Defense Critical Infrastructure: Actions Needed to Improve the Identification and Management of Electrical Power Risks and Vulnerabilities to DOD Critical Assets
Published: 2009-10-23T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The Department of Defense (DOD) relies on a global network of defense critical infrastructure so essential that the incapacitation, exploitation, or destruction of an asset within this network could severely affect DOD's ability to deploy, support, and sustain its forces and operations worldwide and to implement its core missions, including those in Iraq and Afghanistan as well as its homeland defense and strategic missions. In October 2008, DOD identified its 34 most critical assets in this network--assets of such extraordinary importance to DOD operations that according to DOD, their incapacitation or destruction would have a very serious, debilitating effect on the ability of the department to fulfill its missions. Located both within the United States and abroad, DOD's most critical assets include both DOD- and non-DOD-owned assets. DOD relies overwhelmingly on commercial electrical power grids for secure, uninterrupted electrical power supplies to support its critical assets. DOD is the single largest consumer of energy in the United States, as we have noted in previous work. According to a 2008 report by the Defense Science Board Task Force on DOD's Energy Strategy, DOD has traditionally assumed that commercial electrical power grids are highly reliable and subject to only infrequent (generally weather-related), short-term disruptions. For backup supplies of electricity, DOD has depended primarily on diesel generators with short-term fuel supplies. In 2008, however, the Defense Science Board reported that "[c]ritical national security and homeland defense missions are at an unacceptably high risk of extended outage from failure of the [commercial electrical power] grid" upon which DOD overwhelmingly relies for its electrical power supplies. Specifically, the reliability and security of commercial electrical power grids are increasingly threatened by a convergence of challenges, including increased user demand, an aging electrical power infrastructure, increased reliance on automated control systems that are susceptible to cyberattack, the attractiveness of electrical power infrastructure for terrorist attacks, long lead times for replacing key electrical power equipment, and more frequent interruptions in fuel supplies to electricity-generating plants. As a result, commercial electrical power grids have become increasingly fragile and vulnerable to extended disruptions that could severely impact DOD's most critical assets, their supporting infrastructure, and ultimately the missions they support.
section_title: What GAO Found
paragraphs: DOD's most critical assets are vulnerable to disruptions in electrical power supplies, but DOD lacks sufficient information to determine the full extent of the risks and vulnerabilities these assets face. All 34 of these most critical assets require electricity continuously to support their military missions, and 31 of them rely on commercial power grids--which the Defense Science Board Task Force on DOD Energy Strategy has characterized as increasingly fragile and vulnerable--as their primary source of electricity. DOD Instruction 3020.45 requires DOD to conduct vulnerability assessments on all its most critical assets at least once every 3 years. Also, the Office of the Assistant Secretary of Defense for Homeland Defense and Americas' Security Affairs ASD(HD&ASA) has requested the U.S. Army Corps of Engineers--which serves as the Defense Critical Infrastructure Program's Defense Infrastructure Sector Lead Agent for Public Works--to conduct preliminary technical analyses of DOD installation infrastructure (including electrical power infrastructure) to support the teams conducting Defense Critical Infrastructure Program vulnerability assessments on the most critical assets. (1) As of June 2009, and according to ASD(HD&ASA) and the Joint Staff, DOD had conducted Defense Critical Infrastructure Program vulnerability assessments on 14 of the 34 most critical assets.18 DOD has not conducted the remaining assessments because it did not identify the most critical assets until October 2008. To comply with the instruction, DOD would have to complete Defense Critical Infrastructure Program vulnerability assessments on all most critical assets by October 2011. (2) DOD has neither conducted, nor developed additional guidelines and time frames for conducting, these vulnerability assessments on any of the five non-DOD-owned most critical assets located in the United States or foreign countries, citing security concerns and political sensitivities. (3) The U.S. Army Corps of Engineers has not completed the preliminary technical analyses requested because it has not yet received infrastructure-related information regarding the networks, assets, points of service, and inter- and intradependencies related to electrical power systems that it requires from the military services. (4) Although DOD is in the process of developing guidelines, it does not systematically coordinate Defense Critical Infrastructure Program vulnerability assessment processes and guidelines with those of other, complementary DOD mission assurance programs--including force protection; antiterrorism; information assurance; continuity of operations; chemical, biological, radiological, nuclear, and high-explosive defense; readiness; and installation preparedness--that also examine electrical power vulnerabilities of the most critical assets, because DOD has not established specific guidelines for such systematic coordination. (5) The 10 Defense Critical Infrastructure Program vulnerability assessments we reviewed did not explicitly consider assets' vulnerabilities to longer-term (i.e., of up to several weeks' duration) electrical power disruptions19 on a mission-specific basis, as DOD has not developed explicit Defense Critical Infrastructure Program benchmarks for assessing electrical power vulnerabilities associated with longer-term electrical power disruptions. With more comprehensive knowledge of the most critical assets' risks and vulnerabilities to electrical power disruptions, DOD can better avoid compromising crucial DOD-wide missions during electrical power disruptions. This additional information may also improve DOD's ability to effectively prioritize funding needed to address identified risks and vulnerabilities of its most critical assets to electrical power disruptions.

section_title: Letter
paragraphs: The Department of Defense (DOD) relies on a global network of defense  critical infrastructure so essential that the incapacitation, exploitation, or  destruction of an asset within this network could severely affect DOD’s  ability to deploy, support, and sustain its forces and operations worldwide  and to implement its core missions, including those in Iraq and  Afghanistan as well as its homeland defense and strategic missions. In  October 2008, DOD identified its 34 most critical assets in this network— assets of such extraordinary importance to DOD operations that according  to DOD, their incapacitation or destruction would have a very serious,  debilitating effect on the ability of the department to fulfill its missions.  Located both within the United States and abroad, DOD’s most critical  assets include both DOD- and non-DOD-owned assets.
DOD relies overwhelmingly on commercial electrical power grids for  secure, uninterrupted electrical power supplies to support its critical  assets. DOD is the single largest consumer of energy in the United States,  as we have noted in previous work. According to a 2008 report by the  Defense Science Board Task Force on DOD’s Energy Strategy, DOD has  traditionally assumed that commercial electrical power grids are highly  reliable and subject to only infrequent (generally weather-related), short- term disruptions. For backup supplies of electricity, DOD has depended  primarily on diesel generators with short-term fuel supplies.
In 2008, however, the Defense Science Board reported that “ritical  national security and homeland defense missions are at an unacceptably  high risk of extended outage from failure of the [commercial electrical  power] grid” upon which DOD overwhelmingly relies for its electrical  power supplies. Specifically, the reliability and security of commercial  electrical power grids are increasingly threatened by a convergence of  challenges, including increased user demand, an aging electrical power  infrastructure, increased reliance on automated control systems that are  susceptible to cyberattack, the attractiveness of electrical power  infrastructure for terrorist attacks, long lead times for replacing key  electrical power equipment, and more frequent interruptions in fuel  supplies to electricity-generating plants. As a result, commercial electrical  power grids have become increasingly fragile and vulnerable to extended  disruptions that could severely impact DOD’s most critical assets, their  supporting infrastructure, and ultimately the missions they support.
DOD addresses risk and vulnerabilities—including those associated with  electrical power—to its critical assets and installations through a variety  of mission assurance–related programs. In particular, as we have  previously reported, DOD has been responsible since September 2003 for  developing and ensuring implementation of defense critical infrastructure  protection policy and program guidance. To identify and help assure the  availability of this mission-critical infrastructure, in August 2005 DOD  established the Defense Critical Infrastructure Program (DCIP), assigning  overall responsibility for the program to the Office of the Assistant  Secretary of Defense for Homeland Defense and Americas’ Security Affairs  (ASD(HD&ASA)). Since then, ASD(HD&ASA) has issued formal DCIP  program guidance, including a directive articulating the roles and  responsibilities of relevant DOD organizations; an instruction on program  management; and several program manuals, including ones on identifying  critical assets and remediating asset risks and vulnerabilities. Under  DCIP, DOD also established 10 functionally based defense sectors— including one for public works, which encompasses electrical power  infrastructure—and designated a Defense Infrastructure Sector Lead  Agent (DISLA) for each sector. In addition to using DCIP, DOD can also  assess risks and vulnerabilities to its critical assets and installations (at the  departmental, combatant command, military service, and installation  levels) through other mission assurance programs and efforts, including  those related to force protection; antiterrorism; defense continuity;  information assurance; continuity of operations; chemical, biological,  radiological, nuclear, and high-explosive defense; readiness; and  installation preparedness. In addition, within the framework of the  National Infrastructure Protection Plan of 2009, DOD also collaborates  with the Department of Homeland Security (DHS) and the Department of  Energy (DOE) to address risks and vulnerabilities associated with  electrical power infrastructure.
In its May 2008 report on H.R. 5658, the House Committee on Armed  Services noted the risks of electrical power disruptions to critical DOD  missions and, among other things, directed that GAO continue its review  of DCIP. In response to this mandate, we have examined (1) the extent to  which DOD’s most critical assets are vulnerable to disruptions in electrical  power supplies and (2) the extent to which DOD—both within and outside  of the Defense Critical Infrastructure Program—has attempted to assure  the availability of electrical power supplies to its most critical assets.
We have previously conducted an extensive body of work on DOD’s  efforts to assure the availability of defense critical infrastructure, reporting  on DOD’s progress in addressing the evolving management framework for  DCIP; coordination among DCIP stakeholders; implementation of key  program elements; availability of public works infrastructure; and  reliability issues in DOD’s lists of critical assets, among other issues. We  have also issued reports concerning federal critical infrastructure  protection, cybersecurity, and electrical power. A list of these reports by  category can be found at the end of this report in the Related GAO  Products section.
To address our objectives in this report, we conducted three structured  written surveys regarding the electrical power vulnerabilities of DOD’s 34  most critical assets, which DOD identified through DCIP as of October  2008. We pretested the survey with U.S. Army, U.S. Navy, and U.S. Air  Force officials representing three most critical asset sites as well as  officials from the Joint Staff (J-34) and ASD(HD&ASA) to ensure that the  questions were relevant, clearly stated, and easy to understand. We then  administered one survey to the military services and DOD agencies that  own or have program responsibility for the assets through DCIP to obtain  information about the assets’ reliance on electrical power; the assets’  primary and backup sources of electrical power supplies; the number and  type of unplanned electrical power disruptions to the assets; DCIP and  non-DCIP assessments of the assets’ risks and vulnerabilities to electrical  power disruptions from January 2006 through December 2008; and  measures recommended, implemented, or planned to address or manage  such risks and vulnerabilities. We administered another survey to the  Joint Staff to obtain information about the missions supported by the  assets. Finally, we administered the third survey to ASD(HD&ASA)  regarding coordination efforts with relevant DOD and non-DOD  stakeholders. (These surveys are reproduced in full in apps. III, IV, and V.)  We also conducted six follow-up site visits to a nonprobability sample of  critical assets to verify and validate the surveys’ results and evaluate in- depth issues identified in the surveys’ responses, including vulnerability  assessments.
We also interviewed and obtained information from officials representing  ASD(HD&ASA)/DCIP Office, the Joint Staff’s Directorate for Antiterrorism  and Homeland Defense, the U.S. Air Force, the U.S. Army, the U.S. Navy,  the U.S. Marine Corps, the U.S. Army Corps of Engineers, the Defense  Threat Reduction Agency, the Mission Assurance Division of the Naval  Surface Warfare Center, the Defense Science Board’s Task Force on DOD  Energy Security, selected DOD installations, DHS, DOE, the Federal  Energy Regulatory Commission, the North American Electric Reliability  Corporation, the Edison Electrical Institute, and other private-sector  energy organizations.
As agreed with staff of the House Committee on Armed Services, in  addition to issuing this unclassified report, we are issuing a separate  classified product.
We conducted this performance audit from October 2008 through October  2009 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives. A more thorough  description of our scope and methodology is provided in appendix I.
subsections: section_title: Background
subsections: section_title: DOD’s Vulnerability to Electrical Power Disruptions
paragraphs: DOD depends overwhelmingly on the U.S. commercial electrical power  grid for electricity to support its operations and missions. As illustrated  in figures 1 and 2, the grid is a vast, complex network of interconnecte d  regional systems and infrastructure (e.g., power plants, electricity lines,  and control centers) used to generate, transmit, distribute, and manage  electrical power supplies across the United States. According to the  Defense Science Board Task Force on DOD Energy Strategy,  approximately 99 percent of the electrical power DOD installations  consume originates from outside installation boundaries, while  approximately 85 percent of the energy infrastructure that DOD relies on  for electrical power is commercially owned and outside of DOD’s  control.
There are currently a variety of mechanisms in place that may help to  mitigate the risk of losing electricity service due to electrical power  disruptions, including mandatory reliability standards for the electrical  power industry approved by the Federal Energy Regulatory Commission.  In addition, other risk mitigation measures are being considered, such as  islanding. However, while the U.S. commercial electrical power grid is  generally a reliable source of electricity and is subject to some reliability  standards that typically assure its availability over 99 percent of the time,  concerns have been raised about the increasing vulnerability of the grid to  more frequent or longer electrical power disturbances. For example, the  Defense Science Board Task Force reported that the commercial power  grid is “brittle, increasingly centralized, capacity-strained, and largely  unprotected from physical attack, with little stockpiling of critical  hardware.” Similarly, according to the May 2007 Infrastructure Resiliency  Guide for DOD’s Defense Critical Infrastructure Program, “the electric  power network is a complex system of interconnected components that  can fail and cause massive service disruptions.” Factors that contribute to  the grid’s vulnerability include (1) increasing national demand for  electricity; (2) an aging electrical power infrastructure; (3) increased  reliance on automated control systems that are susceptible to  cyberattacks; (4) the attractiveness of electrical power infrastructure as  targets for physical or terrorist attacks; (5) long lead times (of several  months to several years) for replacing high-voltage transformers—which  cost several millions of dollars and are manufactured only in foreign  countries—if attacked or destroyed; and (6) more frequent interruptions in  fuel supplies to electricity-generating plants.
