Defense Cybersecurity: DOD's Monitoring of Progress in Implementing Cyber Strategies Can Be Strengthened
Published: 2017-08-01T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: DOD acknowledges that malicious cyber intrusions of its networks have negatively affected its information technology systems, and that adversaries are gaining capability over time. In 2010, the President re-designated the director of the NSA as CYBERCOM's commander, establishing a dual-hat leadership arrangement for these agencies with critical cybersecurity responsibilities.
House Reports 114-537 and 114-573 both included provisions for GAO to assess DOD's management of its cybersecurity enterprise. This report, among other things, examines (1) DOD officials' perspectives on the advantages and disadvantages of the dual-hat leadership arrangement of NSA/CSS and CYBERCOM, and actions that could mitigate risks if the leadership arrangement ends, and (2) the extent to which DOD has implemented key strategic cybersecurity guidance. GAO analyzed DOD cybersecurity strategies, guidance, and information and interviewed cognizant DOD officials.
section_title: What GAO Found
paragraphs: Officials from Department of Defense (DOD) components identified advantages and disadvantages of the “dual-hat” leadership of the National Security Agency (NSA)/Central Security Service (CSS) and Cyber Command (CYBERCOM) (see table). Also, DOD and congressional committees have identified actions that could mitigate risks associated with ending the dual-hat leadership arrangement, such as formalizing agreements between NSA/CSS and CYBERCOM to ensure continued collaboration, and developing a persistent cyber training environment to provide a realistic, on-demand training capability. As of April 2017, DOD had not determined whether it would end the dual-hat leadership arrangement.
DOD's progress in implementing key cybersecurity guidance—the DOD Cloud Computing Strategy , The DOD Cyber Strategy , and the DOD Cybersecurity Campaign —has varied. DOD has implemented the cybersecurity elements of the DOD Cloud Computing Strategy and has made progress in implementing The DOD Cyber Strategy and DOD Cybersecurity Campaign . However, DOD's process for monitoring implementation of The DOD Cyber Strategy has resulted in the closure of tasks before they were fully implemented; for example, DOD closed a task that, among other things, would require completing cyber risk assessments on 136 weapon systems. Officials acknowledged they are on track to complete the assessments by December 31, 2019, but as of May 2017, the task was not complete. Unless DOD modifies its process for deciding whether a task identified in its Cyber Strategy is implemented, it may not be able to achieve outcomes articulated in the strategy. Also, DOD lacks a timeframe and process for monitoring implementation of the DOD Cybersecurity Campaign objective to transition to commander-driven operational risk assessments for cybersecurity readiness. Unless DOD improves the monitoring of its key cyber strategies, it is unknown when DOD will achieve cybersecurity compliance.
section_title: What GAO Recommends
paragraphs: GAO recommends that DOD take the following two actions: (1) modify its criteria for closing tasks from The DOD Cyber Strategy ; and (2) establish a timeframe and monitoring for implementing an objective of the DOD Cybersecurity Campaign to transition to commander-driven operational risk assessments for cybersecurity readiness. DOD partially concurred with these recommendations and identified actions it plans to take. If implemented, GAO believes these actions would satisfy the intent of the recommendations.

section_title: Letter
paragraphs: The Department of Defense (DOD) faces tens of millions of attempted  malicious cyber intrusions per year as adversaries seek to take  advantage of the department’s reliance upon computer networks.  Although only a small fraction of these attempts are successful, any  successful intrusion has the potential to provide adversaries with the  ability to collect valuable intelligence about capabilities and operations,  degrade networks, and manipulate information that commanders need to  make timely and critical decisions. In the past decade there have been  several high-profile breaches of DOD’s information and networks. For  example, in 2008, DOD suffered a significant compromise of its networks  when a flash drive infected with malicious computer code was inserted  into a DOD-owned laptop in the Middle East. The malicious code spread  throughout DOD’s unclassified and classified networks and enabled data  to be transferred to servers under foreign control.
In the past decade, DOD has acknowledged the increasing scope and  capability of adversaries to negatively affect DOD information and  networks. As such, DOD has taken a number of steps to defend its use of  cyberspace from evolving cyber threats. For example, in 2009, DOD  established U.S. Cyber Command (CYBERCOM) to, among other things,  address the risk of cyber threats and vulnerabilities. In the process of  standing up CYBERCOM, in 2010 the President re-designated the  Director National Security Agency (NSA) as CYBERCOM’s commander,  establishing a “dual-hat” leadership arrangement with the intent of  allowing CYBERCOM to leverage the existing capabilities and capacity of  NSA. NSA, among other things, serves as the government lead for  cryptology, exercises operational control of signals intelligence, and  provides cybersecurity products and services in support of DOD. The  Director of NSA also serves as the chief of DOD’s Central Security  Service (CSS), which promotes coordination between NSA and the  military service cryptologic elements. Officials told us that NSA and CSS are separate organizations, but they now essentially operate as a single  entity (henceforth referred to as “NSA/CSS” in this report).
From fiscal years 2011 through 2016, we issued a number of reports on  DOD’s efforts to protect against cyberspace threats in which we  highlighted management weaknesses across the department and made  recommendations that could improve the department’s cyberspace  management and operations. In 2015 and 2016, we issued reports in  which we emphasized the importance of the recommendations contained  in three cybersecurity reports as high-priorities for DOD to address.  These reports related to the security of DOD’s defense industrial base,  resiliency planning in the event of a cyberattack, and roles and  responsibilities for supporting civil authorities in the event of a cyberattack  that affects the homeland. Later in this report we discuss these reviews  and DOD’s progress in implementing our recommendations in more  depth.
House Report 114-537 accompanying a bill for the National Defense  Authorization Act for Fiscal Year 2017 and House Report 114-573  accompanying a bill for the Intelligence Authorization Act of Fiscal Year  2017 include provisions for us to assess DOD’s management of progress  in protecting its cyber networks, systems, and information—generally  equivalent to assessing DOD’s cybersecurity efforts. Specifically, DOD  defines cybersecurity as the prevention of damage to, protection of, and  restoration of computers, electronic communications systems and  services, wire communications, and electronic communications, including  information contained therein, to ensure its availability, integrity,  authentication, confidentiality, and nonrepudiation. This report examines  (1) DOD officials’ perspectives on the advantages and disadvantages of  maintaining the dual-hat leadership arrangement of NSA/CSS and  CYBERCOM, and actions that could mitigate risks entailed in ending the  leadership arrangement; (2) the extent to which DOD has implemented  key strategic cybersecurity guidance; and (3) the status of DOD’s efforts  to implement our cybersecurity recommendations.
