. Takai, thank you and your staff. We have been in touch 

about a number of issues, and I sure appreciate your staff’s hard 

work in answering our questions. 

I thought I would start by asking a little bit about cloud computing. In the President’s budget, he includes investments that are 

focused on transforming the government IT portfolio through cloud 

computing. 

I was hoping you could speak a little bit about what DOD is 

doing and what NSA is doing today to expand the use of commercial cloud computing. And how are commercial cloud service providers, who are giving the ability to agencies to purchase IT services in more of a utility-based model and, thus, cutting costs significantly, being leveraged? 

General ALEXANDER. Sure. So, a few years ago, NSA leveraged 

Google’s Hadoop, MapReduce, BigTable cloud architecture and 

added to it a security layer and a realtime tipping and queuing capability, which is now in the openware Accumulo. So, given that, 

we actually have implemented that throughout much of NSA. I 

think that is a huge step forward. 

And the reason I go to those two key points is you have to have 

the security layer for us to encrypt data, ensure that you protect 

it. All the things that we are going to talk about, insider threats 

and securing your data, all depend on that. And, as we go forward, 

it is the heart of what we would do under the Joint Information 

Environment. You have to have that as a security kernel, if you 

will, to start off. 

Over to you. 

Ms. TAKAI. So let me pick up from General Alexander’s comments and talk about how those comments are really applicable 

across DOD. 

First of all, we have an aggressive process to move forward on 

utilization of commercial cloud services. It is a part of JIE. And one 

of the things we are working at now is understanding how, in fact, 

we use commercial cloud services. So let me talk about that. 
16 

What General Alexander was talking about is the importance of 

ensuring that, as we move to commercial cloud providers, that they 

have both the ability to be secure and meet what our security requirements are; secondly, that we can operationalize them in a way 

that we don’t lose those clouds from Cyber Command’s visibility because they will be on our networks; and then, again, that from a 

contractual perspective, all of that is built in. 

So, right now, we have four cloud providers that have been, if 

you will, through our security clearance. We have nine that are 

pending that we believe will pass that. And, I think as you know, 

one of the things that we work with is the Federal program, so that 

some of these providers will be through the Federal program; some 

of them will be us pushing them through the Federal program. And 

then we have another nine pilots of different types of services, 

where before we put them through the process we really want to 

see how they are going to operate in our environment. 

The other thing that we are doing is, to General Alexander’s 

point, is to put a model in place around security. So, for instance, 

in unclassified information, the bar isn’t as high, if you will, to pass 

from a security perspective. And then when you get into classified 

information and then, obviously, into higher levels of classification, 

the bar will be a little higher. The service providers will need to 

actually look at the way that their cloud offering would fit within 

our architecture. But then they would be certified to come in and 

could be used by any component in DOD. 

Mr. KILMER. I was hoping to ask also about cyber ranges. And, 

General Alexander, I was hoping you could speak to what sort of 

capabilities do we need to invest in for cyber ranges. 

And then, also, if you could speak to, you know, is there currently a coordinating entity within the DOD to coordinate the use 

and policy of IT cyber ranges and test beds and systems? And if 

so, who is it, and how are they doing it? And if there is not, do you 

think that is a mission that would be best suited for CYBERCOM? 

General ALEXANDER. So, if I could answer the last part of 

that—— 

Mr. KILMER. Sure. 

General ALEXANDER [continuing]. First, I agree with the way you 

pushed that. I do think, as we get more teams, we want these 

teams to be trained in a joint environment. And so I do think at 

some point you are going to need to transition that. We have it 

under four different places right now. Bring them all together. And 

you are going to have to build the capacity to handle the number 

of teams that we have in an interactive way, dynamically. 

So I think consolidation, going to a single provider, and growing 

the capacity so that you can do this in a full-up set of war games 

that will keep people trained. The best training, from my perspective, is really doing this on the network, actually doing it. So there 

is a combination of both. 

I don’t know if you had a chance to go out to the CYBER FLAG 

exercise. They actually ran a very large exercise in cyber, and I 

think it might be worth your while to see that so you can see where 

we are actually trying to take the ranges in the future. 

But I do agree with the thrust of what you are saying; we need 

to consolidate. I actually would push it under the J–7 of Cyber 
17 

Command, as they are doing all the training, they are doing the 

exercises. And I think, in this case, they could also run those 

ranges. We just need to make sure that they are resourced for that. 

Mr. KILMER. Thanks, Mr. Chairman. I yield back. 

Mr. THORNBERRY. Mr. Langevin. 

Mr. LANGEVIN. Thanks. 

What is the average time it has taken for cloud providers to be 

granted approval to operate? 

Ms. TAKAI. I don’t know that we have an average time, but the 

time right now is actually in several months. 

And part of the challenge there has been that, when we talk 

about cloud providers, they generally have a broad range of offerings. And so, even for the Federal program, in order to meet our 

security requirements, for instance, they have to continually monitor their cloud in order to ensure that they have all the security 

provisions. 

They end up—that time is not so much in the approval process, 

but it is in the actual companies setting up to meet the security 

requirements that the Federal Government requires. And then, 

once that happens, they can be quickly certified. 

Mr. LANGEVIN. Okay. Thank you. 

Let me turn to another area. Are you both satisfied with your 

current authorities to identify, recruit, and retain qualified cyber 

personnel? 

And, General, could you provide your assessment of how the Department is leveraging the unique ability of the Guard and Reserve 

to attract personnel who might otherwise be inaccessible to the Department? 

I know you have talked about the Guard and Reserve and training them to the same standards and such, but being able to leverage the unique ability of the Guard and Reserve to, again, attract 

personnel that perhaps, you know, we wouldn’t be able to afford, 

per se, on a long-term basis, which is obviously a challenge, I know, 

for us to be able to attract and retain and recruit the best and the 

brightest. Yet we recognize, in the Guard and Reserve, these folks 

are doing their day job at some very well-known and high-level IT 

companies, and yet they are doing their Guard and Reserve duty, 

and we have the ability to leverage their talents. 

So if you could talk about those areas. 

General ALEXANDER. So, Congressman, first, with respect to personnel, I think we need to come up with a personnel system that 

puts all of our cyber team in one personnel construct, especially for 

the NSA–CYBERCOM team. 

Right now, we have the CCP [Consolidated Cryptologic Program], 

which covers about 85 percent; ISSP [Information System Security 

Program], which covers another 12, roughly, percent; then you have 

the MIP [Military Intelligence Program] and Air Force personnel, 

with another 3 percent. What this means is, when personnel actions come, you deal with four different folks. And for promotions 

and for raises and for everything you are dealing with, you are 

dealing on four different programs. You don’t have an equal setting 

and an equal footing. 

