Defense Cybersecurity: DOD's Monitoring of Progress in Implementing Cyber Strategies Can Be Strengthened
Released: 2017-08-01T00:00:00

Letter

Background

DOD’s Use of Dual-Hatting

“Dual-hatting” is a term used to describe a position in which an incumbent officer has responsibilities in two organizations simultaneously—usually to that officer’s particular military service, and to a joint, combined, or international organization or activity. DOD officials told us that dual- hatting senior leaders is a relatively common practice within DOD to help align authorities, improve mission effectiveness, and use a senior leader’s experience and expertise while balancing the scope of responsibility. Some prominent examples of dual-hatting include the Commander of U.S. Northern Command also serving as the Commander of the North American Aerospace Defense Command; and the Commander of U.S. European Command also serving as the Supreme Allied Commander Europe (that is, the commander of military operations conducted by the North Atlantic Treaty Organization). Additionally, the Air Force and Navy commanders who support U.S. European Command are dual-hatted as service component commanders for U.S. Africa Command.

The Dual-Hat Leadership of NSA/CSS and CYBERCOM

When the Secretary of Defense directed CYBERCOM’s establishment in 2009, he also recommended to the President that the position of Director of NSA be assigned the responsibility for leading this new command. DOD officials told us the dual-hat leadership arrangement originated to allow CYBERCOM to use NSA/CSS infrastructure and tools to carry out its mission more quickly and to establish unity of command and effort for DOD in the cyberspace domain. As the sole leader of these organizations, the dual-hatted leader is responsible for a broad set of roles and responsibilities, as outlined below in table 1.

Since its establishment, CYBERCOM has operated as a sub-unified command organized under U.S. Strategic Command, and this arrangement continues as of April 2017. The National Defense Authorization Act for Fiscal Year 2017 included a provision directing the President to establish CYBERCOM as a unified combatant command. When the President and DOD implement this provision, CYBERCOM will no longer be organized under U.S. Strategic Command. Figure 1 below depicts the NSA/CSS and CYBERCOM leadership arrangement, as of April 2017, and where those offices fit within DOD’s organization. The figure also provides an overview of CYBERCOM’s 133 Cyber Mission Force Teams, which carry out particular parts of CYBERCOM’s mission.

As CYBERCOM has matured, leaders—including Congress, the President, the Director of National Intelligence, and the current leader of NSA/CSS and CYBERCOM—have discussed the concept of ending the dual-hat leadership of the two organizations, such that one individual would lead NSA/CSS and another individual would lead CYBERCOM. Section 1642 of the National Defense Authorization Act for Fiscal Year 2017 enumerated a number of conditions that the Secretary of Defense and the Chairman of the Joint Chiefs of Staff must jointly certify before the dual-hat leadership arrangement for NSA and CYBERCOM can be terminated. While DOD officials have considered ending the dual-hat leadership arrangement, as of April 2017, the department has not decided whether to do so.

DOD Components with Cybersecurity Responsibilities

To establish a cybersecurity program to protect and defend DOD information and information technology, DOD has assigned some of its components and senior officials with cybersecurity responsibilities, summarized in table 2 below.

Key DOD Strategic Cybersecurity Guidance

DOD has issued guidance to support the implementation of its cybersecurity capabilities. Table 3 below lists key DOD strategic-level cybersecurity documents and includes a description of each document, as well as the component organization(s) primarily responsible for their implementation.

Advantages and Disadvantages of the Dual-Hat Arrangement, and Actions That Could Mitigate Potential Risks Associated with Ending the Arrangement

Officials from various DOD components identified advantages and disadvantages of the dual-hat leadership of NSA/CSS and CYBERCOM. Additionally, DOD and Congress have identified actions that could mitigate the risks associated with ending the dual-hat leadership arrangement. As of March 2017, DOD officials informed us that DOD had not determined whether it would end the dual-hat leadership arrangement and was reviewing the steps and funding necessary to meet the requirements established in the law.

Advantages and Disadvantages of the Dual-Hat Leadership Arrangement

According to officials, DOD does not have an official position on the advantages and disadvantages of the dual-hat leadership arrangement of NSA/CSS and CYBERCOM. Through responses to interviews and questionnaires, officials from DOD components provided their perspectives on the advantages and disadvantages associated with the dual-hat leadership arrangement as summarized in table 4, below.

