In November 2014, the Secretary of Defense directed DOD to address the 2014 nuclear enterprise reviews’ recommendations and directed CAPE to track and assess these implementation efforts. The Joint Staff, Navy, Air Force, offices within the Office of the Secretary of Defense, and U.S. Strategic Command are supporting CAPE’s efforts. The Secretary also established the Nuclear Deterrent Enterprise Review Group (NDERG), a group of senior officials chaired by the Deputy Secretary of Defense and including the Vice Chairman of the Joint Chiefs of Staff, to oversee and make decisions regarding implementation of the nuclear enterprise reviews’ recommendations. The NDERG is supported by a Nuclear Deterrent Working Group, which meets biweekly and reviews the status of recommendations, and a Nuclear Deterrent Senior Oversight Group, which meets quarterly and reviews any recommendations that the Working Group believes are ready for the NDERG to close. The Deputy Secretary of Defense updates the Secretary of Defense on NDERG progress as requested. CAPE compiled the recommendations from the two 2014 nuclear enterprise reviews and a memorandum from the Commander of U.S. Strategic Command that identified several additional recommendations. In total, CAPE identified 175 distinct recommendations from the three documents. CAPE then identified 247 sub-recommendations from recommendations directed to multiple services (or other DOD components)—for example, if a recommendation was directed to the Air Force and the Navy, then one sub-recommendation was made to the Air Force and one sub-recommendation was made to the Navy. CAPE then worked with the services to identify offices of primary responsibility for implementing actions to address the recommendations, any offices of coordinating responsibility, and any resources necessary to implement each recommendation. CAPE has developed a tracking tool to collect information on progress in meeting milestones and metrics. This tracking tool identifies offices of responsibility, implementation actions, milestones, and metrics to measure the effectiveness of the actions taken toward implementing each of the recommendations. The tracking tool currently contains hundreds of unique milestones and metrics, and according to CAPE officials, additional milestones and metrics are included as they are identified. The Air Force and the Navy also developed their own methods of tracking their service-specific recommendations. We reviewed DOD’s processes for implementing the 2014 nuclear enterprise reviews’ recommendations and issued a report on July 14, 2016. We found that the process DOD had developed for implementing and tracking the 2014 nuclear enterprise reviews’ recommendations generally appeared consistent with relevant criteria from the Standards for Internal Control in the Federal Government—including using and effectively communicating quality information and performing monitoring activities. As we reported in July 2016, CAPE officials stated that it would take about 3 years to see measurable improvements in the health of the nuclear enterprise and 15 years to implement the great majority of the recommendations and measure whether they have had their intended effects. CAPE and service officials have noted that it would take years for some of the recommended cultural changes to manifest. NC3 is a large and complex system comprised of numerous land-, air-, and space-based components used to assure connectivity between the President and nuclear forces. NC3 is managed by the military departments, nuclear force commanders, and the defense agencies and provides the President with the means to authorize the use of nuclear weapons in a crisis. NC3 systems support five important functions: Force management: assignment, training, deployment, maintenance, and logistics support of nuclear forces before, during, and after any crisis. Planning: development and modification of plans for the employment of nuclear weapons and other options. Situation monitoring: collection, maintenance, assessment, and dissemination of information on friendly forces, adversary forces and possible targets, emerging nuclear powers, and worldwide events of interest. Decision making: assessment, review, and consultation that occur when the employment or movement of nuclear weapons is considered. Force direction: implementation of decisions regarding the execution, termination, destruction, and disablement of nuclear weapons. As recommended in the 2015 NC3 report, the Council on Oversight of the National Leadership Command, Control, and Communications System (the Oversight Council) has taken a lead role in providing oversight and making the final determination on the implementation status of that report’s 13 recommendations. The Oversight Council is co-chaired by the Under Secretary of Defense for Acquisition, Technology, and Logistics and the Vice Chairman of the Joint Chiefs of Staff and its members are the Under Secretary of Defense for Policy; the Commander, U.S. Strategic Command; the Commander, North American Aerospace Defense Command/U.S. Northern Command; the Director, National Security Agency; and the DOD Chief Information Officer. Additional organizations, such as CAPE, may participate in the Oversight Council’s meetings to provide subject matter expertise. The Oversight Council is supported by the Executive Management Board—a functional governance committee chaired by the DOD Chief Information Officer. DOD CIO tracks the implementation of the 2015 NC3 report’s recommendations, among other activities. DOD and the military services set standards to ensure that personnel who work with nuclear weapons and nuclear weapons systems, NC3 systems and equipment, and special nuclear material are reliable, trustworthy, and capable of performing their assigned nuclear weapons-related mission. Nuclear surety generally refers to DOD’s efforts to ensure that nuclear weapons and materials are safe, secure, reliable, and controlled. DOD and the military services use personnel reliability assurance programs— the Personnel Reliability Program and the Air Force’s Arming and Use of Force program for Air Force security forces—to implement these nuclear surety requirements for personnel. When personnel are assigned to a nuclear unit, relevant unit commanders certify that those personnel meet the personnel reliability assurance program standards. Commanders can also suspend or decertify personnel from working with nuclear weapons if they fail to meet these standards during their service. Factors that may lead to suspension or decertification include medical issues; personal conduct; emotional, mental and personality disorders; financial problems such as an inability or unwillingness to satisfy debts or the presence of unexplained wealth; criminal conduct; sexual harassment or assault; misuse of drugs or alcohol; and security violations. According to DOD data, as of December 31, 2016, there were 10,603 DOD personnel certified under the Personnel Reliability Program and 36,464 security forces personnel