Defense Nuclear Enterprise: Processes to Monitor Progress on Implementing Recommendations and Managing Risks Could Be Improved
Released: 2017-10-05T00:00:00


Highlights: section_title: Why GAO Did This Study
paragraphs: In 2014, the Secretary of Defense directed two reviews of DOD's nuclear enterprise. These reviews identified problems with leadership, organization, investment, morale, policy, and procedures, as well as other shortcomings that adversely affected the nuclear deterrence mission. The reviews also made recommendations to address these problems. In 2015, DOD conducted a review focused on NC3 systems, which resulted in additional recommendations.

The National Defense Authorization Act for Fiscal Year 2017 includes a provision for GAO to review DOD's processes for addressing these recommendations, and House Report 114-537 includes a provision for GAO to review changes to DOD's nuclear personnel reliability assurance programs. This report addresses the extent to which DOD and the military services have (1) made progress in implementing recommendations to improve the nuclear enterprise and (2) made changes to their personnel reliability assurance programs. GAO reviewed relevant documents and interviewed agency officials from DOD and the military services. This is a public version of a classified report GAO issued in August 2017. It omits information DOD deemed classified.

section_title: What GAO Found
paragraphs: The Department of Defense (DOD) has made progress in implementing the recommendations from the 2014 nuclear enterprise reviews and the 2015 nuclear command, control, and communications (NC3) systems report.

In December 2016, the Office of Cost Assessment and Program Evaluation (CAPE) provided the military services with guidance that emphasizes using performance measures and milestones to evaluate progress to aid them in tracking and analyzing their implementation of the recommendations from the 2014 nuclear enterprise reviews. However, CAPE's guidance does not require the military services and other DOD components to identify and document risks as part of its recommendation tracking processes. As a result, DOD does not consistently identify and document risks, and it may not be identifying and communicating potential risks related to the nuclear enterprise. One of the 2014 nuclear enterprise reviews found that the avoidance of managing risks by many leaders within the enterprise adversely affected the mission. Developing additional guidance on identifying and documenting risks could enhance DOD's ability to provide oversight of its efforts to monitor progress and make informed responses to address any identified risks.

For recommendations made in the 2015 NC3 report, DOD's Office of the Chief Information Officer (DOD CIO) uses an internal spreadsheet to track implementation but has not yet identified performance measures, milestones, or risks. DOD CIO has drafted a template that, once it has been approved and implemented, will provide a form that could be used for documenting performance measures, milestones, and risks. By identifying and communicating this information, DOD CIO could improve its efforts to track the progress of DOD's actions, evaluate their effects, and formulate responses to risks.

DOD and the military services have implemented changes to their personnel reliability assurance programs in response to recommendations from the 2014 nuclear enterprise reviews. These programs are intended to ensure that DOD personnel who work with nuclear weapons and nuclear weapons systems, NC3 systems and equipment, and special nuclear material are trustworthy, reliable, and capable of performing their assigned nuclear weapons-related mission. The 2014 nuclear enterprise reviews found that these personnel reliability assurance programs were overly complex and administratively burdensome and that frequent and intrusive inspections left nuclear units more focused on preparing for and responding to inspections than on ensuring personnel reliability. DOD and the services have updated their guidance for personnel reliability assurance programs, including focusing on nine essential elements of reliability. For example, the Air Force has incorporated these elements into the standards it uses for its security forces. Additionally, the Air Force has centralized some of its administrative processes, and the Joint Staff has updated inspection procedures in a way that may ease the burden on personnel being inspected.

section_title: What GAO Recommends
paragraphs: DOD should develop additional guidance on identifying and documenting risks, and should identify and communicate performance measures and risks. DOD concurred and provided information about planned actions to implement them.

section_title: Letter
paragraphs: In 2014, as a response to incidents involving the nation’s nuclear  deterrent forces and their senior leadership, the Secretary of Defense  directed both an internal Department of Defense (DOD) review and an  independent review of the DOD nuclear enterprise. The DOD nuclear  enterprise includes Air Force Intercontinental Ballistic Missiles; Air Force  nuclear-capable bombers and tactical fighters; Navy ballistic missile  submarines; and the supporting infrastructure to build, maintain, and  control these assets. The two reviews examined DOD’s nuclear deterrent  mission, and the resulting reports—Internal Assessment of the  Department of Defense Nuclear Enterprise and Independent Review of  the Department of Defense Nuclear Enterprise—identified problems with  leadership, organization, investment, morale, policy, and procedures, as  well as other shortcomings that were adversely affecting the mission.  The Commander of U.S. Strategic Command also identified some  additional areas for improvement in a memorandum. Together, the two  nuclear enterprise review reports and the Strategic Command  Commander’s memorandum (hereafter referred to collectively as the  2014 nuclear enterprise reviews) included recommendations to address  DOD’s management of nuclear personnel, security requirements for  nuclear weapons, and the availability of key equipment and support parts,  among other issues. In 2015, DOD conducted a review focused on  nuclear command, control, and communications (NC3) systems, which  resulted in an additional report with recommendations (hereafter referred  to as the 2015 NC3 report).

The National Defense Authorization Act for Fiscal Year 2017 includes a  provision for us to review—during each of fiscal years 2017 through  2021—DOD’s processes for addressing the recommendations of the two  nuclear enterprise reviews and other assessments of the nuclear  enterprise, including the 2015 NC3 report, and to provide a briefing to the congressional defense committees on the results of our review. In July  2016, we reported that the process DOD had developed for tracking the  2014 reviews’ recommendations generally appeared consistent with  relevant criteria from the Standards for Internal Control in the Federal  Government—including using and effectively communicating quality  information and performing monitoring activities. Additionally, the House  Armed Services Committee report accompanying a bill for the National  Defense Authorization Act for Fiscal Year 2017 includes a provision for us  to review matters related to the changes that DOD and the military  services have made to their nuclear personnel reliability assurance  policies and implementing programs. This includes information on (1) the  Air Force’s shift away from using the Personnel Reliability Program as its  sole nuclear personnel reliability assurance program and toward using  Arming and Use of Force as a second personnel reliability assurance  program for its security forces and (2) the Navy’s continued use of the  Personnel Reliability Program as its sole personnel reliability assurance  program.

This report evaluates the extent to which DOD and the military services  have  1.  made progress in implementing recommendations to improve the  nuclear enterprise, identified performance measures and milestones  to track the progress of its implementation actions, and identified  associated risks and  2.  made changes to their personnel reliability assurance programs to  address the personnel reliability recommendations from the nuclear  enterprise reviews, and the effects of any such changes.

This report is a public version of a classified report that we issued in  August 2017. The Department of Defense deemed some of the  information in our August report to be classified, which must be protected  from loss, compromise, or inadvertent disclosure. Therefore, this report  omits classified information about some findings from DOD’s classified  nuclear enterprise review reports. Although the information provided in  this report is more limited, the report addresses the same objectives as  the classified report and uses the same methodology.