To determine DOD officials’ perspectives on the advantages and  disadvantages of maintaining the dual-hat leadership arrangement of  NSA/CSS and CYBERCOM as well as actions that could mitigate risks entailed in ending the leadership arrangement, we reviewed documents  used by the Joint Staff and CYBERCOM to brief their leadership on the  advantages and disadvantages of the arrangement. We also interviewed  officials from NSA/CSS, CYBERCOM, and the office of DOD’s Chief  Information Officer (CIO) about their perspectives on the advantages and  disadvantages of the dual-hat leadership arrangement. Further, we sent a  written questionnaire to 25 DOD components, including 9 combatant  commands, all 4 military services, 5 combat support agencies, and 7  DOD components responsible for implementing key strategic  cybersecurity guidance. The questionnaire contained 10 questions on  how the dual-hat leadership arrangement affects cyber missions,  functions, and operations, and it instructed recipients to develop  responses representing the perspectives of their components. We  received 14 complete responses to the dual-hat leadership portion of our  questionnaire from CYBERCOM, 6 combatant commands, 4 combat  support agencies, and 3 offices within the Office of the Secretary of  Defense. We received partial responses from 9 other DOD components,  which provided background information on the dual-hat, but not their  views on the advantages, disadvantages, and actions to mitigate risks.  We did not receive any responses from 2 of the components. DOD CIO  also compiled an official response from DOD to the dual-hat leadership  arrangement questions that reflected views from across the 25 DOD  components to whom we sent questionnaires.
Our report reflects the DOD-wide response and the information we  received from the 14 components who responded to our questions.  Additionally, we gathered information from NSA/CSS, CYBERCOM, the  Joint Staff, components from within the Office of the Secretary of  Defense, and the 14 components who responded to our questionnaire on  aspects of the dual-hat leadership arrangement between NSA/CSS and  CYBERCOM that should be preserved or enhanced, and considerations  that should be made before the dual-hat leadership of the organizations is  ended. After compiling the documentary evidence, interview results, and  questionnaire responses, we grouped the resulting advantages and  disadvantages into categories and sent the results with descriptions and  examples to officials at NSA/CSS, CYBERCOM, and DOD CIO for review  to provide additional assurance that the team accurately and  appropriately described and categorized the responses. The components  provided us with technical comments that we incorporated into the report,  as appropriate.
To evaluate the extent to which DOD has implemented key strategic  cybersecurity guidance, we first identified DOD’s key strategic  cybersecurity guidance by asking senior officials from the offices of the  Assistant Secretary of Defense for Cyber Policy, the DOD Principal Cyber  Advisor, and the DOD CIO to identify the strategies, plans, and guidance  currently used by the department to support the implementation of its  cybersecurity capabilities. We also sent questionnaires to 25 DOD  components instructing them to develop responses representing the  perspectives of their components. The questionnaire contained 10  questions on key cyber guidance, and we received responses from 22 of  the components for these questions. Based on input provided by senior  DOD officials and the responses from the 22 DOD components who  responded to our questionnaire, we identified the following three key  strategic cybersecurity documents to review: the 2012 DOD Cloud  Computing Strategy, the 2015 DOD Cybersecurity Campaign, and The  DOD Cyber Strategy, published in 2015.
Second, we reviewed the documents we identified through input from  senior DOD officials and responses to our questionnaire in order to gain  an understanding of the department’s priorities and efforts to defend itself  from evolving cyberspace threats. Although the 2012 DOD Cloud  Computing Strategy and The DOD Cyber Strategy focus on a number of  cyberspace issues, we limited our review of these documents to the  portions related specifically to DOD’s cybersecurity mission. For example,  The DOD Cyber Strategy includes five strategic goals focused on cyber  operations, cybersecurity, and international cooperation, among other  things. To accomplish these goals, DOD identified 49 tasks to complete.  For our review, however, we focused on the 22 tasks related specifically  to the cybersecurity goal.
Third, we collected tracking information and planning documents on  DOD’s cybersecurity efforts in order to learn about the internal controls  for, and determine the extent to which, the department reported  implementing the specific goals, objectives, or tasks associated with the  key strategic cybersecurity guidance. Documents we obtained included  monthly implementation status updates from the Principal Cyber Advisor  on the tasks related to The DOD Cyber Strategy, and DOD’s  Cybersecurity Scorecard, which monitors key tasks from the four lines of  effort in the DOD Cybersecurity Discipline Implementation Plan. We  compared the internal control activities established in these documents  with the monitoring standards established in the Office of Management  and Budget’s Management Responsibility for Enterprise Risk  Management and Internal Control and the Standards for Internal Control  in the Federal Government. In addition, we discussed the department’s  plans and implementation status with DOD officials within the component  organizations primarily responsible for implementing the key strategic  cybersecurity guidance in order to determine the extent to which the  efforts were implemented and closed and to learn more about the internal  control environment. Specifically, we met with DOD officials from the  offices of the DOD Principal Cyber Advisor; DOD CIO; Under Secretary of  Defense for Policy; and Under Secretary of Defense for Acquisitions,  Technology, and Logistics. We also met with officials from the Joint Staff;  CYBERCOM, and the Defense Information Systems Agency. Finally, for  the efforts DOD reported as implemented, we compared documentary  evidence of the department’s actions with the relevant cybersecurity  requirement to determine whether the actions satisfied the goal, objective,  or task identified in the key strategic cybersecurity guidance. However,  we did not test the effectiveness of DOD’s implementation. For those  efforts DOD reported as in progress, we discussed the implementation  status and the challenges, if any, that might impede implementation.
To determine the status of DOD’s efforts to implement our cybersecurity  recommendations, we reviewed the implementation status of  cybersecurity recommendations made to DOD from fiscal years 2011  through 2016. For the purposes of this report, we focused our efforts on  our reports that included cybersecurity-related recommendations to DOD.  Once we identified the reports to include in our review, we used our  recommendation tracking system to determine the status of the  recommendations—i.e., open, closed as implemented, or closed as not- implemented. Open recommendations represent those that DOD is still  taking actions to implement. For those recommendations that were listed  as open, we coordinated with DOD officials responsible for implementing  the recommendations to identify any actions DOD has taken to do so.  Where DOD has taken actions, we determined whether the actions taken  and documents DOD has provided would enable us to change the status  of the recommendation.