certified under the Air Force’s Arming and Use of Force program. Together, there were a total of 47,067 personnel that met the personnel nuclear surety requirements of a personnel reliability assurance program (see table 1). DOD and the military services have made progress in implementing recommendations to improve the defense nuclear enterprise but could improve their efforts by identifying additional performance measures, milestones, and associated risks. CAPE and DOD CIO have separate processes for tracking and evaluating DOD’s progress in implementing the recommendations from the 2014 nuclear enterprise reviews and the 2015 NC3 report, respectively. The NDERG has closed 77 of the 247 sub-recommendations from the 2014 nuclear enterprise reviews following CAPE’s assessment of implementation actions that had been taken by the military services and other DOD components (see fig. 1). For example, with regard to Nuclear Weapons Technical Inspections, the independent 2014 nuclear enterprise review recommended that inspection teams not focus on auditing records but instead examine the processes in place to inform commanders of Personnel Reliability Program issues. In response, DOD, the Air Force, and the Navy have made changes to their inspection processes and the Joint Chiefs of Staff have updated the Nuclear Weapons Technical Inspections guidance to de-emphasize records reviews in favor of knowledge checks and scenario-based discussion during the Personnel Reliability Program portion of these inspections. After reviewing these actions, the NDERG closed this recommendation in December 2016. The 77 closed sub-recommendations make up 62 of the initial 175 recommendations from the 2014 nuclear enterprise reviews. According to DOD CIO officials, as of March 2017, the Oversight Council has closed two of the 13 recommendations from the 2015 NC3 report, and DOD is making progress in implementing the remaining 11 recommendations (see fig. 2). The two closed recommendations are to (1) make the Oversight Council the synchronizing body to evaluate, track, and resolve the findings and recommendations made in that report and (2) broaden Air Force Global Strike Command’s responsibilities to include serving as the lead command for all of the Air Force-owned portions of the NC3 systems. DOD has made progress in implementing the remaining 11 recommendations. For example, the 2015 NC3 report recommended that U.S. Strategic Command review and validate the availability requirements of one of the NC3 systems, which the command has now completed. Additional detail about DOD’s progress is omitted because the information is classified. DOD’s processes for tracking and evaluating its progress in implementing the 2014 nuclear enterprise reviews’ recommendations do not consistently identify and document risks, and its processes for tracking and evaluating its progress in implementing the 2015 NC3 report’s recommendations do not identify performance measures, milestones, or risks. Identifying performance measures, milestones, and associated risks can help an agency to track and evaluate its progress toward completing tasks over time and can help to inform decision makers of potential issues that need to be addressed. We have previously reported that by tracking and developing a performance baseline for all performance measures, agencies can better evaluate whether they are making progress and their goals are being achieved. Similarly, Standards for Internal Control in the Federal Government emphasizes using performance measures and milestones to assess performance over time. We have also derived leading practices from the Government Performance and Results Act of 1993 (GPRA) and the GPRA Modernization Act of 2010, such as clearly defining performance measures and milestones and assessing program results against them. Additionally, Standards for Internal Control in the Federal Government states that management should identify, analyze, and respond to risks related to achieving the defined objectives and should use and internally communicate the necessary quality information in meeting those objectives. CAPE is working with the military services and other DOD components to track and evaluate the implementation actions taken in response to the recommendations from the 2014 nuclear enterprise reviews; however, risks associated with these actions are not consistently identified and documented. In July 2016, we reported on CAPE’s use of a centralized tracking tool that contains relevant information about the status of the actions taken in response to those recommendations. CAPE continues to use this tool, and it remains accessible to the services and other DOD entities on DOD’s classified network. As shown in figure 3, it includes fields for the underlying problem statement, or root cause, for the recommendation; time frames with milestones for implementing the recommendations; and performance measures (referred to as metrics in the tracking tool) to assess the effectiveness of the actions taken. The tracking tool also contains a field for Key Risks and Issues, but we found that this field has not been used consistently. According to CAPE officials, CAPE is using the tracking tool to track progress in meeting milestones and record the metrics it has identified to assess both the progress (through “process metrics”) and the effectiveness of the implementation actions (through “outcome metrics”). The outcome metrics are selected to aid CAPE in determining whether implemented recommendations have addressed the underlying problem that was the impetus for the original recommendation. CAPE used the outcome metrics to inform its assessment of each of the 77 sub- recommendations that the NDERG then closed. According to CAPE officials, CAPE’s approach to measuring effectiveness is to gather supporting data from the services and measure the effectiveness of each recommendation separately. However, these officials noted that until a recommendation has been implemented, CAPE cannot fully assess the effectiveness of the implementation actions. Some recommendations— including changing a service’s culture or morale—will take time to evaluate. According to CAPE officials, the tracking tool currently contains 389 unique metrics and 370 unique milestones to aid in the assessment of the implementation actions. For each of these metrics and milestones, the tracking tool includes expected completion dates and indicates which have been met and which are behind schedule. Additional milestones, particularly for actions more than 18 months out, and additional metrics to aid in measuring the effectiveness of actions taken, are still being identified, according to CAPE officials. In December 2016, the Deputy Secretary of Defense issued a memorandum that directed the transition of the tracking and analysis responsibilities related to implementing the 2014 nuclear enterprise reviews’ recommendations from CAPE to the military departments and other DOD entities. However, CAPE remains responsible for providing guidance to inform the analyses