To evaluate the extent to which DOD and the military services have made  progress in implementing recommendations to improve the nuclear  enterprise, identified performance measures and milestones to track the  progress of its implementation actions, and identified associated risks, we  reviewed documents that establish the recommendations, including the  internal and independent nuclear enterprise reviews, U.S. Strategic  Command’s action plan, and the 2015 NC3 report; guidance such as the  Secretary of Defense’s memo (Nuclear Enterprise Review Corrective  Action Implementation); and additional documents from the Office of Cost  Assessment and Program Evaluation (CAPE), Office of the Chief  Information Officer (CIO), and the military services that outline their  processes for implementing, tracking, and evaluating the implementation  of the recommendations to improve the defense nuclear enterprise. We  compared these processes to relevant criteria from Standards for Internal  Control in the Federal Government—including assessing and responding  to risk, using and effectively communicating quality information, and  performing monitoring activities.

To evaluate the extent to which DOD and the military services have made  changes to their personnel reliability assurance programs to address the  personnel reliability recommendations from the nuclear enterprise  reviews, and the effects of any such changes, we reviewed the personnel  reliability assurance program requirements for DOD personnel in the  Navy, the Army, the Air Force, the Marine Corps, and DOD guidance and  other documents. We then compared these requirements to those in  prior DOD documents and service-specific guidance. We conducted  interviews with officials involved in overseeing and implementing the  department’s and the services’ nuclear personnel reliability assurance  programs. We also reviewed training documents, reports, and other  documents that DOD and the services used to implement changes to  their personnel reliability assurance programs and to educate their  personnel on these changes.

We interviewed officials from the following offices to discuss progress in  implementing the recommendations to improve the nuclear enterprise,  including changes to personnel reliability assurance programs:

Office of the Assistant Secretary of Defense for Nuclear, Chemical,  and Biological Defense Programs (Nuclear Matters)

Defense Threat Reduction Agency

Secretary of the Air Force, Office of the Inspector General

Air Force Headquarters: Manpower, Personnel, and Services (A1),  Security Forces (A4S), and Strategic Deterrence and Nuclear  Integration (A10)

Air Force Global Strike Command

Air Force Inspection Agency

Air Force Personnel Center

Air Force Personnel Reliability Program Administrative Qualification

90th Missile Wing, F.E. Warren Air Force Base

11th Security Forces Group, Joint Base Andrews

628th Security Forces Squadron, Joint Base Charleston

Deputy Under Secretary of the Navy for Policy

Chief of Naval Operations: Nuclear Policy (N514) and Undersea  Warfare (N97)

Marine Corps Headquarters: Plans, Policies, and Operations-Security

Navy Strategic Systems Programs

Department of the Army Headquarters, Operations, Plans, and  Training (G3/5/7)

U.S. Army Nuclear and Countering Weapons of Mass Destruction  We conducted this performance audit from July 2016 to August 2017 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives. We subsequently worked with  DOD from August 2017 to October 2017 to prepare this unclassified  version of the original classified report for public release. This public  version was also prepared in accordance with these standards.
subsections: section_title: Background
subsections: section_title: Oversight of 2014 Nuclear Enterprise Reviews’ Recommendations
paragraphs: In November 2014, the Secretary of Defense directed DOD to address  the 2014 nuclear enterprise reviews’ recommendations and directed  CAPE to track and assess these implementation efforts. The Joint Staff,  Navy, Air Force, offices within the Office of the Secretary of Defense, and  U.S. Strategic Command are supporting CAPE’s efforts. The Secretary  also established the Nuclear Deterrent Enterprise Review Group  (NDERG), a group of senior officials chaired by the Deputy Secretary of  Defense and including the Vice Chairman of the Joint Chiefs of Staff, to  oversee and make decisions regarding implementation of the nuclear  enterprise reviews’ recommendations. The NDERG is supported by a  Nuclear Deterrent Working Group, which meets biweekly and reviews the  status of recommendations, and a Nuclear Deterrent Senior Oversight  Group, which meets quarterly and reviews any recommendations that the  Working Group believes are ready for the NDERG to close. The Deputy  Secretary of Defense updates the Secretary of Defense on NDERG  progress as requested.

CAPE compiled the recommendations from the two 2014 nuclear  enterprise reviews and a memorandum from the Commander of U.S.  Strategic Command that identified several additional recommendations.  In total, CAPE identified 175 distinct recommendations from the three  documents. CAPE then identified 247 sub-recommendations from  recommendations directed to multiple services (or other DOD  components)—for example, if a recommendation was directed to the Air  Force and the Navy, then one sub-recommendation was made to the Air  Force and one sub-recommendation was made to the Navy.

CAPE then worked with the services to identify offices of primary  responsibility for implementing actions to address the recommendations,  any offices of coordinating responsibility, and any resources necessary to  implement each recommendation. CAPE has developed a tracking tool to  collect information on progress in meeting milestones and metrics. This  tracking tool identifies offices of responsibility, implementation actions,  milestones, and metrics to measure the effectiveness of the actions taken  toward implementing each of the recommendations. The tracking tool  currently contains hundreds of unique milestones and metrics, and  according to CAPE officials, additional milestones and metrics are  included as they are identified. The Air Force and the Navy also  developed their own methods of tracking their service-specific  recommendations.

We reviewed DOD’s processes for implementing the 2014 nuclear  enterprise reviews’ recommendations and issued a report on July 14,  2016. We found that the process DOD had developed for implementing  and tracking the 2014 nuclear enterprise reviews’ recommendations  generally appeared consistent with relevant criteria from the Standards  for Internal Control in the Federal Government—including using and effectively communicating quality information and performing monitoring  activities.

As we reported in July 2016, CAPE officials stated that it would take  about 3 years to see measurable improvements in the health of the  nuclear enterprise and 15 years to implement the great majority of the  recommendations and measure whether they have had their intended  effects. CAPE and service officials have noted that it would take years for  some of the recommended cultural changes to manifest.

section_title: NC3 Systems
paragraphs: NC3 is a large and complex system comprised of numerous land-, air-,  and space-based components used to assure connectivity between the  President and nuclear forces. NC3 is managed by the military  departments, nuclear force commanders, and the defense agencies and  provides the President with the means to authorize the use of nuclear  weapons in a crisis.

NC3 systems support five important functions:

Force management: assignment, training, deployment, maintenance,  and logistics support of nuclear forces before, during, and after any  crisis.

Planning: development and modification of plans for the employment  of nuclear weapons and other options.

Situation monitoring: collection, maintenance, assessment, and  dissemination of information on friendly forces, adversary forces and  possible targets, emerging nuclear powers, and worldwide events of  interest.

Decision making: assessment, review, and consultation that occur  when the employment or movement of nuclear weapons is  considered.