DOD Components and Congress Have Identified Actions That Could Mitigate Potential Risks Associated with Ending the Dual-Hat Leadership Arrangement

Actions Identified by DOD Component Officials to Mitigate Potential Risks Associated with Ending the Dual-Hat Leadership Arrangement

In response to the National Defense Authorization Act for Fiscal Year 2017, President Obama supported elevating CYBERCOM to a unified combatant command and stated that NSA/CSS and CYBERCOM should have separate leaders who are able to devote themselves to each organization’s respective missions and responsibilities, but who should continue to leverage the shared capabilities and synergies developed under the dual-hat arrangement. As of April 2017, DOD officials told us that the department supports elevating CYBERCOM to a unified combatant command, but recognizes that there are potential risks in ending the dual-hat leadership arrangement. Prior to the passage of the National Defense Authorization Act for Fiscal Year 2017, DOD components, such as CYBERCOM and the Joint Staff, had already developed internal lists of conditions and prerequisites that could mitigate risks prior to ending the dual-hat leadership arrangement. These considerations were presented to senior leadership within the respective components to help inform their positions on ending the dual-hat leadership arrangement.

According to DOD officials, discontinuing the dual-hat arrangement would require DOD to put the necessary policies and processes in place to continue the mutually beneficial partnership between NSA/CSS and CYBERCOM. Specifically, the arrangement in conjunction with support agreements has enabled CYBERCOM to leverage the capability development, personnel, facilities, infrastructure, testing capabilities, and business processes of NSA/CSS to support CYBERCOM operations. DOD officials also cited the potential for less communication between CYBERCOM and NSA/CSS and slower decision-making if the leadership arrangement were ended. Table 5 below lists the various actions reported to us by officials from DOD components that could mitigate risks associated with ending the dual-hat command structure of NSA/CSS and CYBERCOM, as well as the status of these actions, as of March 2017. According to DOD officials, many of these factors relate as much to the growth and maturation of CYBERCOM as they do the dual-hat status.

Separate from actions identified by select DOD components, Congress has requested information from the department and required it to meet specific conditions and to certify that the termination of the dual-hat arrangement, if pursued by DOD, will not pose risks to the military effectiveness of CYBERCOM that are unacceptable to the national security interests of the United States. Specifically, House Report 114- 537 accompanying a bill for the National Defense Authorization Act of Fiscal Year 2017 and House Report 114-573 accompanying a bill for the Intelligence Authorization Act of Fiscal Year 2017 directed the Secretary of Defense to provide the House defense and intelligence committees with a briefing and an assessment of the dual-hat command by November 1, 2016. According to the committee direction, DOD was to address the following: 1. roles and responsibilities, including intelligence authorities, of each 2. assessment of the current impact of the dual-hat relationship, including both advantages and disadvantages; 3. recommendations on courses of action for separating the dual-hat command relationship between the Commander of CYBERCOM and the Director of the NSA/Chief of CSS, if appropriate; 4. suggested timelines for carrying out such courses of action; and 5. recommendations for legislative actions, as necessary.

DOD did not perform this briefing and assessment. Performing this assessment would have provided DOD with an opportunity to articulate its perspectives on the advantages and disadvantages of the dual-hat leadership arrangement. Further, it would have allowed DOD to present its preferred course of action in relation to separating the leadership of NSA/CSS and CYBERCOM. DOD officials told us that they believed the assessment they were directed to provide to the House defense and intelligence committees in November 2016 was no longer necessary, based on Section 1642 of the National Defense Authorization Act for Fiscal Year 2017. However, while the act did not include the same briefing and assessment requirement identified in the two House reports, the act also did not cancel the committee direction. In addition, the briefing requirement still exists, as evidenced by the explanatory statement accompanying the Intelligence Authorization Act for Fiscal Year 2017, for DOD to brief and provide an assessment of the dual-hat leadership arrangement.

According to Section 1642 of the National Defense Authorization Act for Fiscal Year 2107, DOD cannot terminate the dual-hat leadership arrangement until the Secretary of Defense and the Chairman of the Joint Chiefs of Staff jointly certify that the termination will not pose risks to the military effectiveness of CYBERCOM that are unacceptable to the national security interests of the United States. Section 1642 also requires DOD to conduct an assessment that, among other things, evaluates CYBERCOM’s operational dependence on NSA and evaluates each organization’s ability to carry out its roles and responsibilities independently. In addition, Section 1642 requires DOD to determine whether the following conditions have been met before deciding to end the dual-hat leadership arrangement:

Robust operational infrastructure has been deployed that is sufficient to meet the unique cyber mission needs of CYBERCOM and NSA, respectively.

Robust command and control systems and processes have been established for planning, deconflicting, and executing military cyber operations.

The tools and weapons used in cyber operations are sufficient for achieving required effects.

Capabilities have been established to enable intelligence collection and operational preparation of the environment for cyber operations.

Capabilities have been established to train cyber operations personnel, test cyber capabilities, and rehearse cyber missions.

The cyber mission force has achieved full operational capability.

