ASD(HD&ASA), within the Office of the Under Secretary of Defense for Policy, serves as the principal civilian advisor and the Chairman of the Joint Chiefs of Staff serves as the principal military advisor to the Secretary of Defense on critical infrastructure protection. ASD(HD&ASA) has issued guidance to help assure the availability of critical infrastructure. A component of this guidance outlines the roles and responsibilities of the organizations involved in DCIP. Table 1 summarizes the training and exercise roles and responsibilities of each DCIP organization. TRANSCOM and the installations we visited that have critical transportation assets have incorporated DCIP-like elements into their existing exercises. Although installation personnel we met with often were unaware of DCIP, we found that many conducted routine antiterrorism, emergency management, information assurance, and continuity of operations planning exercises that often include critical transportation assets located on the installation. As part of their regularly scheduled antiterrorism and continuity of operations programs, installation officials at all 19 installations we visited that have critical transportation assets conducted exercises encompassing critical assets located on their installations. However, unlike DCIP, some of these programs do not emphasize an all-threats, all-hazards approach to assuring critical infrastructure. DOD guidance requires the testing of antiterrorism and continuity of operations plans annually through various exercises. DOD’s antiterrorism guidance requires that commanders maintain antiterrorism exercise documentation for no less than 2 years to ensure incorporation of lessons learned. These antiterrorism exercises often contain aspects of DCIP, such as (1) developing adaptive plans and procedures to mitigate risk, (2) restoring capability in the event of a loss or degradation of assets, (3) supporting incident management, and (4) protecting critical infrastructure-related sensitive information. For example, even though installation personnel are often unaware of DCIP, we found that exercises testing antiterrorism and continuity of operations plans typically include critical installation infrastructure, and exercises for emergency management plans sometimes include assuring the availability of critical transportation assets in the event of natural disasters. Several installations in Japan that we visited conducted exercises that assure the availability of critical transportation assets located on those installations. Also, several installation officials responsible for critical transportation assets in PACOM’s area of responsibility with whom we met told us that they conduct exercises that examine the impact of natural disasters, such as earthquakes and typhoons, on critical infrastructure. Installation officials responsible for critical transportation assets in CENTCOM’s area of responsibility told us that they incorporate lessons learned into future exercises. For instance, an installation in the Middle East used exercises to prepare for its response to and recovery from major accidents, natural disasters, attacks, or terrorist use of chemical, biological, radiological, nuclear, or high-yield explosives, and has incorporated its findings into planning for future exercises. Although several of the combatant commands and military services we visited have variously developed headquarters-level DCIP training programs, DOD has not developed DCIP training standards departmentwide. Further, many of the installation personnel responsible for the assurance of critical infrastructure remain unaware of the DCIP program and the DCIP expertise available at the combatant command and military service levels. DOD’s DCIP instruction requires ASD(HD&ASA) to provide policy and guidance for DCIP and oversee the implementation of DCIP education, training, and awareness of goals and objectives. ASD(HD&ASA) recognized the need for DCIP training in its March 2008 Strategy for Defense Critical Infrastructure. Specifically, the strategy states that ASD(HD&ASA) will establish baseline critical infrastructure education requirements. Given that this strategy is relatively new, DCIP training standards have not yet been established departmentwide nor has DOD established a time frame for implementing the training standards. However, in the absence of DCIP training standards departmentwide, we determined through our work examining the five defense sectors that several combatant commands and military services have independently developed their own training programs or modules. For example, PACOM officials stated that they have conducted internal PACOM training and education on critical infrastructure assurance. U.S. Strategic Command has conducted internal training and continuous education for its staff. Further, TRANSCOM and CENTCOM officials told us that they have developed critical infrastructure training for their headquarters-level personnel. Additionally, CENTCOM officials told us that the development of their internal critical infrastructure training was still in its initial stages. Conversely, U.S. European Command officials told us that they are currently focused almost exclusively on identifying critical infrastructure and threats to those assets. Moreover, the Department of the Navy has developed a DCIP training module that it has incorporated into its information assurance training. The module provides an overview of critical infrastructure protection and the vulnerabilities created by increased interdependencies. The U.S. Marine Corps has begun familiarizing its installation antiterrorism officers with DCIP through required training for its Critical Asset Management