Northern Command; the Director, National  Security Agency; and the DOD Chief Information Officer. Nuclear Personnel Reliability

DOD and the military services set standards to ensure that personnel who  work with nuclear weapons and nuclear weapons systems, NC3 systems  and equipment, and special nuclear material are reliable, trustworthy, and  capable of performing their assigned nuclear weapons-related mission. DOD has made progress in implementing the  remaining 11 recommendations. DOD’s Processes for Tracking and Evaluating Its Progress Can Be Improved by Identifying Additional Performance Measures, Milestones, and Risks

DOD’s processes for tracking and evaluating its progress in implementing  the 2014 nuclear enterprise reviews’ recommendations do not  consistently identify and document risks, and its processes for tracking  and evaluating its progress in implementing the 2015 NC3 report’s  recommendations do not identify performance measures, milestones, or  risks. DOD Has Identified Performance Measures and Milestones for Evaluating the Implementation of the 2014 Nuclear Enterprise Reviews’ Recommendations, but Additional Guidance for Identifying and Documenting Risks Could Improve Oversight

CAPE is working with the military services and other DOD components to  track and evaluate the implementation actions taken in response to the  recommendations from the 2014 nuclear enterprise reviews; however,  risks associated with these actions are not consistently identified and  documented. As part of this transition, CAPE provided the military departments and  other DOD entities with guidance to aid in their tracking and analysis of  the recommendations from the 2014 nuclear enterprise reviews, but this  guidance does not require the military services and other DOD  components to identify and document risks prior to bringing a  recommendation for closure. This guidance emphasizes using  performance measures and milestones to track and measure the  progress of implementation actions. The Independent Review of  the Department of Defense Nuclear Enterprise found that the avoidance  of managing risks by many leaders within the enterprise resulted in  adverse impacts to the mission. When approved and implemented, this template will provide a  form that could be used for documenting performance measures,  milestones, and risks for these 2015 recommendations, once this  information is identified. Identifying and sharing performance measures, milestones, and risks  could aid DOD CIO in tracking and evaluating DOD’s efforts to implement  the 2015 NC3 report recommendations. In addition, including an assessment of risks  associated with the implementation of the recommendations from the  2015 NC3 report similar to the follow-up to the recommendations of the  2014 nuclear enterprise reviews could enhance DOD’s ability to provide  oversight of the recommendations and make informed responses to  address any identified risks throughout its review processes, all the way  to their closure by the Oversight Council. DOD and the Military Services Have Implemented Recommended Changes to their Personnel Reliability Assurance Programs to Reduce Administrative Burdens

DOD and the military services have implemented changes to their  personnel reliability assurance programs in response to 17  recommendations from the 2014 nuclear enterprise reviews. Additionally,  the Air Force has incorporated these nine essential elements into its  Arming and Use of Force program, allowing the Air Force to use this  program to ensure that its security forces meet nuclear surety  requirements. These nine essential elements are that an individual must  1.  be a U.S. citizen  2.  have a security clearance and be reinvestigated every five years  3.  be fully qualified for the position in which he or she will serve  4.  have reliability verified by the commander before being assigned to a  Personnel Reliability Assurance Program position  5.  be continuously monitored by peers, supervisors, and commander for  issues that could affect reliability  6.  have his or her personnel file checked for issues that could affect  7.  undergo a medical evaluation to identify any conditions that could  8.  have a personal interview with the commander who will be assessing  9.  exhibit the character and competence to do the job, including  allegiance to the United States and a positive attitude toward nuclear  weapons  In response to the Joint Staff review, the Office of the Assistant Secretary  of Defense for Nuclear Matters, through the Office of the Under Secretary  of Defense for Acquisition, Technology and Logistics, issued a new  version of the Personnel Reliability Program manual in January 2015,  followed by a reissue and renaming of the overarching DOD instruction— changing the name to DOD Nuclear Weapons Personnel Reliability  Assurance—in April 2016. The military services have responded to DOD’s changes by updating their  own guidance. The reviews found that, as a  result, these personnel reliability assurance programs had become  dominated by processes that were intended to prepare for inspections,  rather than to ensure personnel reliability. To address the recommended improvements identified by the 2014  nuclear enterprise reviews, DOD has updated its inspection procedures.
Why GAO Did This Study

In 2014, the Secretary of Defense directed two reviews of DOD's nuclear enterprise. These reviews identified problems with leadership, organization, investment, morale, policy, and procedures, as well as other shortcomings that adversely affected the nuclear deterrence mission. The reviews also made recommendations to address these problems. In 2015, DOD conducted a review focused on NC3 systems, which resulted in additional recommendations.
The National Defense Authorization Act for Fiscal Year 2017 includes a provision for GAO to review DOD's processes for addressing these recommendations, and House Report 114-537 includes a provision for GAO to review changes to DOD's nuclear personnel reliability assurance programs. This report addresses the extent to which DOD and the military services have (1) made progress in implementing recommendations to improve the nuclear enterprise and (2) made changes to their personnel reliability assurance programs. GAO reviewed relevant documents and interviewed agency officials from DOD and the military services. This is a public version of a classified report GAO issued in August 2017. It omits information DOD deemed classified.

What GAO Found

The Department of Defense (DOD) has made progress in implementing the recommendations from the 2014 nuclear enterprise reviews and the 2015 nuclear command, control, and communications (NC3) systems report.
In December 2016, the Office of Cost Assessment and Program Evaluation (CAPE) provided the military services with guidance that emphasizes using performance measures and milestones to evaluate progress to aid them in tracking and analyzing their implementation of the recommendations from the 2014 nuclear enterprise reviews. However, CAPE's guidance does not require the military services and other DOD components to identify and document risks as part of its recommendation tracking processes. As a result, DOD does not consistently identify and document risks, and it may not be identifying and communicating potential risks related to the nuclear enterprise. One of the 2014 nuclear enterprise reviews found that the avoidance of managing risks by many leaders within the enterprise adversely affected the mission. Developing additional guidance on identifying and documenting risks could enhance DOD's ability to provide oversight of its efforts to monitor progress and make informed responses to address any identified risks.
For recommendations made in the 2015 NC3 report, DOD's Office of the Chief Information Officer (DOD CIO) uses an internal spreadsheet to track implementation but has not yet identified performance measures, milestones, or risks. DOD CIO has drafted a template that, once it has been approved and implemented, will provide a form that could be used for documenting performance measures, milestones, and risks. By identifying and communicating this information, DOD CIO could improve its efforts to track the progress of DOD's actions, evaluate their effects, and formulate responses to risks.
DOD and the military services have implemented changes to their personnel reliability assurance programs in response to recommendations from the 2014 nuclear enterprise reviews. These programs are intended to ensure that DOD personnel who work with nuclear weapons and nuclear weapons systems, NC3 systems and equipment, and special nuclear material are trustworthy, reliable, and capable of performing their assigned nuclear weapons-related mission. The 2014 nuclear enterprise reviews found that these personnel reliability assurance programs were overly complex and administratively burdensome and that frequent and intrusive inspections left nuclear units more focused on preparing for and responding to inspections than on ensuring personnel reliability. DOD and the services have updated their guidance for personnel reliability assurance programs, including focusing on nine essential elements of reliability. For example, the Air Force has incorporated these elements into the standards it uses for its security forces. Additionally, the Air Force has centralized some of its administrative processes, and the Joint Staff has updated inspection procedures in a way that may ease the burden on personnel being inspected.

What GAO Recommends

DOD should develop additional guidance on identifying and documenting risks, and should identify and communicate performance measures and risks. DOD concurred and provided information about planned actions to implement them.