conducted by other DOD entities, overseeing the analyses, and assessing recommendations for closure. The aim of these changes was to enhance ownership and embed the principles of robust analysis, continuous monitoring, and responsibility throughout the department. As part of this transition, CAPE provided the military departments and other DOD entities with guidance to aid in their tracking and analysis of the recommendations from the 2014 nuclear enterprise reviews, but this guidance does not require the military services and other DOD components to identify and document risks prior to bringing a recommendation for closure. This guidance emphasizes using performance measures and milestones to track and measure the progress of implementation actions. It includes sections tailored to specific groups of recommendations from the 2014 nuclear enterprise reviews. It also calls for the consideration of potential risks that unintended consequences could occur when a recommendation is brought for closure, but it does not call for risks to be identified, assessed, or documented prior to that time. According to officials from CAPE and the military services, the department considers risks in a number of ways and does capture information about some risks. For example, CAPE has supplemented its review of the military services’ proposed budgets by conducting a review of funding risks related to the nuclear enterprise in areas such as modernization, investment, and personnel. CAPE briefs the results of this review to senior leadership within the NDERG to provide them information about whether the services are including funds to address these items in their yearly budget requests. Additionally, CAPE personnel have identified key risks regarding some of the recommendations and have entered this information into the centralized tracking tool. According to CAPE officials, 63 of the 247 sub-recommendations include information in the Key Risks and Issues field in the tracking tool. However, these officials told us that none of the remaining 184 sub-recommendations include information in this field, because either no key risks or issues were identified or the risks that were identified were not formally documented within the tool. Additionally, risks that are introduced as a result of actions taken to implement a recommendation are not consistently included in the centralized tracking tool or otherwise documented by CAPE. For example, according to Navy and CAPE officials regarding a recommendation to increase the number of skilled shipyard workers to keep up with the maintenance demands of ballistic missile nuclear submarines, the centralized tracking tool documents the risks as the need to complete hiring and training of new shipyard personnel. However, according to Navy officials, the risks resulting from the prioritization of maintenance of ballistic missile nuclear submarines over other vessels not associated with the nuclear deterrent mission, such as fast attack submarines and nuclear aircraft carriers, were discussed and accepted by the Navy, but not documented in the centralized tracking tool. Similarly, the risks associated with recommendations that the Air Force provide additional incentive pay for personnel serving in nuclear positions were identified but not documented in the centralized tracking tool prior to implementation and closure. According to a CAPE official, the Nuclear Deterrent Working Group determined that implementing incentive pay could negatively affect morale, because some Air Force personnel in nuclear positions are not eligible to receive this additional pay. The official stated that the Nuclear Deterrent Senior Oversight Group was briefed on this risk and responded by requesting updates from the Air Force’s annual review on the effectiveness of this incentive pay. The department is not consistently identifying and documenting risks associated with the recommendations, because CAPE’s guidance does not direct the military services and DOD components to document and update information on risk in the centralized tracking tool. According to CAPE officials, since the release of the December 2016 memorandum directing the transition of the tracking and analysis responsibilities for the 2014 nuclear enterprise reviews’ recommendations from CAPE to the military departments and other DOD components, the military services have not, to date, formally identified any key risks for inclusion in the centralized tracking tool. According to one Air Force official, the Air Force identifies and responds to risks through its day-to-day operations; however, this information is not captured by the tracking tool or otherwise documented. According to a CAPE official, additional guidance on documenting risk could encourage the military services and DOD components to capture risks that they have identified in the tracking tool. In a November 2014 memo announcing the department’s response to the nuclear enterprise reviews, the Secretary of Defense stated that the nuclear deterrent plays a critical role in assuring U.S. national security and that it is DOD’s highest priority mission. The Independent Review of the Department of Defense Nuclear Enterprise found that the avoidance of managing risks by many leaders within the enterprise resulted in adverse impacts to the mission. The review noted that avoiding risk by avoiding the problem until it becomes a major issue is a near inevitable outcome of risk-averse cultures and that, too often, it takes a significant event for the leadership to recognize major problems within the force. Similarly, the Internal Assessment of the Department of Defense Nuclear Enterprise stated that many of the senior leaders within DOD and the military services were not cognizant of the problems faced by the enterprise. According to that review, many issues were already being reported through internal self-assessments, but many senior leaders within DOD and the military services were not aware of the conclusions of these self-assessments and so were unable to take action to address them. Given the critical role the nuclear enterprise plays in national security, and given the challenges the Independent Review of the Department of Defense Nuclear Enterprise identified with respect to managing risks and communicating them across the defense nuclear enterprise, it is essential that risks be consistently identified and documented. By documenting information on risks in its centralized tracking tool, DOD could enhance its ability to provide oversight of the recommendations throughout its review processes in the military services, the Nuclear Deterrent Working Group, the Nuclear Deterrent Senior Oversight Group, and the NDERG. By developing additional guidance for identifying and documenting information about these risks, CAPE can also aid the components of the defense nuclear enterprise in their efforts to communicate and formulate responses to the risks—either by deliberately determining to accept the risk or by taking steps to avoid, reduce, or share the risk across