DOD relies increasingly on globally networked computer systems to manage the information it uses to perform operational missions and daily management functions. These systems provide military offensive and defensive capabilities as well as intelligence support. According to DOD, the department operates 2 million to 3 million computers, 100,000 local area networks, and 100 long-distance networks—including service-based, joint defense, and intelligence computers and networks such as the Global Command and Control System, which supports distributed collaborative, worldwide planning for crisis and contingency operations, and the Joint Worldwide Intelligence Communication System, with more than 100 sites worldwide. DOD views information as a strategic resource vital to national security and information superiority as the foundation of its vision of modern warfare. It has concluded that IA is essential to DOD’s information superiority. DOD defines IA as “Information Operations that protect and defend information and information systems by ensuring their availability, integrity, authentication, confidentiality, and non-repudiation . . . includes providing for the restoration of information systems by incorporating protection, detection, and reaction capabilities.” In this context, availability is assured access by authorized users, integrity is protection from unauthorized change, authentication is verification of the originator, confidentiality is protection from unauthorized disclosure, and nonrepudiation is undeniable proof of participation. A 1997 DOD task force report acknowledged that the department requires substantial IA capabilities for its highly interconnected computing and communications environment, noting that “without information assurance, it is increasingly likely that our forces will fail to accomplish their mission.” Other policy and guidance documents also emphasize the critical role of IA in DOD’s mission. In October 1998, the Joint Doctrine for Information Operations identified IA as an essential component of the military’s defensive information operations. In February 2000, the DOD CIO’s annual report on IA identified it as the department’s second highest priority IT issue, following Year 2000 remediation. In March 2000, the Deputy Secretary of Defense issued a guidance and policy memorandum recognizing the pivotal role of global networking in departmental activities and requiring the use of IA safeguards and operational procedures for all of DOD. Defense operations rely increasingly on interconnected information systems, which results in sharing of security risks among all interconnected organizations. In this environment, an adversary need only find and penetrate a single poorly protected system and then use access to that system to penetrate other interconnected systems. Consequently, coordination of IA efforts across DOD is important to maintain adequate security throughout its systems and networks. Historically, the department’s information systems have also been beset by vulnerabilities. Reports by us and DOD document serious and pervasive deficiencies that can impair the military’s ability to (1) control physical and electronic access to its systems and data, (2) ensure that software is properly authorized, tested, and functioning, (3) limit employees’ ability to perform incompatible functions, and (4) resume operations in the event of a disaster. Numerous Defense functions, including weapons and supercomputer research, logistics, finance, procurement, personnel management, military health, and payroll have been adversely affected by system attacks and fraud. DOD, in turn, has acknowledged the need for improvements. The department’s IA challenges are heightened by the growing threat of Internet-based attacks. Intrusions into government information systems— including DOD’s—continue to escalate, in number and complexity, requiring better detection, faster damage containment, and more efficient reporting mechanisms. Furthermore, DOD recognizes that increasing availability of its systems to authorized users has also increased opportunities for unauthorized access, presenting the most serious threat to DOD information. In this environment, security incidents remain an ongoing problem for DOD. DOD has identified an even more fundamental challenge underlying these organizational and technological challenges—a shortage of qualified personnel to fill positions that manage and protect its information systems. Although poor planning of system procurements, downsizing of military and civilian personnel, and an increased emphasis on outsourcing have contributed to DOD’s IT personnel shortage, this shortage also reflects a broader problem in recruiting and retaining IT security professionals in both the public and private sectors, according to a DOD human resources study. In January 1998, the Deputy Secretary of Defense responded to these challenges by forming DIAP and assigning responsibility for its oversight to DOD’s CIO, who is also the Assistant Secretary of Defense for Command, Control, Communications, and Intelligence (ASD(CI)). DIAP was established to meet DOD’s need for “integrated, comprehensive, and consistent Defense-wide IA practice,” and to develop DOD into “a model practitioner of IA” for the nation. In February 1999, DOD’s CIO established four critical departmentwide strategic IA goals: Make IA an integral part of DOD mission readiness criteria. Enhance DOD personnel IA awareness and capabilities. Enhance DOD IA operational capabilities. Establish