The National Science and Technology Council’s Committee on Homeland  and National Security also established a task force in January 2009 to  identify research and development needs for electric grid vulnerabilities  and to coordinate with other federal agencies to address those needs. In  addition, government and industry efforts are under way to examine  cybersecurity threats, develop potential “Smart Grid” solutions to  address some of the grid’s vulnerabilities, and develop and enforce  electricity reliability standards for the industry.
DOD assets are vulnerable to electrical power disruptions in various ways.  For example, according to the DCIP Infrastructure Resiliency Guide,  vulnerabilities may involve the co-location of both primary and secondary  electrical power equipment, single points of failure in an electrical power  network, lack of security access controls to critical electrical power  equipment, electrical power lines sharing rights-of-way with other utilities,  and insufficient backup sources of electrical power generation. To address  such vulnerabilities, the guide suggests that owners or operators of DOD  assets consider diversifying the locations of primary and secondary  electrical power equipment, establishing independent transmission paths  for commercial and backup electrical power, increasing security and  monitoring access to critical electrical power equipment, establishing  mitigation options based on potential loss of rights-of-way, and developing  additional backup sources of electrical power. For more detailed  information regarding typical electrical power vulnerabilities that could  affect DOD assets and potential measures to address them, see appendix  II.
DOD identifies the vulnerabilities and manages the risks of its most critical  assets to electrical power disruptions primarily through DCIP. On October  14, 2008, DOD designated 34 assets through DCIP as its most critical  assets—assets of such extraordinary importance to DOD operations that  according to DOD, their incapacitation or destruction would have a very  serious, debilitating effect on the ability of the department to fulfill its  missions. While most (29 of 34) of these critical assets—which may be  located in the United States, U.S. territories, or foreign countries—are  owned by DOD, 5 are owned by other entities, including both domestic  and foreign commercial and other governmental entities. To ensure the  availability of these and other networked assets critical to DOD missions,  DCIP uses a risk management model that helps decision makers   (1) identify the department’s critical assets based on the criticality of their  missions; (2) conduct “threat and hazard assessments;” (3) conduct  “vulnerability assessments” (that include detailed reviews of electrical  power vulnerabilities); (4) conduct “risk assessments” to determine the  consequences of the assets’ loss, evaluate the importance and urgency of  proposed actions, and develop alternate courses of action; (5) reach “risk  management decisions” to accept risks or reduce risks to acceptable  levels; and (6) formulate “risk responses” to implement the risk  management decisions.
Key stakeholders involved in these DCIP processes include  ASD(HD&ASA), which serves as the principal civilian advisor to the  Secretary of Defense on the identification, prioritization, and protection of  defense critical infrastructure; the Chairman of the Joint Chiefs of Staff,  who serves as DOD’s principal military advisor for the program; and the  combatant commands, the military services, and other DOD agencies and  organizations, which may serve as asset owners or mission owners for  specific critical assets. In addition, as the DISLA for the DCIP Public  Works Defense Sector—which includes both DOD-owned and non-DOD  assets used to support, generate, produce, or transport electrical power  for and to DOD users—the U.S. Army Corps of Engineers is responsible  for identifying asset interdependencies in its sector, including those  related to electrical power, as appropriate. Figure 3 illustrates the key  elements of the DCIP risk management model.
section_title: Other Risk Management Programs and Activities in DOD
paragraphs: In addition to using DCIP, DOD also identifies vulnerabilities and manages  the risks of its most critical assets, including those related to electrical  power, through other DOD mission assurance programs or activities,  including those related to force protection; antiterrorism; information  assurance; continuity of operations; chemical, biological, radiological,  nuclear, and high-explosive defense; readiness; and installation  preparedness. These programs and activities are intended to ensure that  required capabilities and supporting infrastructures are available to DOD  to carry out the National Military Strategy. DOD has established several  complementary programs that help protect critical assets, including those  listed in table 1. In addition, the military departments have developed  service-level critical infrastructure protection programs, which they  coordinate with DCIP.
section_title: Other Agencies and Organizations with Roles in Risk Management
paragraphs: Other federal agencies and industry organizations are to collaborate with  DOD and play significant roles in protecting critical electrical power  infrastructure within the framework of Homeland Security Presidential  Directive 7. This directive, issued in December 2003, requires all federal  departments and agencies to identify, prioritize, and coordinate the  protection of critical infrastructure and key resources from terrorist  attacks. These entities and their roles are summarized below.
Department of Homeland Security. DHS is the principal federal  entity responsible for leading, integrating, and coordinating the  overall national effort to protect the nation’s critical infrastructure  and key resources. DHS led the development of the National  Infrastructure Protection Plan, which provides a framework for  managing risks to U.S. critical infrastructure and outlines the roles  and responsibilities of DHS and other security partners—including  other federal agencies; state, territorial, local, and tribal  governments; and private companies. DHS is responsible for  leading and coordinating a national effort to enhance protection  through 18 critical infrastructure and key resource sectors, and a  “sector-specific agency” has lead responsibility for coordinating  the protection of each of the sectors.
Department of Energy. DOE serves as the sector-specific agency  for the Energy Sector, which includes critical infrastructure and  key resources related to electricity. DOE is responsible for  developing an Energy Sector Specific Plan, in close collaboration  with other National Infrastructure Protection Plan stakeholders,  that applies the plan’s risk management model to critical  infrastructure and key resources within that sector. Within DOE,  the Office of Electricity Delivery and Energy Reliability seeks to  lead national efforts to modernize the electrical grid; enhance  security and reliability of energy infrastructure; and facilitate  recovery from disruptions to energy supply. When requested, DOE  and its national laboratories can provide energy-related expertise  and assistance to DOD. According to DOE officials, DOE and  several DOD combatant commands, including U.S. European  Command and U.S. Africa Command, are considering utilizing DOE  representatives as energy attachés to those commands. The DOE  representatives can provide energy-related expertise to their  respective commands, particularly with respect to the commands’  energy-related planning activities and the security and reliability of  the commands’ energy infrastructure.
Federal Energy Regulatory Commission and the North  American Electric Reliability Corporation. The Energy Policy  Act of 2005 provided the Federal Energy Regulatory Commission  and its subsequently appointed Electric Reliability Organization— the North American Electric Reliability Corporation—new  responsibilities for helping protect and improve the reliability and  security of the U.S. bulk power system through the establishment,  approval, and enforcement of mandatory electrical reliability  standards. Both of these organizations also participate in  safeguarding the nation’s critical infrastructures and key resources,  and they have interacted with DOD regarding electrical power  vulnerabilities. Similarly, the North American Electric Reliability  Corporation has collaborated with DOD and military service  officials through the federal Task Force on Electric Grid  Vulnerability, which is co-chaired by DOD, to identify and address  electrical power vulnerabilities.
The Electrical Power Industry. Electrical power industry  representatives also contribute to the assurance of electrical power  supplies through industry associations—such as the Edison  Electric Institute, the American Public Power Association, and the  National Rural Electric Cooperative Association—and through  local electrical power providers to DOD installations or assets.  Electrical power industry associations, for example, collaborate  with the federal government to help secure the U.S. electrical  power grid through coordinating mechanisms in the National  Infrastructure Protection Plan. In early 2009 the institute  established the Energy Security Partnership Group, which includes  officials from DOD installations and focuses on improving  communications between DOD and its utilities and on identifying  and removing barriers to the development of comprehensive  energy security programs at DOD installations.
section_title: DOD’s Most Critical Assets Are Vulnerable to Electrical Power Disruptions, but DOD Lacks Sufficient Information to Determine the Full Extent of Their Vulnerability
subsections: section_title: DOD’s Most Critical Assets Rely on Electrical Power and Depend Overwhelmingly on Commercial Electrical Power Grids as Their Primary Supply
paragraphs: DOD’s most critical assets and the missions they support are vulnerable to  disruptions in electrical power supplies because of the extent of their  reliance on electricity, particularly from the commercial electrical power  grid. According to our survey of DOD’s most critical assets, all of these  assets require electrical power continuously in order to function and  support their mission(s). Furthermore, the survey results indicate that all  of the most critical assets depend on other supporting infrastructure— such as water; natural gas; and heating, ventilation, and air conditioning— that in turn also rely on electricity to function. As a result, without  appropriate backup electrical power supplies or risk management  measures, these critical assets may be unable to function fully and support  their mission(s) in the event of an electrical power disruption. According  to our survey, at least 24 of the 34 most critical assets experienced some  electrical power disruptions—lasting up to 7 days—during the 3-year  period from January 2006 through December 2008, and the missions  supported by 3 of those critical assets were adversely impacted by  electrical power disruptions. In addition, based on our survey, 31 of these  34 assets rely primarily on commercial electrical power grids for their  electricity supplies. The U.S. commercial electrical power grids have  become increasingly fragile and vulnerable to prolonged outages because  of such factors as (1) increased user demand, (2) fewer spare parts for key  electrical power equipment, (3) increased risks of deliberate physical or  cyberattacks on electrical power infrastructure by terrorists, and (4) more  frequent interruptions in fuel supplies to electricity-generating plants.
Based on our survey, vulnerability assessments of 6 of the most critical  assets reported vulnerabilities associated with the reliability of the  electrical power grids of their commercial electricity providers or DOD  installations. Furthermore, 8 of these critical assets attributed some of  their electrical power disruptions to their commercial electrical power  provider.
section_title: DOD Has Not Yet Completed DCIP Vulnerability Assessments on All of Its Most Critical Assets
paragraphs: DOD is identifying key vulnerabilities—including those related to  electrical power—of its most critical assets through DCIP vulnerability  assessments, but as of June 2009, the department had conducted such  assessments on only 14 of its 34 most critical assets. As part of the DCIP  risk management process, DCIP vulnerability assessments are intended to  systematically examine the characteristics of an installation, system, asset,  application, or its dependencies that could cause it to suffer a degradation  or loss—that is, incapacity to perform its designated function—as a result  of having been subjected to a certain level of threat or hazard. These  vulnerability assessments—most of which the Defense Threat Reduction  Agency has been conducting for DOD—include specific reviews of the  critical assets’ supporting electrical power networks “to ensure that the  distribution network at a given location and supporting offsite [electrical  power] system has the capacity, redundancy, path diversity, security,  survivability, and reliability to properly support a given mission.”
DOD Instruction 3020.45 requires DOD to conduct DCIP vulnerability  assessments on all of its most critical assets at least once every 3 years.  However, while DOD has conducted DCIP assessments on some of its  most critical assets since March 2007, ASD(HD&ASA) and Joint Staff  officials indicated that the department could not schedule or conduct  these assessments systematically until its most critical assets were  formally identified in October 2008. As a result, as of June 2009, DOD had  conducted DCIP vulnerability assessments on 14 of the 34 most critical  assets; had scheduled additional assessments for 13 other most critical  assets from July 2009 through December 2010; and had not yet scheduled  assessments for the remaining 7 most critical assets. According to  ASD(HD&ASA) and Joint Staff officials, DCIP vulnerability assessments  will be conducted on all the most critical assets by October 2011, as  required by DOD Instruction 3020.45. Nevertheless, until DOD completes  these DCIP vulnerability assessments, the department will not have  complete information about electrical power vulnerabilities for all the  most critical assets.
section_title: DOD Lacks Additional Guidance for Conducting DCIP Vulnerability Assessments on Its Non- DOD-Owned Most Critical Assets
paragraphs: DOD has not yet conducted or scheduled DCIP vulnerability assessments,  including assessments of electrical power vulnerabilities, on any of its  non-DOD-owned most critical assets—both those located in the United  States and in foreign countries—and has not yet developed guidance  addressing the unique challenges related to conducting the assessments on  such assets. While the majority of the most critical assets—which may be  located in the United States, U.S. territories, or foreign countries—are  owned by DOD, 5 of the 34 are not owned by DOD. Instead, such critical  assets are owned by either U.S. or foreign commercial or governmental  entities. DOD Instruction 3020.45 requires DOD to conduct DCIP  vulnerability assessments at least once every 3 years on all of its most  critical assets, regardless of the assets’ ownership or location. However,  DOD has not yet conducted or even scheduled DCIP vulnerability  assessments for any of the non-DOD-owned most critical assets located in  the United States or abroad. Furthermore, while DOD has issued extensive  DCIP guidance applicable to all defense critical infrastructure (including  non-DOD-owned critical infrastructure), as discussed above, DOD has not  yet developed a systematic approach or guidelines addressing the unique  challenges related to conducting the assessments on such non-DOD- owned critical assets. ASD(HD&ASA) and Joint Staff officials cited  security concerns, political sensitivities, and lack of DOD authority over  non-DOD-owned assets as key challenges in conducting the DCIP  vulnerability assessments on the non-DOD-owned most critical assets in  foreign countries. For example, according to these officials, notifying a  U.S. or foreign commercial entity, or a foreign government, about its  asset’s designation as one of DOD’s most critical assets could compromise  DCIP security guidelines or U.S. national security. Similarly, for political  reasons, foreign companies or governments may not want to have their  assets identified as supporting U.S. or DOD military missions.