the enterprise. DOD CIO uses an internal spreadsheet to track the implementation of the 13 recommendations from the 2015 NC3 report, but it has not identified performance measures, milestones, or associated risks to evaluate these actions. This spreadsheet includes fields for indicating whether an execution plan exists, the operational impact from implementing the recommendation, forecast closeout (which lists the responsible DOD component or designates the status of the recommendation), and follow- up actions to be taken after a recommendation is closed. Figure 4 shows the layout of this spreadsheet. According to DOD CIO officials that we met with, DOD CIO shares information about the status of the 2015 NC3 report recommendations through meetings with the DOD entities with primary responsibility for implementing the recommendations. However, there is currently no centralized collection of metrics, milestones, and other information with the same level of detail that CAPE had developed and is using for the 2014 nuclear enterprise reviews’ recommendations. According to DOD CIO officials, they are working with the offices of primary responsibility to expand on the current content of the internal tracking spreadsheet. These officials stated that while they had drafted a template to contain the expanded content, it has not yet been approved by the Oversight Council. This draft template contains fields similar to those CAPE developed and the department uses for tracking the department’s progress in implementing the recommendations from the 2014 nuclear enterprise reviews. When approved and implemented, this template will provide a form that could be used for documenting performance measures, milestones, and risks for these 2015 recommendations, once this information is identified. Identifying and sharing performance measures, milestones, and risks could aid DOD CIO in tracking and evaluating DOD’s efforts to implement the 2015 NC3 report recommendations. DOD CIO could improve its efforts to track DOD’s progress in addressing the recommendations by identifying performance measures and milestones as part of the effort it has initiated to expand on the content of its tracking spreadsheet. DOD CIO could also use performance measures to evaluate the actions DOD has taken and determine whether the actions have fully addressed the root cause of the recommendation. DOD officials leading some of the recommendation implementation efforts told us that a number of the issues identified in the 2015 NC3 report stem from enduring problems. These officials noted that an overemphasis on identifying easily attainable performance measures and closing recommendations quickly may improve the overall percentage of recommendations implemented but also could result in underlying root causes continuing to go unaddressed. Our prior work on performance measurement has identified several important attributes—such as the inclusion of baseline and trend data— that performance measures must have if they are to be effective in monitoring progress and determining how well programs are achieving their goals. Additionally, by identifying and communicating risks to NC3 stakeholders, DOD leadership may be in a better position to formulate responses to these risks—including deliberately determining to accept the risk or take steps to avoid, reduce, or share the risk across the defense nuclear enterprise. Promoting the sharing of quality information on the status of the recommendations and potential risks from the 2015 NC3 report among the services and other DOD components with a role in NC3 could help DOD to integrate its nuclear deterrent efforts and help decision makers to formulate responses to any potential risks. The DOD CIO officials that we met with said that it will be important to incorporate performance measures and milestones into their tracking and evaluation process and to consider operational risk and its management when discussing effects on the nuclear enterprise and its NC3 systems. The draft template that DOD CIO is developing, once it is finalized and implemented, could aid the department in identifying performance measures and milestones for these 2015 recommendations in the same way that the centralized tracking tool CAPE developed has been used to collect performance measures and milestones for the 2014 recommendations. In addition, including an assessment of risks associated with the implementation of the recommendations from the 2015 NC3 report similar to the follow-up to the recommendations of the 2014 nuclear enterprise reviews could enhance DOD’s ability to provide oversight of the recommendations and make informed responses to address any identified risks throughout its review processes, all the way to their closure by the Oversight Council. DOD and the military services have implemented changes to their personnel reliability assurance programs in response to 17 recommendations from the 2014 nuclear enterprise reviews. DOD has identified nine essential elements of reliability and released updated guidance to refocus personnel reliability on these elements. Additionally, the Air Force has incorporated these nine essential elements into its Arming and Use of Force program, allowing the Air Force to use this program to ensure that its security forces meet nuclear surety requirements. The Air Force has also created a new office within the Air Force Personnel Center, the Personnel Reliability Program Administrative Qualification Cell, to assist with the administrative review process for personnel newly assigned to Personnel Reliability Program positions or returning to Personnel Reliability Program positions after working elsewhere. In response to both the personnel recommendations and the inspections-related recommendations of the 2014 nuclear enterprise reviews, the Joint Staff, the Navy, and the Air Force have made changes to the procedures they use to conduct nuclear personnel reliability inspections at nuclear facilities. In response to recommendations from the 2014 nuclear enterprise reviews, the Joint Staff led a review of the department’s guidance on the personnel reliability assurance program. The Joint Staff, with the assistance of the military services, identified nine elements from DOD’s personnel reliability assurance requirements that it considered essential to ensure that personnel working with nuclear weapons fully met nuclear surety standards of reliability and trustworthiness. These nine essential elements are that an individual must 1. be a U.S. citizen 2. have a security clearance and be reinvestigated every five years 3. be fully qualified for the position in which he or she will serve 4. have reliability verified by the commander before being assigned to a Personnel Reliability Assurance Program position 5. be continuously monitored by peers, supervisors, and commander for issues that could affect reliability 6. have his or her personnel file checked for issues that could affect 7. undergo a medical evaluation to identify any conditions that could 8. have a personal