So, step one, we need to do that. That is something I have to 

push back to the Department, and we are doing that. I just think, 
18 

as that comes forward, we would need your support on it. Because 

I do think, either as a test or something, it gets us to where we 

want to be, to have one cyber team. 

This really came through on the furloughs. It was a big issue, because half the force is in, or 85 percent is in, the rest are out. Nobody wants to then go over to one of those other billets feeling they 

will be at risk. That is not a way to set up a team. So I think we 

need to fix that. 

With respect to Reserve personnel, you have hit the key things. 

Actually, we are getting good participation, from my perspective, 

into the Reserves. They want to be in this area, and they are very 

good and very helpful. And they come from some of the best and 

brightest amongst industry. 

The key will be getting them the training so that they have those 

same level of skills that the rest of the team—so if they operate 

in the network we don’t make mistakes. And that is important, and 

I think we can do that. 

So we are headed in the right direction. I think General Grass 

and others have agreed that we need to do this. I think we need 

to organize them the same. States will have similar requirements, 

so you can have them working for State things, and then when you 

need the Federal, we know we can employ these as teams, not as 

individuals. I think that will be very helpful. 

Ms. TAKAI. Sir, I would just add on to speak to the civilian side, 

and I think General Alexander has spoken to the military side. 

One of the challenges that we have on the civilian side is actually to the point—the next level of detail is really classifications 

and standardization of classifications for civilian employees, as well 

as the way that we are able to actually move them through the 

promotional opportunities such that they stay in the area of expertise and, you know, can continue to progress. 

We are always going to have the problem with challenges of people moving outside into industry and some of the challenges with 

pay, but one of the things I think we need to do is to really work— 

DHS has put a framework together, and we are all working to it. 

But one of the things we need to do is to really get not only the 

job classifications solidified and through OPM [Office of Personnel 

Management], but then also to make sure that we have the right 

career path and we are moving people along. 

Mr. LANGEVIN. Thank you. 

Do you anticipate right now the additional authorities that you 

need to make that more seamless? 

Ms. TAKAI. Well, we are pursuing that right now, sir. I couldn’t 

tell you that we have or we have not. We are putting proposals together, certainly within DOD, for what we feel we need. And then 

I think both on—we are working on the civilian side, we are working with General Alexander on the military side to get that standardization. So I think that is something that we will watch it and 

then, if it looks like we have an issue, come back and give you an 

update. 

Mr. LANGEVIN. And, Chairman, I had one last question if you are 

okay with that. 
19 

So where are your research and development [R&D] priorities 

over the FYDP and beyond? And what is your role in setting requirements for R&D? 

General ALEXANDER. Within Cyber Command, it is on building 

out our infrastructure and our tools. Those are the two things that 

we are really doing our research and development on. 

So when we say ‘‘tools,’’ there are some sensitive things that we 

do, and to fully answer that I would like to show you a classified 

briefing, perhaps sometime when you come up, so you can see, because they have done some great things there. I think it is important to see what those tools are and what that means. It actually 

goes back to some of your earlier questions, and I think it would 

be well worth your time to see some. 

Mr. LANGEVIN. Fair enough. Will do. Thank you. 

Ms. TAKAI. Just to add on to what General Alexander is saying, 

our main priorities are not only in the defense of the network but 

also looking at tools around the detection of insider threat. I think 

that is a big area. 

We actually work with AT&L [Acquisition, Technology and Logistics] on their S&T [science and technology] budget, and we co-chair 

the group that works with both the AT&L S&T budget but also the 

Investment Review Board that Mr. Kendall chairs that looks at the 

overall investment. Cyber Command is a part of that so that we 

are sure that the investment is aligned with what their priorities 

are. 

Mr. LANGEVIN. Very good. 

Well, I thank you for your answers. I thank you for the work that 

you all are doing. 

And, General, again, congratulations. Job well done. And thank 

you. 

I yield back. 

Mr. THORNBERRY. General, I want to just go back and make sure, 

as we look at the administration’s budget request for this year on 

information assurance, in the cyber environment you described— 

threats increasing, complexity increasing, talk about destructive, et 

cetera—are we spending enough money and money the right way 

to assure that our own networks are secure? 

General ALEXANDER. This is an area that I have put forward to 

the Department and others that I have some concerns that we 

don’t have adequate funding over the years, especially as we go forward in securing the networks. And there are two sets of issues 

that come up with that. 

When we look at it, we have had to cut back across all parts of 

the Department, but in this area, especially, it is difficult because 

there aren’t any service champions. The two champions happen to 

be Ms. Takai and I. And so the real issue comes down to, that is 

something that is very difficult to push forward and very hard to 

explain what you are buying with it. What you are buying is additional security. 

So I am concerned that we don’t have enough funds in those 

areas, and we are pushing that back to the Department. We have 

worked that with the USD(I), with the Department, and also to the 

DNI so they understand our concerns there. 
20 

Going forward, I think investment is going to have to increase 

in that area because of the complexity of encryption and the systems that are coming that our adversaries will have, without going 

into classified. 

Mr. THORNBERRY. Yeah. 

Ms. Takai, do you share the same concerns, at least about future 

years? 

Ms. TAKAI. Yes, sir, I do. 

I think the other item that I would add to what General Alexander is saying is that, as we are moving to the Joint Information 

Environment, back to your point about what do you do about legacy 

systems—— 

Mr. THORNBERRY. Uh-huh. 

Ms. TAKAI [continuing]. There are times where, in fact, you can 

actually get more efficiency, but there are times where you need an 

upfront investment to do that. 

So the challenge is, when we do an annual budget, it doesn’t 

really give us an opportunity to have upfront funding in order to 

be able to get not only the security aspects but to be able to get 

the efficiencies in the later years. It is a challenge with the budgeting process, and it makes it very difficult, again, because for he 

and I, you know, we are pushing into the budgeting process, which 

is service by service today. 

Mr. THORNBERRY. Yeah. Well, I would just say, for me personally, I think that is an area we want to help you with as we can. 

I mean, we are all constrained by these tight budgets, but it makes 

sense to me that sometimes you are going to have to spend more 

money up front to make this transition to a more secure and efficient place. But protecting our networks has got to be near the top 

of our list. 

Okay. It wouldn’t be a hearing without asking spectrum. Tell me 

where we are. I would hate to rob you of the opportunity to not talk 

about spectrum. 

Ms. TAKAI. Well, sir, thank you for the opportunity. 

We actually think that we are making good progress on spectrum. I think as you know, we have submitted our transition plans 

for the 1695 to 1710 and then also the very controversial 1755 to 

1780. 

I hope that the committee has been informed that we really 

pushed very hard for what we believe are some very innovative 

sharing solutions in the 1755 to 1780 in order to move it forward. 