ASD(HD&ASA) and Joint Staff officials recognize the need for developing  an approach and guidelines to conduct DCIP vulnerability assessments on  the five non-DOD-owned most critical assets, particularly those located  abroad. According to these officials, DOD has begun to coordinate with  the Department of State’s Office of the Coordinator for Counterterrorism  to help address some of the security concerns and political sensitivities  associated with conducting such assessments. We have previously  reported on DOD efforts to coordinate with the Department of State on  similar sensitive matters involving foreign governments’ support for DOD  assets abroad. For example, we have previously reported that through the  Department of State, the United States and host-nation governments have  successfully established various types of agreements—including general  agreements, intelligence exchange agreements, written agreements, and  informal agreements—that have been used to help protect U.S. forces and  facilities abroad, and nothing prohibits DOD from developing a similar  approach for conducting DCIP vulnerability assessments on non-DOD- owned most critical assets in foreign countries. Until DOD completes the  vulnerability assessments on such assets, which DOD is also required to  complete by October 2011, DOD officials will not know the extent of those  assets’ vulnerabilities to electrical power disruptions.
section_title: The Defense Infrastructure Sector Lead Agent for Public Works Has Not Completed Its Technical Analysis of Public Works Infrastructure (Including Electricity) Supporting DOD Critical Assets
paragraphs: The U.S. Army Corps of Engineers (Corps)—which serves as DCIP’s  DISLA for Public Works (including electricity)—has not completed  preliminary technical analyses of DOD installation infrastructure. Such  analyses are intended to identify public works infrastructure networks,  assets, points of service, and inter- and intradependencies that support the  critical assets on DOD installations. ASD(HD&ASA) requested these  analyses for all the most critical assets from the Corps in order to support  the teams conducting DCIP vulnerability assessments on those assets.  Preliminary desktop analyses are intended to help brief DCIP vulnerability  assessment teams on the most critical assets’ supporting public works  infrastructure—including electrical power systems—before those teams  conduct the vulnerability assessments on the assets in the field.  According to ASD(HD&ASA), the Corps has completed these analyses for  public works infrastructure located outside of DOD installations with the  most critical assets. However, as of July 2009, the Corps had not yet  conducted these analyses for public works infrastructure located within  DOD installations for any of the most critical assets. According to a Corps  official, the Corps has been unable to begin these analyses because it has  not received infrastructure-related information that it requires from the  military services. According to the official, the Corps has been requesting  this infrastructure-related information informally from the military  services for several months and recently augmented its requests with  formal written requests to the services. However, as of July 2009, the U.S.  Navy is the only service that has begun to gather the requested  information. In written correspondence with us, the remaining two  military departments have indicated that limited funds and personnel will  affect their ability to respond to the Corps’ request for the infrastructure- related information, which one of the services considers to be an  unfunded mandate. Without this information, however, the Corps will be  unable to conduct its preliminary technical analyses of public works  infrastructure, including electrical power systems, which support the most  critical assets. As a result, the teams conducting DCIP vulnerability  assessments will be unable to consider crucial background information  about the most critical assets’ public works infrastructure—including  networks, assets, points of service, and inter- and intradependencies  related to electrical power systems—before the teams conduct the DCIP  vulnerability assessments in the field.
section_title: DCIP Vulnerability Assessments Are Not Systematically Coordinated with Those from Related Mission Assurance Programs
paragraphs: DOD does not systematically coordinate DCIP vulnerability assessment  policy, guidelines, or processes with those of other, related DOD mission- assurance programs that also examine electrical power vulnerabilities of  DOD critical assets. DOD Directive 3020.40 calls for DCIP to complement  other DOD mission assurance programs and efforts, including force  protection; antiterrorism; information assurance; continuity of operations;  chemical, biological, radiological, nuclear, and high-explosive defense;  readiness; and installation preparedness. Vulnerability assessments from  these other mission programs and efforts also examine electrical power  vulnerabilities of DOD critical assets. For example, as part of DOD’s  antiterrorism and force protection efforts, the Defense Threat Reduction  Agency conducts Joint Staff Integrated Vulnerability Assessments at  selected DOD installations worldwide, including some that host critical  assets. These assessments identify vulnerabilities related to terrorism and  force protection at the selected installations, including those related to  electrical power systems, and provide options to assist installation  commanders in mitigating or overcoming the vulnerabilities. Similarly, as  part of the critical asset protection processes, the military services also  conduct vulnerability assessments related to mission assurance at  installations that may also host critical assets. However, DOD Directive  3020.40 does not provide specific guidelines or requirements for  systematically coordinating policy, guidelines, and processes or the results  from DCIP vulnerability assessments on the critical assets with those of  other DOD mission assurance programs.
ASD(HD&ASA) and Joint Staff officials acknowledge the benefits of  coordinating and leveraging the results of assessments from DCIP and  other DOD mission assurance programs—particularly those related to  antiterrorism/force protection, continuity of operations, and information  assurance—and have already taken some steps to further such  coordination. For example, as of June 2009, the Defense Threat Reduction  Agency has conducted DCIP vulnerability assessments on 12 of the most  critical assets in conjunction with Joint Staff Integrated Vulnerability  Assessments being conducted on installations that host those assets,  while the military services have conducted DCIP vulnerability assessments  on 2 of the most critical assets. Also, according to ASD(HD&ASA) and  Joint Staff officials, the results of other DOD mission assurance  vulnerability assessments already conducted on critical assets are made  available for DCIP vulnerability assessment teams to consider before they  conduct the DCIP vulnerability assessments. In addition, the Joint Staff  and the Defense Threat Reduction Agency have begun to develop a formal  agreement to align more closely the standards and benchmarks used to  conduct vulnerability assessments for related DOD mission assurance  programs, particularly DCIP, antiterrorism/force protection, continuity of  operations, and information assurance. However, until DOD finalizes the  guidelines being developed in this agreement, it may be unable to  systematically leverage the results of related vulnerability assessments  that may be conducted on the same critical assets by multiple sources, and  thus enhance DOD’s ability to identify those assets’ electrical power  vulnerabilities.
section_title: DCIP Assessments to Date Do Not Consistently Consider Vulnerabilities to Longer-Term Power Disruptions
paragraphs: DCIP vulnerability assessment teams do not consistently consider the  vulnerabilities of the critical assets to longer-term electrical power  disruptions on a mission-specific basis, which is not explicitly defined in  the DCIP vulnerability assessment benchmarks for electrical power. These  benchmarks serve as detailed criteria by which DCIP vulnerability  assessment teams assess whether the electrical power networks that  support the critical assets—at the host installation and in the supporting  off-site electrical power system—have the “capacity, redundancy, path  diversity, security, survivability, and reliability to properly support a given  mission.” Although the benchmarks consider how long electrical power  backup systems can sustain continuity of critical operations, how to define  what an unacceptable loss of power is, and whether the asset owner  maintains a contingency plan to ensure availability of the electrical power  network to accomplish an asset’s mission, they do not explicitly consider  vulnerabilities related to longer-term electrical power disruptions. As a  result, DOD’s DCIP vulnerability assessments may only focus on  vulnerabilities associated with shorter-term electrical power disruptions.
According to ASD(HD&ASA) officials, DCIP vulnerability assessment  teams already consider longer-term electrical power disruptions indirectly  through questions in the benchmarks that ask about contingency plans  and continuity of operations. However, we found that the DCIP  vulnerability assessment reports that were available for 10 of the 34 most  critical assets did not explicitly consider specific vulnerabilities or risk  mitigation options associated with longer-term electrical power  disruptions on a mission-specific basis. Consequently, such vulnerabilities  or options may not be identified and DOD may not make appropriate risk  management decisions.
Nevertheless, several DOD sources have recognized the need for the  department to more explicitly consider the effects of longer-term electrical  power disruptions to DOD’s critical assets. For example, the Department  of Defense Energy Manager’s Handbook calls for DOD components to  develop strategies for both short- and long-term energy disruptions,  including electricity disruptions. Also, in its February 2008 report, the  Defense Science Board Task Force on DOD Energy Strategy—which  concluded that DOD’s critical national security and homeland defense  missions were at an unacceptably high risk of failure from extended power  disruptions—recommended that DOD consider the duration of electrical  power disruptions, among other factors, in its risk management approach  to reducing risks to critical missions from the loss of commercial electrical  power. An update by the Office of the Under Secretary of Defense for  Acquisition, Technology and Logistics on DOD’s Energy Security Task  Force also proposed a subgoal of “reduc the risk of loss of critical  functions due to extended commercial grid power disruptions at fixed  installations.” Without explicit guidance in the DCIP vulnerability  assessment benchmarks for considering longer-term electrical power  disruptions, future DCIP vulnerability assessments on other critical assets  may be unable to identify vulnerabilities associated specifically with such  electrical power disruptions.
section_title: DOD Has Taken Steps to Assure Availability of Electrical Power to Critical Assets, but It Lacks a Mechanism for Tracking Implementation, and Its Coordination with Electricity Providers Remains Limited
subsections: section_title: DOD Has Taken Some Steps to Assure the Availability of Electrical Power to Its Critical Assets
paragraphs: DOD has taken some steps to assure the availability of its electrical power  supplies by identifying and addressing the vulnerabilities and risks of its  critical assets to electrical power disruptions. For example, from August  2005 through October 2008, DOD issued Defense Critical Infrastructure  Program guidance for identifying critical assets, assessing their  vulnerabilities, and making risk management decisions about those  vulnerabilities. Also, as previously discussed, DOD has conducted DCIP  vulnerability assessments on 14 of the 34 most critical assets and has  scheduled assessments for 13 of the remaining assets, but it has not yet  scheduled assessments for 5 of the non-DOD-owned most critical assets.  The DCIP vulnerability assessments conducted so far have identified  specific electrical power–related vulnerabilities to some of the critical  assets, including vulnerabilities associated with the reliability of the assets’  supporting commercial electrical power grid, the availability of backup  electrical power supplies, and single points of failure in electrical power  systems supporting the assets. Addressing the risks associated with these  vulnerabilities—by remediating, mitigating, or accepting those risks—can  help DOD assure the availability of electrical power to the critical assets.  For example, at all 6 most critical assets we visited, the DOD asset owners  have installed diesel-based electrical power generators as backup sources  of electricity during electrical power disruptions. Other (non-DCIP) DOD  mission assurance programs also have the potential to help DOD assure  the availability of electrical power supplies to its most critical assets. For  example, we found that Joint Service Integrated Vulnerability Assessments  and similar vulnerability assessments from the military services, which  have been conducted on some of the installations with critical assets for  antiterrorism and force protection purposes, also have identified  vulnerabilities related to electrical power.
Furthermore, DOD also has taken steps to coordinate with other federal  agencies, including DOE and DHS, as well as electrical industry  organizations, and these steps may help to assure the supply of electricity  to its critical assets. For example, to represent its concerns and interests  on electricity, DOD participates in the Energy Government Coordinating  Council. The council provides DOD and other federal agencies with a  forum for sharing their concerns, comments, and questions on energy- related matters—including critical infrastructure protection—with DOE,  which chairs the group. In another effort involving DOE, several DOD  combatant commands—including U.S. European Command and U.S.  Africa Command—have recently agreed to accept a DOE departmental  representative to serve as an energy attaché to the commands. The DOE  representatives will provide energy-related expertise to their respective  commands, particularly with respect to the commands’ energy-related  planning activities and the security and reliability of the commands’  energy infrastructure. DOD has also partnered with various federal  agencies and industry organizations to further increase the assurance of  electrical power. For example, DOD serves as co-chair of the federal Task  Force on Electric Grid Vulnerability of the National Science and  Technology Council’s Committee on Homeland and National Security,  which was established in January 2009 to identify research and  development needs for electrical grid vulnerabilities and to coordinate  with other federal agencies to address those needs. In addition, DOD  officials are collaborating with a working group established by the Edison  Electric Institute in early 2009 called the Energy Security Partnership  Group. The group focuses on improving communications between DOD  and its utilities and on identifying and removing barriers to the  development of comprehensive energy security programs at DOD  installations. Also, in July 2009, DOD participated in an interagency  exercise cosponsored by DHS, DOE, and DOD called Secure Grid 2009,  Electric Grid Tabletop Exercise, for which officials from DOD, DOE, DHS,  the Federal Energy Regulatory Commission, the North American Electric  Reliability Corporation, and the Edison Electric Institute, among others,  jointly developed recommendations and potential responses to two  scenarios involving theoretical physical and cyber-related attacks on U.S.  electrical power grids.
