Defense Critical Infrastructure
Actions Needed to Improve the Consistency, Reliability, and Usefulness of DOD's Tier 1 Task Critical Asset List Gao ID: GAO-09-740R July 17, 2009The Department of Defense (DOD) relies on a global network of defense critical infrastructure so essential that the incapacitation, exploitation, or destruction of an asset within this network could severely affect DOD's ability to deploy, support, and sustain its forces and operations worldwide and to implement its core missions, including current missions in Iraq and Afghanistan. Because of its importance to DOD operations, this defense critical infrastructure could be vulnerable to attacks by adversaries, and vulnerable to natural disasters and hazards, such as hurricanes and earthquakes. Since September 2003, the Office of the Assistant Secretary of Defense for Homeland Defense and Americas' Security Affairs (ASD[HD&ASA]) has been responsible for developing and ensuring implementation of critical infrastructure protection policy and program guidance. To identify and help assure the availability of this mission-critical infrastructure, in August 2005 DOD established the Defense Critical Infrastructure Program (DCIP), assigning overall responsibility for the program to ASD(HD&ASA). In April 2008, DOD issued an instruction that further assigned responsibilities and prescribed procedures for the implementation of DCIP, among other things. In October 2008, DOD formalized the process for identifying and prioritizing its critical infrastructure. Since 2006, ASD(HD&ASA) has collaborated with the Joint Staff to compile a list of all DOD- and non-DOD-owned infrastructure essential to accomplish DOD's missions. To support this effort, the combatant commands and military services are to identify and place their critical assets into prioritized tiers, including Tier 1 Task Critical Assets, which are assets of such extraordinary importance that their incapacitation or destruction would have a serious, debilitating effect on the ability of one or more military services, combatant commands, or DCIP Defense Infrastructure Sector Lead Agents to execute the mission essential tasks they support. Defense Critical Assets, on the other hand, are the assets most critical for fulfilling overall DOD missions and are identified from the universe of Task Critical Assets. The Joint Staff worked with the combatant commands, military services, and Defense Infrastructure Sector Lead Agents to develop the current departmentwide list of Tier 1 Task Critical Assets. In October 2008, ASD(HD&ASA) formally accepted the Joint Staff's Defense Critical Asset nomination list as an initial list of Defense Critical Assets. In its May 2008 report on H.R. 5658, the House Committee on Armed Services addressed DOD's lack of progress in analyzing the risks of electrical power outages to critical DOD missions through DCIP and, among other things, directed that GAO continue its review of DCIP. As a result, we initiated our on-going review of the assurance of electrical power supplies to DOD's critical assets.
While DOD has made some progress in developing a Tier 1 Task Critical Asset list, this progress was limited by DOD's lack of consistent criteria for identifying and prioritizing Tier 1 Task Critical Assets. When selecting and submitting their most recent lists of Tier 1 Task Critical Asset submissions to the Joint Staff, the combatant commands and the military services used disparate sets of guidance, including draft and nonbinding guidance, as their criteria. Air Force officials, however, told us they developed formal critical asset identification guidance based on DOD's draft critical asset identification manual. According to military service and combatant command officials, DOD's draft and nonbinding guidance contained unclear definitions of asset tiers, Task Critical Assets, and other key terms, such as "mission essential tasks." DOD has taken some actions toward promoting coordination among the combatant commands, military services, and Joint Staff in compiling DOD's Tier 1 Task Critical Asset list. For example, in August 2005, DOD issued DOD Directive 3020.40, which calls for coordination among the Joint Staff, combatant commands, military services, and other defense agencies for the purpose of identifying and assessing critical assets needed to implement DOD missions. However, DOD has not yet developed formal coordination responsibilities and an effective coordination mechanism within DCIP, including a forum for coordination between the military services and combatant commands when identifying critical assets. Combatant command and military service officials told us that, in considering which assets to submit to DOD's Tier 1 Task Critical Asset list, they coordinate only minimally with each other when determining which assets are critical to combatant command missions. Based on our analysis of the October 2008 manual and discussions with DCIP officials, we found that the Joint Staff, combatant commands, military services, and other DOD agencies still lack clearly defined coordination responsibilities and a mechanism for effective coordination within DCIP. As a result, the communication and coordination efforts among these key DCIP stakeholders when considering assets to nominate as Tier 1 Task Critical Assets have been insufficient and inconsistent. While DOD has developed a strategy and comprehensive management plan for DCIP, it has not fully developed some DCIP program management elements for identifying Tier 1 Task Critical Assets, which could enhance the effectiveness of the program. DOD's formal critical asset identification process manual issued in 2008 lacks some key elements necessary for sound program management, including clearly defined schedules and milestones for meeting performance goals and a formal feedback process. According to our work on sound management practices, comprehensive program schedules and formal communication strategies assist agencies in effectively implementing programs by providing relevant stakeholders with timelines to follow, performance milestones to meet, and shared expectations to guide their efforts. Because DOD lacks a formal process for submitting critical assets, including milestones and formal feedback from ASD(HD&ASA) or the Joint Staff on meeting program goals, the combatant commands and military services are limited in their ability to effectively select, compile, and validate their final nominations to DOD's Tier 1 Task Critical Asset list.
RecommendationsOur recommendations from this work are listed below with a Contact for more information. Status will change from "In process" to "Open," "Closed - implemented," or "Closed - not implemented" based on our follow up work.
Director: Team: Phone:GAO-09-740R, Defense Critical Infrastructure: Actions Needed to Improve the Consistency, Reliability, and Usefulness of DOD's Tier 1 Task Critical Asset List
This is the accessible text file for GAO report number GAO-09-740R
entitled 'Defense Critical Infrastructure: Actions Needed to Improve
the Consistency, Reliability, and Usefulness of DOD's Tier 1 Task
Critical Asset List' which was released on July 20, 2009.
This text file was formatted by the U.S. Government Accountability
Office (GAO) to be accessible to users with visual impairments, as part
of a longer term project to improve GAO products' accessibility. Every
attempt has been made to maintain the structural and data integrity of
the original printed product. Accessibility features, such as text
descriptions of tables, consecutively numbered footnotes placed at the
end of the file, and the text of agency comment letters, are provided
but may not exactly duplicate the presentation or format of the printed
version. The portable document format (PDF) file is an exact electronic
replica of the printed version. We welcome your feedback. Please E-mail
your comments regarding the contents or accessibility features of this
document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
GAO-09-740:
United States Government Accountability Office:
Washington, DC 20548:
July 17, 2009:
Congressional Committees:
Subject: Defense Critical Infrastructure: Actions Needed to Improve the
Consistency, Reliability, and Usefulness of DOD's Tier 1 Task Critical
Asset List:
The Department of Defense (DOD) relies on a global network of defense
critical infrastructure so essential that the incapacitation,
exploitation, or destruction of an asset within this network could
severely affect DOD's ability to deploy, support, and sustain its
forces and operations worldwide and to implement its core missions,
including current missions in Iraq and Afghanistan. Because of its
importance to DOD operations, this defense critical infrastructure
could be vulnerable to attacks by adversaries, and vulnerable to
natural disasters and hazards, such as hurricanes and earthquakes.