And we believe that our transition plans, you know, are in discussion right now, but we believe that they will go through, so there 

will be that opportunity. 

Going forward, thank you for the question, because I actually did 

bring a copy of our just newly released electromagnetic spectrum 

strategy that really addresses where we believe DOD needs to go 

in the longer term, because this isn’t something that we can do in 

the short term. 

But, lastly, we appreciate all of your support. And the last thing 

is, I think the challenge for us is to really figure out how to balance 

our growing needs for spectrum with, clearly, what the Nation’s 

growing need is for spectrum. And I think that is going to require 

innovative solutions, not only on the government side, but it is also 
21 

going to require innovative solutions on industry’s side. And, you 

know, I think between the two is what is really going to bring it 

together. 

So thank you for the question. 

Mr. THORNBERRY. Yeah. Well, I hope your new long-term strategy is useful, because I do—I get the feeling a lot of times we make 

these decisions ad hoc, and we do need that long-term vision, because we have these competing demands from the Department and 

the rest of the country, and it is not a good situation to be able to 

just, kind of, take them one at a time. 

On the spectrum you mentioned, can you meet the auction deadlines? 

Ms. TAKAI. Yes, sir. They are accelerated deadlines, but we 

have—the team has worked very hard, and we will be able to meet 

the timing. 

Mr. THORNBERRY. Okay. 

I just had one other thing right quick. 

General Alexander, in your five things, number three was authorization. And I just want to be sure I understand what sort of 

legal authorization you were talking about when it comes to cyber, 

because that is in our bailiwick. 

General ALEXANDER. So the authorities—— 

Mr. THORNBERRY. Authorities, yeah. 

General ALEXANDER. Yeah. And so the authorities really dealt 

with—the principal there is cyber legislation, the ability for us to 

deal with industry. The rest—— 

Mr. THORNBERRY. So you are talking about the information sharing—— 

General ALEXANDER. That is right. 

Mr. THORNBERRY. Okay. And that is the sort of authorities. 

As far as authorities related to Cyber Command’s ability to defend the country in cyberspace, you feel comfortable where the 

legal authorities are, even though you mentioned command and 

control and a variety of other challenges? 

General ALEXANDER. I do. I think we have the authorities within 

the administration, within the Department, to do what we need. 

Now, the question is, okay, where do we set the limits and stuff? 

But they are working their way through that. 

Mr. THORNBERRY. Yeah. Okay. I just wanted to clarify. 

Okay, great. Again, thank you all for your patience, for your 

work in these very important areas. And we will look forward to 

seeing you both again in one capacity or another. 

With that, the hearing stands adjourned. 

[Whereupon, at 5:35 p.m., the subcommittee was adjourned.] 

A P P E N D I X 

MARCH 12, 2014 

PREPARED STATEMENTS SUBMITTED FOR THE RECORD 

MARCH 12, 2014 

(27) 
28 
29 
30 
31 
32 
33 
34 
35 
36 
37 
38 
39 
40 
41 
42 
43 
44 
45 
46 
47 
48 
49 

QUESTIONS SUBMITTED BY MEMBERS POST HEARING 

MARCH 12, 2014 

(53) 

QUESTIONS SUBMITTED BY MR. THORNBERRY 

Mr. THORNBERRY. Can you describe how the recommendations from the review by 

former Secretary of the Air Force Donley affect the governance and acquisition of 

IT and cyber systems for DOD? What actions have been taken to date to implement 

those recommendations? 

Ms. TAKAI. I am working closely with the Deputy Chief Management Officer and 

the Under Secretary of Defense for Acquisition, Technology and Logistics on the recommendations of former Secretary Donley. As part of this effort, we are reviewing 

existing IT governance processes to ensure they enable more rapid delivery and 

sustainment of information technology and cyber capabilities. We will ensure that 

Congress is kept apprised of our efforts throughout this process. 

Mr. THORNBERRY. How are we instrumenting and architecting our infrastructure 

so as to better detect, mitigate, and recover from deep insider threats? How are you 

ensuring that such investments are efficient (effective and economical)? 

Ms. TAKAI. The cybersecurity of our networks is one of our top missions and we 

are giving it the serious attention it deserves. Our Insider Threat efforts are in 

alignment with guidance from the White House’s Senior Information Sharing and 

Safeguarding Steering Committee and the President’s National Insider Threat Policy and Minimum Standards. The Department has made good progress in implementing the Steering Committee’s priority efforts. 

There are two examples of specific architectural efforts we have implemented to 

better detect, mitigate and recover from insider threats. First, we have completed 

deployment of the Host Based Security System (HBSS) which enables monitoring 

of networks for suspicious user behavior. Second, we are also near 90% complete in 

implementing use of Public Key Infrastructure (PKI) hard-token certificates for our 

Secret network user authentication. PKI use is the cornerstone to eliminating anonymity, so that user actions can be monitored and irrefutably attributed to the individual users, thus helping to detect and deter malicious insiders. 

Based on the most recent unauthorized disclosures of classified information, in 

July 2013, the Undersecretary of Defense for Intelligence and I issued a memorandum directing stronger mitigations for insider threat, including: two-person controls over use of removable media and the requirement to revalidate the need for 

privileged users, such as system administrators, in order to reduce the potential risk 

these users may pose. We are about to issue additional guidance which includes 

oversight of privileged users and stronger access controls over our most sensitive information to restrict access to those with a ‘‘need to know’’. 

In order to ensure that our IT investments to counter insider threats are efficient 

(effective and economical), all our investments are vetted and validated through our 

existing governance processes. This is especially true now due to our constrained 

budget environment. 

Mr. THORNBERRY. What activities does DOD have underway, or is contemplating 

beginning this year, related to making its systems more spectrum efficient? 

Ms. TAKAI. Successful implementation of the DOD Alternative Proposal for the 

1755–1780 MHz band is based on making systems more spectrum efficient. As such, 

a number of the proposals in the 1755–1780 MHz band Transition Plans are 

planned to do exactly that. 

In addition, DOD recently released an Electromagnetic Spectrum Strategy that 

identifies goals to improve spectrum access opportunities, including developing systems that are efficient, flexible, and adaptable in their spectrum use and increasing 

our operational agility in use of the spectrum. To implement the Strategy, DOD is 

developing a roadmap and action plan over the next six months that will lay out 

near- to long-term milestones, including those related to sharing opportunities. 

Mr. THORNBERRY. What opportunities do you see for the commercial sector to be 

more spectrally efficient with the spectrum bands it already has? 

Ms. TAKAI. The Department of Defense is working closely with the National Telecommunications and Information Administration, Federal Communications Commission, Office of Science and Technology Policy and wireless industry stakeholders to 

evaluate and identify ways to share spectrum with commercial users, when possible. 