We conducted this performance audit from June 2016 to August 2017 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
subsections: section_title: DOD’s Use of Dual-Hatting
paragraphs: “Dual-hatting” is a term used to describe a position in which an incumbent  officer has responsibilities in two organizations simultaneously—usually to  that officer’s particular military service, and to a joint, combined, or  international organization or activity. DOD officials told us that dual- hatting senior leaders is a relatively common practice within DOD to help  align authorities, improve mission effectiveness, and use a senior leader’s  experience and expertise while balancing the scope of responsibility.  Some prominent examples of dual-hatting include the Commander of  U.S. Northern Command also serving as the Commander of the North  American Aerospace Defense Command; and the Commander of U.S.  European Command also serving as the Supreme Allied Commander  Europe (that is, the commander of military operations conducted by the  North Atlantic Treaty Organization). Additionally, the Air Force and Navy  commanders who support U.S. European Command are dual-hatted as  service component commanders for U.S. Africa Command.
section_title: The Dual-Hat Leadership of NSA/CSS and CYBERCOM
paragraphs: When the Secretary of Defense directed CYBERCOM’s establishment in  2009, he also recommended to the President that the position of Director  of NSA be assigned the responsibility for leading this new command.  DOD officials told us the dual-hat leadership arrangement originated to  allow CYBERCOM to use NSA/CSS infrastructure and tools to carry out  its mission more quickly and to establish unity of command and effort for  DOD in the cyberspace domain. As the sole leader of these  organizations, the dual-hatted leader is responsible for a broad set of  roles and responsibilities, as outlined below in table 1.
Since its establishment, CYBERCOM has operated as a sub-unified  command organized under U.S. Strategic Command, and this  arrangement continues as of April 2017. The National Defense  Authorization Act for Fiscal Year 2017 included a provision directing the  President to establish CYBERCOM as a unified combatant command.  When the President and DOD implement this provision, CYBERCOM will  no longer be organized under U.S. Strategic Command. Figure 1 below  depicts the NSA/CSS and CYBERCOM leadership arrangement, as of  April 2017, and where those offices fit within DOD’s organization. The  figure also provides an overview of CYBERCOM’s 133 Cyber Mission  Force Teams, which carry out particular parts of CYBERCOM’s mission.
As CYBERCOM has matured, leaders—including Congress, the  President, the Director of National Intelligence, and the current leader of  NSA/CSS and CYBERCOM—have discussed the concept of ending the  dual-hat leadership of the two organizations, such that one individual  would lead NSA/CSS and another individual would lead CYBERCOM.  Section 1642 of the National Defense Authorization Act for Fiscal Year  2017 enumerated a number of conditions that the Secretary of Defense  and the Chairman of the Joint Chiefs of Staff must jointly certify before the  dual-hat leadership arrangement for NSA and CYBERCOM can be  terminated. While DOD officials have considered ending the dual-hat  leadership arrangement, as of April 2017, the department has not decided  whether to do so.
section_title: DOD Components with Cybersecurity Responsibilities
paragraphs: To establish a cybersecurity program to protect and defend DOD  information and information technology, DOD has assigned some of its  components and senior officials with cybersecurity responsibilities,  summarized in table 2 below.
section_title: Key DOD Strategic Cybersecurity Guidance
paragraphs: DOD has issued guidance to support the implementation of its  cybersecurity capabilities. Table 3 below lists key DOD strategic-level  cybersecurity documents and includes a description of each document,  as well as the component organization(s) primarily responsible for their  implementation.
section_title: Advantages and Disadvantages of the Dual-Hat Arrangement, and Actions That Could Mitigate Potential Risks Associated with Ending the Arrangement
paragraphs: Officials from various DOD components identified advantages and  disadvantages of the dual-hat leadership of NSA/CSS and CYBERCOM.  Additionally, DOD and Congress have identified actions that could  mitigate the risks associated with ending the dual-hat leadership  arrangement. As of March 2017, DOD officials informed us that DOD had  not determined whether it would end the dual-hat leadership arrangement  and was reviewing the steps and funding necessary to meet the  requirements established in the law.
subsections: section_title: Advantages and Disadvantages of the Dual-Hat Leadership Arrangement
paragraphs: According to officials, DOD does not have an official position on the  advantages and disadvantages of the dual-hat leadership arrangement of  NSA/CSS and CYBERCOM. Through responses to interviews and  questionnaires, officials from DOD components provided their  perspectives on the advantages and disadvantages associated with the  dual-hat leadership arrangement as summarized in table 4, below.
section_title: DOD Components and Congress Have Identified Actions That Could Mitigate Potential Risks Associated with Ending the Dual-Hat Leadership Arrangement
subsections: section_title: Actions Identified by DOD Component Officials to Mitigate Potential Risks Associated with Ending the Dual-Hat Leadership Arrangement
paragraphs: In response to the National Defense Authorization Act for Fiscal Year  2017, President Obama supported elevating CYBERCOM to a unified  combatant command and stated that NSA/CSS and CYBERCOM should  have separate leaders who are able to devote themselves to each  organization’s respective missions and responsibilities, but who should  continue to leverage the shared capabilities and synergies developed  under the dual-hat arrangement. As of April 2017, DOD officials told us  that the department supports elevating CYBERCOM to a unified  combatant command, but recognizes that there are potential risks in  ending the dual-hat leadership arrangement. Prior to the passage of the  National Defense Authorization Act for Fiscal Year 2017, DOD  components, such as CYBERCOM and the Joint Staff, had already  developed internal lists of conditions and prerequisites that could mitigate  risks prior to ending the dual-hat leadership arrangement. These  considerations were presented to senior leadership within the respective  components to help inform their positions on ending the dual-hat  leadership arrangement.
According to DOD officials, discontinuing the dual-hat arrangement would  require DOD to put the necessary policies and processes in place to  continue the mutually beneficial partnership between NSA/CSS and  CYBERCOM. Specifically, the arrangement in conjunction with support  agreements has enabled CYBERCOM to leverage the capability  development, personnel, facilities, infrastructure, testing capabilities, and  business processes of NSA/CSS to support CYBERCOM operations.  DOD officials also cited the potential for less communication between  CYBERCOM and NSA/CSS and slower decision-making if the leadership  arrangement were ended. Table 5 below lists the various actions reported  to us by officials from DOD components that could mitigate risks  associated with ending the dual-hat command structure of NSA/CSS and  CYBERCOM, as well as the status of these actions, as of March 2017.  According to DOD officials, many of these factors relate as much to the  growth and maturation of CYBERCOM as they do the dual-hat status.