Our survey results confirm that some steps are being taken at various  levels within DOD to improve the assurance of electrical power supplies to  its most critical assets. For example, according to the survey and reports  we reviewed, DOD conducted vulnerability and risk assessments involving  electrical power on 24 of the most critical assets through a variety of DOD  mission assurance reviews, including DCIP assessments, Joint Staff  Integrated Vulnerability Assessments, combatant command assessments,  DOD agency assessments, and local installation assessments. The survey  results also indicate that secondary sources of electricity—such as  uninterruptible power supply systems and diesel generators—provide  some backup electrical power capabilities to almost all of the critical  assets. In addition, according to the survey, asset owners and host  installations for some of the critical assets whose vulnerabilities have been  assessed have taken specific measures to address those vulnerabilities,  such as eliminating single points of failure, developing electrical power  disruption contingency plans, installing emergency electrical power  generators, and increasing physical security measures around electrical  power facilities.
section_title: DOD Lacks a Mechanism for Tracking Implementation of Future DCIP Risk Management Decisions and Responses to Vulnerabilities
paragraphs: DOD has not yet established a mechanism for systematically tracking the  implementation of future DCIP risk management decisions, which are  intended to address vulnerabilities (including those involving electrical  power) that have been identified for the most critical assets. Such tracking  could help DOD ensure that DCIP stakeholders are developing and  implementing measures to address the most critical assets’ identified  vulnerabilities to electrical power disruptions and thereby help assure the  availability of electrical power to those assets. As previously discussed,  DCIP’s risk management program involves the identification of DOD’s  most critical assets; the assessment of those assets’ vulnerabilities through  vulnerability assessments; and subsequent risk assessments, risk  management decisions, and risk responses involving relevant DCIP  stakeholders. DCIP guidance contained in DOD Instruction 3020.45  requires stakeholders to coordinate to make risk management decisions  regarding whether and how to address identified vulnerabilities—through  remediation or mitigation—or accept the risk posed by not addressing  those vulnerabilities.
Under DCIP, ASD(HD&ASA) has overall responsibility for overseeing the  implementation of actions for the remediation, mitigation, or acceptance  of risks to DOD critical assets, while owners of the critical assets are  required to monitor the status and progress of the implementation of DCIP  risk management decisions for their respective assets. ASD(HD&ASA)  officials indicated to us that they do not systematically track the results of  DCIP vulnerability assessments, asserting that they consider it more  important to track the implementation of the subsequent DCIP risk  management decisions and responses to be made concerning the  vulnerabilities that are identified. The officials told us that these risk  management decisions would reflect the consensus that would be reached  by relevant DCIP stakeholders (such as asset owners, mission owners, and  defense infrastructure sector lead agents) on either remediating,  mitigating, or accepting specific vulnerabilities—actions that may require  the stakeholders to provide funding or other resources in order to  implement. However, the officials have not yet tracked any such  decisions or responses, because no such decisions or responses have yet  been made in response to the 14 DCIP vulnerability assessments  conducted so far. According to these officials, because of the number of  stakeholders and potential resources involved, risk management decisions  can take several months to coordinate following a DCIP vulnerability  assessment. These officials said that they plan to monitor the  implementation of DCIP risk management decisions and responses, but  they have not yet developed a mechanism, such as a schedule to track the  implementation status of those decisions and responses, by which to do  so. Without systematic tracking of risk management decisions and  responses, DOD may be unable to comprehensively determine whether  asset owners and host installations are taking the steps agreed to by  relevant DCIP stakeholders to address the vulnerabilities of the critical  assets, including vulnerabilities related to electrical power disruptions.
section_title: DOD’s Coordination with Local Electricity Providers Has Been Limited
paragraphs: DCIP guidance recognizes the importance of collaboration by encouraging  coordination between DOD facilities with critical assets and their  respective public utilities—including electricity providers—in order to  remediate risks involving those utilities. According to this guidance, a  DOD installation “should establish good communications with public  service providers  about service  requirements,” and “that relationship does not have to wait for the  identification of a vulnerability,” as “the remediation of risks posed by  commercial dependency may be more complicated than that of DOD- owned infrastructure.” Similarly, in recognition of the important role that  local utility providers play in supporting DOD installations with critical  assets, the U.S. Army Corps of Engineers is requesting funds for a pilot  program that would involve extensive collaboration with the local  electricity providers at selected U.S. Army installations with critical assets.  The pilot program is intended to analyze the reliability of community  infrastructure in meeting current and anticipated needs of the installations  and the critical missions.
As previously discussed, our survey indicated that 31 of the DOD’s 34 most  critical assets identified the commercial electrical power grid as their  primary source of electrical power. Yet despite this overwhelming  reliance, host installations or owners of only 7 of the surveyed critical  assets reported coordinating with their local electricity providers to either  identify or address their assets’ vulnerabilities to electrical power  disruptions. Furthermore, according to the survey and our analysis, none  of the host installations or owners of the critical assets have developed  any formal agreements with their local electricity providers to help  manage the risks and vulnerabilities of those assets to electrical power  disruptions. Survey respondents cited various reasons for not coordinating  with local electricity providers, including the absence of a requirement for  such coordination and the lack of a vulnerability assessment on the asset  that would indicate the need to initiate such coordination.
Coordinating with local electricity providers could usefully enhance  DOD’s efforts to identify or address the vulnerabilities of critical assets to  electrical power disruptions and thereby better assure the availability of  electrical power to those assets. However, few host installations or owners  of critical assets have coordinated with their local electrical power  providers to help identify or address the assets’ vulnerabilities to electrical  power disruptions. According to an electrical power industry association  representative, local electricity providers may have technical expertise or  be pursuing activities that could help DOD installations develop risk  remediation or mitigation measures to address electrical power  vulnerabilities affecting a critical asset. According to this representative,  such coordination, for example, could lead to agreements in which local  electricity providers would prioritize the restoration of electrical power to  a DOD installation with a critical asset following an electrical power  disruption. In addition, DOD installations could usefully coordinate with  their respective electricity providers concerning an industry initiative  called Spare Transformer Equipment Program, in which electricity  providers agree to share spare electrical power transformers—which are  often foreign made, expensive, and can take several years to order—in the  event of an emergency. Without more extensive coordination between  DOD DCIP stakeholders and local electricity providers, DOD may be  limiting the risk remediation or mitigation options that it could consider  for addressing the vulnerabilities of its critical assets to electrical power  disruptions.
section_title: Conclusions
paragraphs: DOD relies on commercial electrical power grids for secure, uninterrupted  electrical power supplies to support its most critical assets—those whose  incapacitation or destruction would have a very serious, debilitating effect  on the department’s ability to fulfill its missions. However, according to  the Defense Science Board Task Force on DOD Energy Strategy, the  commercial electrical power grids have become increasingly fragile and  vulnerable to extended power disruptions that could severely impact  DOD’s most critical assets, their supporting infrastructure, and the  missions they support, and disruptions to the electrical power grid have  occurred. DOD’s most critical assets are vulnerable to disruptions in  electrical power supplies, but DOD would benefit from additional  information to determine the full extent of the risks and vulnerabilities  these assets face. By completing DCIP vulnerability assessments on all of  its most critical assets, DOD would have more information to determine  the full extent of these assets’ risks and vulnerabilities to such disruptions.  Similarly, with additional guidelines, an implementation plan, and a  schedule for conducting DCIP vulnerability assessments on all non-DOD- owned most critical assets, particularly those located abroad, DOD could  more accurately determine the full extent of those assets’ risks and  vulnerabilities to such disruptions. Further, until the U.S. Army Corps of  Engineers is able to complete the preliminary technical analyses of public  works (including electrical power) infrastructure in support of the DCIP  vulnerability assessments of the critical assets, DOD may be unable to  identify all electrical power vulnerabilities to its most critical assets.  Additionally, once DOD finalizes guidelines specifying how DCIP  assessment criteria and processes should be coordinated with those of  other DOD mission assurance programs, DOD could more systematically  determine whether these programs may also be identifying electrical  power vulnerabilities and risk management options for its most critical  assets. Also, explicit guidelines to assess vulnerabilities to critical assets  from long-term electrical power disruptions would further enhance DOD’s  ability to manage the risks associated with such disruptions.
While DOD has taken some steps toward assuring the availability of its  electrical power supplies to its critical assets, additional DCIP measures  could further enhance efforts to address these assets’ risks and  vulnerabilities to electrical power disturbances. DOD could also improve  its ability to leverage related mission assurance assessments and respond  to future disruptions by developing a mechanism to systematically track  the results of future risk management decisions and responses intended to  address risks and vulnerabilities identified for the most critical assets.  Additionally, DOD could expand its options for addressing disruptions in  the commercial electrical power grid by encouraging greater collaboration  between the owners or host installations of the most critical assets and  their respective local electricity providers.
With more comprehensive knowledge of DOD’s most critical assets’ risks  and vulnerabilities to electrical power disruptions and more effective  coordination with electricity providers, DOD can better avoid  compromising crucial DOD-wide missions during electrical power  disruptions. This additional information may also improve DOD’s ability to  effectively prioritize funding needed to address identified risks and  vulnerabilities of its most critical assets to electrical power disruptions.
section_title: Recommendations for Executive Action
paragraphs: To ensure that DOD has sufficient information to determine the full extent  of the risks and vulnerabilities to electrical power disruptions of its most  critical assets, we recommend that the Secretary of Defense direct the  Assistant Secretary of Defense for Homeland Defense and Americas’  Security Affairs, in collaboration with the Joint Staff’s Directorate for  Antiterrorism and Homeland Defense, combatant commands, military  services, and other Defense Critical Infrastructure Program stakeholders,  as appropriate, to take the following five actions:    Complete Defense Critical Infrastructure Program vulnerability  assessments, as required by DOD Instruction 3020.45, on all of DOD’s  most critical assets by October 2011.
Develop additional guidelines, an implementation plan, and a schedule  for conducting Defense Critical Infrastructure Program vulnerability  assessments on all non-DOD-owned most critical assets located in the  United States and abroad in conjunction with other federal agencies, as  appropriate, that have a capability to implement the plan.
Establish a time frame for the military services to provide the  infrastructure data required for the Public Works Defense  Infrastructure Sector Lead Agent—the U.S. Army Corps of Engineers— to complete its preliminary technical analysis of public works  (including electrical system) infrastructure at DOD installations that  support DOD’s most critical assets.
Finalize guidelines currently being developed to coordinate Defense  Critical Infrastructure Program assessment criteria and processes more  systematically with those of other DOD mission assurance programs.
Develop explicit Defense Critical Infrastructure Program guidelines for  assessing the critical assets’ vulnerabilities to long-term electrical  power disruptions.
To enhance DOD’s efforts to mitigate these assets’ risks and vulnerabilities  to electrical power disruptions and leverage previous assessments and  multiple asset owners’ information, we recommend that the Secretary of  Defense direct the Assistant Secretary of Defense for Homeland Defense  and Americas’ Security Affairs, in collaboration with the Joint Staff’s  Directorate for Antiterrorism and Homeland Defense, combatant  commands, military services, and other Defense Critical Infrastructure  Program stakeholders, as appropriate, to take the following two actions:    Develop a mechanism to systematically track the implementation of  future Defense Critical Infrastructure Program risk management  decisions and responses intended to address electrical power–related  risks and vulnerabilities to DOD’s most critical assets.
Ensure for DOD-owned most critical assets, and facilitate for non-DOD- owned most critical assets, that asset owners or host installations of  the most critical assets, where appropriate, reach out to local  electricity providers in an effort to coordinate and help remediate or  mitigate risks and vulnerabilities to electrical power disruptions that  may be identified for DOD’s most critical assets.
section_title: Agency Comments and Our Evaluation
paragraphs: In written comments on a draft of this report, DOD concurred with all of  our recommendations and provided technical comments, which we  incorporated in the report where appropriate. DOD’s comments are  reprinted in appendix VI. Due to the sensitivity of DOD’s most critical  assets and its concerns about the classification and dissemination of the  initial draft report, as well as the focus of the recommendations on DOD’s  program, we did not request agency comments on the full draft report  from DOE, DHS, and the Federal Energy Regulatory Commission.  However, we did seek technical comments from these entities on sections  of the initial draft report that pertained to their roles and responsibilities,  which we also incorporated in the report where appropriate.
DOD concurred with our five recommendations to ensure that DOD has  sufficient information to determine the full extent of the risks and  vulnerabilities to electrical power disruptions of its most critical assets.  Based on DOD’s comments, we modified our original recommendation  concerning the establishment of a time frame for the military services to  provide the infrastructure data required for preliminary technical analysis  of public works (including electrical system) infrastructure at DOD  installations that support DOD’s most critical assets.
First, DOD concurred with our recommendation that the department  complete DCIP vulnerability assessments on all of its most critical  assets by October 2011, as required by DOD Instruction 3020.45. DOD  noted that the Joint Staff, in coordination with ASD(HD&ASA), has  already begun to conduct these assessments using an all-hazards and  mission-assurance approach. As we reported, as of June 2009, DOD had  conducted DCIP assessments on 14 of the 34 most critical assets.
Second, DOD concurred with our recommendation that the department  develop additional guidelines, an implementation plan, and a schedule  for conducting vulnerability assessments on all non-DOD-owned most  critical assets located in the United States and abroad in conjunction  with other federal agencies, as appropriate, that have a capability to  implement the plan. DOD acknowledged that conducting vulnerability  assessments on such assets, particularly those located abroad, presents  significant challenges, as they require the agreement of the assets’ non- DOD owners. According to the department, the ASD(HD&ASA)/DCIP  Office is coordinating with appropriate offices to examine the  possibility of conducting “remote assessments” on these assets. We  recognize the challenges faced by DOD in identifying the electrical  power vulnerabilities of non-DOD-owned critical assets and support  DOD’s efforts to coordinate with appropriate federal agencies in this  area. We previously have reported on DOD’s efforts to coordinate with  the Department of State on similar sensitive matters involving foreign  governments’ support for DOD assets abroad, noting that such efforts  have resulted in various types of agreements to help protect U.S. forces  and facilities abroad. We also note that if DOD decides to conduct  “remote” DCIP vulnerability assessments on the non-DOD-owned most  critical assets, such assessments should rely on the same benchmarks  used for conducting DCIP vulnerability assessments on DOD-owned  most critical assets.