At the same time, the commercial sector could equally be more efficient in its use 
54 

of non-Federal bands by providing opportunities for Department of Defense and 

other Federal government users to share spectrum, when possible, to meet growing 

mission requirements. 

Specifically as a first step to facilitate the opportunity for bi-direction sharing, the 

Department of Defense, National Telecommunications and Information Administration, and the National Science Foundation are working together to pursue an Other 

Transaction Agreement with an eligible entity to develop and mature technologies 

and related policy changes to enable advanced approaches to spectrum use. The intent is to explore the creation of a forum that facilitates collaboration across government, industry and academia on spectrum technology development, including for 

shared uses between Federal and private sector operations. Industry support of this 

and similar efforts is critical in order to support the nation’s growing economic and 

national security demands on spectrum. 

Mr. THORNBERRY. How are we instrumenting and architecting our infrastructure 

so as to better detect, mitigate, and recover from deep insider threats? How are you 

ensuring that such investments are efficient (effective and economical)? 

General ALEXANDER. In July 2013 the Commander, USCYBERCOM, organized a 

working group dedicated to insider threat mitigation. The working group comprised 

representatives from USCYBERCOM, NSA, DISA, DOD CIO, DIA, DSS, and the 

Service Cyber components. The team synchronized its efforts with the release of the 

USD(I) and DOD CIO memorandum ‘‘Insider Threat Mitigation’’ on 12 July 2013, 

which provided the opportunity to further operationalize current policies and expand 

guidance in accordance with USCYBERCOM’s authorities. Understanding that 

there is no ‘‘silver bullet’’ to mitigate the insider threat, the mitigation strategy depended on a combination of technical solutions, policy, legal and cultural adjustments. A constant throughout all efforts is eventual alignment with the security architecture under the Joint Information Environment (JIE). The initial quick look 

study, which was presented to the DepSecDef, leveraged several previous assessments, studies and policies to identify ‘‘best of breed’’ tactics, techniques and procedures for immediate implementation with follow on development to institutionalize 

mid-term and long-term tasks. The study resulted in an order from USCYBERCOM 

to the DOD enterprise to mitigate common vulnerabilities associated with insider 

threat. Compliance with this order was achieved by 30 October 2013. CYBERCOM 

briefed the OpsDepsTank and the Chairman’s Tank in December 2013. As a result, 

a SecDef memo, Task Force to Review Compromise of Classified Information, was 

signed out on 7 March 2014. Based on that memo four distinct lines of effort are 

under development: 

a. Two-person integrity controls for the SIPRNET 

b. A tiered non-compliance consequence matrix, which is being written and tested 

by the Marine Corps 

c. Patch and Security Technical Implementation Guidance (STIG) for Programs of 

Record 

d. An order to the DOD enterprise directing a number of technical changes, which 

will include tasks directed by the 11 Feb 14 White House memo, Near Term 

Measures to Reduce the Risk of High Impact Unauthorized Disclosures, and 

mid-term mitigations that will take a longer period of time to implement. 

Among the tasks to be directed, the following concepts will be operationalized: 

a. Increased scrutiny on the separation of duties among privileged users 

b. Isolation of logged privileged user activities, storing logs out of reach of privileged users 

c. Privileged user log review conducted by an Insider Threat team or other external entity 

d. Reduced reliance on removable media by requiring use of cross domain solutions when practicable 

e. Continued fine tuning of the Host Based Security System to identify unauthorized attempts to use removable media 

Other pending efforts include a planned brief to CAPE, incorporating the new efforts into inspection programs and continued support to the Mitigation Oversight 

Task Force (MOTF), which is run by the Joint Staff. 

Since these new requirements are unfunded, the timeliness of compliance may be 

an issue and implementation will most likely occur during regularly scheduled upgrades or as part of an overarching program implementation such as JIE. 

Mr. THORNBERRY. To what extent has U.S. Cyber Command collected measures 

of performance or measures of effectiveness to demonstrate that the dual-hatted position is the most effective and most efficient approach to both agencies missions? 

General ALEXANDER. While measures of performance and measures of effectiveness have utility in specific operations and processes we carry out at the tactical 

level, none have yet been defined for the Commander, USCYBERCOM and Director, 
55 

National Security Agency dual hat relationship. The dual hat relationship is 

prompted not just by a drive for efficiencies but also by operational necessity and 

the need for unity of effort in cyberspace. The lack of historical data on alternative 

relationships for command in cyberspace and the difficulty of empirically measuring 

concepts like ‘‘unity of command’’ would make deriving and evaluating measures of 

performance or effectiveness for the dual hat problematic. 

Mr. THORNBERRY. Could you please describe the command and control relationships between U.S. Cyber Command and the other combatant commands and the 

degree to which the new rules of engagement have had any impact on this. 

General ALEXANDER. [The information is for official use only and retained in the 

committee files.] 

QUESTIONS SUBMITTED BY MR. CARSON 

Mr. CARSON. How has the NSA/DHS Centers of Academic Excellence in Information Assurance program impacted your access to qualified candidates for 

cybersecurity positions? What lessons have been learned from this program? And 

are there opportunities to share these lessons, either in curriculum recommendations or some other format, with universities and colleges that are not Centers of 

Excellence so they can provide consistent education? 

Ms. TAKAI. The NSA/DHS Centers of Academic Excellence in Information Assurance program has facilitated development of the pipeline of educated candidates for 

cybersecurity positions. Since 2001 the National Centers of Academic Excellence 

(CAE) in Information Assurance have employed 593 Information Assurance Scholarship Program (IASP)/CAE graduates (a 97% completion rate from the 608 scholarships awarded) and sponsored 216 capacity building grants with CAEs. The IASP 

provides DOD both new hires upon graduation (recruiting) and opportunities for 

current DOD IA Workforce members to advance their education (retention). 

With the publication of the National Initiative for Cybersecurity Education 

(NICE) workforce framework and the evolutionary nature of the cyberspace workforce, now is the time to evaluate the CAE program. My office is currently leading 

a study and analysis of the CAE process, on behalf of DOD, in response to the FY14 

National Defense Authorization Act direction. As part of this analysis, an assessment of lessons learned is being conducted. A report with the overall assessment 

of the CAE program and our recommendations will be generated and shared. 

Additionally, there are public venues (e.g., Colloquium for Information Systems 

Security Education (CISSE) and the National Initiative for Cybersecurity Education 

(NICE) conference) which allow participants to partner and mentor fellow CAE institutions and those aspiring to become CAEs. Workshops are held on mapping 

courses, partnership and scholarship opportunities, ultimately discussing what’s 

working and not working; and collecting feedback on improvement of CAE processes. 

