DEFENSE INFRASTRUCTURE: Guidance Needed to Develop Metrics and Implement Cybersecurity Requirements for Utilities Privatization Contracts
Released: 2018-09-04T00:00:00

Letter

Background

Utilities Privatization Authorities and Intent

Congress provided statutory authority in 1997 for the privatization of utility systems on military installations to address DOD’s need to supply reliable, safe, and efficient utility services to its installations. In defining a utility system, the authority includes systems for the generation and supply of electric power; the treatment or supply of water; the collection or treatment of wastewater; the generation or supply of steam, hot water, and chilled water; the supply of natural gas; and the transmission of telecommunications. Included in a utility system are the associated equipment, fixtures, structures, and other improvements, as well as real property, easements, and rights-of-way. The authority states that the Secretary of a military department may convey a utility system to a municipal, private, regional, district, or cooperative utility company or other entity. DOD’s policy permits the military departments to maintain ownership of utility systems and not privatize them for unique security reasons, such as installations with highly sensitive missions, or when privatization is uneconomical.

Utilities Privatization Roles and Responsibilities

ASD (EI&E) oversees DOD’s utilities privatization program, which is part of the department’s installation energy management portfolio. In this capacity, ASD (EI&E) is responsible for developing policies and overseeing the program. There are two main sources of guidance for utilities privatization— a DOD instruction on energy management at the installation level, DOD Instruction 4170.11, Installation Energy Management, and a series of memorandums specific to utilities privatization. The instruction and memorandums direct the military departments to attempt to privatize all utility systems, unless the Secretary of the military department determines that the system is exempt from privatization for security or economic reasons. Some of the memorandums were issued to provide the military departments with guidance to implement certain changes to the statutory authority related to utilities privatization. For example, the congressional authority was amended in 2006 to require the Secretary of Defense’s (or a designee’s) approval for utilities privatization contracts with terms longer than 10 years, but not to exceed 50 years. The subsequent guidance memo delegated the approval from the Secretary of Defense to the Secretaries of the military departments and the Director of the DLA.

The military departments have the responsibility for program implementation, as the statutory authority to privatize utility systems is granted to the Secretaries of the military departments. As such, the military departments determine which systems will be privatized and which systems may be exempted from privatization due to economic or security reasons. According to military department officials, each military department considers utilities privatization as an option for the recapitalization of utility infrastructure. The Army views utilities privatization as the preferred option, while the Navy and the Air Force consider utilities privatization to be one option among others. Specifically,

Army officials stated that they follow the statute and ASD EI&E program guidance documents. Those documents state that utilities privatization is the preferred method for recapitalizing utility infrastructure and officials stated that the Army plans to assess all of its utility systems for privatization. The Army prioritizes systems in the worst condition and systems with important missions for privatization. According to Army officials, in cases where the utility system is in poor condition and the installation performs important missions, the Army may privatize utility systems even if the costs in the contractor’s proposal exceed the costs in the government’s “should cost” estimate by as much as 15 percent.

The Air Force’s utilities privatization policy states that the program’s goal is to permanently convey utility systems on Air Force active, reserve, and guard installations to private or public utility companies in conjunction with an award of a long-term utility services contract for the operation and maintenance of those systems. The purpose of privatizing a utility system is to restore utility infrastructure to industry standards for operations, maintenance, recapitalization, health, and safety while achieving a monetary savings over the cost of continued Air Force ownership.

According to Navy officials, the Navy has not pursued utilities privatization in recent years but is currently in the process of assessing utility systems for potential conveyance. Any decisions to convey utility systems will be based on a business case analysis for total ownership cost and the ability to improve reliability, resilience, and efficiency for priority missions. Navy officials noted that the Navy follows DOD policy for utility conveyance authority.

DLA works with the military departments to plan for utilities privatization and procures and administers 61 utilities privatization contracts for the Departments of the Army and Air Force from the pre-solicitation phase and into the post-award phase. According to DLA officials, the entire pre- award process takes approximately 915 days, based on the assumption that the solicitation receives 1 to 6 proposals from contractors. Once an award decision is made, privatization involves two transactions with the successful contractor—the conveyance of the utility system infrastructure and the acquisition of utility services for upgrades, operations, and maintenance under a long-term contract of up to 50 years. According to DLA officials, the contract term can be up to 50 years because it allows the military departments the opportunity to spread the high costs to repair and replace existing utility infrastructure over a long period of time. The Department of the Navy administers its own utilities privatization contracts for Navy and Marine Corps installations.

