As DOD’s supply  chain manager, DLA provides food, fuel, medical supplies, clothing, spare  parts for weapon systems, and construction materials to sustain DOD  military operations and combat readiness. DLA Has Not Yet Fully Implemented Its Security Program

DLA has implemented important elements of an information security  program—including establishing a central security management group,  appointing a senior information security officer to manage the program,  and providing security awareness training for its employees. However, DLA  has not yet fully implemented other essential elements of an effective  information security program to protect the confidentiality, integrity, and  availability of its information and information systems that support its  mission. However, employees with  significant information security responsibilities did not receive sufficient  training. DLA did not annually test and evaluate the management and operational  security controls of its systems. However, this documentation was not always  adequate. In addition, data on key information security activities contained in the  primary reporting tool were inaccurate or incomplete. Until DLA takes steps to address  these weaknesses and fully implements its information security program, it  will have limited assurance that agency operations and assets are  adequately protected. Recommendations for Executive Actions

To assist DLA in fully implementing its information security program, we  are making recommendations to the Secretary of Defense to direct the DLA  Director to implement key information security practices and controls by:  consistently assessing risks that could result from the unauthorized  access, use, disclosure or destruction of information and information;  ensuring that training is provided for employees who have significant  responsibilities for information security;  ensuring that security training plans are updated and maintained;  ensuring appropriate monitoring of the agency’s security training   ensuring that annual security test and evaluation activities include  management, operational, and technical controls of every information  system in DLA’s inventory;  documenting and reporting complete plans of action and milestones;  establishing specific guidance or instructions to information assurance  managers and information assurance officers on what—or how—to  document and report plans of action and milestones for system  deficiencies;  discontinuing the practice of issuing “time-limited” authorization to  operate accreditation decisions when certification tasks have not been  completed;   ensuring that the DLA central review team verifies that certification  tasks have been completed; and   maintaining the accuracy and completeness of the data contained in the  agency’s primary reporting tool for recording, tracking, and reporting  performance metrics on information security practices and controls.
Why GAO Did This Study

The Defense Logistics Agency's (DLA) mission is, in part, to provide food, fuel, medical supplies, clothing, spare parts for weapon systems, and construction materials to sustain military operations and combat readiness. To protect the information and information systems that support its mission, it is critical that DLA implement an effective information security program. GAO was asked to review the efficiency and effectiveness of DLA's operations, including its information security program. In response, GAO determined whether the agency had implemented an effective information security program.

What GAO Found

Although DLA has made progress in implementing important elements of its information security program, including establishing a central security management group and appointing a senior information security officer to manage the program, it has not yet fully implemented other essential elements. For example, the agency did not consistently assess risks for its information systems; sufficiently train employees who have significant information security responsibilities or adequately complete training plans; annually test and evaluate the effectiveness of management and operational security controls; or sufficiently complete plans of action and milestones for mitigating known information security deficiencies. In addition, DLA has not implemented a fully effective certification and accreditation process for authorizing the operation of its information systems. Key reasons for these weaknesses are that responsibilities of information security employees were not consistently understood or communicated and DLA has not adequately maintained the accuracy and completeness of data contained in its primary reporting tool for overseeing the agency's performance in implementing key information security activities and controls. Until the agency addresses these weaknesses and fully implements an effective agency-wide information security program, it may not be able to protect the confidentiality, integrity, and availability of its information and information systems, and it may not have complete and accurate performance data for key information security practices and controls.