interview with the commander who will be assessing 9. exhibit the character and competence to do the job, including allegiance to the United States and a positive attitude toward nuclear weapons In response to the Joint Staff review, the Office of the Assistant Secretary of Defense for Nuclear Matters, through the Office of the Under Secretary of Defense for Acquisition, Technology and Logistics, issued a new version of the Personnel Reliability Program manual in January 2015, followed by a reissue and renaming of the overarching DOD instruction— changing the name to DOD Nuclear Weapons Personnel Reliability Assurance—in April 2016. This guidance requires that all DOD personnel occupying positions subject to nuclear personnel reliability assurance program standards must meet the nine essential elements of reliability. Additionally, the revised guidance removed a procedure for temporary decertification, which under the previous guidance was to occur immediately on receipt of information that was, or appeared to be, a reason for decertification. The manual also makes it clear that personnel reliability assurance programs are the commanders’ programs, and the commander is exclusively accountable for determining the fitness for duty of individuals subject to the program. The updated manual also provides some clarity regarding requests for reinstatement by personnel who had previously been decertified from the Personnel Reliability Program. The military services have responded to DOD’s changes by updating their own guidance. The Navy has released a new version of its department- specific Personnel Reliability Program manual, applicable to the Navy and Marine Corps, and Army officials told us that the Army plans to release a new version of its manual in early 2018. The Air Force has released a new version of its Personnel Reliability Program manual, in addition to other guidance changes. Specifically, in response to a provision in DOD’s updated personnel reliability guidance that authorizes the military departments to develop reliability guidance specific to their security force personnel guarding nuclear weapons, the Air Force has made changes to its Arming and Use of Force program. Air Force Arming and Use of Force standards include qualification requirements under which all Air Force security forces, whether assigned to a nuclear facility or a non-nuclear facility, are authorized to carry a weapon as part of their official duties. In addition, Air Force nuclear security forces no longer require separate Personnel Reliability Program certification, as they previously did. The 2014 nuclear enterprise reviews determined that requiring nuclear security forces to meet the standards of two reliability programs at the same time was redundant. Air Force officials told us that utilizing the two reliability programs caused manning problems for the Air Force, because the availability of security force personnel qualified under both programs was limited. As a result of the changes to DOD’s guidance, the Air Force rewrote its Arming and Use of Force guidance to incorporate a new chapter that outlines procedures for assessing security forces against each of the nine essential elements of reliability. This change has allowed the Air Force to use its Arming and Use of Force program as its sole method of establishing personnel reliability assurance for Air Force security force personnel. The Air Force continues to use its Personnel Reliability Program to certify nuclear operators and maintainers. Prior to the implementation of its new version of Arming and Use of Force standards, the Air Force conducted an assessment of the new Arming and Use of Force reliability standards as the sole standard for security forces at six Air Force installations (four nuclear installations and two non- nuclear installations), to identify any gaps or areas for improvement of the new guidance prior to its Air Force-wide implementation. The assessment found that the new Arming and Use of Force standard adequately addressed the nine essential elements required of a personnel reliability assurance program, streamlined monitoring of security forces for commanders by merging the Arming and Use of Force standards with the Air Force Personnel Reliability Program standards, and held the security force personnel to a higher standard to perform armed duty. The Air Force fully implemented its new version of Arming and Use of Force standards across the service in February 2016. As a result of the Air Force’s changes to its Arming and Use of Force guidance, Air Force security forces are now qualified to serve at nuclear facilities and do not need to certify under the Personnel Reliability Program (see fig. 5). Air Force officials told us that requiring security forces to qualify under Arming and Use of Force standards had helped to address manning challenges among nuclear security forces, as well as allowing the Air Force to move experienced security forces personnel from non-nuclear facilities to nuclear assignments. According to several Air Force officials in command of security forces at non-nuclear installations, the changes to the Arming and Use of Force guidance have led to a slight increase in administrative work but have been an overall positive development, in part due to improvements in communication with medical personnel about factors that may affect a determination that an airman should not be armed. All Air Force security force personnel are required to meet the standards of Arming and Use of Force to carry a firearm and perform many of their duties. The Air Force implemented the new version of the Arming and Use of Force standards in 2016. According to Air Force officials, during the implementation, the Air Force decided that security force personnel who were, at that time, disqualified or permanently decertified under the Personnel Reliability Program would not be allowed to certify under the new version of Arming and Use of Force until they had been restored to eligibility for the Personnel Reliability Program. In early 2016, the Air Force conducted a review of 3,167 security force personnel who had previously been decertified or disqualified from the Personnel Reliability Program. The Air Force determined that 2,628 of these personnel were able to attain Personnel Reliability Program eligibility during this review, while 539 were not. Because qualifying under the new version of Arming and Use of Force is now a positional requirement, Air Force officials noted that those who do not qualify must retrain for a different job or separate from the Air Force. Air Force officials told us that the security forces career field received a greater number of new security forces personnel than they had been allocated in previous years to account for the loss of personnel who were unable to qualify under the new Arming and Use of Force standards. The Air Force tracks metrics from the Personnel Reliability Program and from the Arming and Use of Force program on an annual basis. Air Force officials told us that they