DOD organizations that have significant DCIP roles and responsibilities  are shown in figure 3. DOD Has Taken Important Steps to Implement DCIP but Needs a Comprehensive Management Plan to Guide Its Efforts

DOD has taken some important steps to implement DCIP; however, it has  not developed a comprehensive management plan to guide its efforts. As of May 2007, most of DOD’s DCIP guidance and  policies were either newly issued or still in draft, which has resulted in  DOD’s components pursuing varying approaches to implement DCIP. Until DOD  completes a comprehensive management plan to implement DCIP, which  includes issuing remaining DCIP guidance and fully identifying funding  requirements, its ability to implement DCIP will be challenged. Although DOD issued a DCIP directive in August 2005, ASD(HD&ASA)  lacks a chartering directive that, among other things, clearly defines  important roles, responsibilities, and relationships with other DOD  organizations and missions—including the relationship between  ASD(HD&ASA) and the Assistant Secretary of Defense for Special  Operations and Low-Intensity Conflict and Interdependent Capabilities. Although DOD Has Taken Steps to Facilitate Information Sharing and Coordination, Additional Measures Could Be Taken

Existing DCIP guidance emphasizes information sharing and collaboration  with relevant government and private-sector entities. The Critical Infrastructure Program Integration Staff is comprised of  representatives from more than 30 DOD organizations. Including DCIP in  the lead agents’ baseline budgets should reduce reliance on supplemental  appropriations to implement critical infrastructure responsibilities. DOD Estimates That It Has Identified about 25 Percent of the Critical Infrastructure It Owns, and Most of the Non-DOD-Owned Critical Infrastructure Remains Unidentified

DOD estimates that it has identified about 25 percent of the critical  infrastructure it owns, and expects to finish identifying the remaining 75  percent by the end of fiscal year 2009. DOD has identified considerably  less of its critical infrastructure owned by non-DOD entities, and has not  set a target date for its completion. DOD has been performing a limited number of vulnerability assessments  on DOD-owned infrastructure; however, until DOD identifies and  prioritizes all of the critical infrastructure it owns, results have  questionable value for deciding where to target funding investments. Moreover, DOD does not have  a mechanism to flag domestic mission-critical infrastructure for DHS to  consider including among its assessments of the nation’s critical  infrastructure, and has delayed coordinating the assessments of non-DOD  critical infrastructure located abroad. DOD has not identified funding to  remediate vulnerabilities identified through the assessment process. DOD has determined that a small portion of the non-DOD infrastructure— about 200 assets—that belongs to the defense industrial base sector are  mission critical. DOD has delayed coordinating the assessments of  non-DOD-owned infrastructure located abroad because it has decided to  focus on identifying infrastructure that it owns. Conclusions

DOD depends on critical infrastructure to project, support, and sustain its  forces and operations worldwide, but its lack of a comprehensive  management plan to guide its efforts that addresses guidance,  coordination of program stakeholders’ efforts, and resource requirements,  has prevented the department from effectively implementing an efficient  critical infrastructure program. When DOD  components and sector lead agents consistently identify, prioritize, and  assess their critical infrastructure, as well as including the remediation of  vulnerabilities in their funding requirements, DOD’s ability to perform risk- based decision making and target funding to priority needs will be  improved. To evaluate the extent to which DOD has identified, prioritized, and  assessed its critical infrastructure, we met with officials and obtained  relevant documentation from each of the DOD components, sector lead  agents, ASD(HD&ASA), the Joint Staff, and the Mission Assurance  Division.
Why GAO Did This Study

The Department of Defense (DOD) relies on a network of DOD and non-DOD infrastructure assets in the United States and abroad so critical that its unavailability could hinder DOD's ability to project, support, and sustain its forces and operations worldwide. DOD established the Defense Critical Infrastructure Program (DCIP) to identify and assure the availability of mission-critical infrastructure. GAO was asked to evaluate the extent to which DOD has (1) developed a comprehensive management plan to implement DCIP and (2) identified, prioritized, and assessed its critical infrastructure. GAO analyzed relevant DCIP documents and guidance and met with officials from more than 30 DOD organizations that have DCIP responsibilities, and with Department of Homeland Security (DHS) officials involved in protecting critical infrastructure.

What GAO Found

While DOD has taken important steps to implement DCIP, it has not developed a comprehensive management plan to guide its efforts. GAO's prior work has shown the importance of developing a plan that incorporates sound management practices, such as issuing guidance, coordinating stakeholders' efforts, and identifying resource requirements and sources. Most of DOD's DCIP guidance and policies are either newly issued or in draft form, leading some DOD components to rely on other, better-defined programs, such as the antiterrorism program, to implement DCIP. Although DOD issued a DCIP directive in August 2005, the lead office responsible for DCIP lacks a chartering directive that defines important roles, responsibilities, and relationships with other DOD organizations and missions. DOD has created several information sharing and coordination mechanisms; however, additional measures could be taken. Also, DOD's reliance on supplemental appropriations to fund DCIP makes it difficult to effectively plan future resource needs. Until DOD completes a comprehensive DCIP management plan, its ability to implement DCIP will be challenged. DOD estimates that it has identified about 25 percent of the critical infrastructure it owns, and expects to identify the remaining 75 percent by the end of fiscal year 2009. In contrast, DOD has identified significantly less of the critical infrastructure that it does not own, and does not have a target date for its completion. Among the non-DOD-owned critical infrastructure that has been identified are some 200 assets belonging to private sector companies that comprise the defense industrial base--the focus of another report we plan to issue later this year. DOD estimates that about 85 percent of its mission-critical infrastructure assets are owned by non-DOD entities, such as the private sector; state, local, and tribal governments; and foreign governments. DOD has conducted vulnerability assessments on some DOD-owned infrastructure. While these assessments can provide useful information about specific assets, until DOD identifies and prioritizes all of the critical infrastructure it owns, assessment results have limited value for deciding where to target funding investments. For the most part, DOD cannot assess assets it does not own, and DOD has not coordinated with DHS to include them among DHS's assessments of the nation's critical infrastructure. DOD has delayed coordinating the assessment of non-DOD-owned infrastructure located abroad while it focuses on identifying the critical infrastructure that it does own. Regarding current and future DCIP funding levels, they do not include the cost to remediate vulnerabilities that are identified through the assessments. When DOD identifies, prioritizes, and assesses its critical infrastructure, and includes remediation in its funding requirements, its ability to perform risk-based decision making and target funding to priority needs will be improved.