Third, DOD concurred with our recommendation that the department  establish a time frame for the military services to provide the  infrastructure data required for the Public Works Infrastructure Sector  Lead Agent—the U.S. Army Corps of Engineers—to complete its  preliminary technical analysis of public works infrastructure at DOD  installations that support DOD’s most critical assets. Based on  comments from DOD that the Corps has already completed the  technical analysis for public works infrastructure located outside of the  installations, but is still waiting for the data required to complete the  analysis on infrastructure located within the installations, we modified  this recommendation to indicate that these data are required for  completing—rather than conducting—the preliminary technical  analysis. DOD acknowledged that such information is necessary for the  proper characterization of its critical assets from a public works  perspective. We believe that the establishment of specific time frames  for the military services to provide this important information is  necessary because, as of July 2009, only one of the military services— the U.S. Navy—had begun to gather the requested information.
Fourth, DOD concurred with our recommendation that the department  finalize guidelines currently being developed to coordinate DCIP  assessment criteria and processes more systematically with those of  other DOD mission-assurance programs. While acknowledging the  synergistic effect of complementary risk management program  activities and security-related functions, DOD noted that such  programs are subject to different directives and appropriations, and  that critical infrastructure protection at the installation level is not yet  mature. According to DOD, the Joint Staff is now overseeing a “way  ahead” process to better synchronize these efforts. We encourage the  Joint Staff to complete this initiative and identify specific ways for  coordinating DCIP assessment criteria and processes more  systematically with those of DOD’s other mission assurance programs.
Fifth, DOD concurred with our recommendation that the department  develop explicit DCIP guidelines for assessing the most critical assets’  risks and vulnerabilities to long-term electrical power disruptions.  According to DOD, the ASD(HD&ASA)/DCIP Office will review current  vulnerability assessment criteria and standards and work with the Joint  Staff to include considerations of long-term electrical power  disruptions.
DOD also concurred with our two recommendations to enhance DOD’s  efforts to mitigate its most critical assets’ risks and vulnerabilities to  electrical power disruptions and leverage previous assessments and  multiple asset owners’ information:    First, DOD concurred with our recommendation that the department  develop a mechanism to systematically track the implementation of  future DCIP risk management decisions and responses intended to  address electrical power–related risks and vulnerabilities to DOD’s  most critical assets. According to DOD, the ASD(HD&ASA)/DCIP  Office has developed draft DOD Manual 3020.45, Volume 5, Defense  Critical Infrastructure Program (DCIP) Coordination Timeline, that  is being coordinated within the department. DOD notes that manual’s  purpose is to provide uniform procedures and timelines for DCIP  stakeholders—that is, ASD(HD&ASA), the Joint Staff, military  departments, combatant commands, defense agencies, and DISLAs—to  execute DCIP activities and responsibilities, including those related to  risk management decisions and responses. We encourage DOD to  finalize this draft manual and ensure that it provides explicit guidance  on tracking the implementation of DCIP risk management decisions  and responses resulting from DCIP vulnerability assessments of DOD’s  most critical assets. DOD also notes that the DCIP Office is developing  an automated Critical Asset Identification Process Collaboration Tool  that will document and track the status of DCIP stakeholders’ progress  in the DCIP risk management process.
Second, DOD also concurred with our recommendation that the  department ensure for DOD-owned most critical assets, and facilitate  for non-DOD-owned most critical assets, that asset owners or host  installations of the most critical assets, where appropriate, reach out to  local electricity providers in an effort to coordinate and help remediate  or mitigate risks and vulnerabilities to electrical power disruptions that  may be identified for DOD’s most critical assets. DOD’s comments  cited existing guidance that, among other things, (1) encourages  government and private-sector decision makers to work with electricity  providers to identify remedies to potential single points of failure and  (2) advises DOD facility managers to establish good communications  with public service providers about service requirements, and to review  service-level agreements, acquisition programs, contracts, and  operational processes for opportunities to address and include stronger  resiliency language and requirements for future remediation efforts.  According to DOD, this guidance will be reinforced at DCIP forums for  collaboration, such as meetings of the Defense Critical Infrastructure  Integration Staff, Operational Advisory Board, and Defense  Infrastructure Sector Council. We encourage DOD to reinforce such  guidance concerning collaboration with local electricity providers  directly with asset owners or host installations for each of the most  critical assets, as appropriate, in order to help mitigate the risks and  vulnerabilities to electrical power disruptions that may be identified for  those assets.
We are sending copies of this report to other interested congressional  parties; the Secretary of Defense; the Chairman, Joint Chiefs of Staff; the  Secretaries of the U.S. Army, the U.S. Navy, and the U.S. Air Force; the  Commandant of the U.S. Marine Corps; and the Director, Office of  Management and Budget. This report also is available at no charge on  GAO’s Web site at http://www.gao.gov.
If you or your staff have any questions concerning this report, please  contact me at (202) 512-5431 or dagostinod@gao.gov. Contact points for  our Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix VII.
section_title: Appendix I: Scope and Methodology
paragraphs: To conduct our review of the assurance of electrical power supplies to  Department of Defense (DOD) critical assets, we administered three  structured written surveys to the owners or those with program  responsibility for 100 percent of DOD’s 34 most critical assets, which DOD  identified through the Defense Critical Infrastructure Program (DCIP) as  its most critical assets as of October 2008. We administered one survey to  the military services and DOD agencies that own or have program  responsibility for the assets through DCIP to obtain information about the  (1) assets’ degree of reliance on electrical power; (2) assets’ primary and  backup sources of electrical power supplies; (3) number and type of  unplanned electrical power disruptions to the assets; (4) DCIP and non- DCIP assessments of the assets’ risks and vulnerabilities to electrical  power disruptions from January 2006 through December 2008; and   (5) measures recommended, implemented, or planned to address or  manage such risks and vulnerabilities. We administered another survey to  the Joint Staff to obtain information about the missions supported by the  assets. Finally, we administered the third survey to the Office of the  Assistant Secretary of Defense for Homeland Defense and Americas’  Security Affairs (ASD(HD&ASA)) regarding coordination efforts with  relevant DOD and non-DOD stakeholders. (These surveys are reproduced  in full in apps. III, IV, and V, respectively.) We limited our surveys to the  universe of DOD’s most critical assets because of concerns over the  reliability of DOD’s larger list of about 675 Tier 1 Task Critical Assets,  which support critical DOD missions at the departmental, combatant  command, and military service levels. We also conducted six follow-up  site visits to a nonprobability sample of critical assets to verify and  validate the surveys’ results and evaluate in-depth issues identified in the  surveys’ responses. We selected the sites for visits judgmentally based on  the survey responses regarding issues addressed in this report.
We initially selected a random sample from DOD’s universe of about 675  Tier 1 Task Critical Assets to survey for this review. However, based on  discussions with DOD officials and our own analysis, we found significant  data reliability and validity problems with DOD’s Tier 1 Task Critical Asset  list. We found that the use of disparate sets of guidance, including draft  and nonbinding guidance, resulted in the selection and submission of  assets to the Tier 1 Task Critical Asset list based on inconsistent criteria,  thus limiting the usefulness of the Tier 1 Task Critical Asset list to DOD  decision makers in determining DOD’s most critical assets and prioritizing  funding to address identified vulnerabilities. As a result, we determined  that for methodological purposes, DOD’s current Tier 1 Task Critical Asset  list did not represent a meaningful universe from which we should select  our survey sample or to which we should project our survey results.  Because the universe of critical assets did not represent an accurate,  comprehensive list of DOD Tier 1 Task Critical Assets, we determined that  this issue in and of itself warranted further analysis. Therefore, we issued  a separate report, with recommendations, on issues relating specifically  to the Tier 1 Task Critical Asset list to enable DOD to take timely actions  to update and improve its list of Defense Critical Assets in the fall of 2009  and prioritize funding.
Defense Information Systems Agency    Defense Infrastructure Sector Lead Agents    Headquarters, U.S. Army Corps of Engineers, DCIP Public Works    Defense Threat Reduction Agency, Support Branch Chief, Combat    Director of Defense Research and Engineering    Defense Science Board, Task Force on DOD Energy Strategy    Mission Assurance Division, Naval Surface Warfare Center at Dahlgren    Selected DOD critical assets at U.S. military installations within the  To become more familiar with efforts currently taking place to assure the  nation’s electrical power grid, we met with various officials from federal  agencies, electrical power industry associations, and private-sector  entities and other officials to determine their roles and responsibilities,  ongoing initiatives, and the extent of their coordination efforts with DOD  in assuring electrical power to the nation’s power grid. We obtained  relevant documentation and interviewed officials from the following  organizations:    Department of Homeland Security (DHS)
National Protection and Programs Directorate    Office of Infrastructure Protection   Infrastructure Information Collection Division    Partnership and Outreach Division    Protective Security Coordination Division    Office of Cybersecurity and Communications    Department of Energy (DOE), Office of Electricity Delivery & Energy    Federal Energy Regulatory Commission, Office of Electric Reliability    North American Electric Reliability Corporation    CACI International, Inc.    Edison Electric Institute    Pareto Energy, Inc.    Talisman International, LLC  We did not request agency comments from DOE, DHS, and the Federal  Energy Regulatory Commission on the full draft report, which at the time  was classified as SECRET because of (1) DOD’s concerns about the  classification and dissemination of the report and (2) the focus of the  recommendations on DOD’s program. We did seek technical comments  from these entities on sections of the initial draft report that pertained to  their roles and responsibilities, which we incorporated in the report where  appropriate. We also shared sections of the initial draft report that  discussed the 2008 Report of the Defense Science Board Task Force on  DOD Energy Strategy, “More Fight—Less Fuel,” and the entities either  agreed or did not take issue with the conclusions of this report.
To learn more about the assurance of electrical power supplies to DOD  critical assets, we developed three electronic surveys for DOD critical  assets, their missions, and coordination efforts regarding the assets. We  asked responders about (1) missions supported by the assets; (2) assets’  degree of reliance on electrical power; (3) assets’ primary and backup  sources of electrical power supplies; (4) number and type of unplanned  electrical power disruptions to the assets; (5) DCIP and non-DCIP  assessments of the assets’ risks and vulnerabilities to electrical power  disruptions; and (6) measures recommended, implemented, or planned to  address or manage such risks and vulnerabilities, including coordination  efforts with relevant DOD and non-DOD stakeholders.
We conducted our surveys from May 2009 through August 2009, using self- administered electronic surveys. We sent a questionnaire on DOD critical  assets to the owners and operators of DOD-owned critical assets. We sent  a second questionnaire on DOD critical asset missions to the Joint Staff (J- 34). We sent a third questionnaire on coordination efforts for DOD critical  assets to ASD(HD&ASA)/DCIP Office. We sent the questionnaires by  SIPRNet in an attached Microsoft Word form that respondents could  return electronically via SIPRNet after marking check boxes or entering  responses up to the SECRET classification level into open answer boxes.  We also made provisions for receiving completed questionnaires at the  TOP SECRET classification level, if needed, via a GAO Joint Worldwide  Intelligence Communications System account, which was established for  us at the DOD Office of the Inspector General.
We sent the original three electronic questionnaires in May and June 2009.  We sent out reminder e-mail messages at different times to all  nonrespondents in order to encourage a higher response rate. In addition,  we made several courtesy telephone calls to nonrespondents to encourage  their completion of the surveys. All questionnaires were returned by  August 2009. In the end, we achieved a 100 percent response rate.
Because this was not a sample survey, but rather a survey of the universe  of respondents, it has no sampling errors. However, the practical  difficulties of conducting any survey may introduce errors, commonly  referred to as nonsampling errors. For example, difficulties in interpreting  a particular question, determining sources of information available to  respondents, or entering data into a database or analyzing them can  introduce unwanted variability into the survey results. We took steps in  developing the questionnaire, collecting the data, and analyzing them to  minimize such nonsampling error.
For example, design methodologists designed the questionnaire in  collaboration with GAO staff who had subject matter expertise. In addition  to an internal expert technical review by GAO’s Survey Coordination  Group, we pretested the survey with U.S. Army, U.S. Navy, and U.S. Air  Force officials representing three most critical asset sites as well as  officials from the Joint Staff (J-34) and ASD(HD&ASA) to ensure that the  questions were relevant, clearly stated, and easy to understand. Since  there were relatively few changes based on the pretests and because we  were conducting surveys with the universe of respondents, we did not find  it necessary to conduct additional pretests. Instead, changes to the content  and format of the questionnaire were made after the pretests based on the  feedback we received.
When we analyzed the data, an independent analyst checked all computer  programs. All data were double keyed during the data entry process, and  GAO staff traced and verified all of the resulting data to ensure accuracy.
