“Dual-hatting” is a term used to describe a position in which an incumbent officer has responsibilities in two organizations simultaneously—usually to that officer’s particular military service, and to a joint, combined, or international organization or activity. DOD officials told us that dual- hatting senior leaders is a relatively common practice within DOD to help align authorities, improve mission effectiveness, and use a senior leader’s experience and expertise while balancing the scope of responsibility. Some prominent examples of dual-hatting include the Commander of U.S. Northern Command also serving as the Commander of the North American Aerospace Defense Command; and the Commander of U.S. European Command also serving as the Supreme Allied Commander Europe (that is, the commander of military operations conducted by the North Atlantic Treaty Organization). Additionally, the Air Force and Navy commanders who support U.S. European Command are dual-hatted as service component commanders for U.S. Africa Command. When the Secretary of Defense directed CYBERCOM’s establishment in 2009, he also recommended to the President that the position of Director of NSA be assigned the responsibility for leading this new command. DOD officials told us the dual-hat leadership arrangement originated to allow CYBERCOM to use NSA/CSS infrastructure and tools to carry out its mission more quickly and to establish unity of command and effort for DOD in the cyberspace domain. As the sole leader of these organizations, the dual-hatted leader is responsible for a broad set of roles and responsibilities, as outlined below in table 1. Since its establishment, CYBERCOM has operated as a sub-unified command organized under U.S. Strategic Command, and this arrangement continues as of April 2017. The National Defense Authorization Act for Fiscal Year 2017 included a provision directing the President to establish CYBERCOM as a unified combatant command. When the President and DOD implement this provision, CYBERCOM will no longer be organized under U.S. Strategic Command. Figure 1 below depicts the NSA/CSS and CYBERCOM leadership arrangement, as of April 2017, and where those offices fit within DOD’s organization. The figure also provides an overview of CYBERCOM’s 133 Cyber Mission Force Teams, which carry out particular parts of CYBERCOM’s mission. As CYBERCOM has matured, leaders—including Congress, the President, the Director of National Intelligence, and the current leader of NSA/CSS and CYBERCOM—have discussed the concept of ending the dual-hat leadership of the two organizations, such that one individual would lead NSA/CSS and another individual would lead CYBERCOM. Section 1642 of the National Defense Authorization Act for Fiscal Year 2017 enumerated a number of conditions that the Secretary of Defense and the Chairman of the Joint Chiefs of Staff must jointly certify before the dual-hat leadership arrangement for NSA and CYBERCOM can be terminated. While DOD officials have considered ending the dual-hat leadership arrangement, as of April 2017, the department has not decided whether to do so. To establish a cybersecurity program to protect and defend DOD information and information technology, DOD has assigned some of its components and senior officials with cybersecurity responsibilities, summarized in table 2 below. DOD has issued guidance to support the implementation of its cybersecurity capabilities. Table 3 below lists key DOD strategic-level cybersecurity documents and includes a description of each document, as well as the component organization(s) primarily responsible for their implementation. Officials from various DOD components identified advantages and disadvantages of the dual-hat leadership of NSA/CSS and CYBERCOM. Additionally, DOD and Congress have identified actions that could mitigate the risks associated with ending the dual-hat leadership arrangement. As of March 2017, DOD officials informed us that DOD had not determined whether it would end the dual-hat leadership arrangement and was reviewing the steps and funding necessary to meet the requirements established in the law. According to officials, DOD does not have an official position on the advantages and disadvantages of the dual-hat leadership arrangement of NSA/CSS and CYBERCOM. Through responses to interviews and questionnaires, officials from DOD components provided their perspectives on the advantages and disadvantages associated with the dual-hat leadership arrangement as summarized in table 4, below. In response to the National Defense Authorization Act for Fiscal Year 2017, President Obama supported elevating CYBERCOM to a unified combatant command and stated that NSA/CSS and CYBERCOM should have separate leaders who are able to devote themselves to each organization’s respective missions and responsibilities, but who should continue to leverage the shared capabilities and synergies developed under the dual-hat arrangement. As of April 2017, DOD officials told us that the department supports elevating CYBERCOM to a unified combatant command, but recognizes that there are potential risks in ending the dual-hat leadership arrangement. Prior to the passage of the National Defense Authorization Act for Fiscal Year 2017, DOD components, such as CYBERCOM and the Joint Staff, had already developed internal lists of conditions and