Force direction: implementation of decisions regarding the execution,  termination, destruction, and disablement of nuclear weapons.

section_title: Oversight of 2015 NC3 Report Recommendations
paragraphs: As recommended in the 2015 NC3 report, the Council on Oversight of the  National Leadership Command, Control, and Communications System  (the Oversight Council) has taken a lead role in providing oversight and  making the final determination on the implementation status of that  report’s 13 recommendations. The Oversight Council is co-chaired by  the Under Secretary of Defense for Acquisition, Technology, and  Logistics and the Vice Chairman of the Joint Chiefs of Staff and its  members are the Under Secretary of Defense for Policy; the Commander,  U.S. Strategic Command; the Commander, North American Aerospace  Defense Command/U.S. Northern Command; the Director, National  Security Agency; and the DOD Chief Information Officer. Additional  organizations, such as CAPE, may participate in the Oversight Council’s  meetings to provide subject matter expertise. The Oversight Council is  supported by the Executive Management Board—a functional  governance committee chaired by the DOD Chief Information Officer.  DOD CIO tracks the implementation of the 2015 NC3 report’s  recommendations, among other activities.

section_title: Nuclear Personnel Reliability
paragraphs: DOD and the military services set standards to ensure that personnel who  work with nuclear weapons and nuclear weapons systems, NC3 systems  and equipment, and special nuclear material are reliable, trustworthy, and  capable of performing their assigned nuclear weapons-related mission.  Nuclear surety generally refers to DOD’s efforts to ensure that nuclear  weapons and materials are safe, secure, reliable, and controlled. DOD  and the military services use personnel reliability assurance programs— the Personnel Reliability Program and the Air Force’s Arming and Use of  Force program for Air Force security forces—to implement these nuclear  surety requirements for personnel.

When personnel are assigned to a nuclear unit, relevant unit  commanders certify that those personnel meet the personnel reliability  assurance program standards. Commanders can also suspend or  decertify personnel from working with nuclear weapons if they fail to meet  these standards during their service. Factors that may lead to suspension  or decertification include medical issues; personal conduct; emotional,  mental and personality disorders; financial problems such as an inability  or unwillingness to satisfy debts or the presence of unexplained wealth;  criminal conduct; sexual harassment or assault; misuse of drugs or  alcohol; and security violations. According to DOD data, as of  December 31, 2016, there were 10,603 DOD personnel certified under  the Personnel Reliability Program and 36,464 security forces personnel  certified under the Air Force’s Arming and Use of Force program.  Together, there were a total of 47,067 personnel that met the personnel  nuclear surety requirements of a personnel reliability assurance program  (see table 1).

section_title: Progress Made in Implementing Recommendations, but Identifying Additional Performance Measures, Milestones, and Risks Can Aid in Tracking and Evaluating Efforts
paragraphs: DOD and the military services have made progress in implementing  recommendations to improve the defense nuclear enterprise but could  improve their efforts by identifying additional performance measures,  milestones, and associated risks. CAPE and DOD CIO have separate  processes for tracking and evaluating DOD’s progress in implementing  the recommendations from the 2014 nuclear enterprise reviews and the  2015 NC3 report, respectively.
subsections: section_title: DOD Continues to Implement the Recommendations from the 2014 Nuclear Enterprise Reviews
paragraphs: The NDERG has closed 77 of the 247 sub-recommendations from the  2014 nuclear enterprise reviews following CAPE’s assessment of  implementation actions that had been taken by the military services and  other DOD components (see fig. 1). For example, with regard to Nuclear  Weapons Technical Inspections, the independent 2014 nuclear enterprise  review recommended that inspection teams not focus on auditing records  but instead examine the processes in place to inform commanders of  Personnel Reliability Program issues. In response, DOD, the Air Force,  and the Navy have made changes to their inspection processes and the  Joint Chiefs of Staff have updated the Nuclear Weapons Technical  Inspections guidance to de-emphasize records reviews in favor of  knowledge checks and scenario-based discussion during the Personnel  Reliability Program portion of these inspections. After reviewing these  actions, the NDERG closed this recommendation in December 2016. The  77 closed sub-recommendations make up 62 of the initial 175  recommendations from the 2014 nuclear enterprise reviews.

section_title: DOD Has Made Progress in Implementing Recommendations from the 2015 NC3 Report
paragraphs: According to DOD CIO officials, as of March 2017, the Oversight Council  has closed two of the 13 recommendations from the 2015 NC3 report,  and DOD is making progress in implementing the remaining 11  recommendations (see fig. 2). The two closed recommendations are to  (1) make the Oversight Council the synchronizing body to evaluate, track,  and resolve the findings and recommendations made in that report and  (2) broaden Air Force Global Strike Command’s responsibilities to include  serving as the lead command for all of the Air Force-owned portions of  the NC3 systems. DOD has made progress in implementing the  remaining 11 recommendations. For example, the 2015 NC3 report  recommended that U.S. Strategic Command review and validate the  availability requirements of one of the NC3 systems, which the command  has now completed. Additional detail about DOD’s progress is omitted  because the information is classified.

section_title: DOD’s Processes for Tracking and Evaluating Its Progress Can Be Improved by Identifying Additional Performance Measures, Milestones, and Risks
paragraphs: DOD’s processes for tracking and evaluating its progress in implementing  the 2014 nuclear enterprise reviews’ recommendations do not  consistently identify and document risks, and its processes for tracking  and evaluating its progress in implementing the 2015 NC3 report’s  recommendations do not identify performance measures, milestones, or  risks. Identifying performance measures, milestones, and associated risks  can help an agency to track and evaluate its progress toward completing  tasks over time and can help to inform decision makers of potential issues  that need to be addressed. We have previously reported that by tracking  and developing a performance baseline for all performance measures,  agencies can better evaluate whether they are making progress and their  goals are being achieved. Similarly, Standards for Internal Control in the  Federal Government emphasizes using performance measures and  milestones to assess performance over time. We have also derived  leading practices from the Government Performance and Results Act of  1993 (GPRA) and the GPRA Modernization Act of 2010, such as clearly  defining performance measures and milestones and assessing program  results against them. Additionally, Standards for Internal Control in the  Federal Government states that management should identify, analyze,  and respond to risks related to achieving the defined objectives and  should use and internally communicate the necessary quality information  in meeting those objectives.
subsections: section_title: DOD Has Identified Performance Measures and Milestones for Evaluating the Implementation of the 2014 Nuclear Enterprise Reviews’ Recommendations, but Additional Guidance for Identifying and Documenting Risks Could Improve Oversight
paragraphs: CAPE is working with the military services and other DOD components to  track and evaluate the implementation actions taken in response to the  recommendations from the 2014 nuclear enterprise reviews; however,  risks associated with these actions are not consistently identified and  documented. In July 2016, we reported on CAPE’s use of a centralized  tracking tool that contains relevant information about the status of the  actions taken in response to those recommendations. CAPE continues to  use this tool, and it remains accessible to the services and other DOD  entities on DOD’s classified network. As shown in figure 3, it includes  fields for the underlying problem statement, or root cause, for the  recommendation; time frames with milestones for implementing the  recommendations; and performance measures (referred to as metrics in  the tracking tool) to assess the effectiveness of the actions taken. The  tracking tool also contains a field for Key Risks and Issues, but we found  that this field has not been used consistently.