Office of the Under Secretary of Defense for Intelligence and Joint Staff officials told us that they regularly discuss matters related to ending the dual-hat leadership arrangement of NSA/CSS and CYBERCOM. However, as of April 2017, DOD’s senior leaders had not decided whether the dual-hat leadership should be ended, and the department was reviewing the steps and funding necessary to meet the statutory requirement of Section 1642.

DOD’s Implementation of Key Strategic Cybersecurity Guidance Reflects Varied Progress

DOD’s implementation of key strategic cybersecurity guidance—the DOD Cloud Computing Strategy, The DOD Cyber Strategy, and the DOD Cybersecurity Campaign—to help manage and focus its cybersecurity efforts has varied. The department has implemented the cybersecurity objectives identified in the DOD Cloud Computing Strategy, and it has made progress in implementing The DOD Cyber Strategy and DOD Cybersecurity Campaign. However, the department’s process for monitoring implementation of The DOD Cyber Strategy has resulted in the closure of tasks as implemented before the tasks were fully implemented. In addition, the DOD Cybersecurity Campaign lacked timeframes for completion and a process to monitor progress, which together provide accountability to ensure implementation.

DOD Has Implemented the Four Cybersecurity Objectives of the 2012 DOD Cloud Computing Strategy

DOD has implemented the four cybersecurity objectives of the 2012 DOD Cloud Computing Strategy. In July 2012, the DOD CIO issued the DOD Cloud Computing Strategy, which laid the groundwork for accelerating cloud adoption in the department, consistent with the Federal Cloud Computing Strategy. The DOD Cloud Computing Strategy includes four objectives aimed at enhancing the department’s cybersecurity, as listed in table 6 below, along with DOD’s status in implementing the objectives.

In March 2016 DOD issued the DOD Cloud Computing Security Requirements Guide, which outlines the security controls and requirements necessary for using cloud-based solutions. According to DOD officials, the Cloud Computing Security Requirements Guide is the basis for authorizing commercial cloud service providers in the DOD environment and is closely aligned with the Federal Risk and Authorization Management Program—the fundamental cloud approval process for the federal government. This guide establishes a standardized infrastructure for cloud-based services, continuous monitoring, and identity and access management. According to DOD CIO officials, DOD has approved more than 50 commercial cloud networks for various levels of use based on this guidance. Additionally, in October 2016, DOD finalized the Defense Federal Acquisition Regulation Supplement interim rule on network penetration reporting and contracting for cloud services, which further standardized infrastructure requirements for cloud service providers. In April 2017, DOD also submitted a Data Center Optimization Strategic Plan, as required by the Office of Management and Budget, which lays out the number of data centers DOD expects to close through fiscal year 2018 as well as estimated cost savings associated with those closures. The plan DOD submitted shows that the department closed more than 150 data centers in fiscal year 2016 and planned to close more over the following 2 years, which would help reduce network seams through network and data center consolidation.

DOD Has Taken Some Actions on All Cybersecurity Tasks Supporting The DOD Cyber Strategy, but the Current Process for Monitoring Implementation Limits Oversight of Tasks to Completion

DOD has taken some actions on all 22 cybersecurity-related tasks identified in The DOD Cyber Strategy, although it has closed some tasks before they were fully implemented. The purpose of The DOD Cyber Strategy, issued in April 2015, is to guide the development of DOD’s cyber forces and strengthen cyber defense and cyber deterrence postures. This strategy, according to DOD, presents an aggressive, specific plan for leaders from across the department to take action and hold their organizations accountable to achieve the strategy’s objectives. The DOD Cyber Strategy sets prioritized strategic goals and objectives for DOD’s cyber activities and missions to achieve over the ensuing five years (that is, through 2020). The Office of the Under Secretary of Defense for Policy; Office of the Principal Cyber Advisor to the Secretary of Defense; the Office of the Under Secretary of Defense for Acquisition, Technology, and Logistics; and the Joint Staff work with the DOD components to prioritize and oversee the implementation of this strategy and its objectives and to assign responsibility for managing each objective. In a June 2015 memorandum, then Secretary of Defense Ashton Carter identified the implementation of The DOD Cyber Strategy as one of his top priorities and stated that the department should ensure that the outcomes articulated in the strategy were achieved.

DOD has taken actions on all 22 of the tasks associated with the cybersecurity goal of the strategy that focuses on network defense, mission assurance, and security of the defense industrial base. For example, the Office of the Undersecretary of Defense for Acquisition, Technology, and Logistics and the Office of the Undersecretary of Defense for Intelligence formed a working group—the joint acquisition protection and exploitation cell—that links intelligence, counterintelligence, and law enforcement agents with acquisition program managers to prevent and mitigate data loss and theft. This working group ensures that federal acquisition rules and guidance mature over time in a manner consistent with standards, and it establishes an analysis capability to improve protection of controlled technical information and other critical information department-wide. In another example, DOD has adopted activities that include both regulatory and voluntary programs to improve the cybersecurity of defense industrial base companies. Companies maintaining covered defense information or providing critical support are now contractually required to report cyber incidents and use security standards identified in a National Institute of Standards and Technology special publication on protecting controlled unclassified information in nonfederal information systems. In addition, in October 2015, DOD modified eligibility criteria for participants in the defense industrial base cybersecurity information sharing program. Since this revision, DOD officials reported that program participation expanded from 124 to 207 industry partners.