Separate from actions identified by select DOD components, Congress  has requested information from the department and required it to meet  specific conditions and to certify that the termination of the dual-hat  arrangement, if pursued by DOD, will not pose risks to the military  effectiveness of CYBERCOM that are unacceptable to the national  security interests of the United States. Specifically, House Report 114- 537 accompanying a bill for the National Defense Authorization Act of  Fiscal Year 2017 and House Report 114-573 accompanying a bill for the  Intelligence Authorization Act of Fiscal Year 2017 directed the Secretary  of Defense to provide the House defense and intelligence committees  with a briefing and an assessment of the dual-hat command by November  1, 2016. According to the committee direction, DOD was to address the  following:  1.  roles and responsibilities, including intelligence authorities, of each  2.  assessment of the current impact of the dual-hat relationship,  including both advantages and disadvantages;  3.  recommendations on courses of action for separating the dual-hat  command relationship between the Commander of CYBERCOM and  the Director of the NSA/Chief of CSS, if appropriate;  4.  suggested timelines for carrying out such courses of action; and  5.  recommendations for legislative actions, as necessary.
DOD did not perform this briefing and assessment. Performing this  assessment would have provided DOD with an opportunity to articulate its  perspectives on the advantages and disadvantages of the dual-hat  leadership arrangement. Further, it would have allowed DOD to present  its preferred course of action in relation to separating the leadership of  NSA/CSS and CYBERCOM. DOD officials told us that they believed the  assessment they were directed to provide to the House defense and  intelligence committees in November 2016 was no longer necessary,  based on Section 1642 of the National Defense Authorization Act for  Fiscal Year 2017. However, while the act did not include the same  briefing and assessment requirement identified in the two House reports,  the act also did not cancel the committee direction. In addition, the  briefing requirement still exists, as evidenced by the explanatory  statement accompanying the Intelligence Authorization Act for Fiscal Year  2017, for DOD to brief and provide an assessment of the dual-hat  leadership arrangement.
According to Section 1642 of the National Defense Authorization Act for  Fiscal Year 2107, DOD cannot terminate the dual-hat leadership  arrangement until the Secretary of Defense and the Chairman of the Joint  Chiefs of Staff jointly certify that the termination will not pose risks to the  military effectiveness of CYBERCOM that are unacceptable to the  national security interests of the United States. Section 1642 also  requires DOD to conduct an assessment that, among other things,  evaluates CYBERCOM’s operational dependence on NSA and evaluates  each organization’s ability to carry out its roles and responsibilities independently. In addition, Section 1642 requires DOD to determine  whether the following conditions have been met before deciding to end  the dual-hat leadership arrangement:
Robust operational infrastructure has been deployed that is sufficient  to meet the unique cyber mission needs of CYBERCOM and NSA,  respectively.
Robust command and control systems and processes have been  established for planning, deconflicting, and executing military cyber  operations.
The tools and weapons used in cyber operations are sufficient for  achieving required effects.
Capabilities have been established to enable intelligence collection  and operational preparation of the environment for cyber operations.
Capabilities have been established to train cyber operations  personnel, test cyber capabilities, and rehearse cyber missions.
The cyber mission force has achieved full operational capability.
Office of the Under Secretary of Defense for Intelligence and Joint Staff  officials told us that they regularly discuss matters related to ending the  dual-hat leadership arrangement of NSA/CSS and CYBERCOM.  However, as of April 2017, DOD’s senior leaders had not decided  whether the dual-hat leadership should be ended, and the department  was reviewing the steps and funding necessary to meet the statutory  requirement of Section 1642.
section_title: DOD’s Implementation of Key Strategic Cybersecurity Guidance Reflects Varied Progress
paragraphs: DOD’s implementation of key strategic cybersecurity guidance—the DOD  Cloud Computing Strategy, The DOD Cyber Strategy, and the DOD  Cybersecurity Campaign—to help manage and focus its cybersecurity  efforts has varied. The department has implemented the cybersecurity  objectives identified in the DOD Cloud Computing Strategy, and it has  made progress in implementing The DOD Cyber Strategy and DOD  Cybersecurity Campaign. However, the department’s process for  monitoring implementation of The DOD Cyber Strategy has resulted in  the closure of tasks as implemented before the tasks were fully  implemented. In addition, the DOD Cybersecurity Campaign lacked  timeframes for completion and a process to monitor progress, which  together provide accountability to ensure implementation.
subsections: section_title: DOD Has Implemented the Four Cybersecurity Objectives of the 2012 DOD Cloud Computing Strategy
paragraphs: DOD has implemented the four cybersecurity objectives of the 2012 DOD  Cloud Computing Strategy. In July 2012, the DOD CIO issued the DOD  Cloud Computing Strategy, which laid the groundwork for accelerating  cloud adoption in the department, consistent with the Federal Cloud  Computing Strategy. The DOD Cloud Computing Strategy includes four  objectives aimed at enhancing the department’s cybersecurity, as listed in  table 6 below, along with DOD’s status in implementing the objectives.
In March 2016 DOD issued the DOD Cloud Computing Security  Requirements Guide, which outlines the security controls and  requirements necessary for using cloud-based solutions. According to  DOD officials, the Cloud Computing Security Requirements Guide is the  basis for authorizing commercial cloud service providers in the DOD  environment and is closely aligned with the Federal Risk and  Authorization Management Program—the fundamental cloud approval  process for the federal government. This guide establishes a  standardized infrastructure for cloud-based services, continuous  monitoring, and identity and access management. According to DOD CIO  officials, DOD has approved more than 50 commercial cloud networks for  various levels of use based on this guidance. Additionally, in October  2016, DOD finalized the Defense Federal Acquisition Regulation  Supplement interim rule on network penetration reporting and contracting  for cloud services, which further standardized infrastructure requirements  for cloud service providers. In April 2017, DOD also submitted a Data  Center Optimization Strategic Plan, as required by the Office of  Management and Budget, which lays out the number of data centers  DOD expects to close through fiscal year 2018 as well as estimated cost  savings associated with those closures. The plan DOD submitted shows  that the department closed more than 150 data centers in fiscal year 2016  and planned to close more over the following 2 years, which would help  reduce network seams through network and data center consolidation.
section_title: DOD Has Taken Some Actions on All Cybersecurity Tasks Supporting The DOD Cyber Strategy, but the Current Process for Monitoring Implementation Limits Oversight of Tasks to Completion
paragraphs: DOD has taken some actions on all 22 cybersecurity-related tasks  identified in The DOD Cyber Strategy, although it has closed some tasks  before they were fully implemented. The purpose of The DOD Cyber  Strategy, issued in April 2015, is to guide the development of DOD’s  cyber forces and strengthen cyber defense and cyber deterrence  postures. This strategy, according to DOD, presents an aggressive,  specific plan for leaders from across the department to take action and  hold their organizations accountable to achieve the strategy’s objectives.  The DOD Cyber Strategy sets prioritized strategic goals and objectives  for DOD’s cyber activities and missions to achieve over the ensuing five  years (that is, through 2020). The Office of the Under Secretary of  Defense for Policy; Office of the Principal Cyber Advisor to the Secretary  of Defense; the Office of the Under Secretary of Defense for Acquisition,  Technology, and Logistics; and the Joint Staff work with the DOD  components to prioritize and oversee the implementation of this strategy  and its objectives and to assign responsibility for managing each  objective. In a June 2015 memorandum, then Secretary of Defense  Ashton Carter identified the implementation of The DOD Cyber Strategy  as one of his top priorities and stated that the department should ensure  that the outcomes articulated in the strategy were achieved.