Since September 2003, the Office of the Assistant Secretary of Defense
for Homeland Defense and Americas' Security Affairs (ASD[HD&ASA]) has
been responsible for developing and ensuring implementation of critical
infrastructure protection policy and program guidance. To identify and
help assure the availability of this mission-critical infrastructure,
in August 2005 DOD established the Defense Critical Infrastructure
Program (DCIP),[Footnote 1] assigning overall responsibility for the
program to ASD(HD&ASA).[Footnote 2]In April 2008, DOD issued an
instruction that further assigned responsibilities and prescribed
procedures for the implementation of DCIP, among other things.[Footnote
3] In October 2008, DOD formalized the process for identifying and
prioritizing its critical infrastructure.[Footnote 4]
Since 2006, ASD(HD&ASA) has collaborated with the Joint Staff to
compile a list of all DOD-and non-DOD-owned infrastructure essential to
accomplish DOD's missions. To support this effort, the combatant
commands and military services are to identify and place their critical
assets into prioritized tiers,[Footnote 5] including Tier 1 Task
Critical Assets, which are assets of such extraordinary importance that
their incapacitation or destruction would have a serious, debilitating
effect on the ability of one or more military services, combatant
commands, or DCIP Defense Infrastructure Sector Lead Agents to execute
the mission essential tasks they support. Defense Critical Assets,
[Footnote 6] on the other hand, are the assets most critical for
fulfilling overall DOD missions and are identified from the universe of
Task Critical Assets. The Joint Staff worked with the combatant
commands, military services, and Defense Infrastructure Sector Lead
Agents to develop the current departmentwide list of Tier 1 Task
Critical Assets. In October 2008, ASD(HD&ASA) formally accepted the
Joint Staff's Defense Critical Asset nomination list as an initial list
of Defense Critical Assets.
In its May 2008 report on H.R. 5658,[Footnote 7] the House Committee on
Armed Services addressed DOD's lack of progress in analyzing the risks
of electrical power outages to critical DOD missions through DCIP and,
among other things, directed that GAO continue its review of DCIP. As a
result, we initiated our on-going review of the assurance of electrical
power supplies to DOD's critical assets. We originally planned to
select a random sample of DOD Tier 1 Task Critical Assets to survey for
this review; however, based on discussions with DOD officials and our
analysis, we determined that the universe of critical assets did not
represent an accurate, comprehensive list of DOD Tier 1 Task Critical
Assets, and that this issue in and of itself warranted further
analysis.[Footnote 8] Therefore, we are reporting separately on issues
relating specifically to the Tier 1 Task Critical Asset list with
recommendations, so DOD can take action in a timely manner to update
and improve its list of Defense Critical Assets in the fall of 2009 and
prioritize funding. We plan to issue a separate, related report later
this year on our on-going review of the assurance of electrical power
supplies to DOD critical assets.
As discussed with the committees of jurisdiction for this report, we
examined (1) the extent to which the combatant commands and military
services applied consistent and clear criteria in identifying and
prioritizing their submissions of assets to DOD's Tier 1 Task Critical
Asset list; (2) the actions ASD(HD&ASA) has taken to promote
coordination among the Joint Staff, the combatant commands, and the
military services to identify critical assets; and (3) the extent to
which ASD(HD&ASA) developed effective program management practices
related to the identification of Tier 1 Task Critical Assets, such as
formal milestones, schedules, and a feedback process.
We focused the scope of our review on DOD's list of Tier 1 Task
Critical Assets as of March 16, 2009, a universe of about 675 assets
from which a list of Defense Critical Assets was developed.[Footnote 9]
In addition, Defense Infrastructure Sector Lead Agents also identify
Tier 1 Task Critical Assets; however, we did not include them in the
scope of this review because they nominated relatively few assets
compared to the combatant commands and military services.
To evaluate these objectives, we conducted interviews with DCIP
officials at the U.S. Army, the U.S. Navy, and the U.S. Air Force; U.S.
Pacific Command; U.S. Strategic Command; Joint Staff (J-34); and
ASD(HD&ASA). To determine the extent to which the combatant commands
and military services applied consistent and clear criteria in
identifying and prioritizing their submissions of assets to DOD's Tier
1 Task Critical Asset list, we compared information regarding specific
DCIP criteria used from our interviews with the combatant command and
military service officials with prior and existing DCIP guidance,
including the Defense Critical Infrastructure Program Criticality
Process Guidance Document;[Footnote 10] the draft Critical Asset
Identification Process,[Footnote 11] the final DOD Manual 3020.45, DOD
Mission-Based Critical Asset Identification Process;[Footnote 12] DOD
Directive 3020.40;[Footnote 13] DOD Instruction 3020.45;[Footnote 14]
DCIP strategy documents;[Footnote 15] and relevant guidance from the
military services.[Footnote 16] To determine what actions ASD(HD&ASA)
has taken to promote coordination among the Joint Staff, the combatant
commands, and the military services, we conducted interviews with
appropriate DOD officials regarding steps taken and planned, and
evaluated the actions against current DCIP guidance related to
coordination. Finally, to determine the extent to which ASD(HD&ASA) has
developed effective program management practices related to the
identification of Tier 1 Task Critical Assets, such as formal
milestones, schedules, and a feedback process, we compared DCIP program
management strategies and documents with criteria cited under our
previous work on internal controls in the federal government.[Footnote
17] We also interviewed ASD(HD&ASA) and Joint Staff officials to
determine what program management efforts they were developing to
identify and prioritize Tier 1 Task Critical Assets. We conducted this
performance audit from April 2009 to June 2009 in accordance with
generally accepted government auditing standards. Those standards
require that we plan and perform the audit to obtain sufficient,
appropriate evidence to provide a reasonable basis for our findings and
conclusions based on our audit objectives. We believe that the evidence
obtained provides a reasonable basis for our findings and conclusions
based on our audit objectives.
Results in Brief:
While DOD has made some progress in developing a Tier 1 Task Critical
Asset list, this progress was limited by DOD's lack of consistent
criteria for identifying and prioritizing Tier 1 Task Critical Assets.
When selecting and submitting their most recent lists of Tier 1 Task
Critical Asset submissions to the Joint Staff, the combatant commands
and the military services used disparate sets of guidance, including
draft and nonbinding guidance, as their criteria. Air Force officials,
however, told us they developed formal critical asset identification
guidance based on DOD's draft critical asset identification manual.
According to military service and combatant command officials, DOD's
draft and nonbinding guidance contained unclear definitions of asset
tiers, Task Critical Assets, and other key terms, such as "mission
essential tasks." Additionally, while DOD encouraged the combatant
commands and military services to use the Criticality Process Guidance
Document and a draft DOD Mission-Based Critical Asset Identification
Process manual to determine their Tier 1 Task Critical Assets, it did
not require them to do so because DOD's final DOD Mission-Based
Critical Asset Identification Process manual had not yet been issued.
Our prior work on DCIP management[Footnote 18] and the Standards for
Internal Control in the Federal Government[Footnote 19] both emphasize
the importance of management controls to guide program implementation,
which includes the development and issuance of formal guidance. The use
of disparate sets of guidance, including draft and nonbinding guidance,
resulted in the selection and submission of assets to the Tier 1 Task
Critical Assets list based on inconsistent criteria, thus limiting the
usefulness of the Tier 1 Task Critical Asset list to DOD decision-
makers in determining DOD's most critical assets and prioritizing
funding to address identified vulnerabilities. In October 2008, DOD
formally issued the current guidance on the identification of critical
assets--DOD Manual 3020.45, DOD Critical Asset Identification Process-
-that all stakeholders are required to use when identifying and
prioritizing Task Critical Assets. Nevertheless, officials from U.S.
Pacific Command and the Air Force we spoke with said that certain
definitions contained in this current guidance are still subjective.
