DISA’s Joint Interoperability Test Command is the sole certifier of C4I systems. DOD guidance requires that a system be tested and certified before approval to produce and field it. Compliance With Certification Requirement Is Inadequate

Commanders in chief, services, and DOD agencies are generally not complying with the certification requirement. Test Command officials said they did not know precisely how many of these systems require certification. According to Test Command officials, previously certified systems that were later modified are not consistently submitted for recertification as required. In fiscal year 1997, the number of intelligence systems tested and certified increased to 14. Nevertheless, systems receive approval for production and fielding even though they may not have been certified or obtained waivers. Weaknesses Exist in DOD’s Certification Process

Noncompliance with interoperability testing and certification stems from weaknesses in the certification process itself. For example, DOD lacks a complete and accurate listing of C4I systems requiring certification and a plan to prioritize systems for testing. As a result, the Test Command may not be focusing its limited resources on certifying the most critical systems first. The process also does not include a mechanism to notify the services about interoperability problems identified in joint exercises, and the Test Command has only recently begun to contact the services regarding the noted problems. Test Panel Does Not Have a Formal Process for Informing DOD Organizations About Expired Waivers

According to a Test Panel official, the Panel does not have a formal process to ensure that fielded systems with expired waivers are tested. Improvements to the certification process are needed to provide better assurance that C4I systems most critical to joint operations are certified for interoperability. Recommendations

To ensure that systems critical to effective joint operations do not proceed to production without due consideration given to the need for interoperability certification, we recommend that the Secretary of Defense require the acquisition authorities to adhere to the requirement that C4I systems be tested and certified for interoperability prior to the production and fielding decision unless an official waiver has been granted. To improve the process for certifying C4I systems for interoperability, we recommend that the Secretary of Defense, in consultation with the Chairman of the Joint Chiefs of Staff, direct the service secretaries, in collaboration with the Director of DISA to verify and validate all C4 data in the Defense Integration Support Tool and develop a complete and accurate list of C4I systems requiring certification and
Director of DISA to ensure that the status of system’s certification is added to the Defense Integration Support Tool and that this database be properly maintained to better monitor C4 systems for interoperability compliance.
Why GAO Did This Study

Pursuant to a congressional request, GAO reviewed: (1) whether Department of Defense (DOD) organizations are complying with interoperability testing and certification requirements for command, control, communications, computers, and intelligence (C4I) systems; and (2) what actions, if any, are needed to improve the current certification process.

What GAO Found

GAO noted that: (1) DOD does not have an effective process for certifying existing, newly developed, and modified C4I systems for interoperability; (2) many C4I systems have not been certified for interoperability and, in fact, DOD does not know how many require certification; (3) improvements to the certification process are needed to provide DOD better assurance that C4I systems critical to effective joint operations are tested and certified for interoperability; (4) DOD organizations are not complying with the current interoperability testing and certification process for existing, newly developed, and modified C4I systems; (5) according to Test Command officials, many C4I systems that require interoperability testing have not been certified or have not received a waiver from the requirement; (6) the extent of this noncompliance could have far-reaching effects on the use of such systems in joint operations; (7) noncompliance with interoperability testing and certification stems from weaknesses in the certification process itself; (8) while DOD guidance requires that all new systems be certified or obtain a waiver from certification testing before they enter production and fielding, systems proceed to these latter acquisition stages without being certified; (9) this occurs, in part, because Defense Information Systems Agency (DISA) Joint Interoperability Test Command officials lack the authority to compel DOD organizations to submit their C4I systems for testing; (10) although DOD guidance spells out a specific interoperability certification requirement, many DOD organizations are unaware of it; (11) others simply ignore the requirement because it is not strictly enforced or because they do not adequately budget for such testing; (12) another fundamental weakness in the process is the lack of a complete and accurate listing of C4I systems requiring certification and a plan to prioritize systems for testing; (13) as a result, the Test Command may not be focusing its limited resources on certifying the most critical systems first; (14) prioritization is important since the Command has reviewed only about 100 systems per year, and a requirement for recertification of modified systems continually adds to the number of systems requiring certification; and (15) the process does not include notifying the services about interoperability problems, and the Test Command has only recently begun to contact the services regarding the noted problems.