DOD has taken actions on all 22 of the tasks associated with the  cybersecurity goal of the strategy that focuses on network defense,  mission assurance, and security of the defense industrial base. For  example, the Office of the Undersecretary of Defense for Acquisition,  Technology, and Logistics and the Office of the Undersecretary of  Defense for Intelligence formed a working group—the joint acquisition  protection and exploitation cell—that links intelligence,  counterintelligence, and law enforcement agents with acquisition program  managers to prevent and mitigate data loss and theft. This working group  ensures that federal acquisition rules and guidance mature over time in a  manner consistent with standards, and it establishes an analysis  capability to improve protection of controlled technical information and  other critical information department-wide. In another example, DOD has  adopted activities that include both regulatory and voluntary programs to  improve the cybersecurity of defense industrial base companies.  Companies maintaining covered defense information or providing critical  support are now contractually required to report cyber incidents and use  security standards identified in a National Institute of Standards and  Technology special publication on protecting controlled unclassified  information in nonfederal information systems. In addition, in October  2015, DOD modified eligibility criteria for participants in the defense  industrial base cybersecurity information sharing program. Since this  revision, DOD officials reported that program participation expanded from  124 to 207 industry partners.
While DOD has taken some actions on all 22 cybersecurity tasks, we  found that it has closed some tasks before they were fully implemented.  This increases the risk that DOD will not fully implement those tasks, and  also increases the risk that leadership will not be aware of delays or  complications related to fully implementing The DOD Cyber Strategy.  Specifically, the Principal Cyber Advisor has closed tasks when that office  confirms that the DOD component primarily responsible for  implementation has begun taking action on the tasks and follow-on work  to complete the tasks has been integrated into existing DOD processes,  operations, or policies. For example, DOD closed the task that required  the department to assess the cybersecurity of current and future weapon  systems. According to The DOD Cyber Strategy, DOD is to assess and  initiate cybersecurity improvements for existing weapon systems;  mandate cybersecurity requirements for future weapon systems; and  update acquisition and procurement policies to promote effective  cybersecurity. The Deputy Principal Cyber Advisor approved closing this  task in The DOD Cyber Strategy monitoring process when the Under  Secretary of Defense for Acquisition, Technology, and Logistics submitted  a plan to Congress that was required by a provision in the National  Defense Authorization Act for Fiscal Year 2016 and established a process  to develop cybersecurity requirements for future weapon systems. In  response to both The DOD Cyber Strategy task and the provision in the  National Defense Authorization Act for Fiscal Year 2016, DOD—under  the leadership of the Office of the Under Secretary of Defense for  Acquisition, Technology, and Logistics—initiated assessments of its  existing weapon systems. In addition to initiating these assessments and  establishing a process to develop cybersecurity requirements for future  weapon systems, the office updated acquisition and procurement policies  to promote effective cybersecurity by adding an enclosure to its  acquisition guidance, entitled Cybersecurity in the Defense Acquisition  System. All three of these efforts demonstrate that DOD has taken  actions toward implementing this one task.
However, while DOD has taken actions to implement this task, we found  that the task had not been fully implemented. Officials from the Office of  the Under Secretary of Defense for Acquisition, Technology, and  Logistics acknowledged that the task had not been fully implemented and  that the office was on schedule for completing the initial 136 assessments  by December 31, 2019, as required by statute. Similarly, DOD has made  progress toward establishing cybersecurity requirements for future  weapon systems, but the effort is not complete. In January 2017, the Joint  Staff issued a memorandum that established a process requiring weapon  systems to incorporate cyber resilience as they are designed and built.  The process is undergoing a one-year trial period and is scheduled to be  reassessed in 2018.
In addition, once tasks have been closed by the Principal Cyber Advisor,  DOD has not continuously monitored task implementation; rather,  monitoring occurs on a case-by-case basis. For example, officials from  the office of the Principal Cyber Advisor told us that the office approved  the closure of a task to enhance the protection for critical acquisition  programs and technology on the condition that the Office of the Under  Secretary of Defense for Acquisition, Technology, and Logistics provide  regular reports on progress in order to allow the Principal Cyber Advisor  to track progress and provide assistance when necessary. Further, the  officials from the office of the Principal Cyber Advisor told us that the  office reserves the right to re-open or initiate reviews of closed tasks; as  of April 2017, the office had not re-opened any closed tasks.
We have previously determined that DOD components do not  consistently implement cybersecurity-related actions that are identified in  DOD directives, instructions, or memorandums from senior DOD  officials. In 2014, we reported on DOD’s continuity planning and cyber  resiliency efforts. DOD closed a related cyber resiliency task identified in  The DOD Cyber Strategy after the department issued interim guidance for  incorporating cyber resilience into DOD component continuity of  operations plans; and DOD directed all of its components to establish or  update their continuity of operations plans to include cyber resiliency  measures by December 2017. While issuing a memorandum may have  initiated the process, the task has not been fully implemented.
The Office of Management and Budget’s Management Responsibility for  Enterprise Risk Management and Internal Control provides guidance for  management to identify risks and establish internal controls, as  appropriate, to provide reasonable assurance that objectives are  achieved and discusses the responsibility to continuously monitor the  effectiveness of those internal controls. Standards for Internal Control in  the Federal Government explains that in defining objectives management  should clearly define what is to be achieved, how it will be achieved, and  the timeframes for achievement. Further, the standards state that  ongoing monitoring should be built into an entity’s operations and be  performed continually.