According to CAPE officials, CAPE is using the tracking tool to track  progress in meeting milestones and record the metrics it has identified to  assess both the progress (through “process metrics”) and the  effectiveness of the implementation actions (through “outcome metrics”).  The outcome metrics are selected to aid CAPE in determining whether  implemented recommendations have addressed the underlying problem  that was the impetus for the original recommendation. CAPE used the  outcome metrics to inform its assessment of each of the 77 sub- recommendations that the NDERG then closed. According to CAPE  officials, CAPE’s approach to measuring effectiveness is to gather  supporting data from the services and measure the effectiveness of each  recommendation separately. However, these officials noted that until a  recommendation has been implemented, CAPE cannot fully assess the  effectiveness of the implementation actions. Some recommendations— including changing a service’s culture or morale—will take time to  evaluate. According to CAPE officials, the tracking tool currently contains  389 unique metrics and 370 unique milestones to aid in the assessment  of the implementation actions. For each of these metrics and milestones,  the tracking tool includes expected completion dates and indicates which  have been met and which are behind schedule. Additional milestones,  particularly for actions more than 18 months out, and additional metrics to  aid in measuring the effectiveness of actions taken, are still being  identified, according to CAPE officials.

In December 2016, the Deputy Secretary of Defense issued a  memorandum that directed the transition of the tracking and analysis  responsibilities related to implementing the 2014 nuclear enterprise  reviews’ recommendations from CAPE to the military departments and  other DOD entities. However, CAPE remains responsible for providing  guidance to inform the analyses conducted by other DOD entities,  overseeing the analyses, and assessing recommendations for closure.  The aim of these changes was to enhance ownership and embed the  principles of robust analysis, continuous monitoring, and responsibility  throughout the department.

As part of this transition, CAPE provided the military departments and  other DOD entities with guidance to aid in their tracking and analysis of  the recommendations from the 2014 nuclear enterprise reviews, but this  guidance does not require the military services and other DOD  components to identify and document risks prior to bringing a  recommendation for closure. This guidance emphasizes using  performance measures and milestones to track and measure the  progress of implementation actions. It includes sections tailored to  specific groups of recommendations from the 2014 nuclear enterprise  reviews. It also calls for the consideration of potential risks that  unintended consequences could occur when a recommendation is  brought for closure, but it does not call for risks to be identified, assessed,  or documented prior to that time.

According to officials from CAPE and the military services, the  department considers risks in a number of ways and does capture  information about some risks. For example, CAPE has supplemented its  review of the military services’ proposed budgets by conducting a review  of funding risks related to the nuclear enterprise in areas such as  modernization, investment, and personnel. CAPE briefs the results of this  review to senior leadership within the NDERG to provide them information  about whether the services are including funds to address these items in  their yearly budget requests. Additionally, CAPE personnel have identified  key risks regarding some of the recommendations and have entered this  information into the centralized tracking tool. According to CAPE officials,  63 of the 247 sub-recommendations include information in the Key Risks  and Issues field in the tracking tool. However, these officials told us that  none of the remaining 184 sub-recommendations include information in  this field, because either no key risks or issues were identified or the risks  that were identified were not formally documented within the tool.

Additionally, risks that are introduced as a result of actions taken to  implement a recommendation are not consistently included in the  centralized tracking tool or otherwise documented by CAPE. For  example, according to Navy and CAPE officials regarding a  recommendation to increase the number of skilled shipyard workers to  keep up with the maintenance demands of ballistic missile nuclear  submarines, the centralized tracking tool documents the risks as the need  to complete hiring and training of new shipyard personnel. However,  according to Navy officials, the risks resulting from the prioritization of  maintenance of ballistic missile nuclear submarines over other vessels  not associated with the nuclear deterrent mission, such as fast attack  submarines and nuclear aircraft carriers, were discussed and accepted by  the Navy, but not documented in the centralized tracking tool. Similarly,  the risks associated with recommendations that the Air Force provide  additional incentive pay for personnel serving in nuclear positions were  identified but not documented in the centralized tracking tool prior to  implementation and closure. According to a CAPE official, the Nuclear  Deterrent Working Group determined that implementing incentive pay  could negatively affect morale, because some Air Force personnel in  nuclear positions are not eligible to receive this additional pay. The official  stated that the Nuclear Deterrent Senior Oversight Group was briefed on  this risk and responded by requesting updates from the Air Force’s  annual review on the effectiveness of this incentive pay.

The department is not consistently identifying and documenting risks  associated with the recommendations, because CAPE’s guidance does  not direct the military services and DOD components to document and  update information on risk in the centralized tracking tool. According to  CAPE officials, since the release of the December 2016 memorandum  directing the transition of the tracking and analysis responsibilities for the  2014 nuclear enterprise reviews’ recommendations from CAPE to the  military departments and other DOD components, the military services  have not, to date, formally identified any key risks for inclusion in the  centralized tracking tool. According to one Air Force official, the Air Force  identifies and responds to risks through its day-to-day operations;  however, this information is not captured by the tracking tool or otherwise  documented. According to a CAPE official, additional guidance on  documenting risk could encourage the military services and DOD  components to capture risks that they have identified in the tracking tool.

In a November 2014 memo announcing the department’s response to the  nuclear enterprise reviews, the Secretary of Defense stated that the  nuclear deterrent plays a critical role in assuring U.S. national security  and that it is DOD’s highest priority mission. The Independent Review of  the Department of Defense Nuclear Enterprise found that the avoidance  of managing risks by many leaders within the enterprise resulted in  adverse impacts to the mission. The review noted that avoiding risk by  avoiding the problem until it becomes a major issue is a near inevitable  outcome of risk-averse cultures and that, too often, it takes a significant  event for the leadership to recognize major problems within the force.  Similarly, the Internal Assessment of the Department of Defense Nuclear  Enterprise stated that many of the senior leaders within DOD and the  military services were not cognizant of the problems faced by the  enterprise. According to that review, many issues were already being  reported through internal self-assessments, but many senior leaders  within DOD and the military services were not aware of the conclusions of  these self-assessments and so were unable to take action to address  them. Given the critical role the nuclear enterprise plays in national  security, and given the challenges the Independent Review of the  Department of Defense Nuclear Enterprise identified with respect to  managing risks and communicating them across the defense nuclear  enterprise, it is essential that risks be consistently identified and  documented. By documenting information on risks in its centralized  tracking tool, DOD could enhance its ability to provide oversight of the  recommendations throughout its review processes in the military services,  the Nuclear Deterrent Working Group, the Nuclear Deterrent Senior  Oversight Group, and the NDERG. By developing additional guidance for  identifying and documenting information about these risks, CAPE can  also aid the components of the defense nuclear enterprise in their efforts  to communicate and formulate responses to the risks—either by  deliberately determining to accept the risk or by taking steps to avoid,  reduce, or share the risk across the enterprise.

section_title: Identifying Performance Measures, Milestones, and Associated Risks could Improve DOD CIO’s Efforts to Evaluate the Actions Taken in Response to the 2015 NC3 Report
paragraphs: DOD CIO uses an internal spreadsheet to track the implementation of the  13 recommendations from the 2015 NC3 report, but it has not identified  performance measures, milestones, or associated risks to evaluate these  actions. This spreadsheet includes fields for indicating whether an  execution plan exists, the operational impact from implementing the  recommendation, forecast closeout (which lists the responsible DOD  component or designates the status of the recommendation), and follow- up actions to be taken after a recommendation is closed. Figure 4 shows  the layout of this spreadsheet.

