DOD Has Begun Developing and Implementing a Risk Management Approach to Ensure the Availability of the DIB

DOD has begun developing and implementing a risk management  approach to ensure the availability of DIB assets needed to support  mission-essential tasks, though implementation is still at an early stage. It focuses on steps to          (1) identify a critical asset list; (2) prioritize the critical assets on that list;  (3) perform vulnerability assessments on high-priority critical assets; and  (4) encourage contractors’ actions to remediate or mitigate adverse effects  found during these assessments, as appropriate, to ensure continuity of  business operations. DCMA has also  developed an asset prioritization model for determining a criticality score  and ranking critical assets, from highest to lowest risk. DCMA has developed a process  to identify the most important DIB assets and to narrow this list to those it  considers critical. DCMA Has Established a Standardized Vulnerability Assessment Process

DCMA has established a standardized mission assurance vulnerability  assessment process for critical DIB assets. DOD Will Need to Address Several Key Challenges in Implementing Its DIB Risk Management Approach

DOD faces several key challenges in implementing its DIB risk  management approach and will need to address them to ensure that its  approach is sound and its progress can be measured. Fourth, DOD lacks a plan for  identifying and addressing challenges in assessing vulnerabilities of  critical foreign contractors. The DOD risk management approach calls for identifying  DIB assets critical to supporting combatant commanders’ mission- essential tasks that would result in DOD-wide mission failure if the asset  were to be damaged, degraded, or destroyed. Model Has Not Yet Had External Technical Review

Our review of the asset prioritization model revealed that weighting  factors were selected and much of the input data were determined  according to subjective decisions made with only limited review. The absence of comprehensive threat data  undermines the utility of the index score for prioritizing contractors. Furthermore, DOD has not established targets or time frames for resolving  this issue. Without a comprehensive list of critical  assets and a reliable asset prioritization model, DOD cannot ensure that it  has identified the most important DIB critical assets, as is necessary for  carrying out the National Military Strategy. Third, DOD is currently  scheduling and conducting assessments based on contractor amenability  and security clearance status, rather than on the rankings assigned to  critical DIB assets according to its asset prioritization model. Until all of  these issues are addressed, DOD will lack the visibility it needs over  critical DIB asset vulnerabilities, will be unable to encourage critical DIB  contractors to take needed remediation actions, and will be unable to  make informed decisions regarding limited resources. Schedule and conduct vulnerability assessments on the critical DIB assets  based on their respective rankings as validated in the asset prioritization  model, to ensure that the most critical DIB assets are assessed in a timely  manner and DOD maximizes its use of limited resources. DOD partially concurred with our recommendation to prepare a plan to  collaborate with the Department of State and other agencies, as  appropriate, to develop options to identify and address potential  challenges in assessing vulnerabilities in foreign critical DIB assets. Appendix I: Scope and Methodology

To conduct our review of the Department of Defense’s (DOD) defense  industrial base (DIB) program, we obtained relevant documentation and  interviewed officials from the following DOD organizations:  Office of the Secretary of Defense (OSD)
Under Secretary of Defense for Personnel and Readiness, Information    Under Secretary of Defense for Acquisition, Technology, and Logistics,  Office of the Deputy Under Secretary of Defense for Industrial Policy;    Under Secretary of Defense for Intelligence, Counterintelligence &  Security, Physical Security Programs;    DOD Counterintelligence Field Activity, Critical Infrastructure  Protection Program Management Directorate;     Assistant Secretary of Defense for Homeland Defense and Americas’  Security Affairs (ASD), Critical Infrastructure Protection  Office;    Assistant Secretary of Defense for Networks and Information  Integration, Information Management & Technology Directorate;    Joint Staff, Directorate for Operations, Antiterrorism and Homeland    Defense Threat Reduction Agency (DTRA), Combat Support Assessments    Department of the Army, Asymmetric Warfare Office, Critical  Infrastructure Risk Management Branch;    Office of the Chief Information Officer;    Mission Assurance Division, Naval Surface Warfare Center,   Dahlgren Division, Dahlgren, Virginia;    Headquarters, U.S. Marine Corps, Security Division, Critical    Department of the Air Force, Air, Space and Information Operations,  Plans, and Requirements, Homeland Defense Division;    Headquarters, Defense Intelligence Agency, Office for Critical  Infrastructure Protection & Homeland Security/Defense;    Headquarters, Defense Information Systems Agency, Critical    Headquarters, U.S. Strategic Command, Mission Assurance Division, Offutt  Air Force Base, Nebraska To examine the status of DOD’s efforts to develop and implement a risk  management approach, we reviewed Homeland Security Presidential  Directive 7, the Homeland Security Act of 2002, and the National  Infrastructure Protection Plan as they relate to the DIB sector-specific and  sector assurance plans, as well as other studies conducted by GAO, the  Congressional Research Service, and the DOD Inspector General  concerning risk management and defense critical infrastructure.
Why GAO Did This Study