According to officials from U.S. Pacific Command, as long as the
process requires a determination of tier levels after an objective
analysis of missions, mission essential tasks, and criticality, there
will be a subjective element to certain definitions. Based on our
analysis of the guidance and discussions with various officials,
elements within those definitions may need to be further clarified. For
example, Air Force officials stated that determining what constitutes a
mission essential task for combatant command missions is a continuing
challenge. In discussions with us, ASD(HD&ASA) and Joint Staff
officials acknowledged that the critical asset identification process
is still subjective. In the absence of consistent and clear definitions
for determining appropriate asset tiers and asset criticality,
combatant commands and military services applied definitions of Tier 1
Task Critical Assets inconsistently and, going forward, may continue to
do so until these definitions are further clarified.
DOD has taken some actions toward promoting coordination among the
combatant commands, military services, and Joint Staff in compiling
DOD's Tier 1 Task Critical Asset list. For example, in August 2005, DOD
issued DOD Directive 3020.40, which calls for coordination among the
Joint Staff, combatant commands, military services, and other defense
agencies for the purpose of identifying and assessing critical assets
needed to implement DOD missions. Additionally, in October 2008, DOD
issued DOD Manual 3020.45, which defines the combatant command,
military service, and Joint Staff roles in the critical asset
identification process. However, DOD has not yet developed formal
coordination responsibilities and an effective coordination mechanism
within DCIP, including a forum for coordination between the military
services and combatant commands when identifying critical assets.
Combatant command and military service officials told us that, in
considering which assets to submit to DOD's Tier 1 Task Critical Asset
list, they coordinate only minimally with each other when determining
which assets are critical to combatant command missions. Based on our
analysis of the October 2008 manual and discussions with DCIP
officials, we found that the Joint Staff, combatant commands, military
services, and other DOD agencies still lack clearly defined
coordination responsibilities and a mechanism for effective
coordination within DCIP. As a result, the communication and
coordination efforts among these key DCIP stakeholders when considering
assets to nominate as Tier 1 Task Critical Assets have been
insufficient and inconsistent. For example, Army officials stated they
were unaware that an Army-related critical asset was submitted as a
Defense Critical Asset during the previous data call and did not know
who submitted it. Army officials think this will continue to be a
problem under the new asset identification process. This is important
because the asset owner--the Army in this case--typically uses this
information to help develop strategies to mitigate risks and provide
funding to address the asset's identified vulnerabilities. Officials we
spoke with from all three military services stated that lack of
coordination with the combatant commands to identify task critical
assets may continue. Joint Staff officials also acknowledged that
coordination needs to be strengthened between the military services and
combatant commands. Without effective coordination, the Joint Staff,
combatant commands, and military services cannot agree on an accurate
identification and prioritization of assets most critical to fulfilling
combatant commands' missions or reach agreement on how to prioritize
funding to help develop effective actions to protect and mitigate
against possible attacks on DOD's critical infrastructure.
While DOD has developed a strategy and comprehensive management plan
for DCIP, it has not fully developed some DCIP program management
elements for identifying Tier 1 Task Critical Assets, which could
enhance the effectiveness of the program. DOD Directive 3020.40
requires ASD(HD&ASA)--the lead office for DCIP--to develop and ensure
the implementation of DCIP policy and program guidance for the
identification, prioritization, and protection of defense critical
infrastructure. This directive also requires the Joint Staff to assist
ASD(HD&ASA) in the development and maintenance of DCIP standards. DOD's
formal critical asset identification process manual issued in 2008
lacks some key elements necessary for sound program management,
including clearly defined schedules and milestones for meeting
performance goals and a formal feedback process. According to our work
on sound management practices, comprehensive program schedules and
formal communication strategies assist agencies in effectively
implementing programs by providing relevant stakeholders with timelines
to follow, performance milestones to meet, and shared expectations to
guide their efforts. Because DOD lacks a formal process for submitting
critical assets, including milestones and formal feedback from
ASD(HD&ASA) or the Joint Staff on meeting program goals, the combatant
commands and military services are limited in their ability to
effectively select, compile, and validate their final nominations to
DOD's Tier 1 Task Critical Asset list. For example, according to the
combatant command and military service officials we spoke with, the
Joint Staff asked them to submit their final nominations for DOD's Tier
1 Task Critical Asset list in 2008 with relatively little prior notice.
As a result, these officials expressed concern that they did not
receive adequate time to develop their submissions thoroughly or
accurately, and that they did not receive any formal feedback from the
Joint Staff once their lists were submitted. Recognizing this problem,
ASD(HD&ASA) officials told us that they are planning to develop a
formal schedule for the combatant commands and military services to
follow in developing their Tier 1 Task Critical Asset submissions.
However, until ASD(HD&ASA) finalizes and formally issues this schedule,
there may continue to be discrepancies in the expectations among the
combatant commands, military services, and the Joint Staff regarding
the timeframes for submitting assets. As a result, DOD's Tier 1 Task
Critical Asset list may continue to include assets that should not be
on the list, or exclude assets that should be on the list if the
services and combatant commands are not allowed sufficient notice or
time for completing their asset submissions. In addition, without
formal feedback from the Joint Staff on how DCIP stakeholders are
adhering to program guidelines, the combatant commands and military
services may not be aware that some of their asset submissions to the
Tier 1 Task Critical Asset list do not conform to DCIP criteria.
We are recommending that ASD(HD&ASA) clarify key elements within the
DCIP definitions of a Task Critical Assets, formalize coordination
responsibilities and mechanisms within DCIP, and develop processes for
compiling the Tier 1 Task Critical Asset list, including the
development of a formal schedule with timelines and milestones and a
formal feedback process for key DCIP stakeholders when identifying and
prioritizing critical assets for submission to the Tier 1 Task Critical
Asset list.
In written comments on a draft of this report, DOD partially concurred
with all three of our recommendations. For each recommendation, DOD
described relevant guidance in place or in draft and additional actions
it would take in response. Our responses to these comments are
presented in the Agency Comments and Our Evaluation section of this
report, and DOD's comments are reprinted in enclosure I. We also
received technical comments from U.S. Pacific Command, and we
incorporated these as appropriate.
Background:
In response to the guidance contained in Homeland Security Presidential
Directive 7,[Footnote 20]DOD formalized its critical infrastructure
efforts in August 2005 by issuing DOD Directive 3020.40, Defense
Critical Infrastructure Program (DCIP), which established the program
and assigned overall responsibility to ASD(HD&ASA). DOD Directive
3020.40 requires, among other things, that ASD(HD&ASA) develop and
ensure implementation of DCIP policy and program guidance for the
identification, prioritization, and protection of defense critical
infrastructure.
Under DCIP, ASD(HD&ASA) and the Joint Staff have tasked the combatant
commands, military services, and Defense Infrastructure Sector Lead
Agents with nominating infrastructure necessary to accomplish the goals
specified in the National Defense Strategy.[Footnote 21] The combatant
commands, in collaboration with the Joint Staff, identify and
prioritize DOD missions that are the basis for determining
infrastructure criticality, while the military services, as the
principal owners of DOD infrastructure, identify and link
infrastructure to the specific mission requirements of the combatant
commands in coordination with defense infrastructure lead agents. Based
on these efforts, the combatant commands and military services then
nominate assets to DOD's consolidated draft critical asset list, which
ASD(HD&ASA) uses as the basis for developing a final Task Critical
Asset list and the Defense Critical Asset list.