have not yet reviewed the extent to which the changes to Arming and Use of Force made in February 2016 have been effective. Air Force and DOD officials told us that they are waiting until sufficient data are available before making additional changes to the guidance for their personnel reliability assurance program. The Air Force is currently developing a nuclear enterprise health assessment, which will include further assessment of the effects of the changes the Air Force has made to its Personnel Reliability Program and Arming and Use of Force guidance. Air Force officials told us that data collection for this assessment began in the spring of 2017 and that the first summary report will be released in September-October 2017. Once implemented, this Air Force nuclear health assessment will provide an overarching assessment on a periodic basis, similar to a biennial assessment that the Navy conducts of the Navy nuclear enterprise. Unlike the Air Force, the Navy and the Army have opted not to develop separate guidance on nuclear personnel reliability assurance for their security forces personnel. Navy and Army officials told us that there was no reason to create separate guidance for their security forces personnel because, unlike the Air Force, they have not faced manning challenges or administrative burdens related to these positions. The Air Force has a much larger nuclear security force, and personnel transfer between nuclear and non-nuclear facilities more frequently within the Air Force than the other services. The Navy fills security forces positions at the two Navy nuclear facilities with Navy and Marine Corps personnel who report directly from training. According to a Marine Corps official, once these personnel move on to non-nuclear assignments, they generally do not return to nuclear security positions. Army officials told us that their nuclear security forces are highly specialized, very few in number, and serve at only one facility. The Air Force has taken additional steps to improve the Personnel Reliability Program by creating the Air Force Personnel Reliability Program Administrative Qualification Cell to aid with the review of non- security force personnel (e.g., operations personnel, maintenance personnel) as they transition into Personnel Reliability Program positions. Personnel transferring into these positions are subject to an administrative qualification process, which includes a review of their personnel file, medical information, and security clearance information as well as an interview by the new, gaining, commander to assess them for factors that affect their reliability. Prior to October 2015, the commander for the unit that the individual was leaving reviewed the individual’s administrative paperwork and then provided an assessment of the individual’s reliability under the Personnel Reliability Program standards to the commander of the gaining unit. Because this initial review was often conducted by commanders outside of the nuclear field, they had less experience than nuclear commanders in conducting such an assessment. According to Air Force officials, this lack of experience often resulted in the standards being applied either too stringently or too loosely and the initial reviews often being completed late. Additionally, although Air Force guidance indicated that personnel transferring directly from one Personnel Reliability Program position to another were not required to undergo administrative qualification, one of the 2014 nuclear enterprise reviews found that some administrative file reviews were occurring. As of November 2016, the Air Force Personnel Reliability Program Administrative Qualification Cell has been staffed by personnel experienced with the standards, and they assist in conducting reviews of many of the Air Force personnel moving to nuclear assignments. The cell performs the administrative review formerly conducted by the commander of the individual’s losing unit and provides a recommendation to the commander of the gaining unit before that commander makes an assessment (see fig. 6). As a result, according to Air Force officials, the qualification process is now completed more quickly, and the administrative burden on commanders has been lessened. Officials from the Air Force Personnel Center told us that the Personnel Reliability Program Administrative Qualification Cell was currently assisting all Air Force Major Commands but had not yet begun working with all Personnel Reliability Program units. In addition, in response to a recommendation from the 2014 nuclear enterprise reviews, the Air Force has eliminated administrative reviews that some commands were conducting of personnel transferring directly from one Personnel Reliability Program position to another, but which were not required in the Air Force’s guidance. These personnel have remained subject to continuous monitoring, so they do not require new administrative qualification reviews. DOD, the Air Force, and the Navy also made changes to their nuclear inspections processes in response to the 2014 nuclear enterprise reviews. Nuclear units are subject to a number of different inspections. For example, Joint Staff guidance requires that each of the services conduct Nuclear Weapon Technical Inspections biennially at each of their nuclear units. These inspections are intended to examine every aspect of the nuclear mission at that unit, including the processes of the personnel reliability assurance program. Because of the importance of maintaining nuclear surety by keeping nuclear weapons safe and secure, units that receive an unsatisfactory rating on an inspection may be decertified from conducting operations or have a portion of their nuclear capabilities withdrawn and retain only a limited nuclear capability in mission areas that would not jeopardize the safety, security, or reliability of the nuclear weapons. The 2014 nuclear enterprise reviews found that inspections of nuclear forces occurred too frequently, and that the procedures for inspections of personnel reliability assurance programs had become overly burdensome because of their focus on records review. The reviews found that, as a result, these personnel reliability assurance programs had become dominated by processes that were intended to prepare for inspections, rather than to ensure personnel reliability. Before the 2014 nuclear enterprise reviews, DOD personnel working with nuclear weapons were subject to frequent inspections by multiple organizations. According to DOD officials, Air Force major commands and Navy commands were performing inspections at nuclear units under their control every 18 months. One such inspection was conducted as a combined military service and Defense Threat Reduction Agency inspection. Each service inspected additional specific areas. For Navy units, the Navy inspectors would accept the Defense Threat Reduction Agency inspection report and the Navy inspectors would review additional, service-specific items; this resulted in a larger number of inspectors present. For Air