Homeland Security Presidential Directive 7, issued in December 2003, designates the Secretary of Homeland Security as the principal federal official responsible for leading, integrating, and coordinating the overall national effort to protect the nation’s critical infrastructure and key resources. Homeland Security Presidential Directive 7 also requires all federal departments and agencies to identify, prioritize, and coordinate the protection of critical infrastructure and key resources from terrorist attacks. ASD(HD&ASA), within the Office of the Under Secretary of Defense for Policy, serves as the principal civilian advisor and the Chairman of the Joint Chiefs of Staff serves as the principal military advisor to the Secretary of Defense on critical infrastructure protection. The Transportation Defense Sector is made up of a worldwide network of DOD and non-DOD surface, sea, and air assets that the U.S. military relies on to move personnel and equipment. Currently, the Transportation Defense Sector consists of 300 critical air bases, seaports, and commercial airports worldwide and owned by DOD, other U.S. governmental organizations, private companies, and foreign governments. According to TRANSCOM officials, the Transportation Defense Sector is highly resilient because of significant redundancy among the various modes of transportation, particularly as it relates to surface transportation. For example, the size and capabilities of the U.S. rail and highway networks afford ability to reroute shipments via alternate roads and rail lines in the event of disruptions, a key reason why surface transportation assets were not identified as critical. In addition to DCIP, DOD has established other complementary programs that help assure critical assets, including the Antiterrorism Program and the Defense Continuity Program. The Antiterrorism Program is intended to establish protection standards for DOD assets against terrorist attacks. The Defense Continuity Program is intended to ensure that DOD mission- essential functions continue under all circumstances, such as a man-made or natural disaster. DCIP supports a risk-management process that seeks to ensure defense critical infrastructure availability. The risk-management process is comprised of a risk assessment component that identifies critical assets and infrastructure interdependencies that support DOD missions. Applicable follow-on threat and vulnerability assessments are then conducted on those assets to complete the risk assessment. The risk response component ensures that limited resources are optimally allocated towards those assets deemed most important to overall mission success for DOD, and for which it has been determined that the identified level of risk is unacceptable. Several DOD organizations have key roles in helping assure the availability of DOD’s transportation critical assets. The military services, defense agencies, and the combatant commands are responsible, in coordination with the sector lead agents, for identifying and assessing critical assets. The military departments, in their role as executive agent for the combatant commands, provide funding and resources for combatant command critical infrastructure programs. DOD Directive 3020.40 also states that sector lead agents are responsible for collaborating with other defense sector lead agents and DOD DCIP stakeholders to identify cross- sector interdependencies. According to ASD(HD&ASA) officials, TRANSCOM’s methodology for identifying, prioritizing, and assessing its critical transportation assets is inconsistent with the intent of DOD’s DCIP guidance and with the approach adopted by some of the other combatant commands and military services. TRANSCOM officials stated in May 2008 that they now plan to leverage the draft DOD Critical Asset Identification Process manual to reevaluate its currently identified critical transportation assets; however, a timeline to complete this reevaluation has not yet been established. Further, until recently, TRANSCOM relied on its vulnerability assessments to identify critical transportation assets, an action that also conflicted with established DOD guidance and practice. While TRANSCOM officials stated that they will discontinue the use of vulnerability assessment for identification purposes, they were unable to provide any documentation to ASD(HD&ASA) or us to confirm this decision officially. Moreover, its memorandum of understanding with the Joint Staff to participate as transportation subject matter experts on Joint Staff DCIP vulnerability assessments is still in draft. At the time of our review, TRANSCOM had identified 300 Tier 1 and Tier 2 critical transportation assets linked to its global mobility mission. TRANSCOM officials told us that they identified larger systems of assets— categorized as air bases, seaports, and commercial airports—based on their interpretation of the definition of an asset as outlined in DOD Directive 3020.40. TRANSCOM officials explained that these types of installations are part of its worldwide Defense Transportation System that is necessary to carry out TRANSCOM’s missions. This broad list of assets has been submitted to the Joint Staff for inclusion in DOD’s overall draft critical asset list. Because of TRANSCOM’s interpretation of the guidance, its critical asset list lacks the specificity of the critical asset lists prepared by some of the other combatant commands and military