While DOD has taken some actions on all 22 cybersecurity tasks, we found that it has closed some tasks before they were fully implemented. This increases the risk that DOD will not fully implement those tasks, and also increases the risk that leadership will not be aware of delays or complications related to fully implementing The DOD Cyber Strategy. Specifically, the Principal Cyber Advisor has closed tasks when that office confirms that the DOD component primarily responsible for implementation has begun taking action on the tasks and follow-on work to complete the tasks has been integrated into existing DOD processes, operations, or policies. For example, DOD closed the task that required the department to assess the cybersecurity of current and future weapon systems. According to The DOD Cyber Strategy, DOD is to assess and initiate cybersecurity improvements for existing weapon systems; mandate cybersecurity requirements for future weapon systems; and update acquisition and procurement policies to promote effective cybersecurity. The Deputy Principal Cyber Advisor approved closing this task in The DOD Cyber Strategy monitoring process when the Under Secretary of Defense for Acquisition, Technology, and Logistics submitted a plan to Congress that was required by a provision in the National Defense Authorization Act for Fiscal Year 2016 and established a process to develop cybersecurity requirements for future weapon systems. In response to both The DOD Cyber Strategy task and the provision in the National Defense Authorization Act for Fiscal Year 2016, DOD—under the leadership of the Office of the Under Secretary of Defense for Acquisition, Technology, and Logistics—initiated assessments of its existing weapon systems. In addition to initiating these assessments and establishing a process to develop cybersecurity requirements for future weapon systems, the office updated acquisition and procurement policies to promote effective cybersecurity by adding an enclosure to its acquisition guidance, entitled Cybersecurity in the Defense Acquisition System. All three of these efforts demonstrate that DOD has taken actions toward implementing this one task.

However, while DOD has taken actions to implement this task, we found that the task had not been fully implemented. Officials from the Office of the Under Secretary of Defense for Acquisition, Technology, and Logistics acknowledged that the task had not been fully implemented and that the office was on schedule for completing the initial 136 assessments by December 31, 2019, as required by statute. Similarly, DOD has made progress toward establishing cybersecurity requirements for future weapon systems, but the effort is not complete. In January 2017, the Joint Staff issued a memorandum that established a process requiring weapon systems to incorporate cyber resilience as they are designed and built. The process is undergoing a one-year trial period and is scheduled to be reassessed in 2018.

In addition, once tasks have been closed by the Principal Cyber Advisor, DOD has not continuously monitored task implementation; rather, monitoring occurs on a case-by-case basis. For example, officials from the office of the Principal Cyber Advisor told us that the office approved the closure of a task to enhance the protection for critical acquisition programs and technology on the condition that the Office of the Under Secretary of Defense for Acquisition, Technology, and Logistics provide regular reports on progress in order to allow the Principal Cyber Advisor to track progress and provide assistance when necessary. Further, the officials from the office of the Principal Cyber Advisor told us that the office reserves the right to re-open or initiate reviews of closed tasks; as of April 2017, the office had not re-opened any closed tasks.

We have previously determined that DOD components do not consistently implement cybersecurity-related actions that are identified in DOD directives, instructions, or memorandums from senior DOD officials. In 2014, we reported on DOD’s continuity planning and cyber resiliency efforts. DOD closed a related cyber resiliency task identified in The DOD Cyber Strategy after the department issued interim guidance for incorporating cyber resilience into DOD component continuity of operations plans; and DOD directed all of its components to establish or update their continuity of operations plans to include cyber resiliency measures by December 2017. While issuing a memorandum may have initiated the process, the task has not been fully implemented.

The Office of Management and Budget’s Management Responsibility for Enterprise Risk Management and Internal Control provides guidance for management to identify risks and establish internal controls, as appropriate, to provide reasonable assurance that objectives are achieved and discusses the responsibility to continuously monitor the effectiveness of those internal controls. Standards for Internal Control in the Federal Government explains that in defining objectives management should clearly define what is to be achieved, how it will be achieved, and the timeframes for achievement. Further, the standards state that ongoing monitoring should be built into an entity’s operations and be performed continually.

Based on these internal control standards, DOD’s process is not sufficient to ensure the completion or implementation of tasks. Unless DOD modifies its process for deciding whether a task identified in The DOD Cyber Strategy is implemented, the department may not be able to ensure that the outcomes articulated in the strategy are achieved.