DOD’s Privatization of Utility Systems Since 1988

As of January 2017, the military departments have privatized approximately 23 percent (601 of 2,574) of their utility systems. As shown in table 1, the Army has privatized the most systems (369), followed by the Air Force (174), and then the Navy (58). In addition, table 1 shows the number of utility systems the military departments have exempted for either economic or security reasons. As of January 2017, the military departments have 600 systems that have not been privatized or exempted from privatization. The Army and the Air Force have plans to privatize more systems in the coming years.

Industrial Control System Vulnerabilities and Cybersecurity Policies and Guidance

According to an ASD (EI&E) official, information residing on ICS associated with privatized utilities systems, and more broadly, information on any ICS, may be used by adversaries to gain insights into operations on installations or to conduct a cyberattack. According to U.S. Cyber Command, DOD’s ICS are a potential target and an adversary could gain unauthorized access and attack DOD in a variety of ways, including removing data from an ICS, inserting false data to corrupt the monitoring and control of utility infrastructure through ICS, and physically destroying utility infrastructure controlled by an ICS. As such, DOD’s 2015 Cyber Strategy recognizes the need to protect DOD information regardless of where it resides—on DOD’s own information systems and ICS or on contractor-owned information systems and ICS— so that DOD capabilities are not exploited, misdirected, countered, or cloned. Figure 1 illustrates a potential cyberattack using false data in an ICS.

In addition, there have been reports of successful attacks using ICS associated with infrastructure. Specifically, the Office of the Director of National Intelligence issued a report in 2017 describing several of these attacks. For example, the report noted that in 2010, Stuxnet was the first computer virus specifically targeting ICS, and it allowed attackers to take control of the systems and manipulate real-world equipment without the operators knowing. The attacker targeted certain equipment at the Natanz uranium enrichment plant in Iran, manipulated computer systems that control and monitor the speed of the centrifuges, and reportedly destroyed roughly one-fifth of Iran’s nuclear centrifuges by causing them to spin out of control. The attacker increased the pressure on spinning centrifuges while showing the control room that everything appeared normal by replaying recordings of the plant’s protection system values during the attack. In another example, the report noted that in 2012, a U.S. power utility’s ICS was infected with a virus when a third-party technician used an infected USB drive to upload software to the systems. The virus resulted in downtime for the systems and delayed plant restart by approximately 3 weeks.

In recognition of these threats, DOD has developed cybersecurity policies and guidance for ICS that apply to both DOD-owned ICS and contractor- owned ICS. Specifically,

For DOD-owned ICS, the department has issued several policies and guidance for the cybersecurity of ICS. For example, in 2016, in response to one of our prior recommendations that ASD (EI&E) address challenges the military services faced in implementing the risk management framework guidance, ASD (EI&E) directed the services to develop plans identifying the goals, milestones, and resources needed to identify, register and implement cybersecurity controls on DOD facility-related ICS. Further, DOD issued additional guidance that was intended to assist the military services in developing implementation plans to meet these requirements. In 2016, DOD issued guidance, in the form of Unified Facilities Criteria, which provides criteria for the inclusion of cybersecurity in the design of control systems in order to address appropriate security controls during design and subsequent construction. Also, in 2016, the U.S. Cyber Command and the Office of the Secretary of Defense issued guidance that identifies device anomalies that could indicate a cyber incident, specific detection procedures to assess the anomaly, and procedures to recover electronic devices, including removing and replacing the device.

For contractor-owned ICS, including ICS owned by privatized utility system owners, DOD has a Defense Federal Acquisition Regulation Supplement clause to require that contractors take steps to ensure safeguards are put in place to protect covered defense information, which is defined as unclassified controlled technical information or other information that is processed, stored, or transmitted on the contractor’s information system or ICS. Controlled unclassified information is information that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and government-wide policies. The clause also requires the contractor to report cyber incidents.

