DOD and Selected Components Have Taken Steps to Implement Insider- Threat Programs, but DOD Has Not Issued Supplemental Guidance

		DOD and Selected Components Have Begun Implementing Insider- Threat Programs That Incorporate Minimum Standards

DOD and the six selected components we reviewed have begun  incorporating the minimum standards called for in E.O. Selected Components Have Not Incorporated Key Elements of Insider- Threat Programs That Are Cited in DOD Guidance

In addition to the minimum standards issued by the President, DOD  guidance and reports identify elements that could enhance DOD’s efforts  to protect classified information and systems. Develop a baseline of normal activity. DOD Has Assessed Its Insider-Threat Program but Has Not Analyzed Gaps or Incorporated Risk Assessments into the Program

		DOD and Other Entities Have Assessed the Department’s Insider- Threat Program

DOD has conducted self-assessments of its insider-threat program;  additionally, independent entities have assessed DOD components’  compliance with relevant policies and standards. This information is limited because  the current assessments do not reflect the extent to which the  components have accomplished tasks associated with the 63 key  performance indicators. DOD and the Six Components Have Not Incorporated Risk Assessments into Insider- Threat Programs

National-level security guidance states that agencies should assess their   For example, the  risk posture as a part of their insider-threat programs.National Insider Threat Task Force’s guide states that agencies should  identify their critical assets and then assess the risk to those assets. Until DOD provides supplemental  guidance directing components to incorporate risk assessments into their  insider-threat programs, components may not assess risk and DOD will  not be able to determine whether current security measures are adequate  or whether proposed security measures would address a component’s  level of risk. DOD Identified Technical and Policy Changes to Protect against Insider Threats in the Future but Does Not Consistently Collect Information for Oversight and Recommendations

		Selected DOD Components Identified Technical and Policy Changes for Future Action

To help protect classified information and systems from future insider  threats, in the technical area, officials from three of the six DOD  components we reviewed told us that they are hoping to obtain or  improve analytic tools that allow the component to identify anomalous   These analytic tools  behavior that could indicate insider-threat activities.would obtain data through monitoring of user activity. DOD plans to provide this information in 2015. According to OUSD (Intelligence) officials, they do not have a process to  collect information from the components to support management and  oversight duties and inform resource recommendations and investment  goals because DOD has not dedicated a program office that is focused  on oversight of the insider-threat program. Without identifying a  program office to support the Under Secretary of Defense for  Intelligence’s responsibilities in managing and overseeing DOD and  components’ insider-threat programs, DOD may not be able to collect all  information about DOD components’ technical and policy needs and  could face challenges in establishing goals, and recommending resources  and improvements to address insider threats. However, DOD components have not taken action to incorporate other  key elements into their insider-threat programs because DOD has not  issued guidance that identifies actions beyond the minimum standards  that components should take to enhance their insider-threat programs. Such guidance would assist components in developing and strengthening  insider-threat programs and better position the department to safeguard  classified information and systems. While  DOD has assessed aspects of its insider-threat program, it has not  evaluated or documented the extent to which these assessments provide  a continuing analysis of gaps as required by statute and has not  incorporated risk assessments into insider-threat programs; nor have the  results of the existing assessments been provided to DOD’s senior  insider-threat official. GAO staff who made key contributions to this report are listed in appendix  V.

Appendix I: Scope and Methodology

To evaluate the extent to which the Department of Defense (DOD) has  implemented an insider-threat program that incorporates minimum  standards and key elements to protect classified information and  systems, we evaluated initiatives that DOD had established and policy  and guidance that identify responsibilities within the department to  address the threat that insiders pose to classified information and  systems. 13587), the national insider-threat policy and minimum standards, DOD  guidance and reports, Committee on National Security Systems  guidance, a set of leading practices that the National Insider Threat Task  Force recommends, practices that other federal agencies and private  industry use, and a list of essential elements that a group of private-sector  and U.S. government analysts created.consulted by key element, see appendix III.
Why GAO Did This Study

Since 2010, the United States has suffered grave damage to national security and an increased risk to the lives of U.S. personnel due to unauthorized disclosures of classified information by individuals with authorized access to defense information systems. Congress and the President have issued requirements for structural reforms and a new program to address insider threats.
A 2014 House Committee on Armed Services report included a provision that GAO assess DOD's efforts to protect its information and systems. This report evaluates the extent to which (1) DOD has implemented an insider-threat program that incorporates minimum standards and key elements, (2) DOD and others have assessed DOD's insider-threat program, and (3) DOD has identified any technical and policy changes needed to protect against future insider threats. GAO reviewed studies, guidance, and other documents; and interviewed officials regarding actions that DOD and a nonprobability sample of six DOD components have taken to address insider threats.

What GAO Found

The Department of Defense (DOD) components GAO selected for review have begun implementing insider-threat programs that incorporate the six minimum standards called for in Executive Order 13587 to protect classified information and systems. For example, the components have begun to provide insider-threat awareness training to all personnel with security clearances. In addition, the components have incorporated some of the actions associated with a framework of key elements that GAO developed from a White House report, an executive order, DOD guidance and reports, national security systems guidance, and leading practices recommended by the National Insider Threat Task Force. However, the components have not consistently incorporated all recommended key elements. For example, three of the six components have developed a baseline of normal activity—a key element that could mitigate insider threats. DOD components have not consistently incorporated these key elements because DOD has not issued guidance that identifies recommended actions beyond the minimum standards that components should take to enhance their insider-threat programs. Such guidance would assist DOD and its components in developing and strengthening insider-threat programs and better position the department to safeguard classified information and systems.
DOD and others, such as the National Insider Threat Task Force, have assessed the department's insider-threat program, but DOD has not analyzed gaps or incorporated risk assessments into the program. DOD officials believe that current assessments meet the intent of the statute that requires DOD to implement a continuing gap analysis. However, DOD has not evaluated and documented the extent to which the current assessments describe existing insider-threat program capabilities, as is required by the law. Without such a documented evaluation, the department will not know whether its capabilities to address insider threats are adequate and address statutory requirements. Further, national-level security guidance states that agencies, including DOD, should assess risk posture as part of insider-threat programs. GAO found that DOD components had not incorporated risk assessments because DOD had not provided guidance on how to incorporate risk assessments into components' programs. Until DOD issues guidance on incorporating risk assessments, DOD components may not conduct such assessments and thus not be able to determine whether security measures are adequate.
DOD components have identified technical and policy changes to help protect classified information and systems from insider threats in the future, but DOD is not consistently collecting this information to support management and oversight responsibilities. According to Office of the Under Secretary of Defense for Intelligence officials, they do not consistently collect this information because DOD has not identified a program office that is focused on overseeing the insider-threat program. Without an identified program office dedicated to oversight of insider-threat programs, DOD may not be able to ensure the collection of all needed information and could face challenges in establishing goals and in recommending resources and improvements to address insider threats.
This is an unclassified version of a classified report GAO issued in April 2015.

What GAO Recommends

GAO recommends that DOD issue guidance to incorporate key elements into insider-threat programs, evaluate the extent to which programs address capability gaps, issue risk-assessment guidance, and identify a program office to manage and oversee insider-threat programs. DOD agreed or partially agreed with all of the recommendations, and described actions it plans to take. However, DOD's actions may not fully address the issues as discussed in the report.