To verify and validate the survey recipients’ responses and evaluate in  more detail issues identified in the surveys, we conducted six follow-up  site visits to a nonprobability sample of surveyed assets. We selected the  sites for visits judgmentally based on the survey responses regarding  issues addressed in this report. During these site visits, we spoke with  installation personnel, including asset owners and operators, about their  reliance on supporting electrical infrastructure and electricity providers.  While findings from our site visits are not generalizable to all 34 most  critical assets, we obtained follow-up survey information from installation  personnel for critical assets and visited those assets to validate the survey  responses, as applicable. We clarified responders’ interpretation of the  survey questions, discussed their responses in detail, and visited the  critical assets and their supporting infrastructure to better understand  each asset’s unique situation. Finally, we reviewed documentation and  guidance related to those critical assets, including vulnerability  assessments.
We conducted this performance audit from October 2008 through October  2009 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.
section_title: Appendix II: Typical Electrical Power Vulnerabilities and Remediation Measures
paragraphs: Appendix II: Typical Electrical Power  Vulnerabilities and Remediation Measures Examples of electrical power  vulnerabilities  Both the primary and backup power  supply systems exist in the same  room for convenience of  maintenance.
Implement physical diversity in location of  backup support.
Ensure fire suppression systems support  continued operation of non-affected systems.
Increase security on the location during higher  threat periods.
Single transformer provides both  commercial and backup power to a critical  asset.
Alternate paths that supply electrical  power converge at single component  (i.e., a transformer) and represent  potential point of failure if common  component fails.
Have independent commercial and backup  power paths.
Identify alternate location to relocate critical  operations.
Use portable generations and uninterruptible  power supplies to provide power in case of a  single component failure.
Arrange for immediate emergency  maintenance response to restore the  component capability.
Access to buildings that house  electrical power supplies to critical  assets.
Establish strict access control procedures for  buildings and areas housing important system  components.
Relocate important system components to  secured areas.
Bury electric power lines or protect poles with  anti-ram barriers.
Power lines share right-of-way with other  key utilities.
Bridges, tunnels, and trenches often  involve shared rights-of-way for  electrical power that may contain  other key utilities.
Establish mitigation options, such as backup  power or transferring mission to another  location, based on loss of the right-of-way.
Establish agreements with local community to  increase security or patrols for these locations  during increased threat periods.
Be aware of maintenance or repair activities  for other utilities in these locations.
Generators and uninterruptible power  supplies are not large enough to  support the critical asset in case of  primary power loss or in case the  location does not stockpile sufficient  fuel to support the operational time  frame during an electrical power loss.
Determine critical asset needs and purchase  backup generators accordingly.
Maintain at least minimum operational  requirements for consumables (i.e., fuel).
Distribute critical asset operations to other  backup power supplied locations.
section_title: Appendix III: Survey of DOD Critical Assets
paragraphs: The U.S. Government Accountability Office (GAO) is  an independent, non-partisan legislative branch agency  that assists Congress in evaluating how the federal  government spends taxpayer dollars.  GAO supports the  Congress in meeting its constitutional responsibilities  and to help improve the performance and ensure the  accountability of the federal government for the benefit  of the American people.  GAO provides Congress with  timely information that is objective, fact-based,  nonpartisan, nonideological, fair, and balanced.
You can answer most of the questions easily by  checking boxes or filling in blanks.  A few questions  request narrative answers.  Please note that the space  provided will expand to accommodate your answer.   You may write additional comments at the end of the  survey.  We request that you provide the most recent  information from no earlier than January 1, 2006.
Please use your mouse to navigate throughout the  survey by clicking on the field or check box you wish  to fill in.  Do not use the “Tab” or “Enter” keys as  doing so may cause formatting problems.
To select or deselect a check box, simply click or  double click on the box.
Please enter asset here:              narrative responses by writing (U) for “unclassified”  or (S) for “SECRET” at the beginning of each entry  or paragraph, as appropriate.  Please limit your  responses to Task Critical Asset information  classified no higher than “SECRET” in accordance  with the Defense Critical Infrastructure Program  (DCIP) Security Classification Guide, May 2007.
Since you have been identified as a subject matter expert  for this asset, we ask that you coordinate the completion  of this survey with other officials as necessary and return  one consolidated survey for this asset.
After we receive your reply, we may call you to schedule  a follow-up telephone interview if we need to clarify  some answers in the survey.
To assist us, we ask that you complete and return this  survey by June 5, 2009, via SIPRNet to  ArtadiD@gao.sgov.gov.   Please return the completed  survey by e-mail.  Simply save this file to your classified  computer desktop, hard drive, or disk and attach it to  your e-mail.
Lt Col Norman Worthen  Phone:  (703) 693-7542  SIPRNet:: Norman.Worthen@js.pentagon.smil.mil   Thank you for your help.  1.  Although several people may participate in the completion of this survey, we ask that you  provide contact information below for the person coordinating the completion of the survey  in case we need to follow-up with additional questions.
Name:  Rank:  Title:  Unit Name:   Base/Organization:  Commercial Phone #: (      )       -          E-mail:             SIPRNet:             Section A.  Reliance on Electrical Power  Again, please enter the name of the asset for which this survey is being completed.  2.  Does this asset require electrical power in order to function and support its military  mission(s)?  (Mark  only one response)
Yes   No  SKIP TO QUESTION #62  3.  To what extent does this critical asset require electrical power to function?  (Mark   only one response)
All of the time (continuous/constant)   Most of the time   About half of the time   Less than half of the time   None of the time  No  SKIP TO QUESTION #62  Please explain if necessary:              4.  Does this critical asset require supporting infrastructure, such as water; natural gas;  heating, ventilating, and air conditioning (HVAC); or any other supporting utility to  function?  (Mark  only one response)
Yes   No  SKIP TO QUESTION #6  5.  Does this critical asset’s supporting infrastructure require electrical power to function?   (Mark  only one response)  6.  From what source does this asset generally receive its primary electrical power supply?   (Mark  only one response)
Non-DOD electricity provider(s) or utility(ies) (e.g., the commercial power grid)
Name of provider(s) or utility(ies):               DOD-generated electricity supply based on fossil fuels (e.g., diesel-powered generators)   DOD-generated electricity supply based on solar energy   DOD-generated electricity supply based on geothermal energy   DOD-generated electricity supply based on wind energy   DOD-generated electricity supply based on biomass energy   DOD-generated electricity supply based on nuclear energy  7.  Does this asset rely on an intermediate or transitional uninterruptible power supply  (UPS) (i.e. a battery backup) to provide power in the event of an electrical power  disruption? (Mark  only one response)
Yes  How many minutes is the UPS expected to provide electrical power to the   No  Why not?             8.  Does this asset have a back-up power source, other than UPS, in the event of an  electrical power disruption from any of the following sources?  (Mark  one response  for each row)  a.  Batteries or fuel cells (other than UPS)  b.  Non-DOD electricity provider(s)/utility(ies) (e.g., the commercial power grid)
Name of provider(s) or utility(ies):              c.  DOD-generated electricity supply based on fossil fuels (e.g., diesel-powered  generators)  d.  DOD-generated electricity supply based on solar energy  e.  DOD-generated electricity supply based on geothermal energy  f.  DOD-generated electricity supply based on wind energy  g.  DOD-generated electricity supply based on biomass energy  h.  DOD-generated electricity supply based on nuclear energy  9.  How long, collectively, can back-up electrical power sources identified in question 8  provide electricity to the critical asset?  (Mark  only one response)
Less than 24 hours   Between 1 and 3 days (72 hours)   More than 3 days up to 1 week   Between 1 and 2 weeks   Over 2 weeks   Indefinitely (as long as fuel is available)  10. Do the back-up electrical power sources identified in question 8 involve electrical power  generators?  (Mark  only one response)
Yes   No   SKIP TO QUESTION #25  11. Are back-up generators dedicated to the critical asset or shared with other critical  assets or infrastructure?  (Mark  only one response)
Dedicated to the critical asset   Shared with other critical assets or infrastructure  12. Is the back-up generator(s) sufficient to maintain the critical asset and meet its  mission(s) requirements?
Yes   No   SKIP TO QUESTION #25  13. How many days can these generators function before requiring replenishing energy  supplies (e.g., diesel fuel, natural gas, JP-8, etc.)?  14. How many days would the energy supply that is currently stored at the installation or  location of the critical asset be able to support these generators?  15. How many days can these generators function before requiring preventive  maintenance?  16. How many days can these generators function before requiring corrective maintenance?  17. Do you have another back-up generator that could be utilized while performing  preventive or corrective maintenance on the primary generator?  18. How frequently are the generators identified in question 10 above subject to inspection  and preventive maintenance to ensure that they function as intended?  19. Do you conduct inspections and preventive maintenance to these generators as  prescribed by schedule requirements?  20. How frequently are these generators subject to routine testing to ensure that they  function as intended?  21. What plans, if any, do you have to obtain additional energy supplies for these  generators once currently stocked supplies run out?  22. What size (in terms of electricity production capacity, such as kilowatts) are these  generators?  23. What are the electrical requirements (such as kilowatts) for the critical asset?  24. When was this electrical requirement last validated?             (date)
Section C.  Unplanned Disruptions to Electrical Power  25. How many unplanned disruptions, if any, to this asset’s primary electrical power  sources have occurred between January 1, 2006, and December 31, 2008?  (Mark   only one response)
Zero   1 to 5   6 to 10   More than 10   Unknown  26. When did the disruption(s) occur?  (List date(s) for each disruption)  27. How long did each of these disruptions last?  28. Do you know the cause(s) for each disruption?
Yes   No   SKIP TO QUESTION #31  29. What were the causes of each disruption?  30. What trends, if any, did you identify regarding causes of the disruptions?  31. How, if at all, did the disruption(s) affect the asset’s mission(s)?  32. What actions, if any, did you take to mitigate the impact of the disruption(s) on the  asset’s mission(s)?  33. Is this asset incorporated into its electricity provider’s/utility’s reconstitution or  restoration planning?  (Mark  only one response)  34. Have any cyber or computer-based attacks or probes occurred that have negatively  affected the delivery of electrical power to the asset or its supporting infrastructure?   (Mark  only one response)
Yes   No    SKIP TO QUESTION #37   Unknown  SKIP TO QUESTION #37  35. How did you determine that such cyber or computer-based attacks or probes occurred?   (Mark  only one response)  36. Who did you inform, if anyone, about the cyber or computer-based attacks or probes?   (Mark  only one response)  37. Were any assessments conducted between January 1, 2006, and December 31, 2008,  that specifically examined (1) the vulnerabilities of this asset to electrical power  disruptions and/or (2) the risks of electrical power disruptions to this asset?  (Mark   only one response)
Yes   No   SKIP TO QUESTION #54  38. What organization(s) conducted the assessment(s)?  39. What were the date(s) of the assessment(s)?    40. Did the assessment(s) consider vulnerabilities or risks up to one node (electrical power  substation) nearest to the installation or location of the critical asset (i.e., “one node  beyond the fence”)? (Mark  only one response)  41. Did the assessment(s) consider vulnerabilities or risks beyond one node (electrical  power substation) nearest to the installation or location of the critical asset (i.e., more  than “one node beyond the fence”)? (Mark  only one response)  42. Which of the following vulnerabilities or risks listed below were identified from the  assessments?  (Mark  one response for each row)  a.  The reliability and resiliency of a commercial or DOD  installation’s power grid.  b.  The physical security of commercial and DOD electrical power  infrastructures.  c.  The cyber-security of commercial and DOD electrical power  infrastructures.  d.  The lack of back-up electrical generation capabilities  (maintenance, testing, fuel supplies, etc.).  e.  Single points of failure within commercial/DOD electrical power  infrastructures.   f.  The lack of contingency plans for addressing electrical power  disruptions to critical assets.   g.  Other vulnerability or risk  Please describe:              43. What detail was provided about each vulnerability or risk identified in question #42  above?  44. Were measures proposed or recommended to address or manage these vulnerabilities  or risks? (Mark  only one response)
Yes   No  SKIP TO QUESTION #54  45. What measures were proposed or recommended to address or manage these  vulnerabilities or risks?    46. At what level within DOD was the decision made to implement the recommended  measure(s) or not implement the measure(s) and accept the risks?  47. What criteria, if any, were used in determining which measure(s) would be taken to  address, manage, or accept vulnerabilities or risks (e.g., asset criticality, costs, staffing,  technology, funding availability, time constraints, prior Base Realignment and Closure  decisions, etc.)?  48. Was the decision made to implement the recommended measure(s) or not implement  the measure(s) and accept the vulnerabilities or risks?
Yes, implement recommended measure(s)   No, decided not to implement the recommended measure(s) and accept the vulnerabilities  49. Were measures selected for implementation?
Yes   No  SKIP TO QUESTION #54  50. What were the estimated costs for implementing these measures?  51. Have these measures been implemented, scheduled for implementation, or not  scheduled for implementation at this time?  (Mark  for all that apply).
Been implemented   Please identify measure(s):               Been scheduled for implementation   Please identify measure(s):               Not scheduled for implementation at this time  Please identify measure(s):              52. Which DOD major budget category was (or is being) used to implement these  measures?  (Mark  for all that apply).
Operations and Maintenance   Military Personnel   Procurement   Research and Development   Other (Please specify)              Unknown  53. What DoD organizational level implemented (or is implementing) these measures?   (Mark  for all that apply).
Host installation   Higher headquarters   Major command   Combatant command   Other (Please specify)              Unknown  Section F.  Coordination with Other Entities  54.  Is this asset located within the United States?
