	Background

Since the 1960s, the United States has operated polar-orbiting satellite  systems that obtain environmental data to support weather observations  and forecasts. Specifically, a single afternoon polar satellite provides  NOAA 45 percent of the global coverage it needs for its numerical  weather models. While NOAA satellite timelines show continuous coverage in the  afternoon orbit, the JPSS program still faces the potential for a near-term  gap in satellite coverage. As a result, the JPSS program continues to face a potential gap of 8  months between the end of S-NPP’s expected life in October 2016, and  when the JPSS-1 satellite is launched and completes post-launch testing  in June 2017. Uncertainties Remain on Key Future JPSS Development Dates

In addition to its work in completing the JPSS-1 satellite, NOAA has  begun planning for new satellites to ensure the future continuity of polar  satellite data. Until NOAA ensures that its plans for future  polar satellite development are based on the full range of estimated lives  of potential satellites, the agency may not be making the most efficient  use of the nation’s sizable investment in the polar satellite program. As a result of this uncertainty, we recommended that NOAA evaluate the  costs and benefits of different launch scenarios for the JPSS PFO  program, based on updated satellite life expectancies, to ensure satellite  continuity while minimizing program costs. However, the agency did not provide sufficient supporting  evidence or artifacts showing that it had evaluated costs and benefits of  launch scenarios in this way. In a draft report currently at the Department of Commerce for comment,  we reported that NOAA has updated its polar flyout charts three times in  the last 2-and-a-half years. However, while NOAA regularly updates its charts and most of the data  on them were aligned with other program documentation, the agency has  not consistently ensured that its charts were accurate, supported by  stringent analysis, and fully documented. NOAA did not consistently document the justification for updates to its  polar satellite flyout charts. Consequently, the information that NOAA provides Congress on  the flyout charts is not as accurate as it needs to be, which could result in  less-than-optimal decisions. To address these weaknesses, our draft report includes a series of  recommendations to NOAA, including requiring satellite programs to  perform regular assessments of satellite availability, implementing a  consistent approach to depicting satellites beyond their design lives, and  revising and finalizing the policy for updating flyout charts. As we reported in May 2016, NOAA had established information security  policies in key areas detailed by FISMA and recommended by NIST  guidance and the JPSS program had made progress in implementing  these policies. Key controls not fully implemented. Security incidents reported but not consistently tracked. Specifically, NOAA officials reported 10 medium and high-severity  incidents related to the JPSS ground system, including incidents  involving unauthorized access to web servers and computers,  between August 2014 and August 2015. To address these deficiencies, we recommended in our May 2016 report  that the Secretary of Commerce direct the Administrator of NOAA to  establish a plan to address the limitations in the program’s efforts to test  security controls, including ensuring that (1) any changes in the system’s  inventory do not materially affect test results; (2) critical and high-risk  vulnerabilities are addressed within 30 days, as required by agency  policy; and (3) the agency and program are tracking and closing a  consistent set of incident response activities. NOAA concurred with our recommendations. In summary, NOAA is making progress in developing and testing the  JPSS-1 satellite as it moves toward a March 2017 launch date, but  continues to experience issues in remaining ground system development,  and faces a potential near-term data gap in the period before this satellite  becomes operational. Further, findings from a draft report show that NOAA’s efforts to depict  and update key polar satellite information, such as timelines and  operational life, need to be improved. This is in part because NOAA has not finalized a policy that includes  standard steps for updating its charts. However, the program has not fully implemented the policy in several  areas. Until NOAA addresses these  weaknesses, the JPSS ground system remains at high risk of  compromise.
Why GAO Did This Study

Polar-orbiting satellites provide data that are essential to support weather observations and forecasts. NOAA is preparing to launch the second satellite in the JPSS program in March 2017, but a near-term gap in polar satellite coverage remains likely. Given the criticality of satellite data to weather forecasts and the potential impact of a satellite data gap, GAO added this area to its High-Risk List in 2013. This statement addresses the status of the JPSS program and plans for future satellites, NOAA's efforts to depict and update satellite timelines, and the JPSS program's implementation of key information security protections. This statement is based on a May 2016 report on JPSS and a draft report on satellite timelines. To develop the draft report, GAO reviewed agency procedures for updating satellite timelines, compared timelines to best practices and agency documentation, and interviewed officials.

What GAO Found

As highlighted in a May 2016 report, the National Oceanic and Atmospheric Administration's (NOAA) Joint Polar Satellite System (JPSS) program has continued to make progress in developing the JPSS-1 satellite for a March 2017 launch. However, the program has experienced technical challenges which have resulted in delays in interim milestones. In addition, NOAA faces the potential for a near-term gap in satellite coverage of 8 months before the JPSS-1 satellite is launched and completes post-launch testing (see figure). NOAA has also begun planning for future polar satellites. However, uncertainties remained on the best timing for launching these satellites, in part because of the potential for some satellites already in orbit to last longer. NOAA did not provide sufficient evidence that it had evaluated the costs and benefits of launch scenarios for these new satellites based on updated life expectancies. Until this occurs, NOAA may not make the most efficient use of investments in the polar satellite program.
Note: The afternoon orbit is one of three primary polar orbits providing needed coverage for numerical weather models.
As noted in a draft GAO report, NOAA publishes “flyout charts” depicting satellite timelines to support budget requests and appropriations discussions. The agency regularly updates its charts when key changes occur. However, the charts do not always accurately reflect data from other program documentation such as the latest satellite schedules or assessments of satellite availability. NOAA also has not consistently documented its justification for chart updates or depicted lifetimes for satellites beyond their design life, and has not finalized a policy for updating its charts. As a result, the information NOAA provides Congress on the flyout charts is not as accurate as it needs to be, which could result in less-than-optimal decisions.
GAO reported in May 2016 that, although NOAA has established information security policies in key areas recommended by guidance, the JPSS program has not yet fully implemented them. Specifically, while the program has implemented multiple relevant security controls, it has not yet fully implemented almost half of the recommended security controls, did not have all of the information it needed when assessing security controls, and has not addressed key vulnerabilities in a timely manner. Furthermore, NOAA has experienced 10 key information security incidents related to the JPSS ground system, including incidents regarding unauthorized access to web servers and computers. Until NOAA addresses these weaknesses, the JPSS ground system remains at high risk of compromise.

What GAO Recommends

In its May 2016 report, GAO recommended that NOAA assess the costs and benefits of different launch decisions based on updated satellite life expectancies, and address deficiencies in its information security program. NOAA concurred with these recommendations. GAO's draft report includes recommendations to NOAA to improve the accuracy, consistency, and documentation supporting updates to satellite timelines, and to revise and finalize its draft policy governing timeline updates. This report is currently at the Department of Commerce for comment.