DOD’s Section 1648 Report Addressed Some of the Statutorily Required Elements

DOD did not develop a comprehensive plan; instead, the department  submitted a collection of separate documents that addressed some, but  not all six statutorily required elements (hereafter referred to as DOD’s  Section 1648 report). DOD’s Section 1648 report also includes a list of cyber civil support  exercises that DOD conducted over the last 3 years. DOD’s Report Did Not Address One of the Elements Required by the Statute and DOD Has Not Ensured That Staff Are Trained

DOD’s Section 1648 report did not address one of the six required  elements—to provide a plan for internal DOD collective training activities  that are integrated with exercises conducted with other agencies and  state and local governments. In addition, DOD’s Significant Cyber Incident Coordination Procedures  require the Chairman of the Joint Chiefs of Staff, through the National  Military Command Center, to maintain a list of senior DOD officials from  specified organizations that could represent DOD during a Cyber Unified  Coordination Group and who are trained in the National Incident  Management System. Taking action to  improve the areas we have highlighted should help DOD sustain the  progress it has already made. With the President’s decision to elevate  CYBERCOM to a unified combatant command, such actions will also help  as DOD continues to plan to support civil authorities in response to a  cyber incident and where CYBERCOM has a significant role. DOD partially concurred with our recommendation to update the  department's cyber incident coordination training to incorporate the tenets  of PPD-41. Accordingly, we continue to believe that our recommendation is  warranted. Appendix II: Section 1648 (a) of the National Defense Authorization Act for Fiscal Year 2016

SEC. 1648. (a) COMPREHENSIVE PLAN OF DEPARTMENT OF DEFENSE TO  SUPPORT CIVIL AUTHORITIES IN RESPONSE TO CYBER ATTACKS  BY FOREIGN POWERS.—  (1) PLAN REQUIRED.—  (A) IN GENERAL.—Not later than 180 days after the date  of the enactment of this Act, the Secretary of Defense shall  develop a comprehensive plan for the United States Cyber  Command to support civil authorities in responding to cyber  attacks by foreign powers (as defined in section 101 of the  Foreign Intelligence Surveillance Act of 1978 (50 U.S.C. 1801))  against the United States or a United States person. The analysts assessed each element in the report as “fully  addressed,” “partially addressed,” or “not addressed.” If the Section 1648  report addressed all aspects of the required element, the analysts  determined that DOD had “fully addressed” the element.
Why GAO Did This Study

The Presidential Policy Directive on United States Cyber Incident Coordination states that significant cyber incidents are occurring with increasing frequency impacting public and private infrastructure in the United States. Section 1648 of the National Defense Authorization Act for Fiscal Year 2016 included a provision that DOD develop a comprehensive plan for CYBERCOM to support civil authorities in responding to cyberattacks by foreign powers against the United States. Section 1648 also included a provision that GAO review DOD's plan.
This review assesses the extent to which DOD's Section 1648 report addressed the statutorily required submission elements. To conduct this work, GAO assessed DOD's Section 1648 report against the elements outlined in the statute. GAO also discussed the Section 1648 report with DOD policy, Joint Chiefs of Staff, combatant commands, and military service officials.

What GAO Found

The Department of Defense (DOD) did not develop a comprehensive plan for U.S. Cyber Command (CYBERCOM); instead, the department submitted a report consisting of a collection of documents that fully addressed two of the six statutorily required elements; partially addressed three elements; and did not address the sixth element on DOD training activities.
Legend:
○ Did not address: Submission does not include required element.
GAO also found that, in addition to not addressing the training element in the report, DOD had not ensured that staff are trained as required by the Presidential Policy Directive on United States Cyber Incident Coordination or DOD's Significant Cyber Incident Coordination Procedures, which were included DOD's Section 1648 report. Taking action to improve these areas should help DOD sustain progress it has already made. With the President's decision to elevate CYBERCOM to a unified combatant command, such actions will also help as DOD continues to plan to support civil authorities in response to a cyber incident and where CYBERCOM has a significant role.

What GAO Recommends

GAO has previously recommended that DOD take actions on elements of the Section 1648 report that were partially addressed. GAO is making two new recommendations that DOD update cyber incident coordination training and maintain a list of officials trained in the National Incident Management System. DOD concurred with maintaining a list of trained officials and partially concurred on updating cyber training. GAO continues to believe the updating recommendation is warranted.