Yes   No  SKIP TO QUESTION #57  55. To what extent, if at all, did you or the host installation of this asset coordinate with  U.S. electricity provider(s) to identify or address potential vulnerabilities or risks  identified in question 42 above? (Mark  only one response)
Not at all  SKIP TO QUESTION #62   Some extent   Moderate extent   Great extent  56. What was the nature of the coordination with U.S. electricity providers?  57. Is this asset located outside the United States?
Yes   No  SKIP TO QUESTION #62  58. Have there been any efforts to coordinate with host-nation governments and/or foreign- owned electricity providers to identify or address potential vulnerabilities or risks  identified in question #40 above?
Yes   No  SKIP TO QUESTION #62   Unknown  SKIP TO QUESTION #62  59. What was the nature of the coordination with the host-nation governments and/or  foreign-owned electricity provider(s)?  60. Did you or the host installation of this asset coordinate with any other organizations or  entities (other than U.S. electricity providers or host-nation governments and/or  foreign-owned electricity provider(s)) to identify or address potential vulnerabilities or  risks? (Mark  only one response)
Yes   No- SKIP TO QUESTION #62  61. With whom did you or the host installation of this asset coordinate?  62. Please provide any additional information about efforts to identify, assess, or address  the vulnerabilities and risks associated with electrical power disruptions to this asset  that may not have been addressed through the previous questions.
section_title: Appendix IV: Survey of DOD Critical Asset Missions
paragraphs: The U.S. Government Accountability Office (GAO) is  an independent, non-partisan legislative branch agency  that assists Congress in evaluating how the federal  government spends taxpayer dollars.  GAO supports the  Congress in meeting its constitutional responsibilities  and to help improve the performance and ensure the  accountability of the federal government for the benefit  of the American people.  GAO provides Congress with  timely information that is objective, fact-based,  nonpartisan, nonideological, fair, and balanced.
You can answer most of the questions easily by  checking boxes or filling in blanks.  A few questions  request narrative answers.  Please note that the space  provided will expand to accommodate your answer.   You may write additional comments at the end of the  survey.  We request that you provide the most recent  information from no earlier than January 1, 2006.
In response to a congressional mandate in the House  Report on the National Defense Authorization Act for  Fiscal Year 2009, Title XXVIII, Defense Critical  Infrastructure Program, Report 110-652 (May 16, 2008),  GAO is conducting a review of the Assurance of  Electrical Power Supplies to DOD Critical Assets (GAO  code 351266).  The following critical asset was selected  for this survey: survey by clicking on the field or check box you  wish to fill in.  Do not use the “Tab” or “Enter”  keys as doing so may cause formatting problems.
To select or deselect a check box, simply click or  double click on the box.
Please enter asset here:             Since the Joint Staff (J-34) has agreed to respond to the  mission-related questions for this asset, we ask that the  Joint Staff (J-34) coordinate the completion of this  survey with other officials as necessary and return one  consolidated survey for this asset. narrative responses by writing (U) for  “unclassified,” (S) for “SECRET,” or (TS) for TOP  SECRET at the beginning of each entry or  paragraph, as appropriate.  However, please try to  limit your responses to Task Critical Asset  information classified no higher than “SECRET” in  accordance with the Defense Critical Infrastructure  Program (DCIP) Security Classification Guide, May  2007.
After we receive your reply, we may call you to schedule  a follow-up telephone interview if we need to clarify  some answers in the survey.
Thanks in advance for taking the time to complete this  survey.  If you have any questions about the survey,  please contact:  David Artadi, GAO Analyst-in-Charge  Phone:  (404) 679-1989   SIPRNet:  ArtadiD@gao.sgov.gov.
To assist us, we ask that you complete and return this  survey by June 26, 2009, to David Artadi via SIPRNet  at ArtadiD@gao.sgov.gov or to Mark Pross via JWICS  at igproma@dodig.ic.gov, as appropriate.  Please return  the completed survey by e-mail.  Simply save this file to  your classified computer desktop, hard drive, or disk and  attach it to your e-mail.
Thank you for your help.
Again, please enter the name of the asset for which this survey is being completed.  1.  Within which DCIP defense sector(s), as identified in DOD Directive 3020.40, Defense  Critical Infrastructure Program (DCIP), is this asset? (Mark  all that apply.)
Defense Industrial Base (DIB)   Financial Services   Global Information Grid (GIG)   Health Affairs   Intelligence, Surveillance, and Reconnaissance (ISR)   Logistics   Personnel   Public Works   Space   Transportation   Unknown  2.  Where is this asset physically located? (Mark  only one response)
At a military installation   please specify name of installation:              At a commercial facility   please specify name of facility:              At an industrial site   At a stand-alone facility   please specify name of facility:              please specify name of industrial site:             3.  What is the nearest city (and U.S. state or country) to this installation, facility, or site?  a.  City:              b.  State (only if in the U.S.):              c.  Country (only if outside the U.S.):             4.  Who owns the asset? (Mark  only one response)
DOD military service   DOD combatant command   Other DOD organization     Other (non-DOD) U.S. government organization   please specify:              please specify:              please specify:                   (federal, state, or local)   please specify:              U.S. private organization     Foreign military organization   please specify:              Foreign government (nonmilitary) please specify:              please specify:              Foreign private company     Other    5.  Who primarily operates the asset during normal operational status? (Mark  all that  apply.)
DOD military department    DOD combatant command   Other DOD organization     Other (non-DOD) U.S. government organization   please specify:              please specify:              please specify:                  (federal, state, or local)   please specify:              U.S. private organization     please specify:              Foreign military  Foreign government (nonmilitary) please specify:              please specify:              Foreign private company     Other    Section B.  Mission(s), Combatant Command(s), and Military Service(s) Supported by  Asset  6.  Which military mission(s) does this asset support within DOD during normal  operational status other than those missions already described in the document that the  Joint Staff (J-34) provided to GAO about the surveyed assets on November 19, 2008?   (Please list and describe the mission(s) based on the “mission impact statements” and  “mission essential tasks”—as defined in DOD Manual 3020.45, Vol. I, DOD Critical Asset  Identification Process (Oct. 24, 2008)—that were used to designate this asset at its current  DCIP critical asset classification.)  7.  For the military missions identified in question #6, which DOD Unified Combatant  Command(s) with regional responsibilities, if any, does this asset support?  (Mark  all  that apply)
United States Africa Command (USAFRICOM)   United States Central Command (USCENTCOM)   United States European Command (USEUCOM)   United States Northern Command (USNORTHCOM)   United States Pacific Command (USPACOM)   United States Southern Command (USSOUTHCOM)  8.  For the military missions identified in question #6, which DOD Unified Combatant  Command(s) with functional responsibilities, if any, does this asset support? (Mark   all that apply)
United States Joint Forces Command (USJFCOM)   United States Special Operations Command (USSOCOM)   United States Strategic Command (USSTRATCOM)   United States Transportation Command (USTRANSCOM)  9.  For the military missions identified in question #6, which DOD military service(s), if  any, does this asset support? (Mark  all that apply)
United States Army   United States Air Force   United States Navy   United States Marine Corps  10. For the military missions identified in question #6, which other DOD agencies or  organizations, if any, does this asset support?  11. Which non-DOD mission(s), if any, does this asset support during normal operational  status?  (Please include the names of the non-DOD organizations whose missions are  supported by the asset.)  12. Please provide any additional information regarding the missions, combatant  commands, and military services supported by the asset that may not have been  addressed through the previous questions.
section_title: Appendix V: Survey of Coordination Efforts for DOD Critical Assets
paragraphs: The U.S. Government Accountability Office (GAO) is  an independent, non-partisan legislative branch agency  that assists Congress in evaluating how the federal  government spends taxpayer dollars.  GAO supports the  Congress in meeting its constitutional responsibilities  and to help improve the performance and ensure the  accountability of the federal government for the benefit  of the American people.  GAO provides Congress with  timely information that is objective, fact-based,  nonpartisan, nonideological, fair, and balanced.
You can answer most of the questions easily by  checking boxes or filling in blanks.  A few questions  request narrative answers.  Please note that the space  provided will expand to accommodate your answer.   You may write additional comments at the end of the  survey.  We request that you provide the most recent  information from no earlier than January 1, 2006.
Please use your mouse to navigate throughout the  survey by clicking on the field or check box you  wish to fill in.  Do not use the “Tab” or “Enter”  keys as doing so may cause formatting problems.
To select or deselect a check box, simply click or  double click on the box.
Please enter asset here:             Since ASD(HD&ASA)/DCIP Office has agreed to  respond to the coordination-related questions for this  asset, we ask that ASD(HD&ASA)/DCIP Office  coordinate the completion of this survey with other  officials as necessary and return one consolidated survey  for this asset. narrative responses by writing (U) for  “unclassified,” (S) for “SECRET,” or (TS) for TOP  SECRET at the beginning of each entry or  paragraph, as appropriate.  However, please try to  limit your responses to Task Critical Asset  information classified no higher than “SECRET” in  accordance with the Defense Critical Infrastructure  Program (DCIP) Security Classification Guide, May  2007.
After we receive your reply, we may call you to schedule  a follow-up telephone interview if we need to clarify  some answers in the survey.
David Artadi, GAO Analyst-in-Charge  Phone:  (404) 679-1989   SIPRNet:  ArtadiD@gao.sgov.gov.
To assist us, we ask that you complete and return this  survey by June 26, 2009, to David Artadi via SIPRNet  at ArtadiD@gao.sgov.gov or to Mark Pross via JWICS  at igproma@dodig.ic.gov, as appropriate.  Please return  the completed survey by e-mail.  Simply save this file to  your classified computer desktop, hard drive, or disk and  attach it to your e-mail.
Thank you for your help.
Section A.  Coordination with DOD DCIP Stakeholders  Again, please enter the name of the asset for which this survey is being completed.  1.  To what extent has coordination taken place between the owner/custodian/operator of  this asset with the following DOD DCIP stakeholders to identify and/or address  potential vulnerabilities or risks involving electrical power disruptions?  (Mark  one  response for each row)  a.  Military service(s)   (Specify service(s):           )  b.  Combatant command(s)  (Specify command(s):           )  c.  Defense Infrastructure Sector Lead Agent(s)  (Specify Agent(s):           )  d.  ASD(HD&ASA)/DCIP Office  e.  Joint Staff (J-34)  f.  Mission Assurance Division/Dahlgren, VA  g.  Defense Threat Reduction Agency (DTRA)  h.  Other DOD DCIP stakeholder(s) (Specify other  stakeholder(s):            )
NOTE:  If you answered “Not At All” to Question #1, skip to Question #4.  Otherwise,  continue to Question #2.  2.  What was the nature of the coordination with these DOD DCIP stakeholders?  3.  What impact, if any, did this coordination with these DOD DCIP stakeholders have on  identifying and/or addressing potential vulnerabilities or risks to the asset?
Section B.  Coordination with Non-DOD Entities  4.  To what extent has coordination taken place between DOD stakeholders and the U.S.  Department of Homeland Security to identify and/or address potential vulnerabilities  or risks involving electrical power disruptions to the asset?
Not at all  SKIP TO QUESTION #8   Some extent   Moderate extent   Great extent  5.  Which DOD stakeholder(s) were involved in these coordination efforts with the U.S.
Department of Homeland Security?  6.  What was the nature of the coordination with the U.S. Department of Homeland  Security?  7.  What impact, if any, did this coordination with the U.S. Department of Homeland  Security have on identifying and/or addressing potential vulnerabilities or risks  involving electrical power disruptions to the asset?  8.  To what extent has coordination taken place between DOD stakeholders and the U.S.
Department of Energy to identify and/or address potential vulnerabilities or risks  involving electrical power disruptions to the asset?
Not at all  (Skip to question #12.)   Some extent   Moderate extent   Great extent  9.  Which DOD stakeholder(s) were involved in these coordination efforts with the U.S.
Department of Energy?  10. What was the nature of the coordination with the U.S. Department of Energy?  11. What impact, if any, did this coordination with the U.S. Department of Energy have on  identifying and/or addressing potential vulnerabilities or risks to the asset?  12. To what extent has coordination taken place between DOD stakeholders and the U.S.  Federal Energy Regulatory Commission (FERC) to identify and/or address potential  vulnerabilities or risks involving electrical power disruptions to the asset?
Not at all   SKIP TO QUESTION #16   Some extent   Moderate extent   Great extent  13. Which DOD stakeholder(s) were involved in these coordination efforts with the FERC?  14. What was the nature of the coordination with the FERC?  15. What impact, if any, did this coordination with the FERC have on identifying and/or  addressing potential vulnerabilities or risks to the asset?  16. To what extent has coordination taken place between DOD stakeholders and the North  American Electric Reliability Corporation (NERC) to identify and/or address potential  vulnerabilities or risks involving electrical power disruptions to the asset?
Not at all  SKIP TO QUESTION #20   Some extent   Moderate extent   Great extent  17. Which DOD stakeholder(s) were involved in these coordination efforts with the NERC?  18. What was the nature of the coordination with the NERC?  19. What impact, if any, did this coordination with the NERC have on identifying and/or  addressing potential vulnerabilities or risks to the asset?  20. To what extent has coordination taken place between DOD stakeholders and DOE  national laboratories to identify and/or address potential vulnerabilities or risks  involving electrical power disruptions to the asset?