Mr. CARSON. How has the NSA/DHS Centers of Academic Excellence in Information Assurance program impacted your access to qualified candidates for 

cybersecurity positions? What lessons have been learned from this program? And 

are there opportunities to share these lessons, either in curriculum recommendations or some other format, with universities and colleges that are not Centers of 

Excellence so they can provide consistent education? 

General ALEXANDER. The National Centers of Academic Excellence in Information 

Assurance (CAE) have provided outstanding and highly sought candidates for DOD 

Information Assurance/Cybersecurity positions. NSA Recruiters actively recruit from 

the 181 National Centers of Academic Excellence (CAE) to hire qualified candidates 

into our IA/Cyber positions. In addition, our Components actively seek students 

from CAEs applying for the DOD Information Assurance Scholarship Program 

(IASP). The IASP provides both new DOD hires upon graduation (recruiting) and 

opportunities for current DOD IA Workforce members to advance their education 

(retention). Some specific advantages of the IASP are: 

• Scholarships are tied to a DOD position and are awarded to students attending 

CAEs 

• Continuous flow of top IA talent meeting DOD requirements 

• Students participate in internship programs during academic breaks within the 

community to learn DOD systems and procedures 

• Graduates have a commitment to serve in the DOD for a specified time after 

graduation (dependent on length of scholarship) 

Since 2001, DOD has employed 503 IASP/CAE graduates with a 97% completion 

rate (a total of 608 scholarships have been awarded) and sponsored 216 capacity 

building grants with CAEs. DOD works with CAEs to award grants to conduct curriculum development and research of interest to both the schools and DOD. CAE 
56 

students and faculty participate in these grant projects. Through these grants, 

CAEs are encouraged to share their results with other CAEs, minority institutions, 

and institutions that may be seeking CAE designation. Many CAEs have held trainthe-trainer and faculty development sessions at various conferences and events. 

NSA and DHS will conduct further research to determine the direct relationship between CAE alumni hiring and employment partnerships. Studies will also be conducted to determine whether CAE alumni are hired by government at a greater rate 

than non-CAE-graduates. NSA and DHS work with government, industry and academia throughout the year to identify skill gaps between education and job qualification/skills to ensure that CAE graduates are prepared to perform technical mission-critical Cybersecurity jobs. These gaps are then communicated to the CAEs 

with recommendations. NSA and DHS also utilize lessons learned to update the 

CAE program as required to meet the changing IA/Cybersecurity standards and the 

national demands in cyber defense. As a result of the most recent study, the CAE 

program was updated in 2013 and now includes Cyber Defense (CD) education. Academic institutions are now required to meet Core Knowledge Units (KU) and can 

apply for optional Focus Areas (FAs). Government, industry and the CAEs were involved in the update of the CAE program and will continue to evolve the program 

as national IA/Cybersecurity needs change. In the future, a NSA/DHS Advisory 

Council consisting of CAEs, industry and government partners will discuss potential 

changes to the CASE requirements. Updates to the requirements will allow the 

schools to keep up-to-date on curriculum and teaching methods within the 

Cybersecurity field. Under the 2014 National Defense Authorization Act (NDAA), 

DOD/CIO in partnership with NSA and DHS, is conducting an assessment of the 

NSA/DHS CAE program. The assessment will identify the CAE Program’s strengths 

and weaknesses; processes and criteria; maturity of IA as an academic discipline; 

the government’s role in the future development of the CAE curricula and criteria; 

advantages and disadvantages of broadening the governance structure of CAEs; and 

the alignment of CAE curricula/criteria to the National Initiative for Cybersecurity 

Education (NICE). NSA and DHS along with other government agencies, industry 

and academia speak at several venues during the year to brief the CAE program, 

lessons learned and to convey the national IA/Cybersecurity requirements. Annually, NSA and DHS attend the Colloquium for Information Systems Security Education (CISSE), the NICE conference and the CAE Principal’s meeting. These 

venues allow participants to partner and mentor fellow CAE institutions and those 

aspiring to become CAEs. Workshops are held for aspirants on mapping courses to 

the CAE Criteria, along with partnership and scholarship opportunities. The National Science Foundation (NSF) Advanced Technological Education (ATE) centers 

reach out to potential 2-year institutions through curriculum sharing and mentoring 

by 4-year schools. For example, one of the STE centers—CyberWatch—has hosted 

several webinars to educate interested CAEs and non-CAEs on the new Information 

Assurance/Cyber Defense criteria. Webinars were selected for the collaboration 

amongst attendees. 

QUESTIONS SUBMITTED BY MR. KILMER 

Mr. KILMER. The Department is looking to consolidate into a one size fits all desktop solution in the cloud run through DISA, known as virtual desktop infrastructure. Currently, each Service is running on various desktop solutions. Can you explain how the Department is incorporating the unique needs of the user from each 

Service into this infrastructure? 

Ms. TAKAI. The Defense Information Systems Agency (DISA) recently concluded 

a virtual desktop infrastructure (VDI) proof-of-concept that examined the value of 

VDI for DISA’s desktop computing requirements. DISA is currently analyzing the 

outcomes of this initial proof-of-concept to inform decisions on the future approach 

to desktop computing within the DISA organization, but no decision has been made 

to consolidate into a one size fits all desktop solution in the cloud. Similar efforts 

are underway across the DOD Components, but each is looking at the specific desktop computing needs within that Component. 

While the Department will look into the feasibility and effectiveness of providing 

a VDI solution, currently, there are no enterprise efforts underway. Such an effort, 

if undertaken, would need to address the challenge of supporting any unique user 

or organization needs. 

Mr. KILMER. Defense Information Systems Agency (DISA) appears to be leading 

IT centralization efforts in the Department. A cornerstone of this effort is the highly 

publicized but not widely understood Joint Information Environment (JIE). Can you 

discuss JIE’s and DISA’s role in the future of IT in DOD? 
57 

Ms. TAKAI. My office is overseeing the implementation of JIE, which is being implemented by and through the DOD Components, including DISA as a key player. 

The primary goals of the JIE are to make the Department more effective and more 

secure against cyber threats, to reduce cost associated with the Department’s overall 

information technology infrastructure by simplifying, standardizing, centralizing, 

and automating infrastructure at the enterprise level. 

The JIE will improve mission effectiveness by ensuring timely and secure access 

to data and services regardless of location or device; maintaining access to information/services in the face of network disruption, degradation, or damage; and enabling rapid and dynamic capability evolution to meet mission needs across all operational scenarios. JIE will enhance the Department’s cybersecurity by providing a 

consistent IT architecture that improves network resiliency and defensibility, and 

network operators and defenders with shared situation awareness. Finally, JIE enables more efficient use of resources by reducing duplication of effort across Components, reducing total IT operating costs, and supporting more rapid fielding of new 

IT capabilities within a standardized IT architecture. 