According to DOD CIO officials that we met with, DOD CIO shares  information about the status of the 2015 NC3 report recommendations  through meetings with the DOD entities with primary responsibility for  implementing the recommendations. However, there is currently no  centralized collection of metrics, milestones, and other information with  the same level of detail that CAPE had developed and is using for the  2014 nuclear enterprise reviews’ recommendations. According to DOD  CIO officials, they are working with the offices of primary responsibility to  expand on the current content of the internal tracking spreadsheet. These  officials stated that while they had drafted a template to contain the  expanded content, it has not yet been approved by the Oversight Council.  This draft template contains fields similar to those CAPE developed and  the department uses for tracking the department’s progress in  implementing the recommendations from the 2014 nuclear enterprise  reviews. When approved and implemented, this template will provide a  form that could be used for documenting performance measures,  milestones, and risks for these 2015 recommendations, once this  information is identified.

Identifying and sharing performance measures, milestones, and risks  could aid DOD CIO in tracking and evaluating DOD’s efforts to implement  the 2015 NC3 report recommendations. DOD CIO could improve its  efforts to track DOD’s progress in addressing the recommendations by  identifying performance measures and milestones as part of the effort it  has initiated to expand on the content of its tracking spreadsheet. DOD  CIO could also use performance measures to evaluate the actions DOD  has taken and determine whether the actions have fully addressed the  root cause of the recommendation. DOD officials leading some of the  recommendation implementation efforts told us that a number of the  issues identified in the 2015 NC3 report stem from enduring problems.  These officials noted that an overemphasis on identifying easily attainable  performance measures and closing recommendations quickly may  improve the overall percentage of recommendations implemented but  also could result in underlying root causes continuing to go unaddressed.  Our prior work on performance measurement has identified several  important attributes—such as the inclusion of baseline and trend data— that performance measures must have if they are to be effective in  monitoring progress and determining how well programs are achieving  their goals.

Additionally, by identifying and communicating risks to NC3 stakeholders,  DOD leadership may be in a better position to formulate responses to  these risks—including deliberately determining to accept the risk or take  steps to avoid, reduce, or share the risk across the defense nuclear  enterprise. Promoting the sharing of quality information on the status of  the recommendations and potential risks from the 2015 NC3 report  among the services and other DOD components with a role in NC3 could  help DOD to integrate its nuclear deterrent efforts and help decision  makers to formulate responses to any potential risks.

The DOD CIO officials that we met with said that it will be important to  incorporate performance measures and milestones into their tracking and  evaluation process and to consider operational risk and its management  when discussing effects on the nuclear enterprise and its NC3 systems.

The draft template that DOD CIO is developing, once it is finalized and  implemented, could aid the department in identifying performance  measures and milestones for these 2015 recommendations in the same  way that the centralized tracking tool CAPE developed has been used to  collect performance measures and milestones for the 2014  recommendations. In addition, including an assessment of risks  associated with the implementation of the recommendations from the  2015 NC3 report similar to the follow-up to the recommendations of the  2014 nuclear enterprise reviews could enhance DOD’s ability to provide  oversight of the recommendations and make informed responses to  address any identified risks throughout its review processes, all the way  to their closure by the Oversight Council.

section_title: DOD and the Military Services Have Implemented Recommended Changes to their Personnel Reliability Assurance Programs to Reduce Administrative Burdens
paragraphs: DOD and the military services have implemented changes to their  personnel reliability assurance programs in response to 17  recommendations from the 2014 nuclear enterprise reviews. DOD has  identified nine essential elements of reliability and released updated  guidance to refocus personnel reliability on these elements. Additionally,  the Air Force has incorporated these nine essential elements into its  Arming and Use of Force program, allowing the Air Force to use this  program to ensure that its security forces meet nuclear surety  requirements. The Air Force has also created a new office within the Air  Force Personnel Center, the Personnel Reliability Program Administrative  Qualification Cell, to assist with the administrative review process for  personnel newly assigned to Personnel Reliability Program positions or  returning to Personnel Reliability Program positions after working  elsewhere. In response to both the personnel recommendations and the  inspections-related recommendations of the 2014 nuclear enterprise  reviews, the Joint Staff, the Navy, and the Air Force have made changes  to the procedures they use to conduct nuclear personnel reliability  inspections at nuclear facilities.
subsections: section_title: DOD and the Military Services Have Altered Personnel Reliability Standards to Focus on Nine Essential Elements of Reliability
paragraphs: In response to recommendations from the 2014 nuclear enterprise  reviews, the Joint Staff led a review of the department’s guidance on the  personnel reliability assurance program. The Joint Staff, with the  assistance of the military services, identified nine elements from DOD’s  personnel reliability assurance requirements that it considered essential  to ensure that personnel working with nuclear weapons fully met nuclear  surety standards of reliability and trustworthiness.

These nine essential elements are that an individual must  1.  be a U.S. citizen  2.  have a security clearance and be reinvestigated every five years  3.  be fully qualified for the position in which he or she will serve  4.  have reliability verified by the commander before being assigned to a  Personnel Reliability Assurance Program position  5.  be continuously monitored by peers, supervisors, and commander for  issues that could affect reliability  6.  have his or her personnel file checked for issues that could affect  7.  undergo a medical evaluation to identify any conditions that could  8.  have a personal interview with the commander who will be assessing  9.  exhibit the character and competence to do the job, including  allegiance to the United States and a positive attitude toward nuclear  weapons  In response to the Joint Staff review, the Office of the Assistant Secretary  of Defense for Nuclear Matters, through the Office of the Under Secretary  of Defense for Acquisition, Technology and Logistics, issued a new  version of the Personnel Reliability Program manual in January 2015,  followed by a reissue and renaming of the overarching DOD instruction— changing the name to DOD Nuclear Weapons Personnel Reliability  Assurance—in April 2016. This guidance requires that all DOD  personnel occupying positions subject to nuclear personnel reliability  assurance program standards must meet the nine essential elements of  reliability. Additionally, the revised guidance removed a procedure for  temporary decertification, which under the previous guidance was to  occur immediately on receipt of information that was, or appeared to be, a  reason for decertification. The manual also makes it clear that personnel  reliability assurance programs are the commanders’ programs, and the  commander is exclusively accountable for determining the fitness for duty  of individuals subject to the program. The updated manual also provides  some clarity regarding requests for reinstatement by personnel who had  previously been decertified from the Personnel Reliability Program.

The military services have responded to DOD’s changes by updating their  own guidance. The Navy has released a new version of its department- specific Personnel Reliability Program manual, applicable to the Navy and  Marine Corps, and Army officials told us that the Army plans to release a  new version of its manual in early 2018. The Air Force has released a  new version of its Personnel Reliability Program manual, in addition to  other guidance changes.

