	Background

DOD relies increasingly on globally networked computer systems to  manage the information it uses to perform operational missions and daily  management functions. DIAP was  established to meet DOD’s need for “integrated, comprehensive, and  consistent Defense-wide IA practice,” and to develop DOD into “a model  practitioner of IA” for the nation. Conclusions

While DIAP has addressed issues related to DOD’s departmental IA goals,  established new IA policy, improved communication across the  department, and initiated mechanisms for monitoring IA efforts throughout  DOD, many IA issues remain on which it has not taken action or only begun  to work. Given the high priority that DOD puts on IA, we believe the DIAP  should have made progress on more of its implementation plan objectives  by this time and gone further with the ones it has begun to address. Top- level DOD management has not carried out oversight commensurate with  the program’s high-priority role nor has DIAP received the resources that  were judged necessary by DOD when the program was initiated. DOD  continues to face significant personnel, technical, and operational  challenges in implementing an effective departmentwide IA program— something it cannot afford to ignore. A stronger management framework  for DIAP consisting of adequate funding and oversight would establish the  foundation needed to make greater progress in addressing such challenges.
What GAO Found

The components, military services, and agencies of the Department of Defense (DOD) share many risks in their use of globally networked computer systems to perform operational missions. Many reports of vulnerabilities, organized intrusions, and theft related to department systems and networks have underscored weaknesses in DOD systems. In January 1998, DOD responded to these risks by announcing its plans for a Defense-wide Information Assurance Program to promote integrated, comprehensive, and consistent information assurance (IA) practices across the department. Although the program has addressed issues related to DOD's departmental IA goals, established new IA policy, improved communication across the department, and introduced mechanisms for monitoring IA efforts throughout DOD, many IA issues remain unaddressed. Given the high priority that DOD puts on IA, GAO believes the the program should have made progress on more of its implementation plan objectives by this time and gone further with the ones it has begun to address. Top-level DOD management has not carried out oversight commensurate with the program's high-priority role and the program has not received the resources that were judged necessary by DOD when the program was initiated. DOD continues to face significant personnel, technical, and operational challenges in implementing an effective departmentwide IA program--something it cannot afford to ignore. A stronger management framework for the program consisting of adequate funding and oversight would establish the foundation needed to make greater progress in addressing such challenges.