DISA is a key player in the development, implementation and operation of the 

IT infrastructure that enables JIE for the Department. They specifically support the 

JIE effort by developing technical architectures; developing, implementing and operating many of the JIE related capabilities such as networking, security, computing 

services, enterprise services, and network operations centers; and providing engineering expertise needed to enable the Department to leverage commercial technologies and to integrate new technologies into the JIE architecture. 

Mr. KILMER. The Department of Defense has entered into numerous cross-Service 

contracts and has increased the utilization of enterprise license agreements. Can 

you outline the future of these contracts, how the offices responsible for negotiating 

these contracts are designated, and how these offices gather regular input from the 

Services for their unique requirements? 

Ms. TAKAI. The Department of Defense is conducting a DOD-wide inventory of selected software licenses inventory in accordance with fiscal year 2013 National Defense Authorization Act direction. The selected software list was established from 

an analysis of acquisition data that identified publishers with high IT spend across 

DOD. The selected inventory will help identify future targets for enterprise license 

agreements. 

The DOD Enterprise Software Initiative (ESI) Working Group is the primary 

method of setting the strategic sourcing opportunities for the Department. DOD ESI 

coordinates and manages enterprise software agreements to leverage DOD spend for 

volume discounts and optimize license use and contract terms and conditions. My 

office, with support from the Defense Information Systems Agency (DISA) and DOD 

Components, is pursuing Department-wide Enterprise License Agreements (ELA’s) 

that will improve operational efficiencies and enhance cybersecurity and interoperability across DOD while lowering the total cost of ownership for software. Currently we are pursuing ELA’s with CISCO and VMware while working the business 

case analysis with Components. 

Given their expertise and role in contracting and procurement of information technology, DISA is leading the Department’s efforts for coordinating and negotiating 

DOD-wide ELAs, with the Components providing their specific requirements and 

funding. DISA works with the Components to establish licensing models and associated transition plans to achieve effective DOD-wide ELAs for software that is selected based on sound business case analyses (BCAs) which document the cost savings, cost efficiencies and other benefits and risks of establishing DOD-wide ELAs. 

In addition, several Components have created large Joint Enterprise License 

Agreements (JELAs) that we plan to leverage and incorporate into DOD-wide ELAs 

in the future. 

Mr. KILMER. The Department of Defense is looking to adopt more cloud computing 

capabilities but also has a unique set of security requirements that not all vendors 

will be able to comply. How do you drive competition into the cloud market and ensure a level playing field for competitors so the Department can ensure best value 

for the service? 

Ms. TAKAI. The Department gains significant benefit from commercial innovations 

and ongoing competition. To ensure a level playing field and increased completion, 

the Department is making significant investments to promote the use of commercial 

cloud services, categorize our cybersecurity requirements, and speed-up our assessment and approval processes. 

My office designated the Defense Information Systems Agency (DISA) as the Enterprise Cloud Service Broker (ECSB) to promote the access and use of cloud service 

providers (CSPs), to consolidate enterprise demand to maximize the Department’s 
58 

buying power, and facilitate and optimize the DOD’s access and use of commercial 

cloud services that can meet our security and interoperability requirements. 

The DOD has developed a Cloud Security Model that defines six security impact 

levels (public release through and including Secret) and the requirements the CSP 

needs to meet (at each level) in order to integrate with the Department’s 

cybersecurity processes and architecture without requiring each prospective CSP to 

operate at the highest level. The Federal Risk and Authorization Management Program (FedRAMP) is a government-wide program providing a standardized approach 

to security assessment, authorization, and continuous monitoring for cloud services 

and uses a ‘‘do once, use many times’’ assessment process to reduce cost, time, and 

staff for both the CSP and the government. OMB policy requires Federal departments and agencies to comply with FedRAMP guidelines by June 2014. 

The ECSB leverages FedRAMP packages and considers commercial equivalencies 

to DOD-specific security requirements throughout its assessment process. In this 

way, a CSP can work towards FedRAMP compliance and target a specific DOD 

Cloud Security Model security impact level for their service knowing that other 

CSPs need to meet the same set of requirements. The CSP is then free to compete, 

on a level playing field, for DOD business in a manner that meets the Department’s 

security requirements and provides best overall value. 

Mr. KILMER. The FBI issued a consumer alter this summer regarding the growing 

threat of malware in pirated software. What is the Department of Defense doing to 

with its contractors and subcontractors to ensure its supply chain does not procure 

pirated software, thereby opening up a potential side door cyber security threat for 

the Department of Defense? 

Ms. TAKAI. DOD is actively working to improve its software assurance practices 

internally through a Software Assurance Community of Practice (SwA COP), as well 

as working on standards and best practices in concert with public-private groups 

(e.g., The Open Group, Consortium of IT Software Quality. DOD is incorporating 

best practices, such as buying from authorized channels whenever possible and identifying purchase options for sustainment procurements to ensure product authenticity and identification of trusted sources. There are also on-going efforts within 

DOD and across the inter-agency and commercial communities to develop standardized contract language for product integrity expectations and associated liabilities, 

as well as mutually recognized product or organizational certifications. DOD and the 

National Security Agency are monitoring development of the Software Identification 

Tag Standard (ISO/IEC 19770). Though not fully adopted by the private sector or 

government, there is growing interest and support to adopt this standard, and it 

could be very useful in securing the software supply chain. 

Additionally, DOD is working with General Services Administration (GSA) and 

other interagency partners on ways to implement recommendations in the DOD and 

GSA Report, ‘‘Improving Cybersecurity and Resilience through the Acquisition Process,’’ (January 23, 2014). 

Mr. KILMER. In the past year, the Department of Defense has initiated several 

rulemakings focused on stronger procurement policies and supply chain controls 

[DFARS 2012–D055, DFARS 2012–D050, etc]. Given the growing body of data demonstrating that counterfeit software often comes bundled with malware that can 

cause cybersecurity risks, this is a growing area of concern for the Department. 

What is the path forward on these policies and how else is the Department considering explicitly addressing the risks associated with contractors’ use of counterfeit 

software? 

Ms. TAKAI. As part of DOD’s larger Cybersecurity and Trusted Systems and Networks strategies, the Department recognizes the importance of purchasing information technology with adequate cybersecurity built in. As such, DOD is updating its 

procurement policy to reflect the global, commercial marketplace from which DOD 

procures technology to implement critical missions. These procurement policies represent one set of mitigation tools in the cybersecurity toolbox. 