DOD Has Made Progress in Implementing the DOD Cybersecurity Campaign but Does Not Have Timeframes and Monitoring

DOD has made some progress in implementing the seven objectives required by the DOD Cybersecurity Campaign; however, the department does not have established timeframes for achieving full implementation. In June 2015, the DOD CIO; the Under Secretary of Defense for Acquisition, Technology, and Logistics; and the Commander of CYBERCOM initiated a DOD Cybersecurity Campaign to identify specific actions that drive commanders and DOD senior leaders to enforce full cybersecurity compliance and accountability across the department. According to the DOD Cybersecurity Campaign, its goals are to educate commanders, civilian leaders, and all personnel responsible for the cybersecurity of the DOD information network on the risk to the mission. The three senior DOD leaders identified seven objectives to enable commanders and DOD senior leaders to enforce full cybersecurity compliance and accountability across the department. Table 7 below lists each of these objectives and shows our determination of the status of their implementation.

As noted in the table above, DOD has implemented two of the objectives identified in the DOD Cybersecurity Campaign. Specifically, in February 2017, the DOD Information Security Risk Management Committee finalized a charter establishing a Platform Information Technology Cybersecurity Working Group to focus on the cybersecurity of DOD platform information technology systems, including but not limited to weapon systems and industrial control systems. According to the charter, this working group—chaired by the DOD CIO; the Under Secretary of Defense for Acquisition, Technology, and Logistics; and the Commander of CYBERCOM—will provide expertise on the cybersecurity of platform information technology systems across DOD. A working group official explained that platform information technology is currently applicable to special purpose systems controlled and operated solely by technology, including industrial control systems.

The department has also implemented the DOD Cybersecurity Campaign objective to develop a framework for defensive cyberspace operations concept of operations that integrates defensive cyberspace operations and DOD information operations across the DOD information network forces. Specifically, in March 2017, the commander of CYBERCOM approved operational guidance titled, Defensive Cyberspace Operations. The operational guidance is applicable to CYBERCOM, all of its supporting elements, and all DOD components performing defensive cyberspace operations. Among other things, the guidance requires defensive cyberspace operations to be integrated with other cyberspace operations and information related activities. An official from CYBERCOM told us that the operational guidance came from the work to develop a concept of operations and was intended to address DOD’s need for guidance on defensive cyberspace operations.

DOD has also developed processes and procedures to monitor the implementation of four of the five DOD Cybersecurity Campaign objectives that are in the process of being implemented. Specifically, the DOD Cybersecurity Culture and Compliance Initiative monitors the department’s efforts in implementing two DOD Cybersecurity Campaign objectives—(1) execute priority initiatives for individual cybersecurity awareness, and (2) develop and implement a program to reinforce the traits and attributes of a healthy cybersecurity culture. In addition, DOD uses the Cybersecurity Scorecard to monitor two other DOD Cybersecurity Campaign objectives that are in progress—development of a DOD Cybersecurity Scorecard and the execution of the DOD Cybersecurity Discipline Implementation Plan. According to DOD CIO officials, the Cybersecurity Scorecard has allowed for better oversight of DOD components’ implementation of key cybersecurity measures and provides a forum for elevating issues to the Secretary of Defense. However, the scorecard is not fully implemented throughout the DOD components, and DOD continues to work on automating data collection to improve the data’s reliability. Additionally, recognizing the importance of resource prioritization, DOD CIO officials told us that the next phase is to move to a risk-based scorecard, which DOD expects to have implemented by March 2019.

While DOD has taken steps to implement the DOD Cybersecurity Campaign objectives that are still in process, the department does not know when it will achieve full implementation for one of the objectives because the department did not establish a timeframe for completing or monitoring it to help ensure accountability for full implementation. Specifically, the department does not have timeframes for the objective associated with transitioning to commander-driven operational risk assessments for cybersecurity readiness.

DOD has begun implementing the objective to shift the focus of its existing Command Cyber Readiness Inspection process to an operational cybersecurity readiness assessment. Specifically, the Defense Information Systems Agency and the Joint Force Headquarters-DOD Information Network are leading an effort to transition the department from a compliance-based Command Cyber Readiness Inspection process to an operational risk-based inspection focused on missions, vulnerabilities, and threats—currently referred to as the Command Cyber Operational Readiness Inspection process—as the initial phase of CYBERCOM’s broader Command Cyber Readiness Inspection improvement initiative. According to the Joint Force Headquarters-DOD Information Network, the results of the new inspection process will be expressed in terms of risk to the mission and the department’s information network, unlike the previous readiness inspection process, which expressed results as pass or fail. DOD officials indicated that the new operational risk assessments will better allow DOD components to relate their cyber vulnerabilities to their mission. The department has piloted the new process in three organizations; however, DOD has not established a timeframe for implementation or identified a process to hold DOD leaders accountable for implementing these assessments across the department.