Specifically, in response to a provision in DOD’s updated personnel  reliability guidance that authorizes the military departments to develop  reliability guidance specific to their security force personnel guarding  nuclear weapons, the Air Force has made changes to its Arming and Use  of Force program. Air Force Arming and Use of Force standards include  qualification requirements under which all Air Force security forces,  whether assigned to a nuclear facility or a non-nuclear facility, are  authorized to carry a weapon as part of their official duties. In addition, Air  Force nuclear security forces no longer require separate Personnel  Reliability Program certification, as they previously did. The 2014 nuclear  enterprise reviews determined that requiring nuclear security forces to  meet the standards of two reliability programs at the same time was  redundant. Air Force officials told us that utilizing the two reliability  programs caused manning problems for the Air Force, because the  availability of security force personnel qualified under both programs was  limited. As a result of the changes to DOD’s guidance, the Air Force  rewrote its Arming and Use of Force guidance to incorporate a new  chapter that outlines procedures for assessing security forces against  each of the nine essential elements of reliability. This change has allowed  the Air Force to use its Arming and Use of Force program as its sole  method of establishing personnel reliability assurance for Air Force  security force personnel. The Air Force continues to use its Personnel  Reliability Program to certify nuclear operators and maintainers.

Prior to the implementation of its new version of Arming and Use of Force  standards, the Air Force conducted an assessment of the new Arming  and Use of Force reliability standards as the sole standard for security  forces at six Air Force installations (four nuclear installations and two non- nuclear installations), to identify any gaps or areas for improvement of the  new guidance prior to its Air Force-wide implementation. The assessment  found that the new Arming and Use of Force standard adequately  addressed the nine essential elements required of a personnel reliability  assurance program, streamlined monitoring of security forces for  commanders by merging the Arming and Use of Force standards with the  Air Force Personnel Reliability Program standards, and held the security  force personnel to a higher standard to perform armed duty. The Air  Force fully implemented its new version of Arming and Use of Force  standards across the service in February 2016.

As a result of the Air Force’s changes to its Arming and Use of Force  guidance, Air Force security forces are now qualified to serve at nuclear  facilities and do not need to certify under the Personnel Reliability  Program (see fig. 5). Air Force officials told us that requiring security  forces to qualify under Arming and Use of Force standards had helped to  address manning challenges among nuclear security forces, as well as  allowing the Air Force to move experienced security forces personnel  from non-nuclear facilities to nuclear assignments. According to several  Air Force officials in command of security forces at non-nuclear  installations, the changes to the Arming and Use of Force guidance have  led to a slight increase in administrative work but have been an overall  positive development, in part due to improvements in communication with  medical personnel about factors that may affect a determination that an  airman should not be armed.

All Air Force security force personnel are required to meet the standards  of Arming and Use of Force to carry a firearm and perform many of their  duties. The Air Force implemented the new version of the Arming and  Use of Force standards in 2016. According to Air Force officials, during  the implementation, the Air Force decided that security force personnel  who were, at that time, disqualified or permanently decertified under the  Personnel Reliability Program would not be allowed to certify under the  new version of Arming and Use of Force until they had been restored to  eligibility for the Personnel Reliability Program. In early 2016, the Air  Force conducted a review of 3,167 security force personnel who had  previously been decertified or disqualified from the Personnel Reliability  Program. The Air Force determined that 2,628 of these personnel were  able to attain Personnel Reliability Program eligibility during this review,  while 539 were not. Because qualifying under the new version of Arming  and Use of Force is now a positional requirement, Air Force officials  noted that those who do not qualify must retrain for a different job or  separate from the Air Force. Air Force officials told us that the security  forces career field received a greater number of new security forces  personnel than they had been allocated in previous years to account for  the loss of personnel who were unable to qualify under the new Arming  and Use of Force standards.

The Air Force tracks metrics from the Personnel Reliability Program and  from the Arming and Use of Force program on an annual basis. Air Force  officials told us that they have not yet reviewed the extent to which the  changes to Arming and Use of Force made in February 2016 have been  effective. Air Force and DOD officials told us that they are waiting until  sufficient data are available before making additional changes to the  guidance for their personnel reliability assurance program. The Air Force  is currently developing a nuclear enterprise health assessment, which will  include further assessment of the effects of the changes the Air Force has  made to its Personnel Reliability Program and Arming and Use of Force  guidance. Air Force officials told us that data collection for this  assessment began in the spring of 2017 and that the first summary report  will be released in September-October 2017. Once implemented, this Air  Force nuclear health assessment will provide an overarching assessment  on a periodic basis, similar to a biennial assessment that the Navy  conducts of the Navy nuclear enterprise.

Unlike the Air Force, the Navy and the Army have opted not to develop  separate guidance on nuclear personnel reliability assurance for their  security forces personnel. Navy and Army officials told us that there was  no reason to create separate guidance for their security forces personnel  because, unlike the Air Force, they have not faced manning challenges or  administrative burdens related to these positions. The Air Force has a  much larger nuclear security force, and personnel transfer between  nuclear and non-nuclear facilities more frequently within the Air Force  than the other services. The Navy fills security forces positions at the two  Navy nuclear facilities with Navy and Marine Corps personnel who report  directly from training. According to a Marine Corps official, once these  personnel move on to non-nuclear assignments, they generally do not  return to nuclear security positions. Army officials told us that their nuclear  security forces are highly specialized, very few in number, and serve at  only one facility.

section_title: The Air Force Has Created a Personnel Reliability Program Administrative Qualification Cell to Facilitate the Assignment Process for Personnel New to Personnel Reliability Program Positions
paragraphs: The Air Force has taken additional steps to improve the Personnel  Reliability Program by creating the Air Force Personnel Reliability  Program Administrative Qualification Cell to aid with the review of non- security force personnel (e.g., operations personnel, maintenance  personnel) as they transition into Personnel Reliability Program positions.  Personnel transferring into these positions are subject to an  administrative qualification process, which includes a review of their  personnel file, medical information, and security clearance information as  well as an interview by the new, gaining, commander to assess them for  factors that affect their reliability.

Prior to October 2015, the commander for the unit that the individual was  leaving reviewed the individual’s administrative paperwork and then  provided an assessment of the individual’s reliability under the Personnel  Reliability Program standards to the commander of the gaining unit.  Because this initial review was often conducted by commanders outside  of the nuclear field, they had less experience than nuclear commanders in  conducting such an assessment. According to Air Force officials, this lack  of experience often resulted in the standards being applied either too  stringently or too loosely and the initial reviews often being completed  late. Additionally, although Air Force guidance indicated that personnel  transferring directly from one Personnel Reliability Program position to  another were not required to undergo administrative qualification, one of  the 2014 nuclear enterprise reviews found that some administrative file  reviews were occurring.

As of November 2016, the Air Force Personnel Reliability Program  Administrative Qualification Cell has been staffed by personnel  experienced with the standards, and they assist in conducting reviews of  many of the Air Force personnel moving to nuclear assignments. The cell  performs the administrative review formerly conducted by the commander  of the individual’s losing unit and provides a recommendation to the  commander of the gaining unit before that commander makes an  assessment (see fig. 6).

As a result, according to Air Force officials, the qualification process is  now completed more quickly, and the administrative burden on  commanders has been lessened. Officials from the Air Force Personnel  Center told us that the Personnel Reliability Program Administrative  Qualification Cell was currently assisting all Air Force Major Commands  but had not yet begun working with all Personnel Reliability Program  units.

