The Air National Guard does not have any  management responsibilities for GuardNet. In addition, while they provided us with a list of  130 DOD and bureau applications that GuardNet supports, they did not  know whether this list was complete, and other sources of information  suggest that the list is not complete. For example, NGB’s fiscal year 2003  funding request states that the network supports 135 applications. For example, after last year’s terrorist attacks, NGB officials used  GuardNet to communicate with states, territories, and the District of  Columbia on the use of National Guard units to coordinate airport security  activities. According to NGB officials, formally managing GuardNet requirements has  not been an area of management attention or a priority. As a result, NGB  does not know what its network is being used for, what its users’ needs are,  or whether GuardNet is satisfying these needs. NGB also has not developed a network security plan. NGB is not performing critical monitoring activities to ensure that  implemented controls are operating as intended. However, GuardNet is not ready to meet this challenge because NGB does  not fully know the network’s requirements and is not effectively managing  the network. In addition, we recommend that  the requirements management improvement plan provide for  establishing a process that includes (1) developing a requirements  management plan, (2) involving network users in developing and  changing requirements, (3) developing requirements management  baseline documentation, such as a mission needs statement and an  operational requirements document, and (4) establishing controls for  assessing and approving proposed changes to the baseline;  the configuration management improvement plan provide for  establishing a process that includes (1) identifying and documenting the  network’s components/subcomponents (hardware and software), (2)  creating a baseline configuration (development, test, and production  environments) of these component parts, (3) controlling changes to  these configuration baselines through a formal change process that  allows only the NGB-AIS Configuration Control Board to approve  changes to GuardNet, (4) ensuring that network documentation remains  current to enable accurate reporting of changes as the network evolves,  and (5) periodically auditing to ensure that the documentation is  complete and accurate; and   the security management improvement plan provide for establishing a  process that includes (1) assessing risks to determine security needs, (2)  implementing needed controls in accordance with applicable policy and  guidance, (3) monitoring existing controls to ensure that they are  operating as intended, and (4) ensuring that the network is certified and  accredited in accordance with DOD policy. Objectives, Scope, and Methodology

The objectives of our review were to determine (1) the current and  potential requirements of the National Guard Bureau’s (NGB) GuardNet  and (2) the effectiveness of the processes for managing current and  potential network requirements, the network’s configuration, and network  security.
Why GAO Did This Study

The Fiscal Year 2002 Defense Authorization Act required GAO to review GuardNet, the National Guard's wide-area network, which is used to support various Defense applications and was used to support homeland security activities after the terrorist attacks of September 11th. GAO was asked to determine the current and potential requirements for GuardNet and the effectiveness of the processes for managing the network's requirements, configuration, and security.

What GAO Found

The National Guard does not fully know the current or potential requirements for GuardNet or how it is being used, because it has not fully documented requirements. Guard officials provided GAO with a list of applications that the network supports, but they would not attest to the list's completeness, and GuardNet users identified other applications. The processes for managing GuardNet are not effective in three key areas: Requirements: For example, the Guard has not developed a requirements management plan or clearly established users' roles in developing and changing requirements. Configuration: For example, the Guard has not documented the network's configuration and is not controlling changes to configuration components. Security: For example, the Guard has not implemented needed security controls, such as firewalls, to protect GuardNet and does not monitor controls on an ongoing basis to ensure that implemented controls are working as intended. According to Guard officials, establishing these management processes has not been a priority. Without these basic processes, the Guard cannot ensure that GuardNet will perform as intended and provide its users with reliable and secure services. GuardNet is thus a dubious option for further support of critical mission areas such as homeland security.