Advantages and Disadvantages of the Dual-Hat Arrangement, and Actions That Could Mitigate Potential Risks Associated with Ending the Arrangement

Officials from various DOD components identified advantages and  disadvantages of the dual-hat leadership of NSA/CSS and CYBERCOM. As of March 2017, DOD officials informed us that DOD had  not determined whether it would end the dual-hat leadership arrangement  and was reviewing the steps and funding necessary to meet the  requirements established in the law. DOD Components and Congress Have Identified Actions That Could Mitigate Potential Risks Associated with Ending the Dual-Hat Leadership Arrangement

			Actions Identified by DOD Component Officials to Mitigate Potential Risks Associated with Ending the Dual-Hat Leadership Arrangement

In response to the National Defense Authorization Act for Fiscal Year  2017, President Obama supported elevating CYBERCOM to a unified  combatant command and stated that NSA/CSS and CYBERCOM should  have separate leaders who are able to devote themselves to each  organization’s respective missions and responsibilities, but who should  continue to leverage the shared capabilities and synergies developed  under the dual-hat arrangement. DOD officials also cited the potential for less communication between  CYBERCOM and NSA/CSS and slower decision-making if the leadership  arrangement were ended. Performing this  assessment would have provided DOD with an opportunity to articulate its  perspectives on the advantages and disadvantages of the dual-hat  leadership arrangement. DOD’s Implementation of Key Strategic Cybersecurity Guidance Reflects Varied Progress

DOD’s implementation of key strategic cybersecurity guidance—the DOD  Cloud Computing Strategy, The DOD Cyber Strategy, and the DOD  Cybersecurity Campaign—to help manage and focus its cybersecurity  efforts has varied. The department has implemented the cybersecurity  objectives identified in the DOD Cloud Computing Strategy, and it has  made progress in implementing The DOD Cyber Strategy and DOD  Cybersecurity Campaign. However, the department’s process for  monitoring implementation of The DOD Cyber Strategy has resulted in  the closure of tasks as implemented before the tasks were fully  implemented. For example, DOD closed the task that required  the department to assess the cybersecurity of current and future weapon  systems. Unless DOD  modifies its process for deciding whether a task identified in The DOD  Cyber Strategy is implemented, the department may not be able to  ensure that the outcomes articulated in the strategy are achieved. As noted in the table above, DOD has implemented two of the objectives  identified in the DOD Cybersecurity Campaign. Specifically, the department does not have timeframes for the objective  associated with transitioning to commander-driven operational risk  assessments for cybersecurity readiness. Recommendations for Executive Action

To ensure that DOD implements the tasks and objectives of key  cybersecurity guidance to strengthen its cybersecurity posture, we  recommend that the Secretary of Defense take the following two actions:
Direct the Principal Cyber Advisor to modify the criteria for closing  tasks from The DOD Cyber Strategy to reflect whether tasks have  been implemented, and to re-evaluate tasks that have been  previously determined to be completed to ensure that they meet the  modified criteria;
Direct the Commander of CYBERCOM, in coordination with the Under  Secretary of Defense for Acquisition, Technology, and Logistics and  DOD CIO, to establish a timeframe and monitor implementation of the  DOD Cybersecurity Campaign objective to develop cybersecurity  readiness assessments to help ensure accountability. In its  written comments, DOD partially concurred with both of our  recommendations. If DOD takes the actions it  outlined, it will meet the intent of our recommendation.
Why GAO Did This Study

DOD acknowledges that malicious cyber intrusions of its networks have negatively affected its information technology systems, and that adversaries are gaining capability over time. In 2010, the President re-designated the director of the NSA as CYBERCOM's commander, establishing a dual-hat leadership arrangement for these agencies with critical cybersecurity responsibilities.
House Reports 114-537 and 114-573 both included provisions for GAO to assess DOD's management of its cybersecurity enterprise. This report, among other things, examines (1) DOD officials' perspectives on the advantages and disadvantages of the dual-hat leadership arrangement of NSA/CSS and CYBERCOM, and actions that could mitigate risks if the leadership arrangement ends, and (2) the extent to which DOD has implemented key strategic cybersecurity guidance. GAO analyzed DOD cybersecurity strategies, guidance, and information and interviewed cognizant DOD officials.

What GAO Found

Officials from Department of Defense (DOD) components identified advantages and disadvantages of the “dual-hat” leadership of the National Security Agency (NSA)/Central Security Service (CSS) and Cyber Command (CYBERCOM) (see table). Also, DOD and congressional committees have identified actions that could mitigate risks associated with ending the dual-hat leadership arrangement, such as formalizing agreements between NSA/CSS and CYBERCOM to ensure continued collaboration, and developing a persistent cyber training environment to provide a realistic, on-demand training capability. As of April 2017, DOD had not determined whether it would end the dual-hat leadership arrangement.
DOD's progress in implementing key cybersecurity guidance—the DOD Cloud Computing Strategy , The DOD Cyber Strategy , and the DOD Cybersecurity Campaign —has varied. DOD has implemented the cybersecurity elements of the DOD Cloud Computing Strategy and has made progress in implementing The DOD Cyber Strategy and DOD Cybersecurity Campaign . However, DOD's process for monitoring implementation of The DOD Cyber Strategy has resulted in the closure of tasks before they were fully implemented; for example, DOD closed a task that, among other things, would require completing cyber risk assessments on 136 weapon systems. Officials acknowledged they are on track to complete the assessments by December 31, 2019, but as of May 2017, the task was not complete. Unless DOD modifies its process for deciding whether a task identified in its Cyber Strategy is implemented, it may not be able to achieve outcomes articulated in the strategy. Also, DOD lacks a timeframe and process for monitoring implementation of the DOD Cybersecurity Campaign objective to transition to commander-driven operational risk assessments for cybersecurity readiness. Unless DOD improves the monitoring of its key cyber strategies, it is unknown when DOD will achieve cybersecurity compliance.

What GAO Recommends

GAO recommends that DOD take the following two actions: (1) modify its criteria for closing tasks from The DOD Cyber Strategy ; and (2) establish a timeframe and monitoring for implementing an objective of the DOD Cybersecurity Campaign to transition to commander-driven operational risk assessments for cybersecurity readiness. DOD partially concurred with these recommendations and identified actions it plans to take. If implemented, GAO believes these actions would satisfy the intent of the recommendations.