The Office of Management and Budget’s Management Responsibility for Enterprise Risk Management and Internal Control requires agencies to implement risk management in coordination with a number of internal control processes, including those contained in Standards for Internal Control in the Federal Government. Standards for Internal Control in the Federal Government highlight the need to (1) define objectives in specific terms, to include how objectives are to be achieved and timeframes for their achievement; and (2) enforce accountability by evaluating performance and holding organizations accountable. Until the DOD CIO; the Under Secretary of Defense for Acquisition, Technology, and Logistics; and the Commander of CYBERCOM establish a timeframe for completing and a process for monitoring the objective associated with cybersecurity readiness assessments, DOD may be unable to assess its progress in achieving the objective, or to determine when it will achieve the strategic goals and objectives of the DOD Cybersecurity Campaign.

DOD Has Implemented Fifteen of Twenty-seven Cybersecurity Recommendations from Prior GAO Reports

As of March 2017, DOD had implemented 15 of the 27 cybersecurity recommendations (56 percent) we made in fiscal years 2011 through 2016. DOD is continuing to take actions to address 11 open recommendations, and 1 recommendation has been closed as not implemented. DOD’s 56 percent implementation rate is slightly lower than the government-wide 60 percent rate for implementing recommendations aimed at improving the security of federal systems and information. Table 8 below shows our analysis of the implementation status of the 27 cybersecurity recommendations.

DOD Has Implemented More Than Half of Prior GAO Recommendations

As of March 2017, DOD had implemented 15 of the 27 cybersecurity recommendations (56 percent) we made in fiscal years 2011 through 2016. Among them are the following:

Cyberspace Activities. In July 2011, we reported on DOD’s organization and planning of cyberspace operations, including its defensive and offensive efforts to address cybersecurity threats. DOD lacked clear and complete guidance on command and control responsibilities, and DOD did not have a comprehensive approach to assess its cyberspace capability needs and prioritize capability gaps. We made 4 recommendations to strengthen DOD’s cyberspace doctrine and operations to better address cybersecurity threats and ensure a more comprehensive approach to developing and prioritizing the department’s cyberspace capability needs. DOD has implemented those 4 recommendations. In 2011, DOD updated its guidance related to cyberspace command and control relationships. In May 2012, DOD issued a capability gap assessment memorandum that includes DOD cyberspace capability gaps, proposed mitigation actions, and estimated completion dates. In February 2013, DOD issued a joint doctrine publication on cyberspace operations. These actions allowed the department to take a more comprehensive approach to its cyberspace capabilities and clarify its cyberspace command and control relationships.

Cyberspace Budget Estimates. In July 2011, we reported that DOD’s cybersecurity budget estimates did not include all full-spectrum cyberspace operations, including computer network attack, computer network exploitation, and classified funding costs. The department also lacked a central organization or a methodology for collecting and compiling budget information on cyberspace operations. We made 2 recommendations to improve DOD’s ability to develop and provide consistent and complete budget estimates for its cyberspace operations. DOD implemented these recommendations by issuing new guidance for cyberspace operations budget submissions. The new guidance documents enabled DOD to develop a single cyberspace operations budget estimate that provides a complete picture of its cyberspace operations investments.

Small Business Cybersecurity Efforts. In September 2015, we recommended that DOD identify and disseminate cybersecurity resources to defense small businesses, because DOD’s Office of Small Business Programs had not done so. In their response to the draft report, DOD officials stated that the department would implement training events and education programs. Since then DOD has implemented this recommendation by making a reference guide for its workforce to use when engaging with small businesses. These steps better position defense small businesses to protect their information and networks from cyber threats.

DOD Has Not Yet Implemented Critical and High-Priority Cybersecurity Recommendations

DOD has not yet implemented 12 recommendations we have made to address cybersecurity weaknesses and strengthen its cyberspace posture. These 12 recommendations include 6 that address critical issues identified by The DOD Cyber Strategy and that we also previously identified as a priority for implementing. Among the recommendations not yet implemented (open, or closed as not-implemented) are the following:

Continuity of Operations. In April 2014, we found that some DOD components had not developed continuity plans, conducted continuity exercises, or established oversight to hold the components accountable. Therefore, we made 4 recommendations to strengthen DOD’s cyber continuity program by: (1) updating DOD’s continuity guidance; (2) providing planning tools for exercises with cyber degradation; (3) increasing oversight of the components; and (4) evaluating its process for tasking the components and evaluating their continuity readiness. DOD concurred with and subsequently took actions to begin implementing the 4 recommendations; however, DOD has not fully implemented these recommendations. For example, DOD drafted an update to its defense continuity policy guidance, but as of January 2017, the revisions had not been completed. Without this guidance, it will be difficult for the DOD components to provide reasonable assurance that the systems and networks needed to maintain continuity of operations in a degraded cyber environment will be reliable, accessible, or available within needed timeframes.