Military Departments Have Some Types of Information on Their Privatized Utility Systems, but Have Not Tracked Contract Performance or Developed Measurable Performance Standards

The military departments have information about utility systems that have been privatized, but they have not tracked utilities privatization contract performance or developed measurable performance standards for these contracts. Specifically, for the systems in our sample the military departments have some information on the costs for utility infrastructure improvements and commodities, system reliability, and contractor performance evaluations.

Costs for Utility Infrastructure Improvements: The military departments have information on the estimated cost avoidance at the time of contract award for utility infrastructure improvements; however, none of the military departments have determined whether the utilities privatization contracts are on track to achieve those cost avoidance estimates. For example, officials at Fort Bragg, North Carolina, estimated at the time of contract award that it would have cost the Army $61.4 million to provide natural gas utility services over the life of the utilities privatization contract, while the successful proposal from the contractor estimated a cost of $52.3 million for the same services. Therefore, the Army initially projected that it would avoid an estimated cost of $9.1 million for natural gas utility services at Fort Bragg over the life of the contract.

However, the estimate at the time of contract award used by each military department does not account for changes in the cost of the contract over time. Moreover, none of the military departments measure actual cost avoidance over time, and some utilities privatization contracts have experienced cost increases. Specifically, we found that six of the nine utilities privatization contracts in our sample included modifications, which increased the original cost of the contract by more than 5 percent after adjusting for inflation. For example, the contract to privatize electric and water services at Tyndall Air Force Base, Florida, had 59 modifications, which have increased the total estimated contract value by 36 percent ($42 million) to $159 million since it was awarded in September 2010. In addition, the water and wastewater privatization contract at Fort Bragg had 219 modifications, which has increased the total estimated contract value by 96 percent ($552 million) to about $1.1 billion since it was awarded in September 2007.

According to military department and DLA officials, there are limitations to using the information in the modifications to analyze changes in cost over time associated with the utilities privatization contracts because some cost changes may have occurred even if the government had retained ownership of the utility system. DLA officials stated that the modifications are made for a number of different reasons, including changes in mission requirements, changes to the utility service requirements, and capital upgrade projects on the installation. According to military department officials, cost changes associated with changes in the installation’s mission would likely have occurred had the military department retained ownership and would not be a cost increase due to privatization. Thus, it is difficult to determine the extent to which cost increases affect the cost avoidance estimated at the time of contract award.

In 2006, we reported that cost growth in DOD’s utilities privatization contracts may become a concern because once a utility system is privatized, the government enters into a sole-source relationship with the privatized utilities system owner, which may put the government at a disadvantage when negotiating prices for utility system changes. To mitigate this disadvantage, DLA and Air Force officials stated that they use experts who review proposals from the privatized utility system owners to help ensure that costs are fair and reasonable.

Costs for Utility Commodities: Military department officials stated that they have observed reduced usage of the commodity provided by the utility, such as water usage, and thus decreased commodity costs through utilities privatization; however, installation officials have not tracked the data and associated savings. Furthermore, the officials have not determined whether any savings were fully attributable to utilities privatization, recognizing that other factors may have affected commodity usage. For example, officials at Tyndall Air Force Base, Florida, stated that repairs to their privatized water system infrastructure have resulted in less water usage, and that there has been a decrease in the number of leaks. An Army official estimated commodity cost savings by comparing commodity costs prior to utilities privatization with commodity costs after utilities privatization. This approach was based on the assumption that any such savings were primarily due to utilities privatization. However, an Army official stated that the commodity cost savings the Army estimated could be attributed to other factors outside of utilities privatization, such as decreases in base population or execution of Energy Savings Performance Contracts. Air Force and Navy officials stated they did not estimate commodity cost savings.

System Reliability: Military department officials stated that they have perceived improvements in utility system reliability since utilities privatization and have access to contractor-provided data to assess reliability; however, the military departments have not used the contractor-provided data to determine reliability trends over time. For example, Army officials at Arlington National Cemetery, Virginia, stated that they could not recall an unscheduled outage since the privatization of the electric system in 2015. In addition, officials at Tyndall Air Force Base, Florida, stated that there was a significant drop in outages after the electric system was privatized in 2010. However, we found that none of the military departments have formally measured improvements in reliability due to utilities privatization, because, according to military installation officials, they did not track reliability statistics prior to utilities privatization nor were they required to do so. In addition, we found that not all installations in our sample of cases have analyzed contractor-provided outage data, which includes information on the number of scheduled and unscheduled outages and the causes of the outages, to verify perceived reliability improvements. However, officials at Hill Air Force Base, Utah, stated that the system owner provides reports that track reliability over time and trends could be determined through this data collection. As we previously reported, there are benefits to collecting utility disruption information since it can be used to identify repairs and to prioritize funding for those repairs.