The U.S. military relies on the defense industrial base (DIB) to meet requirements to fulfill the National Military Strategy. The potential destruction, incapacitation, or exploitation of critical DIB assets by attack, crime, technological failure, natural disaster, or man-made catastrophe could jeopardize the success of U.S. military operations. GAO was asked to review the Department of Defense's (DOD) Defense Critical Infrastructure Program and has already reported that DOD has not developed a comprehensive management plan for its implementation. This, the second GAO report, has (1) determined the status of DOD's efforts to develop and implement a risk management approach to ensure the availability of DIB assets, and (2) identified challenges DOD faces in its approach to risk management. GAO analyzed plans, guidance, and other documents on identifying, prioritizing, and assessing critical domestic and foreign DIB assets and held discussions with DOD and contractor officials.

What GAO Found

DOD has begun developing and implementing a risk management approach to ensure the availability of DIB assets needed to support mission-essential tasks, though implementation is still at an early stage. Its sector assurance and sector-specific plans focus on steps to identify a list of critical assets that, if damaged, would result in unacceptable consequences; prioritize those critical assets based on a risk assessment process; perform vulnerability assessments on high-priority critical assets, and encourage contractors' actions to remediate or mitigate adverse effects found during these assessments, as appropriate, to ensure continuity of business. The Defense Contract Management Agency, the executing agency for the DIB, has developed a process to identify the most important DIB assets and to narrow this list to those it considers critical. It has also developed an asset prioritization model for determining a criticality score and ranking critical assets, and it has established a standardized mission assurance vulnerability assessment process for critical DIB assets. DOD faces several key challenges in implementing its DIB risk management approach. Overall, DOD's methodology for identifying critical DIB assets is evolving, and DOD lacks targets and time frames for completing development of key program elements that are needed for its risk management approach. Without them, DOD cannot measure its progress toward ensuring that DIB assets supporting critical DOD missions are properly identified and prioritized. The specific challenges are as follows: First, DOD is not fully incorporating the military services' mission-essential task information (i.e., listings of assets whose damage, degradation, or destruction would result in DOD-wide mission failure) in compiling its critical asset list. Second, GAO's analysis of DOD's prioritization model shows that weighting factors were selected and data determined according to subjective decisions and limited review, and that needed contractor-specific data were lacking, as was comprehensive threat information, thus undermining the utility of the index score for prioritizing contractors. Without these comprehensive data and a reliable asset prioritization model, DOD will not be in a sound position to know that it has identified the most important and critical assets, as called for in the National Military Strategy. Third, with regard to scheduling and conducting assessments of critical DIB assets, DOD is currently doing so based on contractor amenability and security clearance status without regard for assets' priority rankings, and thus cannot ensure that the most critical DIB contractors are assessed. Fourth, DOD lacks a plan for developing options to work with the Department of State and other appropriate agencies to identify and address potential challenges in assessing vulnerabilities in foreign critical DIB assets. Until all these challenges are addressed, DOD will lack the visibility it needs over critical DIB asset vulnerabilities, will be unable to encourage critical DIB contractors to take needed remediation actions, and will be unable to make informed decisions regarding limited resources.