In addition, in response to a recommendation from the 2014 nuclear  enterprise reviews, the Air Force has eliminated administrative reviews  that some commands were conducting of personnel transferring directly  from one Personnel Reliability Program position to another, but which  were not required in the Air Force’s guidance. These personnel have  remained subject to continuous monitoring, so they do not require new  administrative qualification reviews.

section_title: DOD, the Air Force, and the Navy Have Made Changes to the Inspections Processes for Their Personnel Reliability Programs
paragraphs: DOD, the Air Force, and the Navy also made changes to their nuclear  inspections processes in response to the 2014 nuclear enterprise  reviews. Nuclear units are subject to a number of different inspections.  For example, Joint Staff guidance requires that each of the services  conduct Nuclear Weapon Technical Inspections biennially at each of their  nuclear units. These inspections are intended to examine every aspect  of the nuclear mission at that unit, including the processes of the  personnel reliability assurance program. Because of the importance of  maintaining nuclear surety by keeping nuclear weapons safe and secure,  units that receive an unsatisfactory rating on an inspection may be  decertified from conducting operations or have a portion of their nuclear  capabilities withdrawn and retain only a limited nuclear capability in  mission areas that would not jeopardize the safety, security, or reliability  of the nuclear weapons.

The 2014 nuclear enterprise reviews found that inspections of nuclear  forces occurred too frequently, and that the procedures for inspections of  personnel reliability assurance programs had become overly burdensome  because of their focus on records review. The reviews found that, as a  result, these personnel reliability assurance programs had become  dominated by processes that were intended to prepare for inspections,  rather than to ensure personnel reliability. Before the 2014 nuclear  enterprise reviews, DOD personnel working with nuclear weapons were  subject to frequent inspections by multiple organizations. According to  DOD officials, Air Force major commands and Navy commands were  performing inspections at nuclear units under their control every 18  months. One such inspection was conducted as a combined military  service and Defense Threat Reduction Agency inspection. Each service  inspected additional specific areas. For Navy units, the Navy inspectors  would accept the Defense Threat Reduction Agency inspection report and  the Navy inspectors would review additional, service-specific items; this  resulted in a larger number of inspectors present. For Air Force units, the  combined inspection was performed concurrently, with the Air Force  inspecting the same items as the Defense Threat Reduction Agency  inspectors as well as reviewing additional, service-specific items; this  resulted in two separate inspection teams. The 2014 nuclear enterprise  reviews found that a mistake by a single individual could result in an  entire submarine or wing receiving an unsatisfactory rating—even in  cases not involving a clear, critical error—potentially leading to the  withdrawal of their nuclear weapons capabilities. The Independent  Review of the Department of Defense Nuclear Enterprise found that the  high frequency of inspections resulted in nuclear units spending  significant time preparing for inspections rather than focusing on  performing their mission.

The Independent Review of the Department of Defense Nuclear  Enterprise also stated that the portions of these inspections concerned  with the personnel reliability assurance program were heavily focused on  records review, especially at Air Force nuclear units. During each  inspection, inspectors would review hundreds of personnel files and  medical records to assess whether the commander and medical staff had  made the correct decision in determining an individual to be reliable. Air  Force officials told us that commanders and their medical staffs could be  found deficient for improperly certifying individuals as reliable even if  these individuals had been able to perform their duties without any  issues—for example, after routine medical procedures like a regular  check-up with an eye doctor. As a result, commanders and medical staff  at these units implemented additional procedures beyond those outlined  in DOD guidance, such as temporarily suspending personnel from  Personnel Reliability Program duties for every off-base medical  appointment regardless of whether it could affect their reliability.  Additionally, according to the Internal Assessment of the Department of  Defense Nuclear Enterprise, inspectors also cited minor administrative  deficiencies that were unrelated to personnel reliability, such as using the  improper color of ink to fill out a form.

To address the recommended improvements identified by the 2014  nuclear enterprise reviews, DOD has updated its inspection procedures.  The Joint Staff has updated the Nuclear Weapons Technical Inspections  guidance to reduce the frequency of inspections at nuclear units from  every 18 months to every 24 months. DOD’s Defense Threat Reduction  Agency no longer conducts joint inspections with the services but is  responsible for providing oversight of the services’ inspectors on behalf of  the Chairman of the Joint Chiefs of Staff. For the portion of the  inspection concerned with personnel reliability assurance, the updated  guidance de-emphasizes records reviews in favor of focusing on  processes and procedures through observation, interviews, and scenario- based discussions. The Navy and the Air Force have also updated their  inspection procedures to implement these changes in DOD’s guidance.  For example, Air Force inspectors do not conduct records checks unless  the interviews and scenario-based discussions reveal a lack of procedural  knowledge. Similarly, Navy officials stated that Navy inspectors review  additional records as needed if a lack of procedural knowledge is  revealed. To aid the Navy in assessing the overall effectiveness of the  updated inspection procedures, the Navy has opted to also review a  sample of the health records of personnel recently certified or reinstated  into the Personnel Reliability Program.

According to Air Force officials at one nuclear wing that had recently  undergone a Nuclear Weapons Technical Inspection, the changes to  inspection procedures for their personnel reliability assurance programs  that DOD and the Air Force have implemented have had a positive effect.  These officials stated that the increased use of scenario-based  discussions and knowledge checks, combined with inspectors taking a  less adversarial and more conversational discussion approach to their  inspection inquiries, has resulted in an environment where personnel feel  more comfortable self-disclosing problems or mistakes, and where the  focus of the inspection is on process improvement rather than on  identifying administrative errors, independent of whether the errors were  substantive deficiencies.

section_title: Conclusions
paragraphs: DOD has taken steps to improve the defense nuclear enterprise in  response to the 2014 nuclear enterprise reviews and the 2015 NC3  report. The processes CAPE has developed to track and evaluate  continuing progress to improve the defense nuclear enterprise—including  changes in DOD’s and the military services’ approaches to administering  their personnel reliability assurance programs—provide a good  framework for continually monitoring the department’s efforts. This  framework is also a good example of how similar efforts to implement and  oversee actions on department-wide improvements on a wide range of  subjects could be made effectively. By developing additional guidance to  identify and document risks associated with implementing the  recommendations from the 2014 nuclear enterprise reviews and  identifying and communicating performance measures, milestones, and  risks for the 2015 NC3 report recommendations, the department— particularly through the NDERG and the Oversight Council for NC3— would be better positioned to ensure that progress continues to be made,  underlying problems are addressed, and risks are mitigated or accepted  after considering the predictable and desirable results.

section_title: Recommendations for Executive Action
paragraphs: We are making the following two recommendations to DOD:  CAPE, in coordination with the military departments and other DOD  entities serving as offices of primary responsibility for implementing the  recommendations, develop additional guidance for these offices to  identify associated risks and document information about these risks in  the centralized tracking tool. (Recommendation 1)