Contractor Performance Evaluations: The military departments use the Contractor Performance Assessment Reporting System to subjectively evaluate each utility system owner’s performance across several categories, including management, schedule, and cost control, among others; however, based on our review of the evaluations associated with the nine contracts in our sample, we found that the evaluations were anecdotal and varied in frequency and quality. While we found that the assessing officials generally reported satisfactory system owner performance, the performance periods in the evaluations varied. For example, one evaluation for the water privatization contract at Naval Air Station Key West, Florida, covered 4 years, while the subsequent evaluation for the same contract covered 1 year. Another evaluation for the natural gas privatization contract at Fort Bragg, North Carolina, covered a performance period of 1 year and 4 months. Guidance for these contractor assessments indicates that agencies should conduct contractor performance evaluations on an interim annual basis and upon final completion of the contract. In addition, evaluation information supporting ratings varied. In one evaluation for the electric and water privatization contract at Tyndall Air Force Base, Florida, an assessing official cited multiple concerns in the supporting narrative for an evaluation area and rated it as “unsatisfactory,” while the subsequent evaluation for the same contract provided an “exceptional” rating for the same evaluation area with no explanation of how previous concerns were addressed.

The military departments have not tracked utilities privatization contract performance and have not developed measurable performance standards because ASD (EI&E) has not issued guidance requiring the military departments to develop metrics and measurable performance standards. Standards for Internal Control in the Federal Government state that management should design control activities—such as the establishment of performance measures and indicators—to achieve objectives. In addition, our prior work has shown that an element of sound planning focuses on developing a set of metrics that will be applied to gauge progress toward attainment of the plan’s long-term goals. The metrics can be used to evaluate the plan through objective measurement and systematic analysis to determine the manner and extent to which privatized utility systems meet measurable performance standards. According to our prior work, performance measurement focuses on whether a program has achieved its objectives, expressed as measurable performance standards. Moreover, DOD’s guidebook for the acquisition of services states that services acquisition is about acquiring performance results that meet performance requirements needed to successfully execute an organization’s mission. Those performance requirements and how the government will assess the contractor’s performance must be determined before the contract is awarded.

DOD has guidance that requires the military departments to conduct a post-conveyance review for each privatized utility system. That guidance states that the military departments shall compare utilities privatization costs after the contract award to projected costs to identify whether there is a problem with cost growth. The guidance does not require the development of metrics and associated measurable performance standards to report on the performance of utilities privatization contracts.

ASD (EI&E) officials stated that performance metrics are needed to improve DOD’s oversight of utilities privatization efforts. According to Standards for Internal Control in the Federal Government, it is important for management to design performance metrics and standards because they help the entity achieve its goals. For example, ASD (EI&E) officials stated that they issued a data call to the military departments in January 2017 requesting information about the performance of utilities privatization contracts. Officials noted that they received different information from each military department and did not believe that the information would enable the department to determine whether the privatized utilities systems are improving reliability or achieving the cost savings originally estimated. For example, these officials stated that some installations provided contractor performance evaluation ratings, but these ratings were anecdotal and could not be used to determine improved reliability or estimated cost savings. Air Force officials also stated that they needed performance metrics to improve their management of utilities privatization. Officials explained that the information they receive from contracting officers and contracting officer representatives specific to privatized utilities is anecdotal and qualitative, and they have no metrics in place that allow the Air Force to track the performance of utilities privatization contracts over time or to identify trends and issues that would enable the Air Force to take steps to improve utilities privatization. However, Air Force officials stated that the Air Force is working on developing a standardized reporting template, called the Monthly System Performance Report, which will enable the Air Force to track reliability for its privatized utility systems and to identify reliability trends over time.