Force units, the combined inspection was performed concurrently, with the Air Force inspecting the same items as the Defense Threat Reduction Agency inspectors as well as reviewing additional, service-specific items; this resulted in two separate inspection teams. The 2014 nuclear enterprise reviews found that a mistake by a single individual could result in an entire submarine or wing receiving an unsatisfactory rating—even in cases not involving a clear, critical error—potentially leading to the withdrawal of their nuclear weapons capabilities. The Independent Review of the Department of Defense Nuclear Enterprise found that the high frequency of inspections resulted in nuclear units spending significant time preparing for inspections rather than focusing on performing their mission. The Independent Review of the Department of Defense Nuclear Enterprise also stated that the portions of these inspections concerned with the personnel reliability assurance program were heavily focused on records review, especially at Air Force nuclear units. During each inspection, inspectors would review hundreds of personnel files and medical records to assess whether the commander and medical staff had made the correct decision in determining an individual to be reliable. Air Force officials told us that commanders and their medical staffs could be found deficient for improperly certifying individuals as reliable even if these individuals had been able to perform their duties without any issues—for example, after routine medical procedures like a regular check-up with an eye doctor. As a result, commanders and medical staff at these units implemented additional procedures beyond those outlined in DOD guidance, such as temporarily suspending personnel from Personnel Reliability Program duties for every off-base medical appointment regardless of whether it could affect their reliability. Additionally, according to the Internal Assessment of the Department of Defense Nuclear Enterprise, inspectors also cited minor administrative deficiencies that were unrelated to personnel reliability, such as using the improper color of ink to fill out a form. To address the recommended improvements identified by the 2014 nuclear enterprise reviews, DOD has updated its inspection procedures. The Joint Staff has updated the Nuclear Weapons Technical Inspections guidance to reduce the frequency of inspections at nuclear units from every 18 months to every 24 months. DOD’s Defense Threat Reduction Agency no longer conducts joint inspections with the services but is responsible for providing oversight of the services’ inspectors on behalf of the Chairman of the Joint Chiefs of Staff. For the portion of the inspection concerned with personnel reliability assurance, the updated guidance de-emphasizes records reviews in favor of focusing on processes and procedures through observation, interviews, and scenario- based discussions. The Navy and the Air Force have also updated their inspection procedures to implement these changes in DOD’s guidance. For example, Air Force inspectors do not conduct records checks unless the interviews and scenario-based discussions reveal a lack of procedural knowledge. Similarly, Navy officials stated that Navy inspectors review additional records as needed if a lack of procedural knowledge is revealed. To aid the Navy in assessing the overall effectiveness of the updated inspection procedures, the Navy has opted to also review a sample of the health records of personnel recently certified or reinstated into the Personnel Reliability Program. According to Air Force officials at one nuclear wing that had recently undergone a Nuclear Weapons Technical Inspection, the changes to inspection procedures for their personnel reliability assurance programs that DOD and the Air Force have implemented have had a positive effect. These officials stated that the increased use of scenario-based discussions and knowledge checks, combined with inspectors taking a less adversarial and more conversational discussion approach to their inspection inquiries, has resulted in an environment where personnel feel more comfortable self-disclosing problems or mistakes, and where the focus of the inspection is on process improvement rather than on identifying administrative errors, independent of whether the errors were substantive deficiencies. DOD has taken steps to improve the defense nuclear enterprise in response to the 2014 nuclear enterprise reviews and the 2015 NC3 report. The processes CAPE has developed to track and evaluate continuing progress to improve the defense nuclear enterprise—including changes in DOD’s and the military services’ approaches to administering their personnel reliability assurance programs—provide a good framework for continually monitoring the department’s efforts. This framework is also a good example of how similar efforts to implement and oversee actions on department-wide improvements on a wide range of subjects could be made effectively. By developing additional guidance to identify and document risks associated with implementing the recommendations from the 2014 nuclear enterprise reviews and identifying and communicating performance measures, milestones, and risks for the 2015 NC3 report recommendations, the department— particularly through the NDERG and the Oversight Council for NC3— would be better positioned to ensure that progress continues to be made, underlying problems are addressed, and risks are mitigated or accepted after considering the predictable and desirable results. We are making the following two recommendations to DOD: CAPE, in coordination with the military departments and other DOD entities serving as offices of primary responsibility for implementing the recommendations, develop additional guidance for these offices to identify associated risks and document information about these risks in the centralized tracking tool. (Recommendation 1) DOD CIO—in coordination with CAPE, the military departments, Joint Staff, and U.S. Strategic Command—as the draft template and any other additional tools to aid in their approach are finalized, identify and communicate to NC3 stakeholders performance measures and milestones to assist in tracking the progress of implementation of the recommendations from the 2015 NC3 report and evaluating the outcomes of implementation actions, and risks associated with the implementation of the recommendations from the 2015 NC3 report. (Recommendation 2) We provided a draft of the classified report to DOD for comment. In its comments, reproduced in appendix I, DOD concurred with both of our recommendations. In response to our first recommendation, DOD indicated that the Director, CAPE, will issue supplementary guidance for the relevant DOD components to identify and document key risks related to implementation of recommendations from the 2014 reviews, risks related to implementation of alternate approaches, and potential unintended consequences. In response to our second recommendation, DOD stated that DOD CIO will work with the