Based on these internal control standards, DOD’s process is not sufficient  to ensure the completion or implementation of tasks. Unless DOD  modifies its process for deciding whether a task identified in The DOD  Cyber Strategy is implemented, the department may not be able to  ensure that the outcomes articulated in the strategy are achieved.
section_title: DOD Has Made Progress in Implementing the DOD Cybersecurity Campaign but Does Not Have Timeframes and Monitoring
paragraphs: DOD has made some progress in implementing the seven objectives  required by the DOD Cybersecurity Campaign; however, the department  does not have established timeframes for achieving full implementation.  In June 2015, the DOD CIO; the Under Secretary of Defense for  Acquisition, Technology, and Logistics; and the Commander of  CYBERCOM initiated a DOD Cybersecurity Campaign to identify specific  actions that drive commanders and DOD senior leaders to enforce full  cybersecurity compliance and accountability across the department.  According to the DOD Cybersecurity Campaign, its goals are to educate  commanders, civilian leaders, and all personnel responsible for the  cybersecurity of the DOD information network on the risk to the mission.  The three senior DOD leaders identified seven objectives to enable  commanders and DOD senior leaders to enforce full cybersecurity  compliance and accountability across the department. Table 7 below lists  each of these objectives and shows our determination of the status of  their implementation.
As noted in the table above, DOD has implemented two of the objectives  identified in the DOD Cybersecurity Campaign. Specifically, in February  2017, the DOD Information Security Risk Management Committee  finalized a charter establishing a Platform Information Technology  Cybersecurity Working Group to focus on the cybersecurity of DOD  platform information technology systems, including but not limited to  weapon systems and industrial control systems. According to the charter,  this working group—chaired by the DOD CIO; the Under Secretary of  Defense for Acquisition, Technology, and Logistics; and the Commander  of CYBERCOM—will provide expertise on the cybersecurity of platform  information technology systems across DOD. A working group official  explained that platform information technology is currently applicable to  special purpose systems controlled and operated solely by technology,  including industrial control systems.
The department has also implemented the DOD Cybersecurity Campaign  objective to develop a framework for defensive cyberspace operations  concept of operations that integrates defensive cyberspace operations  and DOD information operations across the DOD information network  forces. Specifically, in March 2017, the commander of CYBERCOM  approved operational guidance titled, Defensive Cyberspace Operations.  The operational guidance is applicable to CYBERCOM, all of its  supporting elements, and all DOD components performing defensive  cyberspace operations. Among other things, the guidance requires  defensive cyberspace operations to be integrated with other cyberspace  operations and information related activities. An official from CYBERCOM  told us that the operational guidance came from the work to develop a  concept of operations and was intended to address DOD’s need for  guidance on defensive cyberspace operations.
DOD has also developed processes and procedures to monitor the  implementation of four of the five DOD Cybersecurity Campaign  objectives that are in the process of being implemented. Specifically, the  DOD Cybersecurity Culture and Compliance Initiative monitors the  department’s efforts in implementing two DOD Cybersecurity Campaign  objectives—(1) execute priority initiatives for individual cybersecurity  awareness, and (2) develop and implement a program to reinforce the  traits and attributes of a healthy cybersecurity culture. In addition, DOD  uses the Cybersecurity Scorecard to monitor two other DOD  Cybersecurity Campaign objectives that are in progress—development of  a DOD Cybersecurity Scorecard and the execution of the DOD  Cybersecurity Discipline Implementation Plan. According to DOD CIO  officials, the Cybersecurity Scorecard has allowed for better oversight of  DOD components’ implementation of key cybersecurity measures and  provides a forum for elevating issues to the Secretary of Defense.  However, the scorecard is not fully implemented throughout the DOD  components, and DOD continues to work on automating data collection to  improve the data’s reliability. Additionally, recognizing the importance of  resource prioritization, DOD CIO officials told us that the next phase is to  move to a risk-based scorecard, which DOD expects to have  implemented by March 2019.
While DOD has taken steps to implement the DOD Cybersecurity  Campaign objectives that are still in process, the department does not  know when it will achieve full implementation for one of the objectives  because the department did not establish a timeframe for completing or  monitoring it to help ensure accountability for full implementation.  Specifically, the department does not have timeframes for the objective  associated with transitioning to commander-driven operational risk  assessments for cybersecurity readiness.
DOD has begun implementing the objective to shift the focus of its  existing Command Cyber Readiness Inspection process to an operational  cybersecurity readiness assessment. Specifically, the Defense  Information Systems Agency and the Joint Force Headquarters-DOD  Information Network are leading an effort to transition the department  from a compliance-based Command Cyber Readiness Inspection process  to an operational risk-based inspection focused on missions,  vulnerabilities, and threats—currently referred to as the Command Cyber  Operational Readiness Inspection process—as the initial phase of  CYBERCOM’s broader Command Cyber Readiness Inspection  improvement initiative. According to the Joint Force Headquarters-DOD  Information Network, the results of the new inspection process will be  expressed in terms of risk to the mission and the department’s  information network, unlike the previous readiness inspection process,  which expressed results as pass or fail. DOD officials indicated that the  new operational risk assessments will better allow DOD components to  relate their cyber vulnerabilities to their mission. The department has  piloted the new process in three organizations; however, DOD has not  established a timeframe for implementation or identified a process to hold  DOD leaders accountable for implementing these assessments across  the department.
The Office of Management and Budget’s Management Responsibility for  Enterprise Risk Management and Internal Control requires agencies to  implement risk management in coordination with a number of internal  control processes, including those contained in Standards for Internal  Control in the Federal Government. Standards for Internal Control in the  Federal Government highlight the need to (1) define objectives in specific  terms, to include how objectives are to be achieved and timeframes for  their achievement; and (2) enforce accountability by evaluating  performance and holding organizations accountable. Until the DOD  CIO; the Under Secretary of Defense for Acquisition, Technology, and  Logistics; and the Commander of CYBERCOM establish a timeframe for  completing and a process for monitoring the objective associated with  cybersecurity readiness assessments, DOD may be unable to assess its  progress in achieving the objective, or to determine when it will achieve  the strategic goals and objectives of the DOD Cybersecurity Campaign.
section_title: DOD Has Implemented Fifteen of Twenty-seven Cybersecurity Recommendations from Prior GAO Reports
paragraphs: As of March 2017, DOD had implemented 15 of the 27 cybersecurity  recommendations (56 percent) we made in fiscal years 2011 through  2016. DOD is continuing to take actions to address 11 open  recommendations, and 1 recommendation has been closed as not  implemented. DOD’s 56 percent implementation rate is slightly lower than  the government-wide 60 percent rate for implementing recommendations  aimed at improving the security of federal systems and information.  Table 8 below shows our analysis of the implementation status of the 27  cybersecurity recommendations.