• DFARS Case 2012–D055, Requirements Relating to Supply Chain Risk, implements Section 806 of the National Defense Authorization Act of 2011. Defense 

Procurement and Acquisition Policy and the DOD CIO are in the process of 

modifying the interim rule based on comments received from industry and Congress. In addition, DOD is identifying pilot programs to exercise the new policy, 

once revised. 

• DFARS Case 2012–D055, Detection and Avoidance of Counterfeit Electronic 

Parts. The draft final rule is at the Office of Management and Budget’s Office 

of Information and Regulatory Affairs for clearance to be published in the Federal Register. 
59 

• DFARS Case 2014–D005, Detection and Avoidance of Counterfeit Electronic 

Parts—Further Implementation. The draft proposed rule is in the initial drafting phase. • DOD continues to work with GSA and other interagency partners to develop an 

implementation plan supporting the final report of the Department of Defense 

(DOD) and General Services Administration (GSA) Joint Working Group on Improving Cybersecurity and Resilience through Acquisition, signed by the Secretary of Defense and the Administrator of General Services on January 23, 

2014. 

My office is also leading or co-leading several internal efforts to share information 

and develop best practices in this area. A few examples are: • The DOD Software Assurance (SwA) Community of Practice, a group of DOD 

SwA practitioners, share information on software assurance best practices to be 

leveraged in improving guidance to the Department’s Program Protection processes. • DOD is also involved in industry-government information sharing effort to flag 

potential counterfeit issues through the Government-Industry Data Exchange 

Program (GIDEP). • DOD is exploring ‘‘track and trace’’ technologies that may afford manufacturers, 

distributors, and acquirers the capability to better validate authenticity of parts 

and components. 

Mr. KILMER. The current DOD Certification and Accreditation (C&A) of software 

is a fragmented process between DOD Service components and is often not standardized for all vendors. This often results in delayed and inconsistent certification 

and accreditation of IT products, as well as delays the customers’ deployment and 

subsequent time to value for software acquisition. In the past, this process has 

taken over a year which has fostered inefficient deployment of systems procured and 

incentivizes DOD organizations to procure redundant systems. What is the Department doing to streamline and standardize the C&A process? 

Ms. TAKAI. My office recently published DODI 8500.01 ‘‘Cybersecurity,’’ and DODI 

8510.01 ‘‘Risk Management Framework for DOD IT’’ which transitions the Department from the DOD-specific Defense Information Assurance Certification and Accreditation Process (DIACAP) to the National Institute of Standards and Technology 

(NIST) Risk Management Framework (RMF) and the NIST security controls, which 

are already in use by the rest of the Federal Government. Vendors may now build 

products once according to NIST guidelines and then more readily deploy them government-wide. 

DOD’s alignment with the Civil and Intelligence Community on NIST guidelines 

creates one standard that will streamline interagency information system 

interconnectivity and promote information sharing. The policies also stress incorporation of cybersecurity early and robustly in the acquisition and system development 

lifecycle, reducing time and money spent bolting security on late in system development, and producing material with cyber security that can keep up with an evolving 

threat. The policies also establish NIST’s concept of ‘‘common controls,’’ allowing information systems to inherit existing controls from hosting organizations, reducing 

the number of controls that must be implemented by individual information systems. Additionally, individual software ‘‘products’’ are not subject to the full RMF 

process an information system undergoes. Products are securely configured in accordance with security controls applicable to that particular product, and then undergo assessment prior to incorporation into an information system. With the adoption of the common NIST guidelines, product vendors will be able to better understand cybersecurity requirements before they begin development, ensuring streamlined approval by DOD. 

Mr. KILMER. The DNI and CIA recognized that they could not afford to build a 

community, multi-tenant cloud with the innovations, scale and capabilities that already exist via the leading commercial cloud providers, and that is was faster, 

cheaper, and better to leverage industry. My understanding is DISA is attempting 

to build their own cloud solution called milCloud which would likely be directly competitive to Commercial Cloud Providers (CSPs)? How much are you spending to 

build this solution, and more importantly, why are you not following the same logic 

the intelligence community is using, even for classified data? 

Ms. TAKAI. Under the Intelligence Community Information Technology Enterprise 

(IC ITE) effort, DNI is pursuing both commercially provided and Government provided private cloud capabilities. While the large public cloud vendors have certainly 

captured everyone’s attention, other commercial companies have made significant 

investments to provide products that enable organizations to implement their own 

private cloud environments. These products have matured to a point where establishing a private cloud environment is no longer the difficult undertaking that it 
60 

once was. In fact, many of these products build on an organizations existing infrastructure to provide cloud capabilities. 

The genesis of milCloud stemmed from actions to drive efficiencies and automation into an enterprise computing service. Today, milCloud’s IaaS capability is implemented using commercial products that build on DISA’s existing, commerciallyprovided and competitively acquired computing infrastructure, and enabled DISA to 

achieve an initial capability with minimal risk. The lessons learned in providing this 

initial capability are providing valuable information that is informing the Department’s long term approach to achieving cloud capabilities. 

The approach taken by the CIA is one of the models under consideration by the 

Department. One of the most interesting aspects of the CIA cloud is that they were 

able to attract a large public cloud vendor to provide a private cloud capability for 

the IC. Prior to this contract, Amazon had never provided this type of private cloud. 

The scope of the CIA contract created enough incentive to convince Amazon to entertain a new business model that they previously had not supported. Compared 

with the CIA’s $80.6 million investment, DOD has invested approximately $4.7 million to establish the initial milCloud’s IaaS capability. 

Today, the Department is making small investments that are improving our understanding of which of the cloud acquisition models will deliver best value solutions 

to the Department’s IT requirements. These investments are enabling us to develop 

a standard approach for integrating CSPs with our wide area network defenses and 

for conducting coordinated responses to cyber attacks. With these procedures and 

technologies, the Department will be able to scale to multiple commercial providers 

and gain efficiencies through competition and commercial innovation. 

As we learn from our initial cloud efforts, define the appropriate cybersecurity 

constructs, and continue our collaboration with industry, the Department will be 

able to effectively expand our use of both public clouds and commercially-hosted private clouds. 

Mr. KILMER. Why is DOD classifying all sensitive data/workloads that would run 

in a Commercial CSP as National Security Systems (NSS) and be subject to additional security controls, when very few of them are actually classified as NSS by 

definition? 

Ms. TAKAI. The Department is not classifying all sensitive data and workloads as 

NSS. In our cybersecurity policies we do not differentiate between NSS and nonNSS. Rather, we have a single set of cybersecurity controls that is then tailored to 

a particular system based on the effect that system has on the Department’s ability 

to perform its assigned mission, protect its assets, and fulfill its responsibilities. 

The Department uses the standard cybersecurity controls defined in NIST Special 

Publication 800–53, Security and Privacy Controls for Federal Information Systems 

and Organizations. Building on the NIST standards, the Department worked with 

the Intelligence Community and DHS to develop additional guidance on control selection for evaluating IT systems within the NIST Risk Management Framework. 