According to DCIP guidance for identifying defense critical
infrastructure, the process used by DCIP stakeholders provides a
consistent, repeatable, mission-focused analysis process to identify
Task Critical Assets and an effects-based analysis to identify Defense
Critical Assets from the list of Tier 1 Task Critical Assets. A Task
Critical Asset is an asset of such extraordinary importance that its
incapacitation or destruction would have a very serious debilitating
effect on the ability of DOD, a military department, combatant command,
sub-unified command, defense agency, or Defense Infrastructure Sector
Lead Agent to execute the task that the asset supports. In October
2008, DOD issued DOD Manual 3020.45 that outlined a process for the
combatant commands, the military services, the Defense Infrastructure
Sector Lead Agents, and other DOD organizations to follow when
identifying assets for submission as DOD Task Critical Assets. This
process results in a DOD-wide list of Task Critical Assets that are
tiered into three groups (Tier 1, Tier 2, and Tier 3) based on the
criticality of their supported missions. The manual then tasks the
Chairman of the Joint Chiefs of Staff to recommend a list of DOD
Defense Critical Assets--selected from the Tier 1 Task Critical Asset
list--to ASD(HD&ASA) for review and approval.
ASD(HD&ASA) has issued numerous documents with guidance related to
DCIP, including DOD directives, manuals, and instructions. Figure 1
illustrates the timeline of issuance of key pieces of DCIP guidance
related to the identification of Task Critical Assets and Defense
Critical Assets.
Figure 1: Timeline of Issuance of Key DCIP Guidance:
[Refer to PDF for image: time line]
September 2003: ASD(HD&ASA) becomes responsible for critical
infrastructure protection policy and program guidance.
August 2005: DOD issues DOD Directive 3020.40 Defense Critical
Infrastructure Program (DCIP).
December 2006: DOD releases the DCIP Defense Critical Infrastructure
Program Critical Process Guide.
May 2007: DOD releases the DCIP Security Classification Manual.
September 2007: DOD releases the draft Critical Asset Identification
Process manual.
April 2008: DOD issues DOD Instruction 3020.45 Defense Critical
Infrastructure Program (DCIP) Management.
October 2008: DOD issues DOD Manual 3020.45, Vol.1, DOD Critical Asset
Identification Process.
Source: GAO analysis of DOD documents.
[End of figure]
DOD Lacks Consistent Criteria for Identifying and Prioritizing Critical
Assets to Develop Its Tier 1 Task Critical Asset List:
While DOD has made some progress in developing an evolving Tier 1 Task
Critical Asset list, this progress has been limited by DOD's lack of
consistent criteria, including unclear definitions, for identifying and
prioritizing Tier 1 Task Critical Asset nominations. The Joint Staff
formally requested submissions of task critical assets from the
military services, combatant commands, and other DCIP stakeholders in
January 2007, and early in 2008, the Joint Staff asked that the
military services and combatant commands update their list of their
Tier I Task Critical Assets. However, the combatant commands and
military services used different sets of guidance, including draft and
non-binding guidance, as criteria during their identification and
prioritization processes for their Tier 1 Task Critical Asset
submissions. For example, DCIP officials at U.S. Pacific Command, the
Army, the Air Force, and the Navy told us they had used internally
developed guidance to identify and prioritize their Tier 1 Task
Critical Asset nominations, while U.S. Strategic Command officials said
that they had used the draft version of the DOD Critical Asset
Identification Process manual that was available during the 2007 data
call to develop their submissions. Air Force officials also told us
they developed formal critical asset identification guidance based on
DOD's draft critical asset identification manual. Based on our review
of the various forms of guidance, the definitions were varied for Tier
1 and Task Critical Assets and some versions of the guidance did not
contain definitions for Tier 1. Similarly, for their nominations to the
most recent Tier 1 Task Critical Asset list compiled in 2008, the
combatant commands and military services continued to use different
sets of draft and non-binding guidance as criteria for selection and
submission of assets to the Joint Staff, since ASD(HD&ASA) had not yet
finalized the DOD Critical Asset Identification Process Manual.
In addition, according to various combatant command and military
service officials, the draft and non-binding guidance also contained
unclear definitions for Task Critical Assets and for Tier 1 Task
Critical Assets. In our discussions with officials from the U.S.
Pacific Command, the military services, and the Joint Staff, these
officials explained that the definitions for a Task Critical Asset and
for a Tier 1 Task Critical Asset contained in the draft and non-binding
guidance were subjective and could be interpreted differently by
combatant commands or military services based on their respective
missions. For example, officials from one military service stated that
they were not sure why certain assets they owned were nominated by a
combatant command. Combatant command officials also acknowledged this
and added the value of an asset to a combatant command mission may not
be readily apparent to asset owners at DOD installations. DCIP
officials from the Army, the Air Force, and the Navy told us that
clearer descriptions of the combatant commands' mission essential
tasks--which are used to identify Task Critical Assets--would improve
the critical asset identification process for DCIP. The military
services use information about tasks essential to completing combatant
command missions to help them identify their potential submissions to
the Tier 1 Task Critical Asset list by providing specific information
about combatant command missions that they use to identify assets
needed for those missions. For example, Air Force officials said they
have a lot of knowledge regarding tasks needed to complete their Air
Force-specific missions, but do not always have similar knowledge of
combatant command missions. According to these officials, the military
services typically obtain combatant command mission task information
from the Defense Readiness Reporting System,[Footnote 22] as the
combatant commands do not provide this detailed information directly to
the military services. However, Air Force and Navy officials stated
that this information is often inconsistent. Better developed
information about tasks essential to completing combatant command
missions, including standards and conditions to determine what
constitutes a mission failure or mission degradation,[Footnote 23]
would provide additional clarity in identifying and prioritizing Task
Critical Assets.
In the absence of formal DCIP guidance on the critical asset
identification process, ASD(HD&ASA) encouraged, but did not require,
the combatant commands and military services to use their draft and non-
binding guidance to identify and prioritize their Tier 1 Task Critical
Asset submissions in 2007 and 2008. This guidance included the
Criticality Process Guidance Document, issued in December 2006, and the
draft version of the DOD Critical Asset Identification Process manual,
issued in September 2007.
Our prior work on DCIP management[Footnote 24] and the Standards for
Internal Control in the Federal Government[Footnote 25] both emphasize
the importance of management controls to guide program implementation,
which includes the development and issuance of formal guidance. Based
on discussions with combatant command and military service officials,
the lack of consistent criteria, including varying definitions of key
terms, in the selection of Tier 1 Task Critical Asset submissions and
the absence of binding guidance from ASD(HD&ASA) have resulted in a
Tier 1 Task Critical Asset list of limited usefulness to decision-
makers in determining DOD's most critical assets. Specifically, the
list may continue to include assets that should not be on the list.
Also, as noted in our prior work, the absence of formal DCIP guidance
and policies has led DOD components, such as the combatant commands and
military services, to pursue varying approaches to identify and ensure
the availability of their critical assets. ASD(HD&ASA) and Joint Staff
officials acknowledged that the current version of the Tier 1 Task
Critical Asset list is problematic and that they expect the current
list of Tier 1 Task Critical Assets to change significantly over the
next year because the military services and combatant commands are now
required to use formal critical asset identification criteria to submit
an update to their Tier 1 Task Critical Asset lists. ASD(HD&ASA)
officials believe the use of this new guidance will improve the quality
of the list.
DOD issued the final version of the DOD Critical Asset Identification
Process manual in October 2008. However, officials from the Air Force
and U.S. Pacific Command we spoke with said that certain definitions
contained in this current guidance are still subjective and elements
within those definitions still need to be clarified. For example, Air
Force officials stated that determining what constitutes a mission
essential task for combatant command missions is a continuing
challenge. In addition, U.S. Pacific Command officials explained that
tiering critical assets is an inherently subjective process with asset
and mission owners relying on their own individual perspectives and
interpretations of the definitions to determine the appropriate tier of
an asset. For example, military services typically have different
mission-essential tasks and, in some cases, the military services will
assign the same asset to different tier levels. In discussions with us,
ASD(HD&ASA) and Joint Staff officials acknowledged that the critical
asset identification process is still subjective and further
clarification may be needed. Though DOD has issued the final version of
the DOD Critical Asset Identification Process manual, based on our
analysis of this manual and discussions with military service and
combatant command officials, further clarification of the tier
definitions and certain elements within those definitions may be
warranted to prevent future inconsistencies in the combatant commands'
and the military services' submissions of assets to DOD's Tier 1 Task
Critical Asset list.
