Figure 3 depicts program  components. Accordingly, we designated information  security as a government-wide high risk area in 1997 and it has remained  on our high-risk list since then. As of  December 2015, the agency had implemented 2 recommendations and  was working to address the remaining 9. NOAA Continues to Develop JPSS, but Selected Components Have Experienced Milestone Delays, Cost Growth, and Risks

Over the last year, the JPSS program has continued to make progress in  developing the JPSS-1 satellite. However, the program has continued to experience delays in meeting  interim milestones. The JPSS ground system also has experienced recent delays. These have not yet  been resolved. However, the  program has yet to fully implement the best practices and policies  established by the organization, and shortfalls exist in each of the  remaining areas. For example, while the program has established plans  of action to address control weaknesses, it has not addressed systemic  critical issues in a timely manner. Selection and Implementation of Security Controls: The JPSS Program Established a System Security Plan, but Has Not Fully Implemented a Significant Number of Key Controls

In accordance with NOAA policy and NIST guidance, the JPSS program  established a System Security Plan for its ground system that identifies  the key security controls it plans to implement based on its system  security categorization and impact analyses. Specifically, the assessment team reported that it  did not have all of the information it needed to plan or test the entire  system and its artifacts. NOAA Made Progress in Assessing the Potential for a Satellite Data Gap and Has Improved Efforts to Plan and Implement Gap Mitigation Activities

Over the last year, NOAA made progress in assessing the potential for a  satellite gap, improved its satellite gap mitigation plan, and completed  multiple mitigation activities; however, key shortfalls remain on these  efforts. NOAA Data Show That a Near-Term Gap Is Unlikely, but Weaknesses Remain in Underlying Analysis; the Program Plans to Perform an Additional Assessment

We previously reported that NOAA was facing a potential near-term gap  in polar data between the expected end of useful life of the S-NPP  satellite and the beginning of operation of the JPSS-1 satellite. The program did this to  get regular updates on the health of individual satellites and to help plan  future satellite programs and launch dates. These four instruments are environmental  sensors that provide critical data used in numerical weather prediction  and imagery. Until NOAA ensures that its plans for future polar satellite development  are based on the full range of estimated lives of potential satellites, the  agency may not be making the most efficient use of the nation’s sizable  investment in the polar satellite program. Although the JPSS  program has assessed key risks, established and evaluated security  controls, and remediated selected control weaknesses, key deficiencies  remain. We will continue to monitor NOAA’s ongoing efforts to  address our prior recommendations. While NOAA is planning a follow-on polar satellite program to better  ensure polar satellite coverage in the future, the agency has not  evaluated the costs and benefits of different launch scenarios based on  its updated understanding of how long its satellites might last, and  uncertainties remain in determining appropriate dates for the  development and launch of the satellites. NOAA concurred with all four of our  recommendations and identified steps it is taking to implement them. GAO staff who made  major contributions to this report are listed in appendix V.

Appendix I: Objectives, Scope, and Methodology

Our objectives were to (1) evaluate the National Oceanic and  Atmospheric Administration’s (NOAA) progress on the Joint Polar  Satellite System (JPSS) program with respect to schedule, cost, and key  risks; (2) assess NOAA’s efforts to plan and implement appropriate  information security protections for polar satellite data; (3) evaluate  NOAA’s efforts to assess the probability of a near-term gap in polar  satellite data, as well as its progress in implementing key activities for  mitigating a gap; and (4) assess NOAA’s efforts to plan and implement a  follow-on polar satellite program.
Why GAO Did This Study

NOAA established the JPSS program in 2010 to replace aging polar satellites and provide critical environmental data used in forecasting the weather. However, the potential exists for a gap in satellite data if the current satellite fails before the next one is operational. Because of this risk and the potential impact of a gap on the health and safety of the U.S. population and economy, GAO added this issue to its High Risk list in 2013, and it remained on the list in 2015.
GAO was asked to review the JPSS program. GAO's objectives were to (1) evaluate progress on the program, (2) assess efforts to implement appropriate information security protections for polar satellite data, (3) evaluate efforts to assess and mitigate a potential near-term gap in polar satellite data, and (4) assess agency plans for a follow-on polar satellite program. To do so, GAO analyzed program status reports, milestone reviews, and risk data; assessed security policies and procedures against agency policy and best practices; examined contingency plans and actions, as well as planning documents for future satellites; and interviewed experts as well as agency and contractor officials.

What GAO Found

The $11.3 billion Joint Polar Satellite System (JPSS) program has continued to make progress in developing the JPSS-1 satellite for a March 2017 launch. However, the program has experienced recent delays in meeting interim milestones, including a key instrument on the spacecraft that was delivered almost 2 years later than planned. In addition, the program has experienced cost growth ranging from 1 to 16 percent on selected components, and it is working to address selected risks that have the potential to delay the launch date.
Although the National Oceanic and Atmospheric Administration (NOAA) established information security policies in key areas recommended by the National Institute of Standards and Technology, the JPSS program has not yet fully implemented them. Specifically, the program categorized the JPSS ground system as a high-impact system, and selected and implemented multiple relevant security controls. However, the program has not yet fully implemented almost half of the recommended security controls, did not have all of the information it needed when assessing security controls, and has not addressed key vulnerabilities in a timely manner (see figure). Until NOAA addresses these weaknesses, the JPSS ground system remains at high risk of compromise.
NOAA has made progress in assessing and mitigating a near-term satellite data gap. GAO previously reported on weaknesses in NOAA's analysis of the health of its existing satellites and its gap mitigation plan. The agency improved both its assessment and its plan; however, key weaknesses remain. For example, the agency anticipates that it will be able to have selected instruments on the next satellite ready for use in operations 3 months after launch, which may be optimistic given past experience. GAO is continuing to monitor NOAA's progress in addressing prior recommendations.
Looking ahead, NOAA has begun planning for new satellites to ensure data continuity. This program would include two new JPSS satellites and a smaller interim satellite. However, uncertainties remain on the expected useful lives of the current satellites, and NOAA has not evaluated the costs and benefits of different launch scenarios based on up-to-date estimates. Until it does so, NOAA may not be making the most efficient use of the nation's sizable investment in the polar satellite program.

What GAO Recommends

GAO recommends that NOAA take steps to address deficiencies in its information security program and complete key program planning actions needed to justify and move forward on a follow-on polar satellite program. NOAA concurred with GAO's recommendations and identified steps it is taking to address them.