This guidance was published through the Committee for National Security Systems, 

but it is used for all DOD systems not just NSS. 

Mr. KILMER. The Office of the CIO recently issued Supplemental Guidance for the 

Department of Defense’s Acquisition and Secure Use of Commercial Cloud Services. 

This Guidance adds additional security controls and processes that Commercial 

CSPs have to go through in order to provide cloud services to DOD components. Will 

DOD data centers run by DISA be put through the same level of third party scrutiny and accreditation as commercial CSPs are required to complete? If not, why? 

Ms. TAKAI. DOD data centers are evaluated using the same cybersecurity controls, 

but are held to a higher standard than is being used by the DOD Enterprise Cloud 

Service Broker (ECSB). Currently, the ECSB is using the standard profiles for 

hosting systems that processes unclassified information and whose loss would not 

have a significant effect on the Department’s mission. DOD data centers are evaluated against the requirements for hosting all DOD workloads, including classified 

systems, and systems whose loss would have a catastrophic impact on the Department’s mission. In addition, the DOD data centers are required to follow additional 

cybersecurity guidance defined in the DISA Security Technical Implementation 

Guides (STIG). 

The additional requirements that are identified in the DOD Cloud Security Model 

address the need and approach for integrating Commercial CSPs with the Department’s cybersecurity defenses and cybersecurity operations. DOD data centers are 

fully integrated with these network protections and operations. 

Mr. KILMER. The CIA is moving swiftly to field the Commercial Cloud Solution 

(C2S) to take advantage of the rapid agility and innovation of commercial cloud. My 

understanding is this community cloud will service the entire intelligence community and significantly reduce the costs of computing and infrastructure as well as 
61 

enhance security and operational effectiveness. What are your plans to begin 

transitioning your investment from the NSA IC cloud to C2S to further reduce costs 

and take advantage of the investment the DNI/CIA is making in this community 

cloud based on commercial cloud services? 

General ALEXANDER. Having an IC Cloud with two diverse, but complementary, 

implementations—one commercial and one government—is part of the IC ITE architecture established by the ODNI. NSA is working with CIA bi-weekly to ensure that 

NSA’s IC–GOVCLOUD and CIA’s C2S maximize all resources available for IC ITE 

users. With C2S becoming available in the later summer of 2014, we will have more 

opportunity to meet a customer’s needs. NSA and CIA have developed the Joint 

Store Front which is the front door for an agency to request cloud services. The 

Joint Store Front will align the requests with resources to ensure that a customer’s 

needs are validated and met. NSA and CIA have agreed to assess the right mix of 

cloud services provided by both GOVCLOUD and C2S after C2S has been operational for 6 months. This would give us better metrics to make an informed decision of the roadmaps ahead and capacity needed for both. The assessment is due 

to ODNI February 2015. For its part as a consumer of the IC Cloud, NSA will be 

a consumer of C2S capabilities where the economies so indicate. We expect that the 

primary focus of the IC–GOVCLOUD will remain data access, integration, and analytics, and our roadmap includes converging the functionality of the internal NSA 

Major System Acquisition clouds (MDR1 and MDR2) with the IC–GOVCLOUD to 

maximize the potential for integrating data across the IC. 

QUESTIONS SUBMITTED BY MR. PETERS 

Mr. PETERS. The Federal Information Technology Acquisition Reform Act of 2014 

(FITARA) (HR 1232) passed the House on February 25 and has been referred to 

both the Senate Armed Services Committee and the Senate Homeland Security and 

Governmental Affairs Committee, With or without FITARA, how will the DOD ensure that solicitations are based on open standards, technical requirements, and 

without brand name references? What is the DOD doing to ensure that fair and 

open practices are being followed to avoid the ‘‘lock-in’’ of a single vendor? 

Ms. TAKAI. Independent of the Federal Information Technology Acquisition Reform Act, the Department has recently issued the Interim DOD Instruction 5000.02, 

acquisition policy, that establishes a policy framework by which DOD will acquire 

IT. The updated policy includes guidance on creating and sustaining a competitive 

environment that encourages improved performance and cost control for DOD systems. The policy also addresses the issue of the government maintaining rights to 

data associated with a delivered capability to ensure that proprietary data formats 

and exchanges do not lead to ‘‘lock-in’’. 

In addition to the updated acquisition policy mentioned above, the Department 

has promoted the use of open systems and open systems architecture by issuing 

guidance, such as the ‘‘DOD Open Systems Architecture Contract Guidebook for 

Program Managers’’, and ‘‘Clarifying Guidance Regarding Open Source Software 

(OSS)’’. Furthermore, these guidelines for open systems architecture have been incorporated into the curriculum of the Defense Acquisition University. 

With regard to open standards, the Department has had a long-standing requirement for programs to follow IT standards that are listed in the DOD IT Standards 

Registry (DISR). The standards listed in the DISR are managed through a rigorous 

governance process in which open commercial standards are considered for adoption 

first and foremost. My office will continue to work closely with the office of the 

Under Secretary of Defense for Acquisition, Technology and Logistics to ensure IT 

investments are based on performance and value while meeting the Department’s 

mission and business requirements. 

Mr. PETERS. Many industry stakeholders believe that DOD sole source justifications are provided without adequate market research or include arguments favoring 

the need to maintain a single vendor network. Are you aware of instances where 

sole source justification was provided without adequate market research or in favor 

of a single vendor? Please describe the steps DOD is taking to introduce alternative 

network vendors into DOD network infrastructure environment. 

Ms. TAKAI. I am not aware of any instance where a sole source justification was 

provided without adequate market research. 

DOD procurement officials are required to follow the procedures outlined in the 

Federal Acquisition Regulation (FAR) and the Defense FAR Supplement (DFARS), 

Part 10—Market Research, which requires market research for all procurement levels but the level of detail will vary based on the dollar amount and complexity of 

the procurement. In accordance with FAR Subpart 10.002, acquisitions begin with 
62 

a description of the Government’s needs stated in terms sufficient to allow conduct 

of market research. Market research is then conducted to determine if commercial 

items or nondevelopmental items are available to meet the Government’s needs or 

could be modified to meet the Government’s needs. 

In accordance with FAR Subpart 6.302–1(c)—Only One Responsible Source and 

No Other Supplies or Services Will Satisfy Agency Requirements—Application for 

brand name descriptions, there may be cases where the use of a particular brandname, product, or feature of a product, peculiar to one manufacturer is essential to 

the Government’s requirements, thereby precluding consideration of a product manufactured by another company. In these cases, a justification and approval must be 

executed and posted with the solicitation. 

Æ