DOD Has Taken Steps to Promote Coordination among Key DCIP Stakeholders
but Still Lacks an Effective Coordination Mechanism for Identifying and
Nominating Critical Assets:
DOD has taken some actions toward promoting coordination among the
combatant commands, military services, and the Joint Staff in
developing DOD's Tier 1 Task Critical Asset list, such as issuing the
October 2008 DCIP critical asset identification guidance. However, it
has not yet developed formal coordination responsibilities and an
effective coordination mechanism within DCIP, including a forum for
coordination between the military services and combatant commands when
identifying critical assets. According to combatant command and
military service officials, they conduct minimal coordination when
determining which assets are critical to combatant command missions--a
key step in identifying assets to nominate to DOD's Tier 1 Task
Critical Asset list. In addition, Navy and Army officials stated they
only coordinate minimally with the Joint Staff once they submit their
assets for the Tier 1 Task Critical Asset list. Combatant commands are
charged in the DCIP guidance with conducting analyses of command
mission and mission essential tasks with their associated conditions
and standards and providing the results of these analyses to the
appropriate DCIP stakeholders to support Task Critical Asset
identification. In contrast, the military services own most of the
assets and, in some cases, are responsible for providing resources,
such as funding, to protect those assets, thereby assuring the
capabilities needed to implement missions. Consequently, the combatant
commands and military services each have a role in identifying and
prioritizing critical assets through DCIP.
In August 2005, DOD issued DOD Directive 3020.40, which calls for
coordination among the combatant commands, military services, the Joint
Staff, and other DOD agencies for the purpose of identifying and
assessing critical assets needed to implement combatant command
missions. Additionally, in October 2008, DOD issued DOD Manual 3020.45,
which further defines combatant command, military service, and Joint
Staff roles in the critical asset identification process. However,
based on our analysis of the October 2008 manual and discussions with
DCIP officials, DCIP continues to lack clearly defined coordination
responsibilities and a mechanism for effective coordination within the
program among the combatant commands and military services. As a
result, the communication and coordination efforts among these key DCIP
stakeholders are insufficient and inconsistent, which hinders the
ability of the military services to identify critical assets needed to
fulfill combatant command missions.
Officials we spoke with from all three military services stated that,
while the new guidance outlines a critical asset identification
process, lack of coordination with the combatant commands may continue.
Military service officials rely on the combatant commands to provide
detailed information about their missions to help the military services
identify critical assets. For example, Air Force officials told us that
they rely on combatant commands to provide them with combatant command-
related mission essential task information, but that this information
is not always accurately and consistently provided by the combatant
commands. Similarly, Army officials stated they were unaware of the
submission of a particular Army-owned critical asset by a combatant
command to the Tier 1 Task Critical Asset list--and its subsequent
selection as a Defense Critical Asset--during the previous Joint Staff
data call for Task Critical Asset submissions until the Army officials
viewed the final Tier 1 Task Critical Asset list. According to these
Army officials, their lack of awareness of this asset's status as a
Defense Critical Asset hindered their ability to develop and share
effective risk mitigation strategies for this asset with senior Army
leaders. Air Force and Army officials stated that the new guidance will
not specifically address these coordination issues.
ASD(HD&ASA) and Joint staff officials acknowledge that DCIP-related
coordination between the combatant commands and military services could
be strengthened. Officials at U.S. Strategic Command stated they are in
the process of developing an electronic information sharing field
within the critical asset database used to track DOD's Task Critical
Assets for DCIP. U.S. Strategic Command manages the database used to
track DOD's critical assets. These officials also told us that this
information sharing mechanism may help the combatant commands, military
services, and the Joint Staff improve their coordination efforts, but
that this mechanism has not yet been finalized and is still being
tested within the DCIP community. Until ASD(HD&ASA) formalizes
coordination responsibilities among key DCIP stakeholders and develops
an effective coordination mechanism, coordination among the combatant
commands, military services, and the Joint Staff for DCIP will continue
to be limited. Without effective coordination, the Joint Staff,
combatant commands, and military services cannot agree on an accurate
identification and prioritization of assets most critical to fulfilling
combatant commands' missions or reach agreement on how to prioritize
funding to help develop effective actions to protect and mitigate
against possible attacks on DOD's critical infrastructure.
DCIP Lacks Some Key Program Elements Needed to Facilitate the Critical
Asset Identification and Prioritization Process:
While DOD has developed a strategy and a comprehensive management plan
for managing DCIP and issued a new DOD Mission-Based Critical Asset
Identification Process manual,[Footnote 26] DCIP still lacks certain
key elements for nominating Tier 1 Task Critical Assets, which could
enhance the effectiveness of the program, including development of
clearly defined schedules for meeting performance goals and a formal
feedback process. According to our work on sound management practices,
[Footnote 27] comprehensive program schedules and formal communication
strategies assist agencies in effectively implementing programs by
providing relevant stakeholders with timelines to follow, performance
milestones to meet, and shared expectations to guide their efforts. To
date, the Joint Staff has not requested Tier 1 Task Critical Asset
submissions from the combatant commands and military services using a
routine and consistent timeline with milestones. Instead, the Joint
Staff has requested asset submissions from the combatant commands and
military services primarily on an ad-hoc basis, without providing a
formal schedule or deadlines for the responsible organizations to
follow. Subsequently, the military services expressed concern that they
were not allowed adequate time to generate thorough and accurate
nominations for DOD's Tier 1 Task Critical Asset list prior to the
required 2008 deadline for submission to the Joint Staff. For example,
according to the combatant command and military service officials with
whom we spoke, the Joint Staff asked them to submit their final
nominations for DOD's Tier 1 Task Critical Asset list in 2008 with
relatively little prior notice. As a result, these officials expressed
concern that they did not receive adequate time to develop their
submissions thoroughly or accurately. Furthermore, Air Force and U.S.
Pacific Command officials expect their future processes for generating
more accurate Tier 1 Task Critical Asset submissions to take, on
average, a total of 18 months and 3 years, respectively. However,
ASD(HD&ASA) and Joint Staff officials indicated they hope to revise the
current Tier 1 Task Critical Asset list using the new DCIP critical
asset identification process in approximately 4 months, or by October
2009. However, until ASD(HD&ASA) clarifies a timeline and milestones
for submitting critical assets to the combatant commands and military
services, there may continue to be discrepancies in the expectations
among the combatant commands, military services, and the Joint Staff
regarding the expected timeframes for submitting assets. As a result,
DOD's Tier 1 Task Critical Asset list may continue to include assets
that should not be on the list, or exclude assets that should be on the
list if the services and combatant commands are not allowed sufficient
notice or time for completing asset submissions.
