The Deputy Assistant Secretary of Defense for Chemical and  Biological Defense is responsible for Chemical and Biological  Defense Program oversight activities, acquisition policy guidance, and  interagency coordination. 3. CBDP Enterprise officials acknowledge the importance,  validity, and necessity of addressing the 2008 recommendation and  recognized these points in their 2012 CBDP Business Plan. However, the  CBDP Enterprise has made limited progress in achieving this  infrastructure goal because CBDP Enterprise officials told us that they  were focused on higher priorities and had no CBDP Enterprise-wide  impetus to address the infrastructure recommendations. The CBDP Enterprise Does Not Have an Entity to Achieve Infrastructure Transformation and Has Not Established Timelines and Milestones to Identify Required Infrastructure Capabilities

The limited progress in fully achieving the CBDP Enterprise goal to  identify required infrastructure capabilities, and transform the way  infrastructure is managed, is because OASD (NCB) has not identified and  designated an entity that has the responsibility and authority needed to  lead the effort to ensure the achievement of this and other CBDP  Enterprise goals (e.g., the other three 2008 PAIO recommendations, as  identified in the Background section of this report, and the goal  established in the 2012 CBDP Business Plan—an assessment of the  CBDP Enterprise’s required infrastructure capabilities), and no timelines  or milestones have been established for their completion. The CBDP Enterprise Plans to Identify Potential Duplication in Its Chemical and Biological Defense Infrastructure but Does Not Plan to Consider Information from Existing Studies from Other Federal Agencies

The CBDP Enterprise has taken some actions to identify, address, and  manage potential fragmentation, overlap, and duplication. By identifying,  requesting, and considering information from existing infrastructure  studies from other federal agencies working in this area, PAIO will be  better positioned to meet DOD’s goal to avoid duplication by having more  information about existing infrastructure across the federal government  for use by the CBDP Enterprise to support its work. PAIO Does Not Plan to Identify, Request, or Consider Information from Existing Infrastructure Studies from Other Federal Agencies as Part of Its Duplication Study

PAIO plans to identify potential duplication within the CBDP Enterprise;  however, PAIO does not plan to identify, request, or consider information  from existing studies about infrastructure capabilities of other federal  agencies with research and development or test and evaluation  infrastructure to study chemical and biological threats. The CBDP Enterprise Used Threat Data and Plans to Use Data on Threats and Results of Risk Assessments to Support Future Research and Development Planning but Has Not Updated Its Guidance and Planning Process

The CBDP Enterprise used data on chemical and biological threats from  the intelligence community and plans to use threat data and the results  from risk assessments first conducted in 2014 by the Joint Requirements  Office and ODASD (CBD) to support planning for its future portfolio  planning process for research and development. The standards also call for written  procedures, to better ensure leadership directives are implemented. As of March 2015, ODASD (CBD) and Joint  Requirements Office officials had not formally committed to updating such  guidance or established a time frame for doing so to fully institutionalize  the use of risk assessments. Going forward, addressing internal control standards by updating its  guidance and the planning process to fully institutionalize the use of risk  assessments would support planning, help ensure that the CBDP  Enterprise leadership directives are implemented, and end dependence  upon any particular agency official to request risk assessments to support  future investment planning. Fully institutionalizing the  use of risk assessments would support CBDP Enterprise planning and  may provide new information about chemical and biological defense  capabilities to further prioritize the CBDP Enterprise’s future research and  development investments. To help ensure that the CBDP Enterprise’s infrastructure is properly  aligned to address current and emerging chemical and biological threats,  we recommend that the Secretary of Defense direct the appropriate DOD  officials to take the following two actions:  identify and designate an entity within the CBDP Enterprise with the  responsibility and authority to lead the effort to ensure achievement of  the infrastructure goals (e.g., the four 2008 PAIO recommendations,  including the recommendation that the CBDP Enterprise identify its  required infrastructure capabilities, and the goal established in the  2012 CBDP Business Plan), and establish timelines and milestones for achieving identified chemical  and biological infrastructure goals, including implementation of the  2008 PAIO recommendation that the CBDP Enterprise identify its  required infrastructure capabilities. Appendix II: Scope and Methodology