DOD’s utilities privatization program has been in place for 21 years and some information, such as the contractor-provided reliability data, is available that could be used to track performance over time. Performance metrics and standards would help ASD (EI&E) track the outcomes of the utilities privatization program. In addition, the life of utilities privatization contracts can extend to 50 years, producing a long-term, one-to-one relationship between the utility system owner and the government. The ability of ASD (EI&E), DLA, and the military departments to track performance over the life of utilities privatization contracts may help mitigate the risks of being in a one-to-one relationship with the utility system owner. Without issuing guidance that requires the military departments and DLA to develop and implement metrics and measurable performance standards to track contract performance for future utilities privatization contracts and to develop similar guidance for current utilities privatization contracts, the department will lack information on the performance of utilities privatization contracts. As a result, ASD (EI&E), the military departments, and DLA may not be able to perform effective program management and oversight for these long-term utilities privatization contracts.

DOD Has Cybersecurity Requirements for Industrial Control Systems, but Has Not Begun to Implement Those Requirements for Utilities Privatization Contracts

DOD Has Cybersecurity Requirements for Industrial Control Systems

In November 2013, DOD issued guidance in the form of a Defense Federal Acquisition Regulation Supplement clause to establish minimum requirements for safeguarding covered defense information on a contractor’s ICS. The clause requires contractors to implement a minimum set of security controls on contractor information technology and ICS, to report cyber incidents, and to support DOD damage assessments as needed. According to DOD, the Defense Federal Acquisition Regulation Supplement clause for safeguarding covered defense information is required to be added to all new solicitations and contracts as of November 2013. The clause is not required to be incorporated retroactively into DOD contracts awarded prior to 2013, but that does not preclude a contracting officer from modifying existing contracts to incorporate the clause.

To implement the clause for safeguarding covered defense information, the contractor must apply a minimum set of security controls on its ICS. For the contractor to know what the appropriate security controls are, DOD first must identify what, if any, covered defense information is provided to or developed by the contractor in performance of the contract. If the requiring activity determines that covered defense information is provided to or developed by the contractor, then the contracting officer notifies the contractor by documenting what information is considered covered defense information. Then, to secure DOD’s covered defense information, the contractor must apply adequate security to its ICS on which that information resides and document, in a system security plan, how the requirements were met or how the contractor plans to meet the requirements. When requested by the requiring activity, the system security plan should be submitted to demonstrate that adequate security has been implemented. Figure 2 shows the responsibilities for identifying, marking, and securing DOD’s covered defense information on contractor information and industrial control systems.

DOD Has Not Begun to Implement Cybersecurity Requirements for Utilities Privatization Contracts

DOD officials stated that while they have taken steps to incorporate the clause requiring the safeguarding of covered defense information into many of their utilities privatization contracts, they have not begun to implement the cybersecurity requirement in the clause to ensure that covered defense information is appropriately safeguarded for those contracts. DLA, Army, and Air Force officials stated that they have added cybersecurity requirements to some of the utilities privatization contracts they administer, but the Navy has not. Specifically:

DLA: According to DLA officials, of the 61 privatized utility contracts DLA manages on behalf of the Army and Air Force, officials have incorporated the clause requiring the safeguarding of DOD covered defense information into 60 contracts, and are in the process of modifying one contract to incorporate the clause. According to DLA officials, beginning in June 2015, they determined that the utilities privatization contracts needed to be modified to incorporate the cybersecurity requirements to safeguard DOD covered defense information associated with its utilities privatization contracts for two reasons. First, DLA officials stated that they interpreted DLA- contracting guidance issued in 2015 to direct them to incorporate the clause into all contracts. Second, DLA officials stated that the clause should be applied to all utilities privatization contracts so that there was consistency across the program. Since the issuance of the DLA contracting guidance in 2015, DLA officials stated that they have provided direction to the utilities privatization contracting officers on multiple occasions to incorporate the clause into all contracts and plan to ensure that the remaining contracts are modified to include the clause. DLA officials stated that most of the contract modifications to include this clause were completed in 2015 and 2016; however, some modifications occurred as late as 2017.

