ASD(HD&ASA) has issued guidance to help assure the availability of  critical infrastructure. Aspects of Critical Infrastructure Assurance Are Incorporated into TRANSCOM and Installation Exercises

TRANSCOM and the installations we visited that have critical  transportation assets have incorporated DCIP-like elements into their  existing exercises. Although installation personnel we met with often were  unaware of DCIP, we found that many conducted routine antiterrorism,  emergency management, information assurance, and continuity of  operations planning exercises that often include critical transportation  assets located on the installation. DOD guidance requires the testing of  antiterrorism and continuity of operations plans annually through  various exercises. DOD Has Not Developed DCIP Training Standards Departmentwide, and Installation Personnel Remain Unaware of Existing DCIP Expertise

Although several of the combatant commands and military services we  visited have variously developed headquarters-level DCIP training  programs, DOD has not developed DCIP training standards  departmentwide. DCIP Training Standards Have Not Yet Been Developed Departmentwide

DOD’s DCIP instruction requires ASD(HD&ASA) to provide policy and  guidance for DCIP and oversee the implementation of DCIP education,  training, and awareness of goals and objectives. ASD(HD&ASA)  recognized the need for DCIP training in its March 2008 Strategy for  Defense Critical Infrastructure. Given that this strategy is relatively new, DCIP training  standards have not yet been established departmentwide nor has DOD  established a time frame for implementing the training standards. However, in the absence of DCIP training standards departmentwide, we  determined through our work examining the five defense sectors that  several combatant commands and military services have independently  developed their own training programs or modules. With Few Exceptions, Installation Personnel We Met with Responsible for Critical Transportation Assets Were Unaware of Existing DCIP Expertise

With few exceptions, installation personnel we met with who are  responsible for assuring the availability of critical transportation  infrastructure were not familiar with DCIP and were not aware that the  combatant commands or military services possessed DCIP expertise that  they could leverage for two reasons. Furthermore, DOD has not  developed an effective way to communicate that DCIP expertise is  available to installation personnel at the combatant command and military  service levels. Conclusions

Because the network of DOD- and non-DOD-owned critical infrastructure  represents an attractive target to adversaries and also is potentially  vulnerable to a variety of natural disasters or accidents, it is crucial for  DOD to conduct DCIP exercises and develop and implement DCIP  training. However, they conducted complementary exercises that while in some  cases not emphasizing the full spectrum of threats and hazards, often  involved some aspects of critical infrastructure assurance and provided a  measure of protection for critical assets located on the installation. Coordinate with the combatant commands and military services to  develop an effective means to communicate to installation personnel the  existence and availability of DCIP expertise at the combatant command  and military service levels. Appendix I: Scope and Methodology

To determine the extent to which the Department of Defense (DOD) has  (1) incorporated aspects of the Defense Critical Infrastructure Program  (DCIP) into its exercises in the Transportation Defense Sector and   (2) developed DCIP training standards departmentwide and made  installation personnel aware of existing DCIP expertise, we obtained  relevant documentation and interviewed officials from the following DOD  organizations:    Office of the Secretary of Defense (OSD)
Office of the Assistant Secretary of Defense for Homeland Defense and    Joint Staff, Directorate for Operations, Antiterrorism and Homeland    Defense Threat Reduction Agency, Combat Support Assessments Division    Military services    Department of the Army, Asymmetric Warfare Office, Critical    Office of the Chief Information Officer    Mission Assurance Division, Naval Surface Warfare Center,  Dahlgren Division, Dahlgren, Virginia    Department of the Air Force, Air, Space and Information Operations,  Plans, and Requirements, Homeland Defense Division    Headquarters, U.S. Marine Corps, Security Division, Critical    Headquarters, U.S. Central Command, Critical Infrastructure Program  Office, MacDill Air Force Base (AFB), Florida    Headquarters, U.S. European Command, Critical Infrastructure  Protection Program Office, Patch Barracks, Vaihingen, Germany    Headquarters, U.S. Pacific Command, Antiterrorism and Critical  Infrastructure Division, Camp H.M. Smith, Hawaii    U.S.
Why GAO Did This Study

The Department of Defense (DOD) relies on a global network of DOD and non-DOD infrastructure so critical that its unavailability could have a debilitating effect on DOD's ability to project, support, and sustain its forces and operations worldwide. DOD established the Defense Critical Infrastructure Program (DCIP) to assure the availability of mission-critical infrastructure. GAO was asked to evaluate the extent to which DOD has (1) incorporated aspects of DCIP into its exercises in the Transportation Defense Sector and (2) developed DCIP training standards departmentwide and made installation personnel aware of existing DCIP expertise. GAO examined a nonprojectable sample of 46 critical assets representing the four military services, five combatant commands, and selected installations within five defense sectors. GAO reviewed relevant DOD DCIP guidance and documents and interviewed cognizant officials regarding DCIP exercises, training, and awareness.

What GAO Found

U.S. Transportation Command (TRANSCOM) and the installations GAO visited that have critical transportation assets have incorporated aspects of critical infrastructure assurance into their exercises. DOD's DCIP guidance requires the combatant commands and the military services to conduct annual DCIP exercises, either separately or in conjunction with existing exercises. DCIP guidance also requires commanders to ensure submission of lessons learned from these exercises. For example, TRANSCOM has included aspects of critical infrastructure assurance in its two major biennial exercises. Although military personnel at 13 of the 19 installations GAO visited that have critical transportation assets generally were not aware of DCIP, GAO found that all 19 of these installations conduct routine exercises that often involve aspects of critical infrastructure assurance, and they incorporate lessons learned from past exercises into future exercises. For example, personnel at these installations conduct antiterrorism, emergency management, and continuity of operations planning exercises that often include critical assets located on the installation. While several of the combatant commands and military services included in GAO's review of the five defense sectors have independently developed DCIP training at the headquarters level, DOD has not yet developed DCIP training standards departmentwide, and installation personnel remained largely unaware of existing DCIP expertise. DOD's DCIP instruction requires the Office of the Assistant Secretary of Defense for Homeland Defense and Americas' Security Affairs (ASD[HD&ASA]) to provide policy and guidance for DCIP and oversee the implementation of DCIP education, training, and awareness of goals and objectives. ASD(HD&ASA) recognizes the need for DCIP training and program awareness, as noted in its March 2008 critical infrastructure strategy. However, given the newness of the strategy, ASD(HD&ASA) has not yet established departmentwide DCIP training standards for assuring the availability of critical infrastructure or a time frame for implementing the training standards. In the absence of established DCIP training standards, the combatant commands and military services are variously developing and implementing their own DCIP training programs. For example, the Navy has established an information assurance training program that includes a DCIP module. Furthermore, installation personnel GAO spoke with, with few exceptions, were not familiar with DCIP or aware of DCIP expertise at the combatant command and military service headquarters levels. In addition, DOD has not developed an effective way to communicate to installation personnel the existence of DCIP expertise. Consequently, they rely on other, more established programs that in some cases do not emphasize the consideration of the full spectrum of threats and hazards. Without DCIP training standards departmentwide and a means of communicating them to installation personnel, the combatant commands and military services potentially may develop mutually redundant or inconsistent training programs, and installation personnel will continue to be unaware of existing DCIP expertise.