Insider Threat. In June 2015, we made 4 recommendations to address challenges with DOD’s insider threat program—of which DOD concurred with two, and partially concurred with two. DOD is developing an insider threat implementation plan to address two of the recommendations, but that plan has not yet been published. DOD officials told us that the department is no longer taking action to address our recommendation to evaluate the extent to which its insider-threat programs address capability gaps. This recommendation originated in part when DOD did not complete a continuing analysis of gaps in security measures and of technology, policies, and processes that are needed to increase the capability of its insider-threat program to address these gaps, as required by statute. This survey would have allowed DOD to define existing insider-threat program capabilities; identify gaps in security measures; and advocate for the technology, policies, and processes necessary to increase capabilities in the future. In their comments to the draft report, DOD officials stated that the department analyzes security gaps each quarter through its self-assessments, which identify program capability gaps. However, DOD has not evaluated and documented the extent to which the current assessments describe existing insider-threat program capabilities, as required by law. Without a documented evaluation, the department will not know whether its capabilities to address insider threats are adequate, or whether the capabilities address statutory requirements.

Defense Civil Support. In April 2016, we found that DOD’s guidance did not clearly define the roles and responsibilities of key DOD entities—such as DOD components—for domestic cyber incidents. For example, U.S. Northern Command’s Defense Support of Civil Authorities response concept plan states that U.S. Northern Command would be the supported command for a mission to support civil authorities in responding to a domestic cyber incident. However, other guidance directs and DOD officials confirmed that a different command, CYBERCOM, would be responsible for supporting civil authorities in the event of a domestic cyber incident. Therefore, we made a recommendation that DOD issue or update guidance that clarifies roles and responsibilities to support civil authorities in a domestic cyber incident. DOD concurred with this recommendation. As of April 2017, the department had not implemented this recommendation, but officials indicated that they are in the process of drafting guidance that will clarify these roles. Specifically, the department is drafting a memorandum on defense support for cyber incident response that DOD officials believe will clearly articulate how DOD would support domestic cyber incident response efforts. DOD also scheduled exercises and a workshop to help it prepare to support civil authorities in the event of a cyber incident. However, until DOD clarifies the roles and responsibilities of its key entities for cyber incidents, it will remain unclear which DOD component or command should be providing support to civil authorities in the event of a major cyber incident.

We continue to believe that implementing these 12 recommendations would improve DOD’s cyberspace posture. We will continue to monitor DOD’s implementation of these recommendations, paying particular attention to the 6 high-priority recommendations that are still not implemented. Appendix I lists each report issued from fiscal years 2011 through 2016 that included recommendations for DOD, along with each recommendation’s implementation status.

Conclusions

DOD continues to face complex and evolving cyberspace threats to its networks and information. It has taken actions to implement the tasks and objectives from the DOD Cloud Computing Strategy, The DOD Cyber Strategy, and the DOD Cybersecurity Campaign. However, gaps in the department’s processes for monitoring implementation of this guidance limits DOD’s ability to monitor the status of, and hold organizations accountable for, implementing key cybersecurity actions—such as its goal to identify, prioritize, and defend its most important networks and data so that it can carry out its missions effectively. DOD has made progress in implementing the seven actions required by the DOD Cybersecurity Campaign, but it does not know when it will achieve full implementation of one of the six remaining actions. DOD’s continuing progress is highlighted by CYBERCOM’s recent release of defensive cyber operations guidance in accordance with one of the objectives of the DOD Cybersecurity Campaign. Addressing the gaps in DOD’s plans and timeframes for completing the remaining action will help DOD find and fix any root causes of cybersecurity breaches. Failure to implement this objective makes DOD vulnerable to cyber threats that may negatively affect mission readiness and could hinder mission accomplishment.

Recommendations for Executive Action

To ensure that DOD implements the tasks and objectives of key cybersecurity guidance to strengthen its cybersecurity posture, we recommend that the Secretary of Defense take the following two actions:

Direct the Principal Cyber Advisor to modify the criteria for closing tasks from The DOD Cyber Strategy to reflect whether tasks have been implemented, and to re-evaluate tasks that have been previously determined to be completed to ensure that they meet the modified criteria;

Direct the Commander of CYBERCOM, in coordination with the Under Secretary of Defense for Acquisition, Technology, and Logistics and DOD CIO, to establish a timeframe and monitor implementation of the DOD Cybersecurity Campaign objective to develop cybersecurity readiness assessments to help ensure accountability.