To determine the extent to which the Chemical and Biological Defense  Program (CBDP) Enterprise has achieved its goal to identify required  infrastructure capabilities to address current and emerging chemical and  biological threats, we reviewed the Program Analysis and Integration  Office’s (PAIO) 2008 study, Chemical and Biological Defense Program’s  Non-Medical Physical Infrastructure Capabilities Assessment, which  assessed the physical infrastructure capabilities of the CBDP Enterprise  to support the CBDP mission. Security. Public Health Preparedness: Developing and Acquiring Medical  Countermeasures Against Chemical, Biological, Radiological, and  Nuclear Agents.
Why GAO Did This Study

The United States faces current and emerging chemical and biological threats, and defenses against these threats enable DOD to protect the force, preclude strategic gains by adversaries, and reduce risk to U.S. interests.
GAO was asked to review DOD efforts to manage its chemical and biological defense infrastructure capabilities. This report examines the extent to which the CBDP Enterprise has: (1) achieved its goal to identify required infrastructure capabilities to address current and emerging chemical and biological threats; (2) identified, addressed, and managed potential fragmentation, overlap, and duplication in its chemical and biological defense infrastructure; and (3) used and plans to use threat data and the results of risk assessments to support its investment planning for chemical and biological defense. GAO analyzed CBDP infrastructure policies, plans, and studies from organizations across the CBDP Enterprise from fiscal years 2008 through 2014.

What GAO Found

A key component of the 26 Department of Defense (DOD) organizations that constitute the Chemical and Biological Defense Program (CBDP) Enterprise is the chemical and biological defense research and development and test and evaluation infrastructure. After nearly 7 years, the CBDP Enterprise has not fully achieved its goal to identify required infrastructure capabilities. The Joint Chemical, Biological, Radiological, and Nuclear Defense Program Analysis and Integration Office (PAIO), CBDP's analytical arm, recommended in 2008 that the CBDP Enterprise identify required infrastructure capabilities, such as laboratories to research chemical and biological agents, to ensure alignment of the infrastructure to its mission. CBDP Enterprise officials recognize the importance, validity, and necessity of addressing the 2008 recommendation. The CBDP Enterprise has made limited progress in achieving this infrastructure goal because CBDP Enterprise officials told GAO that they were focused on higher priorities and had no CBDP Enterprise-wide impetus to address the infrastructure recommendations. The Office of the Assistant Secretary of Defense for Nuclear, Chemical, and Biological Defense Programs previously identified the need for an entity that has the responsibility and authority needed to ensure achievement of this goal, but DOD has not designated such an entity. By identifying and designating an entity with the responsibility and authority to lead infrastructure transformation, the CBDP Enterprise would be better positioned to achieve this goal.
The CBDP Enterprise has taken some actions at its laboratories to identify duplication in its chemical and biological defense infrastructure. DOD directives outline goals, such as to avoid duplication by using existing DOD and other federal agencies' facilities. As part of an ongoing study to identify required infrastructure, in July 2015 PAIO plans to inventory and analyze CBDP Enterprise infrastructure for potential duplication. However, study officials stated that they do not plan to identify, request, or consider information about infrastructure capabilities from existing studies of other federal agencies, such as the Department of Homeland Security, because their office does not have the authority or resources to require such information. By considering existing information, which would not necessarily require new authority, PAIO will have more information about existing infrastructure inventory across the federal government, such as its capability and potential availability for use.
The CBDP Enterprise used threat data and plans to use threat data and the results from risk assessments piloted in 2014 to support its future portfolio planning process to prioritize research and development investment. However, the CBDP Enterprise has not updated its guidance and planning process to fully institutionalize the use of risk assessments. Federal standards for internal control state that agencies should have written procedures to better ensure leadership directives are implemented. According to CBDP Enterprise officials, while updating the guidance would be beneficial, they had not committed to updating such guidance or established a time frame for doing so. By updating its guidance to fully institutionalize the use of risk assessments, the CBDP Enterprise would be better positioned to prioritize future research and development investments.

What GAO Recommends

GAO recommends, among other things, that DOD (1) designate an entity to lead the effort to identify required infrastructure; (2) identify, request, and consider any information from chemical and biological infrastructure studies of other federal agencies to avoid potential duplication; and (3) update the CBDP Enterprise's guidance and planning process to fully institutionalize the use of risk assessments. DOD concurred with all five of GAO's recommendations and discussed actions it plans to take.