prerequisites that could mitigate risks prior to ending the dual-hat leadership arrangement. These considerations were presented to senior leadership within the respective components to help inform their positions on ending the dual-hat leadership arrangement. According to DOD officials, discontinuing the dual-hat arrangement would require DOD to put the necessary policies and processes in place to continue the mutually beneficial partnership between NSA/CSS and CYBERCOM. Specifically, the arrangement in conjunction with support agreements has enabled CYBERCOM to leverage the capability development, personnel, facilities, infrastructure, testing capabilities, and business processes of NSA/CSS to support CYBERCOM operations. DOD officials also cited the potential for less communication between CYBERCOM and NSA/CSS and slower decision-making if the leadership arrangement were ended. Table 5 below lists the various actions reported to us by officials from DOD components that could mitigate risks associated with ending the dual-hat command structure of NSA/CSS and CYBERCOM, as well as the status of these actions, as of March 2017. According to DOD officials, many of these factors relate as much to the growth and maturation of CYBERCOM as they do the dual-hat status. Separate from actions identified by select DOD components, Congress has requested information from the department and required it to meet specific conditions and to certify that the termination of the dual-hat arrangement, if pursued by DOD, will not pose risks to the military effectiveness of CYBERCOM that are unacceptable to the national security interests of the United States. Specifically, House Report 114- 537 accompanying a bill for the National Defense Authorization Act of Fiscal Year 2017 and House Report 114-573 accompanying a bill for the Intelligence Authorization Act of Fiscal Year 2017 directed the Secretary of Defense to provide the House defense and intelligence committees with a briefing and an assessment of the dual-hat command by November 1, 2016. According to the committee direction, DOD was to address the following: 1. roles and responsibilities, including intelligence authorities, of each 2. assessment of the current impact of the dual-hat relationship, including both advantages and disadvantages; 3. recommendations on courses of action for separating the dual-hat command relationship between the Commander of CYBERCOM and the Director of the NSA/Chief of CSS, if appropriate; 4. suggested timelines for carrying out such courses of action; and 5. recommendations for legislative actions, as necessary. DOD did not perform this briefing and assessment. Performing this assessment would have provided DOD with an opportunity to articulate its perspectives on the advantages and disadvantages of the dual-hat leadership arrangement. Further, it would have allowed DOD to present its preferred course of action in relation to separating the leadership of NSA/CSS and CYBERCOM. DOD officials told us that they believed the assessment they were directed to provide to the House defense and intelligence committees in November 2016 was no longer necessary, based on Section 1642 of the National Defense Authorization Act for Fiscal Year 2017. However, while the act did not include the same briefing and assessment requirement identified in the two House reports, the act also did not cancel the committee direction. In addition, the briefing requirement still exists, as evidenced by the explanatory statement accompanying the Intelligence Authorization Act for Fiscal Year 2017, for DOD to brief and provide an assessment of the dual-hat leadership arrangement. According to Section 1642 of the National Defense Authorization Act for Fiscal Year 2107, DOD cannot terminate the dual-hat leadership arrangement until the Secretary of Defense and the Chairman of the Joint Chiefs of Staff jointly certify that the termination will not pose risks to the military effectiveness of CYBERCOM that are unacceptable to the national security interests of the United States. Section 1642 also requires DOD to conduct an assessment that, among other things, evaluates CYBERCOM’s operational dependence on NSA and evaluates each organization’s ability to carry out its roles and responsibilities independently. In addition, Section 1642 requires DOD to determine whether the following conditions have been met before deciding to end the dual-hat leadership arrangement: Robust operational infrastructure has been deployed that is sufficient to meet the unique cyber mission needs of CYBERCOM and NSA, respectively. Robust command and control systems and processes have been established for planning, deconflicting, and executing military cyber operations. The tools and weapons used in cyber operations are sufficient for achieving required effects. Capabilities have been established to enable intelligence collection and operational preparation of the environment for cyber operations. Capabilities have been established to train cyber operations personnel, test cyber capabilities, and rehearse cyber missions. The cyber mission force has achieved full operational capability. Office of the Under Secretary of Defense for Intelligence and Joint Staff officials told us that they regularly discuss matters related to ending the dual-hat leadership arrangement of NSA/CSS and CYBERCOM.