stakeholders of the Council on Oversight of the National Leadership Command, Control, and Communications System to identify and document performance measures and milestones associated with progress toward the recommendations from the 2015 NC3 report, as well as the risks related to implementation of these recommendations. We are encouraged that DOD is planning to take these actions and believe that, once they have been completed, the department will be better positioned to ensure that progress in implementing the recommendations from both the 2014 nuclear enterprise reviews and the 2015 NC3 report continues to be made, underlying problems within the defense nuclear enterprise are addressed, and risks are mitigated or accepted after deliberate consideration. DOD also provided technical comments, which we incorporated as appropriate. We are sending copies of this report to the appropriate congressional committees, and to the Secretary of Defense; the Under Secretary of Defense for Acquisition, Technology, and Logistics; the Chairman of the Joint Chiefs of Staff; the Secretaries of the Army, of the Navy, and of the Air Force; the Commandant of the Marine Corps; the Commander, U.S. Strategic Command; the Department of Defense Chief Information Officer; and the Director of the Office of Cost Assessment and Program Evaluation. In addition, the report is available at no charge on the GAO website at http://www.gao.gov If you or your staff have any questions about this report, please contact me at (202) 512-9971 or KirschbaumJ@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix II. In addition to the contact named above, key contributors to this report were Penney Harwell Caramia, Assistant Director; Chris Cronin; R. Scott Fletcher; Jonathan Gill; Brent Helt; Douglas Hunker; Joanne Landesman; Marc Molino; Amie Lesser; Pamela Davidson; and Michael Shaughnessy. Nuclear Weapons Sustainment: Budget Estimates Report Contains More Information than in Prior Fiscal Years, but Transparency Can Be Improved. GAO-17-557. Washington, D.C.: July 20, 2017. Nuclear Weapons: DOD Assessed the Need for Each Leg of the Strategic Triad and Considered Other Reductions to Nuclear Force. GAO-16-740. Washington, D.C.: September 22, 2016. Defense Nuclear Enterprise: DOD Has Established Processes for Implementing and Tracking Recommendations to Improve Leadership, Morale, and Operations. GAO-16-597R. Washington, D.C.: July 14, 2016. Nuclear Weapons Sustainment: Improvements Made to Budget Estimates Report, but Opportunities Remain to Further Enhance Transparency. GAO-16-23. Washington, D.C.: December 10, 2015.

Summary: In 2014, the Secretary of Defense directed two reviews of DOD's nuclear enterprise. These reviews identified problems with leadership, organization, investment, morale, policy, and procedures, as well as other shortcomings that adversely affected the nuclear deterrence mission. The reviews also made recommendations to address these problems. In 2015, DOD conducted a review focused on NC3 systems, which resulted in additional recommendations. The National Defense Authorization Act for Fiscal Year 2017 includes a provision for GAO to review DOD's processes for addressing these recommendations, and House Report 114-537 includes a provision for GAO to review changes to DOD's nuclear personnel reliability assurance programs. This report addresses the extent to which DOD and the military services have (1) made progress in implementing recommendations to improve the nuclear enterprise and (2) made changes to their personnel reliability assurance programs. GAO reviewed relevant documents and interviewed agency officials from DOD and the military services. This is a public version of a classified report GAO issued in August 2017. It omits information DOD deemed classified. The Department of Defense (DOD) has made progress in implementing the recommendations from the 2014 nuclear enterprise reviews and the 2015 nuclear command, control, and communications (NC3) systems report. In December 2016, the Office of Cost Assessment and Program Evaluation (CAPE) provided the military services with guidance that emphasizes using performance measures and milestones to evaluate progress to aid them in tracking and analyzing their implementation of the recommendations from the 2014 nuclear enterprise reviews. However, CAPE's guidance does not require the military services and other DOD components to identify and document risks as part of its recommendation tracking processes. As a result, DOD does not consistently identify and document risks, and it may not be identifying and communicating potential risks related to the nuclear enterprise. One of the 2014 nuclear enterprise reviews found that the avoidance of managing risks by many leaders within the enterprise adversely affected the mission. Developing additional guidance on identifying and documenting risks could enhance DOD's ability to provide oversight of its efforts to monitor progress and make informed responses to address any identified risks. For recommendations made in the 2015 NC3 report, DOD's Office of the Chief Information Officer (DOD CIO) uses an internal spreadsheet to track implementation but has not yet identified performance measures, milestones, or risks. DOD CIO has drafted a template that, once it has been approved and implemented, will provide a form that could be used for documenting performance measures, milestones, and risks. By identifying and communicating this information, DOD CIO could improve its efforts to track the progress of DOD's actions, evaluate their effects, and formulate responses to risks. DOD and the military services have implemented changes to their personnel reliability assurance programs in response to recommendations from the 2014 nuclear enterprise reviews. These programs are intended to ensure that DOD personnel who work with nuclear weapons and nuclear weapons systems, NC3 systems and equipment, and special nuclear material are trustworthy, reliable, and capable of performing their assigned nuclear weapons-related mission. The 2014 nuclear enterprise reviews found that these personnel reliability assurance programs were overly complex and administratively burdensome and that frequent and intrusive inspections left nuclear units more focused on preparing for and responding to inspections than on ensuring personnel reliability. DOD and the services have updated their guidance for personnel reliability assurance programs, including focusing on nine essential elements of reliability. For example, the Air Force has incorporated these elements into the standards it uses for its security forces. Additionally, the Air Force has centralized some of its administrative processes, and the Joint Staff has updated inspection procedures in a way that may ease the burden on personnel being inspected. DOD should develop additional guidance on identifying and documenting risks, and should identify and communicate performance measures and risks. DOD concurred and provided information about planned actions to implement them.