Not at all  SKIP TO QUESTION #24   Some extent  (Specify laboratory(ies):           )   Moderate extent  (Specify laboratory(ies):           )   Great extent  (Specify laboratory(ies):           )  21. Which DOD stakeholder(s) were involved in these coordination efforts with DOE  national laboratories?  22. What was the nature of the coordination with DOE national laboratories?  23. What impact, if any, did this coordination with DOE national laboratories have on  identifying and/or addressing potential vulnerabilities or risks to the asset?  24. To what extent has coordination taken place between DOD stakeholders and the U.S.
Department of State to identify and/or address potential vulnerabilities or risks  involving electrical power disruptions to the asset?
Not at all  SKIP TO QUESTION #28   Some extent   Moderate extent   Great extent  25. Which DOD stakeholder(s) were involved in these coordination efforts with the U.S.
Department of State?  26. What was the nature of the coordination with the U.S. Department of State?  27. What impact, if any, did this coordination with the U.S. Department of State have on  identifying and/or addressing potential vulnerabilities or risks to the asset?  28. To what extent has coordination taken place between DOD stakeholders and electrical  power industry associations to identify and/or address potential vulnerabilities or risks  involving electrical power disruptions to the asset?
Not at all   SKIP TO QUESTION #32   Some extent   (Specify association(s):          )    Moderate extent    (Specify association(s):           )   Great extent   (Specify association(s):          )   29. Which DOD stakeholder(s) were involved in these coordination efforts with electrical  power industry associations?  30. What was the nature of the coordination with electrical power industry associations?  31. What impact, if any, did this coordination have on identifying and/or addressing  potential vulnerabilities or risks to the asset?  32. To what extent has coordination taken place between DOD stakeholders and any other  organizations not mentioned above to identify and/or address potential vulnerabilities  or risks involving electrical power disruptions to the asset?
Not at all   SKIP TO QUESTION #26   Some extent   (Specify other organization(s):           )   Moderate extent   (Specify other organization(s):           )   Great extent   (Specify other organization(s):           )  33. Which DOD stakeholder(s) were involved in these coordination efforts with these other  organizations?  34. What was the nature of the coordination with these other organizations?  35. What impact, if any, did this coordination with these other organizations have on  identifying and/or addressing potential vulnerabilities or risks to the asset?  36. Please provide any additional information regarding coordination with DOD or non- DOD organizations to identify and/or address potential vulnerabilities or risks  involving electrical power disruptions to the asset that may not have been addressed  through the previous questions.
section_title: Appendix VI: Comments from the Department of Defense
section_title: Appendix VII: GAO Contact and Staff Acknowledgments
subsections: section_title: Acknowledgments
paragraphs: In addition to the contact named above, Mark A. Pross, Assistant Director;  David G. Artadi; James D. Ashley; Yecenia C. Camarillo; Gina M. Flacco;  Brian K. Howell; Katherine S. Lenane; Greg A. Marchand; Michael S. Pose;  Terry L. Richardson; John W. Van Schaik; Marc J. Schwartz; and Cheryl A.  Weissman made key contributions to this report.
section_title: Related GAO Products
paragraphs: Defense Critical Infrastructure: Actions Needed to Improve the  Consistency, Reliability, and Usefulness of DOD’s Tier 1 Task Critical  Asset List. GAO-09-740R. Washington, D.C.: July 17, 2009.
Defense Critical Infrastructure: Developing Training Standards and an  Awareness of Existing Expertise Would Help DOD Assure the  Availability of Critical Infrastructure. GAO-09-42. Washington, D.C.:  October 30, 2008.
Defense Critical Infrastructure: Adherence to Guidance Would Improve  DOD’s Approach to Identifying and Assuring the Availability of Critical  Transportation Assets. GAO-08-851. Washington, D.C.: August 15, 2008.
Defense Critical Infrastructure: DOD’s Risk Analysis of Its Critical  Infrastructure Omits Highly Sensitive Assets. GAO-08-373R. Washington,  D.C.: April 2, 2008.
Defense Infrastructure: Management Actions Needed to Ensure  Effectiveness of DOD’s Risk Management Approach for the Defense  Industrial Base. GAO-07-1077. Washington, D.C.: August 31, 2007.
Defense Infrastructure: Actions Needed to Guide DOD’s Efforts to  Identify, Prioritize, and Assess Its Critical Infrastructure. GAO-07-461.  Washington, D.C.: May 24, 2007.
subsections: section_title: Critical Infrastructure Protection
paragraphs: The Department of Homeland Security’s (DHS) Critical Infrastructure  Protection Cost-Benefit Report. GAO-09-654R. Washington, D.C.: June 26,  2009.
Influenza Pandemic: Opportunities Exist to Address Critical  Infrastructure Protection Challenges That Require Federal and Private  Sector Coordination. GAO-08-36. Washington, D.C.: October 31, 2007.
Critical Infrastructure: Sector Plans Complete and Sector Councils  Evolving. GAO-07-1075T. Washington, D.C.: July 12, 2007.
Critical Infrastructure Protection: Sector Plans and Sector Councils  Continue to Evolve. GAO-07-706R. Washington, D.C.: July 10, 2007.
Critical Infrastructure: Challenges Remain in Protecting Key Sectors.  GAO-07-626T. Washington, D.C.: March 20, 2007.
Critical Infrastructure Protection: Progress Coordinating Government  and Private Sector Efforts Varies by Sectors’ Characteristics. GAO-07-39.  Washington, D.C.: October 16, 2006.
Critical Infrastructure Protection: Challenges for Selected Agencies and  Industry Sectors. GAO-03-233. Washington, D.C.: February 28, 2003.
Critical Infrastructure Protection: Commercial Satellite Security Should  Be More Fully Addressed. GAO-02-781. Washington, D.C.: August 30, 2002.
section_title: Electrical Power
paragraphs: Electricity Restructuring: FERC Could Take Additional Steps to Analyze  Regional Transmission Organizations’ Benefits and Performance.  GAO-08-987. Washington, D.C.: September 22, 2008.
Department of Energy, Federal Energy Regulatory Commission:  Mandatory Reliability Standards for Critical Infrastructure Protection.  GAO-08-493R. Washington, D.C.: February 21, 2008.
Electricity Restructuring: Key Challenges Remain. GAO-06-237.  Washington, D.C.: November 15, 2005.
Meeting Energy Demand in the 21st Century: Many Challenges and Key  Questions. GAO-05-414T. Washington, D.C.: March 16, 2005.
Electricity Restructuring: Action Needed to Address Emerging Gaps in  Federal Information Collection. GAO-03-586. Washington, D.C.: June 30,  2003.
Restructured Electricity Markets: Three States’ Experiences in Adding  Generating Capacity. GAO-02-427. Washington, D.C.: May 24, 2002.
Energy Markets: Results of FERC Outage Study and Other Market Power  Studies. GAO-01-1019T. Washington, D.C.: August 2, 2001.
section_title: Cybersecurity
paragraphs: Cybersecurity: Continued Federal Efforts Are Needed to Protect Critical  Systems and Information. GAO-09-835T. Washington, D.C.: June 25, 2009.
Information Security: Cyber Threats and Vulnerabilities Place Federal  Systems at Risk. GAO-09-661T. Washington, D.C.: May 5, 2009.
National Cybersecurity Strategy: Key Improvements Are Needed to  Strengthen the Nation’s Posture. GAO-09-432T. Washington, D.C.:   March 10, 2009.
Critical Infrastructure Protection: DHS Needs to Better Address Its  Cybersecurity Responsibilities. GAO-08-1157T. Washington, D.C.:  September 16, 2008.
Critical Infrastructure Protection: DHS Needs to Fully Address Lessons  Learned from Its First Cyber Storm Exercise. GAO-08-825. Washington,  D.C.: September 9, 2008.
Cyber Analysis and Warning: DHS Faces Challenges in Establishing a  Comprehensive National Capability. GAO-08-588. Washington, D.C.:   July 31, 2008.
Critical Infrastructure Protection: Further Efforts Needed to Integrate  Planning for and Response to Disruptions on Converged Voice and Data  Networks. GAO-08-607. Washington, D.C.: June 26, 2008.
Information Security: TVA Needs to Address Weaknesses in Control  Systems and Networks. GAO-08-526. Washington, D.C.: May 21, 2008.
Critical Infrastructure Protection: Sector-Specific Plans’ Coverage of Key  Cyber Security Elements Varies. GAO-08-64T. Washington, D.C.:   October 31, 2007.
Critical Infrastructure Protection: Sector-Specific Plans’ Coverage of Key  Cyber Security Elements Varies. GAO-08-113. Washington, D.C.:   October 31, 2007.
Critical Infrastructure Protection: Multiple Efforts to Secure Control  Systems Are Under Way, but Challenges Remain. GAO-07-1036.  Washington, D.C.: September 10, 2007.
Critical Infrastructure Protection: DHS Leadership Needed to Enhance  Cybersecurity. GAO-06-1087T. Washington, D.C.: September 13, 2006.
Critical Infrastructure Protection: Challenges in Addressing  Cybersecurity. GAO-05-827T. Washington, D.C.: July 19, 2005.
Critical Infrastructure Protection: Department of Homeland Security  Faces Challenges in Fulfilling Cybersecurity Responsibilities.  GAO-05-434. Washington, D.C.: May 26, 2005.
Critical Infrastructure Protection: Improving Information Sharing with  Infrastructure Sectors. GAO-04-780. Washington, D.C.: July 9, 2004.
Technology Assessment: Cybersecurity for Critical Infrastructure  Protection. GAO-04-321. Washington, D.C.: May 28, 2004.
Critical Infrastructure Protection: Establishing Effective Information  Sharing with Infrastructure Sectors. GAO-04-699T. Washington, D.C.:  April 21, 2004.
Critical Infrastructure Protection: Challenges and Efforts to Secure  Control Systems. GAO-04-628T. Washington, D.C.: March 30, 2004.
Critical Infrastructure Protection: Challenges and Efforts to Secure  Control Systems. GAO-04-354. Washington, D.C.: March 15, 2004.
Posthearing Questions from the September 17, 2003, Hearing on  “Implications of Power Blackouts for the Nation’s Cybersecurity and  Critical Infrastructure Protection: The Electric Grid, Critical  Interdependencies, Vulnerabilities, and Readiness.” GAO-04-300R.  Washington, D.C.: December 8, 2003.
Critical Infrastructure Protection: Challenges in Securing Control  Systems. GAO-04-140T. Washington, D.C.: October 1, 2003.
Combating Terrorism: Observations on National Strategies Related to  Terrorism. GAO-03-519T. Washington, D.C.: March 3, 2003.
Critical Infrastructure Protection: Efforts of the Financial Services  Sector to Address Cyber Threats. GAO-03-173. Washington, D.C.: January  30, 2003.
High-Risk Series: Protecting Information Systems Supporting the  Federal Government and the Nation’s Critical Infrastructures.  GAO-03-121. Washington, D.C.: January 2003.
Critical Infrastructure Protection: Significant Challenges Need to Be  Addressed.  GAO-02-961T. Washington, D.C.: July 24, 2002.
Critical Infrastructure Protection: Federal Efforts Require a More  Coordinated and Comprehensive Approach for Protecting Information  Systems. GAO-02-474. Washington, D.C.: July 15, 2002.
Critical Infrastructure Protection: Significant Homeland Security  Challenges Need to Be Addressed. GAO-02-918T. Washington, D.C.: July 9,  2002.
Critical Infrastructure Protection: Significant Challenges in  Safeguarding Government and Privately Controlled Systems from  Computer-Based Attacks. GAO-01-1168T. Washington, D.C.: September 26,  2001.
Critical Infrastructure Protection: Significant Challenges in Protecting  Federal Systems and Developing Analysis and Warning Capabilities.  GAO-01-1132T. Washington, D.C.: September 12, 2001.
Critical Infrastructure Protection: Significant Challenges in Developing  Analysis, Warning, and Response Capabilities. GAO-01-1005T.  Washington, D.C.: July 25, 2001.
Critical Infrastructure Protection: Significant Challenges in Developing  Analysis, Warning, and Response Capabilities. GAO-01-769T.  Washington, D.C.: May 22, 2001.
Critical Infrastructure Protection: Significant Challenges in Developing  National Capabilities. GAO-01-323. Washington, D.C.: April 25, 2001.
Critical Infrastructure Protection: Challenges to Building a  Comprehensive Strategy for Information Sharing and Coordination.  GAO/T-AIMD-00-268. Washington, D.C.: July 26, 2000.
Critical Infrastructure Protection: Comments on the Proposed Cyber  Security Information Act of 2000. GAO/T-AIMD-00-229. Washington, D.C.:  June 22, 2000.
Critical Infrastructure Protection: “ILOVEYOU” Computer Virus  Highlights Need for Improved Alert and Coordination Capabilities.  GAO/T-AIMD-00-181. Washington, D.C.: May 18, 2000.
Critical Infrastructure Protection: National Plan for Information  Systems Protection. GAO/AIMD-00-90R. Washington, D.C.: February 11,  2000.
Critical Infrastructure Protection: Comments on the National Plan for  Information Systems Protection. GAO/T-AIMD-00-72. Washington, D.C.:  February 1, 2000.
Critical Infrastructure Protection: Fundamental Improvements Needed  to Assure Security of Federal Operations. GAO/T-AIMD-00-7. Washington,  D.C.: October 6, 1999.
Critical Infrastructure Protection: Comprehensive Strategy Can Draw  on Year 2000 Experiences. GAO/AIMD-00-1. Washington, D.C.: October 1,  1999.