subsections: section_title: DOD Has Implemented More Than Half of Prior GAO Recommendations
paragraphs: As of March 2017, DOD had implemented 15 of the 27 cybersecurity  recommendations (56 percent) we made in fiscal years 2011 through  2016. Among them are the following:
Cyberspace Activities. In July 2011, we reported on DOD’s  organization and planning of cyberspace operations, including its  defensive and offensive efforts to address cybersecurity threats. DOD  lacked clear and complete guidance on command and control  responsibilities, and DOD did not have a comprehensive approach to  assess its cyberspace capability needs and prioritize capability  gaps. We made 4 recommendations to strengthen DOD’s  cyberspace doctrine and operations to better address cybersecurity  threats and ensure a more comprehensive approach to developing  and prioritizing the department’s cyberspace capability needs. DOD  has implemented those 4 recommendations. In 2011, DOD updated  its guidance related to cyberspace command and control  relationships. In May 2012, DOD issued a capability gap assessment  memorandum that includes DOD cyberspace capability gaps,  proposed mitigation actions, and estimated completion dates. In  February 2013, DOD issued a joint doctrine publication on cyberspace  operations. These actions allowed the department to take a more  comprehensive approach to its cyberspace capabilities and clarify its  cyberspace command and control relationships.
Cyberspace Budget Estimates. In July 2011, we reported that  DOD’s cybersecurity budget estimates did not include all full-spectrum  cyberspace operations, including computer network attack, computer  network exploitation, and classified funding costs. The department  also lacked a central organization or a methodology for collecting and  compiling budget information on cyberspace operations. We made 2  recommendations to improve DOD’s ability to develop and provide  consistent and complete budget estimates for its cyberspace  operations. DOD implemented these recommendations by issuing  new guidance for cyberspace operations budget submissions. The  new guidance documents enabled DOD to develop a single  cyberspace operations budget estimate that provides a complete  picture of its cyberspace operations investments.
Small Business Cybersecurity Efforts. In September 2015, we  recommended that DOD identify and disseminate cybersecurity  resources to defense small businesses, because DOD’s Office of  Small Business Programs had not done so. In their response to the  draft report, DOD officials stated that the department would implement  training events and education programs. Since then DOD has  implemented this recommendation by making a reference guide for its  workforce to use when engaging with small businesses. These steps  better position defense small businesses to protect their information  and networks from cyber threats.
section_title: DOD Has Not Yet Implemented Critical and High-Priority Cybersecurity Recommendations
paragraphs: DOD has not yet implemented 12 recommendations we have made to  address cybersecurity weaknesses and strengthen its cyberspace  posture. These 12 recommendations include 6 that address critical issues  identified by The DOD Cyber Strategy and that we also previously  identified as a priority for implementing. Among the recommendations not  yet implemented (open, or closed as not-implemented) are the following:
Continuity of Operations. In April 2014, we found that some DOD  components had not developed continuity plans, conducted continuity  exercises, or established oversight to hold the components  accountable. Therefore, we made 4 recommendations to strengthen  DOD’s cyber continuity program by: (1) updating DOD’s continuity  guidance; (2) providing planning tools for exercises with cyber  degradation; (3) increasing oversight of the components; and (4)  evaluating its process for tasking the components and evaluating their  continuity readiness. DOD concurred with and subsequently took  actions to begin implementing the 4 recommendations; however, DOD  has not fully implemented these recommendations. For example,  DOD drafted an update to its defense continuity policy guidance, but  as of January 2017, the revisions had not been completed. Without  this guidance, it will be difficult for the DOD components to provide  reasonable assurance that the systems and networks needed to  maintain continuity of operations in a degraded cyber environment will  be reliable, accessible, or available within needed timeframes.
Insider Threat. In June 2015, we made 4 recommendations to  address challenges with DOD’s insider threat program—of which  DOD concurred with two, and partially concurred with two. DOD is  developing an insider threat implementation plan to address two of the  recommendations, but that plan has not yet been published. DOD  officials told us that the department is no longer taking action to  address our recommendation to evaluate the extent to which its  insider-threat programs address capability gaps. This  recommendation originated in part when DOD did not complete a  continuing analysis of gaps in security measures and of technology,  policies, and processes that are needed to increase the capability of  its insider-threat program to address these gaps, as required by  statute. This survey would have allowed DOD to define existing  insider-threat program capabilities; identify gaps in security measures;  and advocate for the technology, policies, and processes necessary  to increase capabilities in the future. In their comments to the draft  report, DOD officials stated that the department analyzes security  gaps each quarter through its self-assessments, which identify  program capability gaps. However, DOD has not evaluated and  documented the extent to which the current assessments describe  existing insider-threat program capabilities, as required by law.  Without a documented evaluation, the department will not know  whether its capabilities to address insider threats are adequate, or  whether the capabilities address statutory requirements.
Defense Civil Support. In April 2016, we found that DOD’s guidance  did not clearly define the roles and responsibilities of key DOD  entities—such as DOD components—for domestic cyber incidents.  For example, U.S. Northern Command’s Defense Support of Civil  Authorities response concept plan states that U.S. Northern  Command would be the supported command for a mission to support  civil authorities in responding to a domestic cyber incident. However,  other guidance directs and DOD officials confirmed that a different  command, CYBERCOM, would be responsible for supporting civil  authorities in the event of a domestic cyber incident. Therefore, we  made a recommendation that DOD issue or update guidance that  clarifies roles and responsibilities to support civil authorities in a  domestic cyber incident. DOD concurred with this recommendation.  As of April 2017, the department had not implemented this  recommendation, but officials indicated that they are in the process of  drafting guidance that will clarify these roles. Specifically, the  department is drafting a memorandum on defense support for cyber  incident response that DOD officials believe will clearly articulate how  DOD would support domestic cyber incident response efforts. DOD  also scheduled exercises and a workshop to help it prepare to support  civil authorities in the event of a cyber incident. However, until DOD  clarifies the roles and responsibilities of its key entities for cyber  incidents, it will remain unclear which DOD component or command  should be providing support to civil authorities in the event of a major  cyber incident.