Army: Army officials who manage the Army’s other utilities privatization contracts stated that the clause requiring the safeguarding of covered defense information has been added to some contracts, but could not state definitively that the clause was added to all of the utilities privatization contracts that the Army manages. Army officials stated that Army contracting guidance issued in 2015 did not specifically address utilities privatization; however, the guidance did require that the clause be added to several different types of contracts, including all contracts for programs where officials expect covered defense information to be furnished by the government or developed by the contractor, and contracts that were active in fiscal year 2016 and later, among other contracts, or provide a rationale for not including the clause. Army officials stated that they did not know if their utilities privatization contracts contained covered defense information. However, Army officials determined that the guidance required the clause to be added to utilities privatization contracts because these contracts fell into the category of contracts that were active in fiscal year 2016 and later. Another contracting officer for several Army privatization contracts stated that he does not recall how information about the guidance to incorporate the clause into utilities privatization contracts was shared. However, he stated that the issue was discussed at utilities privatization meetings, and he believed that it was implied at these meetings that the clause should be incorporated into existing utilities privatization contracts.

Air Force: The Air Force official who manages the Air Force’s utilities privatization program stated that two of the nine contracts managed by the Air Force included the clause, and the clause was being added to two additional contracts at the time of our review. Further, the Air Force stated that it was planning on adding the clause to the remaining five contracts. An Air Force official stated that it was not clear whether the clause was required to be incorporated into all existing utilities privatization contracts. However, since DLA added the clause across all of the utilities privatization contracts it managed, the Air Force official assumed that all non-DLA managed utilities privatization contracts should do the same.

Navy: Navy officials stated that they have not taken steps to incorporate the requirement into any of their utilities privatization contracts. According to Navy officials, they have not added the cybersecurity clause to the Navy’s utilities privatization contracts because they are waiting for guidance from ASD (EI&E) regarding whether the clause is necessary for all utilities privatization contracts and, if so, additional guidance on how to implement the clause.

DLA, Army, and Air Force officials stated that while they have taken steps to incorporate the clause requiring the safeguarding of covered defense information into many of their utilities privatization contracts, they have not begun to implement the cybersecurity requirement for those contracts. As previously discussed, DOD acquisition guidance states that the requiring activity, which in the case of utilities privatization contracts is the military departments, must identify what information is considered covered defense information and provide that information to the contractor. However, before officials can fully implement these requirements, they must first identify what information is considered covered defense information.

According to an ASD (EI&E) official, information residing on ICS associated with privatized utility systems could be considered covered defense information because it could be used by adversaries to gain insights into operations on installations or to conduct a cyberattack. For example, information about energy or other commodity usage, water or gas pressure in pipes, or the amount of chemicals that need to be added during water treatment processes might be useful information to an adversary seeking to disrupt operations on a military installation. In one example of a cyber incident on an ICS associated with the operation of a dam in New York, a threat actor repeatedly obtained information on the status and operation of the dam, including information about the water levels, temperature, and status of the gate that controls water levels and flow rates. This access would allow the attacker to remotely operate and manipulate the dam’s gate. However, in this instance, the gate had been manually disconnected for maintenance at the time of the intrusion. In another example, threat actors obtained control-level access to a water treatment ICS and altered settings that controlled the amount of chemicals used to treat tap water and water flow rates, disrupting water distribution. The activity triggered an alert within the ICS, notifying the water treatment utility to quickly identify and reverse the chemical and flow changes, largely minimizing the impact on customers. Had the threat actors been more familiar with the flow control system, the attack could have been far more consequential.

However, DLA officials stated that there are currently no procedures that state what, if any, information associated with utilities privatization contracts is considered covered defense information. DLA officials stated that they conferred with Army and Air Force officials, and DLA’s own policy division, and reached out to ASD (EI&E) to obtain a clear definition on what information associated with DOD’s utilities privatization contracts might be considered covered defense information.