DOD CIO—in coordination with CAPE, the military departments, Joint  Staff, and U.S. Strategic Command—as the draft template and any other  additional tools to aid in their approach are finalized, identify and  communicate to NC3 stakeholders performance measures and  milestones to assist in tracking the progress of implementation of the  recommendations from the 2015 NC3 report and evaluating the outcomes  of implementation actions, and risks associated with the implementation  of the recommendations from the 2015 NC3 report. (Recommendation 2)

section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of the classified report to DOD for comment. In its  comments, reproduced in appendix I, DOD concurred with both of our  recommendations. In response to our first recommendation, DOD  indicated that the Director, CAPE, will issue supplementary guidance for  the relevant DOD components to identify and document key risks related  to implementation of recommendations from the 2014 reviews, risks  related to implementation of alternate approaches, and potential  unintended consequences. In response to our second recommendation,  DOD stated that DOD CIO will work with the stakeholders of the Council  on Oversight of the National Leadership Command, Control, and  Communications System to identify and document performance  measures and milestones associated with progress toward the  recommendations from the 2015 NC3 report, as well as the risks related  to implementation of these recommendations. We are encouraged that  DOD is planning to take these actions and believe that, once they have  been completed, the department will be better positioned to ensure that  progress in implementing the recommendations from both the 2014  nuclear enterprise reviews and the 2015 NC3 report continues to be  made, underlying problems within the defense nuclear enterprise are  addressed, and risks are mitigated or accepted after deliberate  consideration. DOD also provided technical comments, which we  incorporated as appropriate.

We are sending copies of this report to the appropriate congressional  committees, and to the Secretary of Defense; the Under Secretary of  Defense for Acquisition, Technology, and Logistics; the Chairman of the  Joint Chiefs of Staff; the Secretaries of the Army, of the Navy, and of the  Air Force; the Commandant of the Marine Corps; the Commander, U.S.  Strategic Command; the Department of Defense Chief Information  Officer; and the Director of the Office of Cost Assessment and Program  Evaluation. In addition, the report is available at no charge on the GAO  website at http://www.gao.gov  If you or your staff have any questions about this report, please contact  me at (202) 512-9971 or KirschbaumJ@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix II.

section_title: Appendix I: Comments from the Department of Defense

section_title: Appendix II: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact

section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, key contributors to this report  were Penney Harwell Caramia, Assistant Director; Chris Cronin; R. Scott  Fletcher; Jonathan Gill; Brent Helt; Douglas Hunker; Joanne Landesman;  Marc Molino; Amie Lesser; Pamela Davidson; and Michael Shaughnessy.

section_title: Related GAO Products
paragraphs: Nuclear Weapons Sustainment: Budget Estimates Report Contains More  Information than in Prior Fiscal Years, but Transparency Can Be  Improved. GAO-17-557. Washington, D.C.: July 20, 2017.

Nuclear Weapons: DOD Assessed the Need for Each Leg of the Strategic  Triad and Considered Other Reductions to Nuclear Force. GAO-16-740.  Washington, D.C.: September 22, 2016.

Defense Nuclear Enterprise: DOD Has Established Processes for  Implementing and Tracking Recommendations to Improve Leadership,  Morale, and Operations. GAO-16-597R. Washington, D.C.: July 14, 2016.

Nuclear Weapons Sustainment: Improvements Made to Budget Estimates  Report, but Opportunities Remain to Further Enhance Transparency.  GAO-16-23. Washington, D.C.: December 10, 2015.


Question-summary annotations: questions: question: How does CAPE's guidance assist the military services?
answer: In December 2016, the Office of Cost Assessment and Program Evaluation (CAPE) provided the military services with guidance that emphasizes using performance measures and milestones to evaluate progress to aid them in tracking and analyzing their implementation of the recommendations from the 2014 nuclear enterprise reviews.
child_questions: question: What shortcomings does the guidance have?
answer: However, CAPE's guidance does not require the military services and other DOD components to identify and document risks as part of its recommendation tracking processes. As a result, DOD does not consistently identify and document risks, and it may not be identifying and communicating potential risks related to the nuclear enterprise.
child_questions: question: What did a 2014 review find?
answer: One of the 2014 nuclear enterprise reviews found that the avoidance of managing risks by many leaders within the enterprise adversely affected the mission.

question: How could additional guidance be important for the DOD?
answer: Developing additional guidance on identifying and documenting risks could enhance DOD's ability to provide oversight of its efforts to monitor progress and make informed responses to address any identified risks.

questions: question: How does the DOD CIO track implementation for recommendations made in the 2015 NC3 report?
answer: For recommendations made in the 2015 NC3 report, DOD's Office of the Chief Information Officer (DOD CIO) uses an internal spreadsheet to track implementation but has not yet identified performance measures, milestones, or risks.
child_questions: question: Once implemented, what can the DOD CIO template be used to document?
answer: DOD CIO has drafted a template that, once it has been approved and implemented, will provide a form that could be used for documenting performance measures, milestones, and risks.
child_questions: question: Why is tracking documenting such information important?
answer: By identifying and communicating this information, DOD CIO could improve its efforts to track the progress of DOD's actions, evaluate their effects, and formulate responses to risks.

questions: question: What did the 2014 nuclear enterprise reviews find?
answer: The 2014 nuclear enterprise reviews found that these personnel reliability assurance programs were overly complex and administratively burdensome and that frequent and intrusive inspections left nuclear units more focused on preparing for and responding to inspections than on ensuring personnel reliability.
child_questions: question: How did the DOD and military services react to these reviews?
answer: DOD and the military services have implemented changes to their personnel reliability assurance programs in response to recommendations from the 2014 nuclear enterprise reviews. DOD and the services have updated their guidance for personnel reliability assurance programs, including focusing on nine essential elements of reliability.
child_questions: question: Specifically, how has the Air Force incorporated their response to these reviews?
answer: For example, the Air Force has incorporated these elements into the standards it uses for its security forces. Additionally, the Air Force has centralized some of its administrative processes, and the Joint Staff has updated inspection procedures in a way that may ease the burden on personnel being inspected.

question: What is the purpose of the personnel reliability assurance programs?
answer: These programs are intended to ensure that DOD personnel who work with nuclear weapons and nuclear weapons systems, NC3 systems and equipment, and special nuclear material are trustworthy, reliable, and capable of performing their assigned nuclear weapons-related mission.

questions: question: What did the Secretary of Defense direct in 2014?
answer: In 2014, the Secretary of Defense directed two reviews of DOD's nuclear enterprise.
child_questions: question: What information did the reviews contain?
answer: These reviews identified problems with leadership, organization, investment, morale, policy, and procedures, as well as other shortcomings that adversely affected the nuclear deterrence mission. The reviews also made recommendations to address these problems.

question: What resulted from the DOD's 2015 review?
answer: In 2015, DOD conducted a review focused on NC3 systems, which resulted in additional recommendations.

questions: question: How is the GAO involved with the DOD's processes for addressing recommendations?
answer: The National Defense Authorization Act for Fiscal Year 2017 includes a provision for GAO to review DOD's processes for addressing these recommendations, and House Report 114-537 includes a provision for GAO to review changes to DOD's nuclear personnel reliability assurance programs.
child_questions: question: What two aspects are addressed in the report?
answer: This report addresses the extent to which DOD and the military services have (1) made progress in implementing recommendations to improve the nuclear enterprise and (2) made changes to their personnel reliability assurance programs.

question: In addition to reviewing documents, how else is the GAO involved with the DOD?
answer: GAO reviewed relevant documents and interviewed agency officials from DOD and the military services.