We continue to believe that implementing these 12 recommendations  would improve DOD’s cyberspace posture. We will continue to monitor  DOD’s implementation of these recommendations, paying particular  attention to the 6 high-priority recommendations that are still not  implemented. Appendix I lists each report issued from fiscal years 2011  through 2016 that included recommendations for DOD, along with each  recommendation’s implementation status.
section_title: Conclusions
paragraphs: DOD continues to face complex and evolving cyberspace threats to its  networks and information. It has taken actions to implement the tasks and  objectives from the DOD Cloud Computing Strategy, The DOD Cyber  Strategy, and the DOD Cybersecurity Campaign. However, gaps in the  department’s processes for monitoring implementation of this guidance  limits DOD’s ability to monitor the status of, and hold organizations  accountable for, implementing key cybersecurity actions—such as its goal  to identify, prioritize, and defend its most important networks and data so  that it can carry out its missions effectively. DOD has made progress in  implementing the seven actions required by the DOD Cybersecurity  Campaign, but it does not know when it will achieve full implementation of  one of the six remaining actions. DOD’s continuing progress is highlighted  by CYBERCOM’s recent release of defensive cyber operations guidance  in accordance with one of the objectives of the DOD Cybersecurity  Campaign. Addressing the gaps in DOD’s plans and timeframes for  completing the remaining action will help DOD find and fix any root  causes of cybersecurity breaches. Failure to implement this objective  makes DOD vulnerable to cyber threats that may negatively affect  mission readiness and could hinder mission accomplishment.
section_title: Recommendations for Executive Action
paragraphs: To ensure that DOD implements the tasks and objectives of key  cybersecurity guidance to strengthen its cybersecurity posture, we  recommend that the Secretary of Defense take the following two actions:
Direct the Principal Cyber Advisor to modify the criteria for closing  tasks from The DOD Cyber Strategy to reflect whether tasks have  been implemented, and to re-evaluate tasks that have been  previously determined to be completed to ensure that they meet the  modified criteria;
Direct the Commander of CYBERCOM, in coordination with the Under  Secretary of Defense for Acquisition, Technology, and Logistics and  DOD CIO, to establish a timeframe and monitor implementation of the  DOD Cybersecurity Campaign objective to develop cybersecurity  readiness assessments to help ensure accountability.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of our report to DOD for review and comment. In its  written comments, DOD partially concurred with both of our  recommendations. DOD’s written comments are reprinted in their entirety  in appendix II. DOD also provided technical comments, which we  incorporated into the report where appropriate.
DOD partially concurred with our recommendation to modify the criteria  for closing tasks from The DOD Cyber Strategy to reflect whether tasks  have been implemented and re-evaluate tasks that have previously been  determined to be completed to ensure that they meet the modified  criteria. The department stated that it has a robust process in place to  ensure that tasks are normalized within appropriate processes,  operations, and/or policies. DOD stated that it will implement internal  control standards to periodically reassess closed tasks and that the  department will re-evaluate the word “closed” as it relates to enduring  activities that have active efforts ongoing across the department. If DOD  implements these actions it will help ensure that the department monitors  the status of these cybersecurity tasks to completion and will meet the  intent of our recommendation.
DOD partially concurred with our recommendation to establish  timeframes and monitor implementation of the DOD Cybersecurity  Campaign objectives related to readiness assessments and a defensive  cyberspace concept of operations to help ensure accountability. The  department stated that CYBERCOM will coordinate with the necessary  components to develop timelines for implementing these objectives.  Further, the DOD CIO and the Under Secretary of Defense for  Acquisition, Technology, and Logistics will monitor the status of these  objectives to help ensure accountability. If DOD takes the actions it  outlined, it will meet the intent of our recommendation. Because  CYBERCOM provided us a copy of their recently published defensive  cyber operations guidance before completion of our audit, we adjusted  our recommendation to omit reference to a defensive cyberspace concept  of operations.
We are sending copies of this report to the appropriate congressional  committees, the Secretary of Defense, DOD’s Deputy Principal Cyber  Advisor, the Commander of CYBERCOM, the Acting Under Secretary of  Defense for Acquisition, Technology, and Logistics, and DOD’s Acting  Chief Information Officer.  In addition, the report is available at no charge  on the GAO website at http://www.gao.gov.
If you or your staff have any questions about this report, please contact  me at (202) 512- 9971 or kirschbaumj@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. Key contributors to this report are listed in  appendix III.
section_title: Appendix I: Status of Cybersecurity Recommendations Made to the Department of Defense (DOD), Fiscal Years 2011 through 2016
paragraphs: Table 9 below summarizes the status of the 27 cybersecurity  recommendations we made to DOD in 10 reports issued from fiscal years  2011 through 2016. We classify each recommendation as implemented,  open, or not-implemented. Open and not-implemented recommendations  are those that the agency has not yet taken sufficient steps to implement.  Open recommendations are recommendations that the agency is still  working toward implementing, while DOD is no longer taking actions on  the recommendation that is not implemented. The recommendations are  listed by report.
section_title: Appendix II: Comments from the Department of Defense
section_title: Appendix III: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the individual named above, Tommy Baril, Assistant  Director; Tracy Barnes; John Beauchamp; Lon Chin; Pamela Davidson;  Ashley Houston; Jason Kelly; Amie Lesser; Randy Neice; and Cheryl  Weissman made key contributions to this report.
section_title: Related Unclassified GAO Products
paragraphs: Defense Department Cyber Efforts: Definitions, Focal Point, and  Methodology Needed for DOD to Develop Full-Spectrum Cyberspace  Budget Estimates. GAO-11-695R. Washington, D.C.: July 29, 2011.
Defense Department Cyber Efforts: DOD Faces Challenges In Its Cyber  Activities. GAO-11-75. Washington, D.C.: July 25, 2011.
Defense Department Cyber Efforts: More Detailed Guidance Needed to  Ensure Military Services Develop Appropriate Cyberspace Capabilities.  GAO-11-421. Washington, D.C.: May 20, 2011.
Defense Cyber Efforts: Management Improvements Needed to Enhance  Programs Protecting the Defense Industrial Base from Cyber Threats.  GAO 12-762SU, August 3, 2012.
Defense Cybersecurity: DOD Needs to Better Plan for Continuity of  Operations in a Degraded Cyber Environment and Provide Increased  Oversight. GAO-14-404SU, April 1, 2014.
Insider Threats: DOD Should Strengthen Management and Guidance to  Protect Classified Information and Systems. GAO-15-544, June 2, 2015.
Defense Infrastructure: Improvements in DOD Reporting and  Cybersecurity Implementation Needed to Enhance Utility Resilience  Planning. GAO-15-749, July 23, 2015.
Defense Cybersecurity: Opportunities Exist for DOD to Share  Cybersecurity Resources with Small Businesses. GAO-15-777,  September 24, 2015.
Civil Support: DOD Needs to Clarify Its Roles and Responsibilities for  Defense Support of Civil Authorities during Cyber Incidents. GAO-16-332,  April 4, 2016.
Defense Civil Support: DOD Needs to Identify National Guard’s Cyber  Capabilities and Address Challenges in Its Exercises. GAO-16-574,  September 6, 2016.