System, used by the U.S. Marine Corps to track critical infrastructure. Air Force officials told us that they have a mission assurance training module that includes critical infrastructure protection, and like the U.S. Marine Corps, they conduct training for major Air Force commands on their version of the Critical Asset Management System. Further, officials we spoke with at the Air Mobility Command—an Air Force major command and subcomponent command to TRANSCOM—told us that they provide annual DCIP training to their air mobility wings. Army officials we met with did not identify Army-specific DCIP training but stated that training needs to be comprehensive and not defense sector specific. However, because there are no DCIP training standards departmentwide and combatant command- and military service-level training has not reached installation personnel responsible for assuring the availability of defense critical infrastructure, installation personnel rely on other, more established programs, such as the Antiterrorism Program. However, unlike DCIP, some of these programs do not emphasize consideration of the full spectrum of threats and hazards that can compromise the availability of critical infrastructure. For example, the Antiterrorism Program focuses on terrorist threats to assets and personnel. While some DCIP training exists, the combatant commands’ and military services’ development of disparate training programs, without benefit of DCIP training standards departmentwide, may result in programs that contain potentially conflicting information. As a result, training may be less effective, and resources may be used inefficiently. With few exceptions, installation personnel we met with who are responsible for assuring the availability of critical transportation infrastructure were not familiar with DCIP and were not aware that the combatant commands or military services possessed DCIP expertise that they could leverage for two reasons. First, as we previously reported, the military services have not yet developed specific guidance for how installations are to implement DCIP. Second, DCIP efforts to date have focused primarily on the identification and assessment of critical infrastructure. At 13 of the 19 installations we visited that have critical transportation assets, installation personnel we spoke with stated that prior to our visit, they had not heard of DCIP. Furthermore, DOD has not developed an effective way to communicate that DCIP expertise is available to installation personnel at the combatant command and military service levels. Until DOD develops a way to effectively communicate the existence of DCIP expertise to installation personnel, such personnel may not be able to fully leverage DCIP knowledge, which will affect how they assure the availability of critical infrastructure from an all-hazards approach, which they currently may not be doing. Because the network of DOD- and non-DOD-owned critical infrastructure represents an attractive target to adversaries and also is potentially vulnerable to a variety of natural disasters or accidents, it is crucial for DOD to conduct DCIP exercises and develop and implement DCIP training. With few exceptions, at the sites we visited, installation officials responsible for the assurance of critical assets were not aware of DCIP. However, they conducted complementary exercises that while in some cases not emphasizing the full spectrum of threats and hazards, often involved some aspects of critical infrastructure assurance and provided a measure of protection for critical assets located on the installation. In the absence of DCIP training standards departmentwide, the combatant commands and military services are developing and implementing disparate training programs, which may result in duplicative programs or programs that potentially may contain inconsistent information. As a result, training may be less effective and resources may be used inefficiently. Furthermore, lacking a process for communicating existing DCIP expertise across the department, installation personnel will be unable to take full advantage of existing knowledge in assuring the availability of critical infrastructure. We are making two recommendations to help assure the availability of critical infrastructure by improving training and awareness. We recommend that the Secretary of Defense direct ASD(HD&ASA) to: Develop departmentwide DCIP training standards and an implementation time frame to enable the combatant commands and military services to develop consistent and cost-effective training programs. Coordinate with the combatant commands and military services to develop an effective means to communicate to installation personnel the existence and availability of DCIP expertise at the combatant command and military service levels. In written comments on a draft of this report, DOD concurred with both of our recommendations. Also, TRANSCOM provided us with technical comments, which we incorporated in the report where appropriate. DOD’s comments are reprinted in appendix II. DOD concurred with our recommendation to develop departmentwide DCIP training standards and an implementation time frame to enable the combatant commands and military services to develop consistent and cost-effective training programs. In its comments, DOD stated that ASD(HD&ASA) intends to designate U.S. Joint Forces Command as the executive agent for the development of critical infrastructure protection education and training standards, and upon completion of the development of training standards, ASD(HD&ASA) will set a 180-day time frame for full implementation by the combatant commands and military services to enable consistent and cost-effective training.