DCIP guidance does not contain a process for providing formal feedback
to the combatant commands and military services regarding their
selection of assets for the Tier 1 Task Critical Asset list. Based on
discussions with combatant command, military, and Joint Staff
officials, only minimal informal feedback has occurred to date. Our
prior work, including Standards for Internal Control in the Federal
Government,[Footnote 28]emphasizes the need for formal feedback as a
management control. The lack of formal feedback from the Joint Staff
may result in a Tier 1 Task Critical Asset list that includes
inappropriate assets that do not meet DOD criteria. For example, Army,
Navy, and Air Force officials we spoke with stated they would find
formal feedback useful when submitting future nominations for the DOD
Tier 1 Task Critical Asset list to the Joint Staff. Without any formal
feedback, the combatant commands and military services may continue to
either submit assets for the Tier 1 Task Critical Asset lists that
should not be on the list or may exclude assets that should be on the
list from their submissions. As a result, DOD's Tier 1 Task Critical
Asset list maintained by the Joint Staff may continue to include assets
that are not appropriate. Without fully developed timelines for data
submissions and a formal feedback process regarding those submissions
within DCIP, combatant commands and military services might not
accurately identify the assets most critical to their missions and make
fully informed budgetary and resource allocation decisions necessary to
protect those assets from possible threats or hazards.
Conclusions:
DOD's recent issuance of DOD Manual 3020.45 Volume 1, DOD Critical
Asset Identification Process, is a positive step toward developing a
consistent and reliable Tier 1 Task Critical Asset list; however,
further action is needed. Having a complete and reliable list of
prioritized and assessed critical assets will enable DOD to target
resources to its most mission-critical assets at highest risk.
Subjectivity and a lack of clarity regarding the appropriate guidance
to clarify key definitions may continue to result in inappropriate
assets being nominated by the combatant commands and military services,
and prevent DOD from having a complete and accurate list of critical
assets. DOD officials acknowledged that the current definitions of Task
1 and Task Critical Asset are subjective. Also, until coordination
within the program is formalized and strengthened, the military
services, combatant commands, and the Joint Staff may not be in a
position to coordinate effectively with each other to determine which
assets are most critical to DOD and levels of funding to address
identified vulnerabilities. Finally, while DOD has made progress in
issuing a strategy for critical infrastructure, DOD's lack of effective
program management practices may continue to limit the program's
effectiveness in identifying and prioritizing critical assets.
Recommendations for Executive Action:
We are recommending that the Secretary of Defense take the following
three actions:
* To improve the consistency and reliability of the Tier 1 Task
Critical Asset list, direct the Assistant Secretary of Defense for
Homeland Defense and Americas' Security Affairs and the Joint Staff to
further clarify the definitions of a Tier 1 Task Critical Asset
contained in DOD Manual 3020.45 Volume I, Critical Asset Identification
Process, along with definitions of key elements, such as "mission
essential tasks." Potential approaches could include establishing and
issuing a set of test questions to apply to a proposed critical asset
or providing a set of hypothetical examples to use in identifying
critical assets.
* To facilitate effective coordination among the combatant commands,
military services, and the Joint Staff in compiling the Tier 1 Task
Critical Asset list, direct the Assistant Secretary of Defense for
Homeland Defense and Americas' Security Affairs and the Joint Staff to
develop specific coordination responsibilities and a coordination
mechanism within DCIP for each of those stakeholders to use when
compiling the list.
* To improve the overall effectiveness of DOD's process to develop a
list of Tier 1 Task Critical Assets, direct the Assistant Secretary of
Defense for Homeland Defense and Americas' Security Affairs and the
Joint Staff to formalize processes for compiling the Tier 1 Task
Critical Asset list, including the development of a formal schedule
with timelines and milestones for submitting Tier 1 Task Critical Asset
data and a formal process for the Joint Staff to provide feedback to
the combatant commands and military services regarding the assets they
propose to include on the Tier 1 Task Critical Asset list.
Agency Comments and Our Evaluation:
In written comments on a draft of this report, which included three
draft recommendations, DOD partially concurred with all three of our
recommendations. For each recommendation, DOD described relevant
guidance in place or in draft and additional actions it would take in
response. Also, U.S. Pacific Command provided technical comments, which
we incorporated in the report where appropriate. DOD's comments are
reprinted in enclosure I.
DOD partially concurred with our first recommendation, which called for
clarification of definitions of a Tier 1 and a Task Critical Asset, and
elements within those definitions. In its written comments, DOD stated
that Manual 3020.45 Volume 1, Mission-Based Critical Asset
Identification Process provides comprehensive procedures for
identifying critical assets through a mission-focused process. They
added that when considering the impact to the mission, the concept of
"mission (or function) failure" depends on the organizational level,
nature, scope, conditions, and standards associated with the mission
and that each mission is different. While we recognize the validity of
this observation, we continue to believe that the identification of a
set of Tier 1 Task Critical Assets with similar levels of mission
criticality would be facilitated by the use of consistent definitions.
Based on our interviews with military service officials, these
different determinations of mission failure make it difficult for the
services to determine which assets are critical for combatant command
missions. Further, while DOD stated in its written comments that
guidance already exists on mission essential tasks, such as the Joint
Mission Essential Task List Development Handbook, this guidance is not
referenced in DCIP directives and instructions. Finally, DOD stated
that ASD(HD&ASA) will work with the Joint Staff to provide additional
clarification in their critical asset guidance, an action we believe is
responsive to our recommendation.
DOD partially concurred with our second recommendation, calling for the
development of coordination responsibilities and a coordination
mechanism within DCIP for stakeholders to use when compiling the Tier 1
Task Critical Asset list. DOD stated that its current guidance
establishes coordination responsibilities within DCIP; DOD Directive
3020.40, DOD Instruction 3020.45, and DOD Manual 3020.45 Volume 1
outline coordination responsibilities among key DCIP stakeholders. We
acknowledge this DOD guidance in our report. However, based on our
discussions with military service and combatant command officials, we
continue to believe that these coordination responsibilities need to be
specifically identified. DOD stated that the Joint Staff uses a formal
Joint Staff Action Process, which provides ample opportunity for
military service and combatant command feedback and a means for seeking
clarification of guidance. However, we were told by a Joint Staff
official that a formal Joint Staff Action Process was not issued for
the March 2009 Tier 1 Task Critical Asset list, and we have not found
evidence of the issuance of one since January 2007. In addition, DOD
also stated in its written comments that coordination mechanisms exist
within DCIP, such as the Operational Advisory Board and the Defense
Critical Infrastructure Integration Staff. According to DOD, both of
these forums meet quarterly and are specifically designed to facilitate
information sharing. However, military service and combatant command
officials told us that the coordination promoted by these existing
mechanisms does not address asset identification, prioritization, and
mission impact assessment. Finally, DOD stated it will work with the
Joint Staff to determine what further coordination guidance is needed
and why existing coordination mechanisms are not being used to identify
and prioritize assets. We agree that this is a necessary action for DOD
in order to improve coordination within DCIP and, if pursued, could be
responsive to our recommendation.
DOD partially concurred with our third recommendation, calling for the
development of a formal schedule, milestones, and feedback process for
critical asset identification. According to DOD's written comments,
ASD(HD&ASA) has developed a draft DOD Manual 3020.45 Volume 6 Defense
Critical Infrastructure Program (DCIP) Execution Timeline. DOD intends
for this manual to provide uniform procedures for the execution of DCIP
activities and timelines for DCIP stakeholders to use in coordinating
the execution of DCIP activities outlined in current DCIP guidance and
ensure that feedback is provided to the components. With regard to the
DCIP Critical Asset Identification Process Collaboration Tool that DOD
intends to use as a way to establish a standard timeline and
milestones, we note that this tool could potentially improve the
critical asset identification process once it is implemented if the
military services and combatant use the tool. We continue to believe
that the military services and combatant commands could benefit from a
more formal data call with deadlines, milestones, and an opportunity to
receive feedback from the Joint Staff.