services. Moreover, according to ASD(HD&ASA) officials, TRANSCOM’s decision to identify entire installations was inconsistent with the intent of DCIP guidance. While TRANSCOM is not the only combatant command or military service to identify an entire installation as critical, it is the only organization that has done so for its entire list. DOD guidance requires combatant commands to first identify their missions, the critical assets that support those missions, and the threats and hazards to those critical assets, and then assess the vulnerability of the critical assets to the threats and hazards identified (see fig. 2). TRANSCOM skips steps two and three listed in figure 2 and instead has been using Transportation Infrastructure Vulnerability Assessments to identify specific critical assets. According to TRANSCOM officials, the identification of threats and hazards to critical assets (step 3) is incorporated in the conduct of vulnerability assessments (step 4), since Transportation Infrastructure Vulnerability Assessments specifically address vulnerability to all threats and hazards. ASD(HD&ASA) officials stated that when they began developing an overall DOD critical asset list, they told the combatant commands and military services that stopping the identification process for critical assets at the installation level is insufficient for the purposes of DCIP. As a result of continued submission of entire installations as critical assets, ASD(HD&ASA) published in March 2008 the Strategy for Defense Critical Infrastructure to reiterate the need for greater specificity in critical asset identification. Further, ASD(HD&ASA) is developing the DOD Critical Asset Identification Process manual, which is still in draft, but also notes that stopping the asset identification process at the system level (e.g., an air base, seaport, or commercial airport) does not meet the needs of DCIP, and that rarely is an entire system essential to mission success. For example, it is insufficient to identify an air base as a critical asset; rather, more specific assets, such as a runway, should be identified as appropriate. Figure 3 illustrates the DCIP critical asset identification process and where TRANSCOM’s previous efforts have stopped. TRANSCOM officials stated that because the DOD Critical Asset Identification Process manual was still in draft, they had initially chosen not to implement its contents until its formal publication. According to TRANSCOM officials, beginning in May 2008, TRANSCOM began the process to develop coordination methods to facilitate the use of the criteria in the draft DOD Critical Asset Identification Process manual for the identification and validation of assets prior to submitting them to the Joint Staff. TRANSCOM has recognized that this process will require time to complete a meaningful critical transportation asset list; however, a timeline to complete this process has not yet been established. Complicating the process of identifying and prioritizing critical assets has been TRANSCOM’s use of Transportation Infrastructure Vulnerability Assessments. Though contrary to DCIP guidance, TRANSCOM has been using its vulnerability assessments to identify specific critical assets rather than using the process outlined in DCIP guidance to identify specific critical assets. As a result, TRANSCOM officials could not tell us what specific transportation assets at a given site were critical, stating that in the absence of a Transportation Infrastructure Vulnerability Assessment it could be, though not necessarily, assumed that what was identified as critical at one location might be critical at another. For example, if a Transportation Infrastructure Vulnerability Assessment identified specific critical assets (such as a runway, navigation aids, or a fuel depot) at an air base as critical, it could be reasonably assumed that the same assets would probably be critical at other air bases. However, while TRANSCOM officials have stated that they will discontinue the use of vulnerability assessment for identification purposes, they were unable to provide any documentation to ASD(HD&ASA) or us to confirm this decision officially. Additionally, TRANSCOM’s memorandum of understanding with the Joint Staff to serve as transportation subject matter experts for the enhanced DCIP module to the Joint Staff’s Integrated Vulnerability Assessment when transportation assets are assessed remains in draft. At the behest of ASD(HD&ASA) in 2006, the Joint Staff began the process of creating a list of Tier 1 critical assets based on assets nominated and submitted by DOD organizations, including the combatant commands and the military services using DCIP-approved criteria. The Joint Staff’s list has gone through several iterations and a subset of Tier 1 critical assets, known as Defense Critical Assets, will be selected by ASD(HD&ASA). These Defense Critical Assets are of such extraordinary importance to DOD operations in peace, crisis, and war that their incapacitation or destruction would have a very serious, debilitating effect on the ability of DOD to fulfill its missions. TRANSCOM has not yet established a timeline to reevaluate critical transportation assets using the approved DCIP methodology. Until this reevaluation is completed, ASD(HD&ASA)’s ability to formulate a comprehensive Defense Critical Asset list that includes transportation assets and effectively targets spending for risk reduction efforts will be impeded.