an integrated DOD Security Management Infrastructure. DIAP was intended to help meet these goals by planning, coordinating, integrating, and overseeing IA activities, and by supporting review and assessment of IA resource investments on a departmentwide basis. In this regard, DIAP became DOD’s official program for ensuring the continual integration and coherent execution of all IA functions, activities, and program resources. DIAP was to continually monitor and act as a facilitator for the execution of IA resources, which remained the responsibility of the commanders-in-chief, military services, and Defense agencies where the activities and programs reside. Responsibility for the creation and management of DIAP was assigned to the Director of Information Assurance, a position reporting to the CIO. The Director was designated DIAP’s program manager and was authorized a staff of representatives from DOD component organizations to support Defense-wide IA planning, programming, budgeting, and execution review. In addition to the DIAP staff, the Director of IA also maintains a staff dedicated to the Office of Infrastructure and Information Assurance (I&IA). As depicted in its management plan, the DIAP program structure also included the following individuals and organizations that contribute to achieving the department’s IA goals: DOD CIO Council − monitors and coordinates IT investments, including National Information Security (INFOSEC) manager − assesses cyber threats and security posture for national security systems; Defense Information Infrastructure adviser − plans, develops, and supports CDIAP would also work with an Intelligence Community (IC) coordinator to ensure integration and compatibility of IA efforts. Appendix I provides a description of certain IA-related Defense organizations and their relationships with DIAP, based on the implementation plan. The implementation plan also established the general structure of the DIAP staff and assigned it a variety of responsibilities. The plan described expected DIAP staffing levels, with specific numbers of personnel to be provided by the Office of the Secretary of Defense, the Joint Staff, each of the military services, and several Defense agencies. As described in the implementation plan, DIAP staff was divided into two teams, the Functional Evaluation and Integration Team (FEIT) and the Program Development and Integration Team (PDIT). FEIT was assigned responsibility for development of Defense-wide IA performance goals, standards, metrics, and oversight of functional areas. The organization of FEIT reflects, in part, each of the four DOD IA goals corresponding to readiness assessments, human resources, the operational environment, and security management. The remaining FEIT functional areas address policy integration, architecture, acquisitions, and research and development. PDIT was assigned responsibility for oversight, coordination, and integration of the department’s IA resource programs through participation in DOD’s IA planning and budgeting processes, and was specifically charged with tasks such as categorizing program activities, developing departmentwide budgets, and preparing the CIO’s annual IA assessment. Liaison positions were established to coordinate DIAP activities with special communities whose interests span multiple functional areas. Appendix II lists DIAP staff responsibilities for each program area as outlined in the implementation plan. The objectives of our review were to (1) examine the progress and accomplishments of DIAP since its inception and (2) identify obstacles to further progress. To determine the progress and accomplishments of DIAP, we ascertained its mission, responsibilities, and organization through analysis of documents provided by DOD. We gathered and analyzed information on DIAP plans, activities, products, and accomplishments from the DIAP staff, the Office of the ASD(CI) (OASD(C Ballistic Missile Defense Organization, Defense Advanced Research Projects Agency, Defense Information Systems Agency (DISA), Defense Intelligence Agency, Defense Logistics Agency, Defense Security Service, National Imagery and Mapping Agency, National Reconnaissance Office, and National Security Agency (NSA). We selected these organizations primarily based on their roles in defense- related IA as documented in the 1999 DOD CIO Annual Information Assurance Report. We also reviewed DOD self-assessments, plans for departmentwide IA activities, and inspector general reports on DIAP and other departmentwide IA activities. We focused on the DIAP’s accomplishments and plans most clearly tied to DOD’s IA goals, and thus did not compile a comprehensive inventory of all DIAP accomplishments, particularly those led by other Defense components. We identified interactions of the DIAP staff with each Defense organization and the impact of DIAP staff efforts as perceived by those organizations. We also reviewed IA plans, products, and accomplishments of groups outside of the DIAP staff and assessed the mechanisms used to integrate the activities of these groups with those of the DIAP staff. These outside groups included the Joint Staff, the IA Panel, the INFOSEC Research Council, and the Office of Infrastructure and Information Assurance in OASD(CI). We did not attempt to determine the proportion of IA accomplishments attributable to the DIAP staff or to other organizations. We verified activities and events related to accomplishments where feasible but did not verify all claims of accomplishments.