As agreed with your offices, we are sending copies of this report to
the Chairmen and Ranking Member of the Senate and House Appropriations
Subcommittees on Defense and on Military Construction, Veterans
Affairs, and Related Agencies; Senate and House Committees on Armed
Services; and other interested congressional parties. We also are
sending copies to the Secretary of Defense; the Chairman, Joint Chiefs
of Staff; the Secretaries of the Army, the Navy, and the Air Force; the
Commandant of the Marine Corps; and the Director, Office of Management
and Budget. In addition, the report will be available at no charge on
GAO's Web site at [hyperlink, http://www.gao.gov].
If you or your staff have any questions concerning this report, please
contact me at (202) 512-5431 or by e-mail at dagostinod@gao.gov.
Contact points for our Offices of Congressional Relations and Public
Affairs may be found on the last page of this report. GAO staff who
made key contributions to this report are listed in enclosure II.
Signed by:
Davi M. D'Agostino:
Director:
Defense Capabilities and Management:
Enclosures - 2:
List of Committees:
The Honorable Carl Levin:
Chairman:
The Honorable John McCain:
Ranking Member:
Committee on Armed Services:
United States Senate:
The Honorable Daniel Inouye:
Chairman:
The Honorable Thad Cochran:
Ranking Member:
Subcommittee on Defense:
Committee on Appropriations:
United States Senate:
The Honorable Tim Johnson:
Chairman:
The Honorable Kay Bailey Hutchison:
Ranking Member:
Subcommittee on Military Construction, Veterans Affairs, and Related
Agencies:
Committee on Appropriations:
United States Senate:
The Honorable Ike Skelton:
Chairman:
The Honorable Howard McKeon:
Ranking Member:
Committee on Armed Services:
House of Representatives:
The Honorable John P. Murtha:
Chairman:
The Honorable C.W. Bill Young:
Ranking Member:
Subcommittee on Defense:
Committee on Appropriations:
House of Representatives:
The Honorable Chet Edwards:
Chair:
The Honorable Zach Wamp:
Ranking Member:
Subcommittee on Military Construction, Veterans Affairs, and Related
Agencies:
Committee on Appropriations:
House of Representatives:
[End of section]
Enclosure I: Comments from the Department of Defense:
Assistant Secretary Of Defense:
Homeland Defense: Americas' Security Affairs:
2600 Defense Pentagon:
Washington, D.C. 20301-2600:
July 15, 2009:
Ms. Davi M. D'Agostino:
Director, Defense Capabilities and Management:
U.S. Government Accountability Office:
441 G Street, N.W.
Washington, DC 20548:
This is the Department of Defense (DoD) response to the GAO draft
report, GAO09-740R, "Defense Critical Infrastructure: Actions Needed to
Improve the Consistency, Reliability, and Usefulness of DoD's Tier 1
Task Critical Asset List," dated June 22, 2009 (GAO Code 351341). DoD
partially concurs with all three recommendations. Our response to the
recommendations is enclosed.
Our point of contact for this action is Mr. Antwane Johnson, Office of
the Assistant Secretary of Defense for Homeland Defense and Americas'
Security Affairs (OASD (HD&ASA)), (703) 602-5730, Extension 143 or
Antwane.Johnson@osd.mil.
Sincerely,
Signed by:
Christine E. Wormuth:
Principal Deputy:
Enclosure: As stated:
[End of letter]
GAO Draft Report - Dated June 22, 2009:
GAO Code 351341 /GAO-09-740R:
"Defense Critical Infrastructure: Actions Needed to Improve the
Consistency, Reliability, and Usefulness of DoD's Tier 1 Task Critical
Asset List"
Department Of Defense Comments To The Recommendations:
Recommendation 1: The GAO recommends that the Secretary of Defense
direct the Assistant Secretary of Defense for Homeland Defense and
Americas' Security Affairs and the Joint Staff to further clarify the
definitions of a Tier 1 Task Critical Asset contained in DoD Manual
3020.45 Volume I, Critical Asset Identification Process, along with
definitions of key elements, such as "mission essential tasks."
Potential approaches could include establishing and issuing a set of
test questions to apply to a proposed critical asset or providing a set
of hypothetical examples to use in identifying critical assets.
DOD Response: Partially concur. DoD Manual 3020.45 Volume I, Critical
Asset Identification Process, provides comprehensive procedures for
identifying critical assets through the use of a mission-focused
process. The process begins with an analysis of assigned missions and
decomposes them to a level that can be directly tied to an asset. The
loss of the asset is then analyzed to determine the impact on the
mission. If the impact is mission failure, it is considered a Tier 1
task critical asset. As each mission is different, the analysis must
consider the organizational level, nature, scope, conditions, and
standards associated with the mission. Mission-essential tasks
represent a commander's priority of warfighting requirements based on
assigned missions. The Joint Mission Essential Task List (JMETL)
Development Handbook provides guidance to help commanders define their
mission-essential tasks along with associated conditions and measurable
standards. The DCIP Office will work with the Joint Staff to provide
additional clarification of this guidance.
Recommendation 2: The GAO recommends that the Secretary of Defense
direct the Assistant Secretary of Defense for Homeland Defense and
Americas' Security Affairs and the Joint Staff to develop specific
coordination responsibilities and a coordination mechanism within the
Defense Critical Infrastructure Program (DCIP) for each of those
stakeholders to use when compiling the list.
DOD Response: Partially concur. Existing guidance (DoD Directive
3020.40, DoD Instruction 3020.45, and DoD Manual 3020.45, Volume 1)
provides specific coordination responsibilities for each of the
components during the critical asset identification process. In
addition, the Joint Staff, when issuing a data call for TCA
submissions, uses a formal Joint Staff Action Process which provides
ample opportunity for Combatant Command and Service feedback and a
means for seeking clarification of guidance. OASD (HD&ASA) has
established forums, such as the Joint Staff-chaired Operational
Advisory Board (OAB) and the DCIP Office-chaired Defense Critical
Infrastructure Integration Staff (DCIIS). Both of these forums meet
quarterly and are specifically designed to provide for the
identification, clarification, and resolution of CIP issues among
stakeholders and to facilitate information sharing
The DCIP Office will work with the Joint Staff to determine what, if
any, further guidance is required regarding specific coordination
responsibilities, and why stakeholders failed to employ existing
coordination mechanisms when compiling their TCA lists.
Recommendation 3: The GAO recommends that the Secretary of Defense
direct the Assistant Secretary of Defense for Homeland Defense and
Americas' Security Affairs and the Joint Staff to formalize processes
for compiling the Tier 1 Task Critical Asset list, including the
development of a formal schedule with timelines and milestones for
submitting Tier 1 Task Critical Asset data and a formal process for the
Joint Staff to provide feedback to the Combatant Commands and military
services regarding the assets they propose to include on the Tier 1
Task Critical Asset list.
DOD Response: Partially concur. OASD (HD&ASA) is formalizing the
process for compiling Tier 1 Task Critical Task Asset list in a draft
manual, DoDM 3020.45 Volume 6, Defense Critical Infrastructure Program
(DCIP) Execution Timeline. The manual will provide uniform procedures
for the execution of DCIP activities, a standard timeline, and exact
milestones that OASD (HD&ASA), the Joint Staff, Military Departments,
Combatant Commands, Defense Agencies, and the Defense Infrastructure
Sector Lead Agencies will use to coordinate the execution of activities
and responsibilities assigned in DoDD 3020.40, Defense Critical
Infrastructure Program, DoDI 3020.45, Defense Critical Infrastructure
Program Management, and DoD Manual 3020.45, Defense Critical
Infrastructure Program: DoD Mission-Based Critical Asset Identification
Process, Volumes 1, 5, and 7. The execution timeline will ensure the
development of the Tier 1 TCA List and provide feedback to the
components. The DCIP Office is also developing a collaboration tool
which, in conjunction the publication of DoDM 3020.45 , will improve
stakeholder situational awareness of each step in the process of
identifying TCAs.