Agency Comments and Our Evaluation

We provided a draft of our report to DOD for review and comment. In its written comments, DOD partially concurred with both of our recommendations. DOD’s written comments are reprinted in their entirety in appendix II. DOD also provided technical comments, which we incorporated into the report where appropriate.

DOD partially concurred with our recommendation to modify the criteria for closing tasks from The DOD Cyber Strategy to reflect whether tasks have been implemented and re-evaluate tasks that have previously been determined to be completed to ensure that they meet the modified criteria. The department stated that it has a robust process in place to ensure that tasks are normalized within appropriate processes, operations, and/or policies. DOD stated that it will implement internal control standards to periodically reassess closed tasks and that the department will re-evaluate the word “closed” as it relates to enduring activities that have active efforts ongoing across the department. If DOD implements these actions it will help ensure that the department monitors the status of these cybersecurity tasks to completion and will meet the intent of our recommendation.

DOD partially concurred with our recommendation to establish timeframes and monitor implementation of the DOD Cybersecurity Campaign objectives related to readiness assessments and a defensive cyberspace concept of operations to help ensure accountability. The department stated that CYBERCOM will coordinate with the necessary components to develop timelines for implementing these objectives. Further, the DOD CIO and the Under Secretary of Defense for Acquisition, Technology, and Logistics will monitor the status of these objectives to help ensure accountability. If DOD takes the actions it outlined, it will meet the intent of our recommendation. Because CYBERCOM provided us a copy of their recently published defensive cyber operations guidance before completion of our audit, we adjusted our recommendation to omit reference to a defensive cyberspace concept of operations.

We are sending copies of this report to the appropriate congressional committees, the Secretary of Defense, DOD’s Deputy Principal Cyber Advisor, the Commander of CYBERCOM, the Acting Under Secretary of Defense for Acquisition, Technology, and Logistics, and DOD’s Acting Chief Information Officer. In addition, the report is available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact me at (202) 512- 9971 or kirschbaumj@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix III.

Appendix I: Status of Cybersecurity Recommendations Made to the Department of Defense (DOD), Fiscal Years 2011 through 2016

Table 9 below summarizes the status of the 27 cybersecurity recommendations we made to DOD in 10 reports issued from fiscal years 2011 through 2016. We classify each recommendation as implemented, open, or not-implemented. Open and not-implemented recommendations are those that the agency has not yet taken sufficient steps to implement. Open recommendations are recommendations that the agency is still working toward implementing, while DOD is no longer taking actions on the recommendation that is not implemented. The recommendations are listed by report.

Appendix II: Comments from the Department of Defense

Appendix III: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the individual named above, Tommy Baril, Assistant Director; Tracy Barnes; John Beauchamp; Lon Chin; Pamela Davidson; Ashley Houston; Jason Kelly; Amie Lesser; Randy Neice; and Cheryl Weissman made key contributions to this report.

Related Unclassified GAO Products

Defense Department Cyber Efforts: Definitions, Focal Point, and Methodology Needed for DOD to Develop Full-Spectrum Cyberspace Budget Estimates. GAO-11-695R. Washington, D.C.: July 29, 2011.

Defense Department Cyber Efforts: DOD Faces Challenges In Its Cyber Activities. GAO-11-75. Washington, D.C.: July 25, 2011.

Defense Department Cyber Efforts: More Detailed Guidance Needed to Ensure Military Services Develop Appropriate Cyberspace Capabilities. GAO-11-421. Washington, D.C.: May 20, 2011.

Defense Cyber Efforts: Management Improvements Needed to Enhance Programs Protecting the Defense Industrial Base from Cyber Threats. GAO 12-762SU, August 3, 2012.

Defense Cybersecurity: DOD Needs to Better Plan for Continuity of Operations in a Degraded Cyber Environment and Provide Increased Oversight. GAO-14-404SU, April 1, 2014.

Insider Threats: DOD Should Strengthen Management and Guidance to Protect Classified Information and Systems. GAO-15-544, June 2, 2015.

Defense Infrastructure: Improvements in DOD Reporting and Cybersecurity Implementation Needed to Enhance Utility Resilience Planning. GAO-15-749, July 23, 2015.

Defense Cybersecurity: Opportunities Exist for DOD to Share Cybersecurity Resources with Small Businesses. GAO-15-777, September 24, 2015.

Civil Support: DOD Needs to Clarify Its Roles and Responsibilities for Defense Support of Civil Authorities during Cyber Incidents. GAO-16-332, April 4, 2016.

Defense Civil Support: DOD Needs to Identify National Guard’s Cyber Capabilities and Address Challenges in Its Exercises. GAO-16-574, September 6, 2016.