DLA’s efforts to obtain clarification from ASD (EI&E) on how to implement the clause for utilities privatization contracts began in 2016. For example, in 2016, DLA officials stated they met with ASD (EI&E) officials to discuss the issue of covered defense information specific to the utilities privatization program, discussing what, if any, information on ICS associated with privatized utilities should be identified as covered defense information. Further, DLA officials asked for procedures regarding what steps to take to evaluate a contractor’s compliance with the provision. In addition, DLA officials asked privatized utilities system owners to conduct a self-assessment of the cybersecurity controls they currently use for their ICS. DLA officials stated that they provided this information to ASD (EI&E) to aid decision making on how to approach cybersecurity for these systems. However, DLA officials stated that they did not receive a clear response from ASD (EI&E). DLA officials stated that because there are no procedures that definitively state which, if any, utilities privatization- related information should be categorized as covered defense information, they have been unable to provide clear procedures to the utilities privatization contractors who must implement the clause to safeguard any such information. Moreover, according to DLA officials, some of the utilities privatization contractors were reluctant to modify the contract to incorporate the clause for safeguarding DOD covered defense information because it was unclear how it was to be implemented. Also, Navy officials stated that they have not yet incorporated the clause into any of their utilities privatization contracts because they are waiting for procedures from ASD (EI&E). In addition, DLA and military department officials stated that the current costs associated with implementing the clause are unknown.

Standards for Internal Control in the Federal Government require management to evaluate security threats to information technology, which can come from both internal and external sources, and periodically review policies and procedures for continued relevance and effectiveness in addressing related risks. Information technology refers to processes that are enabled by technology, including ICS, which are computer-controlled systems that monitor or operate physical utility infrastructure, among other things. DLA and military department officials stated they have not begun to implement the requirements in the clause because they are waiting for ASD (EI&E) officials to issue procedures concerning how the military departments are to determine what, if any, covered defense information associated with utilities privatization contracts is provided or developed by the contractor in performance of the contract. Such procedures are needed to help the military departments and DLA take the appropriate steps to implement the defense acquisition regulation clause for their utilities privatization contracts and safeguard covered defense information. An ASD (EI&E) official acknowledged that specific procedures concerning how the military departments are to determine what, if any, information associated with utilities privatization contracts is considered covered defense information are lacking and the office plans to update the policies. However, at the time of our review, it was not clear what that guidance will require.

In the absence of a clear understanding of how to implement the clause requiring the safeguarding of covered defense information, both installation officials and some system owners reported having taken various actions to address and enhance the cybersecurity of ICS associated with privatized utility systems. For example,

An Air Force installation official stated that he and an employee of the privatized utility system worked closely with the installation’s office that handles cybersecurity and followed service guidance to try to ensure mitigation of risks to and the security of the ICS. For example, officials ensured that the ICS could not be accessed remotely and that authorized users are required to use strong passwords. The Air Force official stated that the privatized utility system owner may be required to apply additional cybersecurity measures in the future, depending on what decisions are made regarding the provision to safeguard covered defense information.

A Navy installation official stated that he had no knowledge of what, if any, cybersecurity practices the privatized utility system owner had implemented for the ICS it uses to help operate an electrical distribution system. However, an official from the privatized utility system owner stated that the company has adopted some cybersecurity practices, which have been audited by an independent organization for 3 of the last 4 years, and the company plans to make this a standard part of business operations.

Army officials stated that the installation relies on the privatized utility system owner to employ industry practices for cybersecurity efforts. Officials from the privatized utility system owner stated that the company has robust cybersecurity practices and the ability to continuously monitor the system to detect any unusual activities.

While installation officials and some system owners reported having taken some steps to address and enhance the cybersecurity of ICS associated with privatized utility systems, the lack of procedures may result in uncertainty as to whether covered defense information across utilities privatization contracts is safeguarded by the military departments and DLA. As previously reported, vulnerabilities in ICS can be exploited by various methods, causing loss of data, denial of service, or the physical destruction of infrastructure. Without procedures concerning how the military departments are to determine what, if any, covered defense information is provided to or developed by the contractor in the performance of the utilities privatization contract, the military departments and DLA may not be able to take steps to adequately and consistently protect DOD’s information associated with utilities privatization contracts.

Conclusions

As of January 2017, the military departments have privatized over 600 utility systems, and the Army and the Air Force have plans to privatize more systems in the coming years. While the military departments have some types of information on their privatized utilities, they have not tracked utilities privatization contract performance or developed measurable performance standards, as asked for in the Standards for Internal Control in the Federal Government. In addition, while military department officials stated that they have perceived improvements in utility system reliability since utilities privatization, the military departments have not used contractor-provided data to determine reliability trends over time. Without issuing guidance that requires the military departments and DLA to develop and implement metrics and measurable performance standards to track contract performance for future utilities privatization contracts and to develop similar guidance for current utilities privatization contracts, the department will lack information on the performance of utilities privatization contracts. As a result, ASD (EI&E), the military departments, and DLA may not be able to perform effective program management and oversight for these long-term utilities privatization contracts.

DOD officials stated that they have taken steps to incorporate the clause requiring the safeguarding of covered defense information into many of their utilities privatization contracts, but they have not begun to implement the cybersecurity requirement for those contracts. DLA, Army, and Air Force officials stated they have not begun to implement the cybersecurity requirement for those contracts that include the clause because ASD (EI&E) has not issued specific procedures regarding how the military departments are to determine whether covered defense information is provided to or developed by the contractor in the performance of the utilities privatization contract. The lack of procedures may result in uncertainty as to whether covered defense information across utilities privatization contracts is safeguarded by the military departments and DLA. As previously reported, vulnerabilities in ICS can be exploited by various methods, causing loss of data, denial of service, or the physical destruction of infrastructure. Without procedures concerning how the military departments are to determine what, if any, types of information are considered covered defense information and are provided to or developed by the contractor in the performance of the utilities privatization contract, the military departments and DLA will not be able to adequately and consistently protect DOD’s information associated with utilities privatization contracts.

Recommendations for Executive Action

We are making two recommendations to the Secretary of Defense.

The Secretary of Defense should ensure that the Assistant Secretary of Defense for Energy, Installations, and Environment, in consultation with the military departments, issues guidance requiring the military departments and DLA to develop and implement performance metrics and measurable performance standards to track utilities privatization contract performance for future utilities privatization contracts, and develops similar guidance for current utilities privatization contracts. (Recommendation 1)

The Secretary of Defense should ensure that the Assistant Secretary of Defense for Energy, Installations, and Environment (a) issues procedures concerning how the military departments are to determine what constitutes covered defense information and what, if any, of this information is provided to or developed by the contractor in the performance of utilities privatization contracts, and (b) takes appropriate steps to protect such information. (Recommendation 2)

Agency Comments and Our Evaluation

We provided a draft of this report to DOD for review and comment. In written comments, DOD concurred with both of our recommendations. DOD’s comments are reprinted in their entirety in appendix II. DOD also provided technical comments, which we incorporated as appropriate.

We are sending copies of this report to the appropriate congressional committees, the Secretary of Defense, and the Secretaries of the military departments. In addition, the report is available at no charge on our website at http://www.gao.gov.

If you or your staff members have any questions about this report, please contact Brian Lepore at (202) 512-4523 or LeporeB@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III.

Appendix I: Selected Characteristics of the Department of Defense’s (DOD) Utilities Privatization Contracts Included in GAO’s Review

This appendix provides information on the nine utilities privatization contracts that we selected as case studies to review. Each of seven contracts privatized one utility system, and each of two contracts privatized two utility systems, for a total of 11 utility systems covered by the nine contracts. Table 2 lists selected characteristics of each contract.

Appendix II: Comments from the Department of Defense

Appendix III: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the contact named above, Kristy Williams (Assistant Director), Michael Armes, John Bauckman, Emily Biskup, Vincent Buquicchio, Cаrolyṇn Cаvanаugh, Desiree Cunningham, Michael Gilmore, Simon Hirschfeld, Gina Hoover, Kush Malhotra, Richard Powelson, and Jack Wang made key contributions to this report.

Related GAO Products

Defense Infrastructure: Actions Needed to Strengthen Utility Resilience Planning. GAO-17-27. Washington, D.C., November 14, 2016.

Defense Infrastructure: Improvements in DOD Reporting and Cybersecurity Implementation Needed to Enhance Utility Resilience Planning. GAO-15-749. Washington, D.C., July 23, 2015.

GAO, Defense Infrastructure: Actions Taken to Improve the Management of Utility Privatization, but Some Concerns Remain. GAO-06-914. Washington, D.C.: September 5, 2006.

Defense Infrastructure: Management Issues Requiring Attention in Utility Privatization. GAO-05-433. Washington, D.C.: May 12, 2005.