[End of section]
Enclosure II:
GAO Contact and Staff Acknowledgments:
GAO Contact:
Davi M. D'Agostino, (202) 512-5431 or dagostinod@gao.gov:
Acknowledgments:
In addition to the contact named above, Mark A. Pross, Assistant
Director; David G. Artadi; James D. Ashley; Yecenia C. Camarillo; Gina
M. Flacco; Brian K. Howell; Katherine S. Lenane; Michael S. Pose; Terry
L. Richardson; and Cheryl A. Weissman made key contributions to this
report.
[End of section]
Footnotes:
[1] DOD Directive 3020.40, Defense Critical Infrastructure Program
(DCIP), (Aug. 19, 2005).
[2] Earlier programs analogous to DCIP can be traced back to 1998.
[3] DOD Instruction 3020.45, Defense Critical Infrastructure Program
(DCIP) Management (Apr. 21, 2008).
[4] DOD Manual 3020.45-M, Defense Critical Infrastructure Program
(DCIP): DOD Mission-Based Critical Asset Identification Process (CAIP),
Volume 1 (Oct. 24, 2008).
[5] According to DOD's critical asset identification guidance, the
definitions of the tiered Task Critical Assets are: Tier 1--An asset
the loss, incapacitation, or disruption of which could result in
mission (or function) failure at the DOD, military department,
combatant command, sub-unified command, defense agency, or defense
infrastructure sector level. Tier 2--An asset the loss, incapacitation,
or disruption of which could result in severe mission (or function)
degradation at the DOD, military department, combatant command, sub-
unified command, defense agency, or defense infrastructure sector
level. Tier 3--An asset the loss, incapacitation, or disruption of
which could result in mission (or function) failure below the military
department, combatant command, sub-unified command, defense agency, or
defense infrastructure sector level. (Emphasis added by GAO.)
[6] Defense Critical Assets are of such extraordinary importance to DOD
operations in peace, crisis, and war that their incapacitation or
destruction would have a very serious, debilitating effect on the
ability of DOD to fulfill its missions. Defense critical assets are a
subset of Tier 1 Task Critical Assets. Currently, there are about 675
Tier 1 Task Critical Assets and 29 Defense Critical Assets.
[7] H.R. Rep. No. 110-652, pp. 523-524 (May 16, 2008).
[8] Although we found a number of duplicate assets on the Tier 1 Task
Critical Asset list, combatant command officials said that duplication
of Task Critical Assets is not a serious issue and is due mainly to the
different naming conventions between the military services and
combatant commands. Moreover, combatant command officials noted that if
several combatant commands identify an asset as a Task Critical Asset,
then this merely reflects its criticality to multiple mission owners.
[9] The actual number of Tier 1 Task Critical Assets can change
frequently, since critical assets are regularly added and deleted from
the list by the combatant commands, military services, defense
agencies, and Defense Infrastructure Sector Lead Agents.
[10] Department of Defense, Defense Critical Infrastructure Program
Criticality Process Guidance Document (Dec. 21, 2006).
[11] Department of Defense, Critical Asset Identification Process,
Draft, Version 2.0 (Sept. 1, 2007).
[12] DOD 3020.45-M Volume 1 (Oct. 24, 2008).
[13] DOD Directive 3020.40 (Aug. 19, 2005).
[14] DOD Instruction 3020.45 (Apr. 21, 2008).
[15] These include the Department of Defense, Strategy for Defense
Critical Infrastructure (Washington, D.C.: March 2008) and Department
of Defense, National Defense Strategy (Washington, D.C.: June 2008).
[16] See, for example, U.S. Air Force, The Identification of Critical
Assets and Infrastructures--Methodology, Version 2.0 (Apr. 7, 2006);
Air Force Policy Directive 10-24, Air Force Critical Infrastructure
Program (CIP) (Apr. 28, 2006); and U.S. Army, Critical Infrastructure
Risk Management; The Identification of Critical Assets Methodology
(Jan. 6, 2007).
[17] See GAO, Standards for Internal Control in the Federal Government,
[hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1]
(Washington, D.C.: November 1999).
[18] GAO, Defense Infrastructure: Actions Needed to Guide DOD's Efforts
to Identify, Prioritize, and Assess Its Critical Infrastructure,
[hyperlink, http://www.gao.gov/products/GAO-07-461] (Washington, D.C.:
May 24, 2007).
[19] [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1].
[20] Homeland Security Presidential Directive 7, issued in December
2003, requires, among other things, that all federal departments and
agencies identify, prioritize, and coordinate the protection of
critical infrastructure and key resources from terrorist attacks. DCIP
encompasses the full spectrum of threats--ranging from terrorist
attacks to natural disasters and catastrophic accidents--that can
adversely affect critical defense infrastructure.
[21] Department of Defense, The National Defense Strategy of the United
States of America (Washington, D.C.: June 2008).
[22] The Defense Readiness Reporting System is a real-time information
system that measures and reports on the readiness of military forces
and the supporting infrastructure to meet missions and goals assigned
by the Secretary of Defense.
[23] According to the DOD Critical Asset Identification Process manual,
a Tier 1 Task Critical Asset is defined by mission failure if the asset
is lost, incapacitated, or disrupted. However, a Tier 2 Task Critical
Asset is defined by severe mission (or function) degradation if the
asset is lost, incapacitated, or disrupted.
[24] [hyperlink, http://www.gao.gov/products/GAO-07-461].
[25] [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1].
[26] DOD 3020.45-M Volume 1 (Oct. 24, 2008).
[27] [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1].
[28] [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1].
[End of section]
GAO's Mission:
The Government Accountability Office, the audit, evaluation and
investigative arm of Congress, exists to support Congress in meeting
its constitutional responsibilities and to help improve the performance
and accountability of the federal government for the American people.
GAO examines the use of public funds; evaluates federal programs and
policies; and provides analyses, recommendations, and other assistance
to help Congress make informed oversight, policy, and funding
decisions. GAO's commitment to good government is reflected in its core
values of accountability, integrity, and reliability.
Obtaining Copies of GAO Reports and Testimony:
The fastest and easiest way to obtain copies of GAO documents at no
cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each
weekday, GAO posts newly released reports, testimony, and
correspondence on its Web site. To have GAO e-mail you a list of newly
posted products every afternoon, go to [hyperlink, http://www.gao.gov]
and select "E-mail Updates."
Order by Phone:
The price of each GAO publication reflects GAO‘s actual cost of
production and distribution and depends on the number of pages in the
publication and whether the publication is printed in color or black and
white. Pricing and ordering information is posted on GAO‘s Web site,
[hyperlink, http://www.gao.gov/ordering.htm].
Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537.
Orders may be paid for using American Express, Discover Card,
MasterCard, Visa, check, or money order. Call for additional
information.
To Report Fraud, Waste, and Abuse in Federal Programs:
Contact:
Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]:
E-mail: fraudnet@gao.gov:
Automated answering system: (800) 424-5454 or (202) 512-7470:
Congressional Relations:
Ralph Dawn, Managing Director, dawnr@gao.gov:
(202) 512-4400:
U.S. Government Accountability Office:
441 G Street NW, Room 7125:
Washington, D.C. 20548:
Public Affairs:
Chuck Young, Managing Director, youngc1@gao.gov:
(202) 512-4800:
U.S. Government Accountability Office:
441 G Street NW, Room 7149:
Washington, D.C. 20548:
