This is the accessible text file for GAO report number GAO-09-740R 
entitled 'Defense Critical Infrastructure: Actions Needed to Improve 
the Consistency, Reliability, and Usefulness of DOD's Tier 1 Task 
Critical Asset List' which was released on July 20, 2009. 

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as part 
of a longer term project to improve GAO products' accessibility. Every 
attempt has been made to maintain the structural and data integrity of 
the original printed product. Accessibility features, such as text 
descriptions of tables, consecutively numbered footnotes placed at the 
end of the file, and the text of agency comment letters, are provided 
but may not exactly duplicate the presentation or format of the printed 
version. The portable document format (PDF) file is an exact electronic 
replica of the printed version. We welcome your feedback. Please E-mail 
your comments regarding the contents or accessibility features of this 
document to Webmaster@gao.gov. 

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately. 

GAO-09-740: 

United States Government Accountability Office: 
Washington, DC 20548: 

July 17, 2009: 

Congressional Committees: 

Subject: Defense Critical Infrastructure: Actions Needed to Improve the 
Consistency, Reliability, and Usefulness of DOD's Tier 1 Task Critical 
Asset List: 

The Department of Defense (DOD) relies on a global network of defense 
critical infrastructure so essential that the incapacitation, 
exploitation, or destruction of an asset within this network could 
severely affect DOD's ability to deploy, support, and sustain its 
forces and operations worldwide and to implement its core missions, 
including current missions in Iraq and Afghanistan. Because of its 
importance to DOD operations, this defense critical infrastructure 
could be vulnerable to attacks by adversaries, and vulnerable to 
natural disasters and hazards, such as hurricanes and earthquakes. 
Since September 2003, the Office of the Assistant Secretary of Defense 
for Homeland Defense and Americas' Security Affairs (ASD[HD&ASA]) has 
been responsible for developing and ensuring implementation of critical 
infrastructure protection policy and program guidance. To identify and 
help assure the availability of this mission-critical infrastructure, 
in August 2005 DOD established the Defense Critical Infrastructure 
Program (DCIP),[Footnote 1] assigning overall responsibility for the 
program to ASD(HD&ASA).[Footnote 2]In April 2008, DOD issued an 
instruction that further assigned responsibilities and prescribed 
procedures for the implementation of DCIP, among other things.[Footnote 
3] In October 2008, DOD formalized the process for identifying and 
prioritizing its critical infrastructure.[Footnote 4] 

Since 2006, ASD(HD&ASA) has collaborated with the Joint Staff to 
compile a list of all DOD-and non-DOD-owned infrastructure essential to 
accomplish DOD's missions. To support this effort, the combatant 
commands and military services are to identify and place their critical 
assets into prioritized tiers,[Footnote 5] including Tier 1 Task 
Critical Assets, which are assets of such extraordinary importance that 
their incapacitation or destruction would have a serious, debilitating 
effect on the ability of one or more military services, combatant 
commands, or DCIP Defense Infrastructure Sector Lead Agents to execute 
the mission essential tasks they support. Defense Critical Assets, 
[Footnote 6] on the other hand, are the assets most critical for 
fulfilling overall DOD missions and are identified from the universe of 
Task Critical Assets. The Joint Staff worked with the combatant 
commands, military services, and Defense Infrastructure Sector Lead 
Agents to develop the current departmentwide list of Tier 1 Task 
Critical Assets. In October 2008, ASD(HD&ASA) formally accepted the 
Joint Staff's Defense Critical Asset nomination list as an initial list 
of Defense Critical Assets. 

In its May 2008 report on H.R. 5658,[Footnote 7] the House Committee on 
Armed Services addressed DOD's lack of progress in analyzing the risks 
of electrical power outages to critical DOD missions through DCIP and, 
among other things, directed that GAO continue its review of DCIP. As a 
result, we initiated our on-going review of the assurance of electrical 
power supplies to DOD's critical assets. We originally planned to 
select a random sample of DOD Tier 1 Task Critical Assets to survey for 
this review; however, based on discussions with DOD officials and our 
analysis, we determined that the universe of critical assets did not 
represent an accurate, comprehensive list of DOD Tier 1 Task Critical 
Assets, and that this issue in and of itself warranted further 
analysis.[Footnote 8] Therefore, we are reporting separately on issues 
relating specifically to the Tier 1 Task Critical Asset list with 
recommendations, so DOD can take action in a timely manner to update 
and improve its list of Defense Critical Assets in the fall of 2009 and 
prioritize funding. We plan to issue a separate, related report later 
this year on our on-going review of the assurance of electrical power 
supplies to DOD critical assets. 

As discussed with the committees of jurisdiction for this report, we 
examined (1) the extent to which the combatant commands and military 
services applied consistent and clear criteria in identifying and 
prioritizing their submissions of assets to DOD's Tier 1 Task Critical 
Asset list; (2) the actions ASD(HD&ASA) has taken to promote 
coordination among the Joint Staff, the combatant commands, and the 
military services to identify critical assets; and (3) the extent to 
which ASD(HD&ASA) developed effective program management practices 
related to the identification of Tier 1 Task Critical Assets, such as 
formal milestones, schedules, and a feedback process. 

We focused the scope of our review on DOD's list of Tier 1 Task 
Critical Assets as of March 16, 2009, a universe of about 675 assets 
from which a list of Defense Critical Assets was developed.[Footnote 9] 
In addition, Defense Infrastructure Sector Lead Agents also identify 
Tier 1 Task Critical Assets; however, we did not include them in the 
scope of this review because they nominated relatively few assets 
compared to the combatant commands and military services. 

To evaluate these objectives, we conducted interviews with DCIP 
officials at the U.S. Army, the U.S. Navy, and the U.S. Air Force; U.S. 
Pacific Command; U.S. Strategic Command; Joint Staff (J-34); and 
ASD(HD&ASA). To determine the extent to which the combatant commands 
and military services applied consistent and clear criteria in 
identifying and prioritizing their submissions of assets to DOD's Tier 
1 Task Critical Asset list, we compared information regarding specific 
DCIP criteria used from our interviews with the combatant command and 
military service officials with prior and existing DCIP guidance, 
including the Defense Critical Infrastructure Program Criticality 
Process Guidance Document;[Footnote 10] the draft Critical Asset 
Identification Process,[Footnote 11] the final DOD Manual 3020.45, DOD 
Mission-Based Critical Asset Identification Process;[Footnote 12] DOD 
Directive 3020.40;[Footnote 13] DOD Instruction 3020.45;[Footnote 14] 
DCIP strategy documents;[Footnote 15] and relevant guidance from the 
military services.[Footnote 16] To determine what actions ASD(HD&ASA) 
has taken to promote coordination among the Joint Staff, the combatant 
commands, and the military services, we conducted interviews with 
appropriate DOD officials regarding steps taken and planned, and 
evaluated the actions against current DCIP guidance related to 
coordination. Finally, to determine the extent to which ASD(HD&ASA) has 
developed effective program management practices related to the 
identification of Tier 1 Task Critical Assets, such as formal 
milestones, schedules, and a feedback process, we compared DCIP program 
management strategies and documents with criteria cited under our 
previous work on internal controls in the federal government.[Footnote 
17] We also interviewed ASD(HD&ASA) and Joint Staff officials to 
determine what program management efforts they were developing to 
identify and prioritize Tier 1 Task Critical Assets. We conducted this 
performance audit from April 2009 to June 2009 in accordance with 
generally accepted government auditing standards. Those standards 
require that we plan and perform the audit to obtain sufficient, 
appropriate evidence to provide a reasonable basis for our findings and 
conclusions based on our audit objectives. We believe that the evidence 
obtained provides a reasonable basis for our findings and conclusions 
based on our audit objectives. 

Results in Brief: 

While DOD has made some progress in developing a Tier 1 Task Critical 
Asset list, this progress was limited by DOD's lack of consistent 
criteria for identifying and prioritizing Tier 1 Task Critical Assets. 
When selecting and submitting their most recent lists of Tier 1 Task 
Critical Asset submissions to the Joint Staff, the combatant commands 
and the military services used disparate sets of guidance, including 
draft and nonbinding guidance, as their criteria. Air Force officials, 
however, told us they developed formal critical asset identification 
guidance based on DOD's draft critical asset identification manual. 
According to military service and combatant command officials, DOD's 
draft and nonbinding guidance contained unclear definitions of asset 
tiers, Task Critical Assets, and other key terms, such as "mission 
essential tasks." Additionally, while DOD encouraged the combatant 
commands and military services to use the Criticality Process Guidance 
Document and a draft DOD Mission-Based Critical Asset Identification 
Process manual to determine their Tier 1 Task Critical Assets, it did 
not require them to do so because DOD's final DOD Mission-Based 
Critical Asset Identification Process manual had not yet been issued. 
Our prior work on DCIP management[Footnote 18] and the Standards for 
Internal Control in the Federal Government[Footnote 19] both emphasize 
the importance of management controls to guide program implementation, 
which includes the development and issuance of formal guidance. The use 
of disparate sets of guidance, including draft and nonbinding guidance, 
resulted in the selection and submission of assets to the Tier 1 Task 
Critical Assets list based on inconsistent criteria, thus limiting the 
usefulness of the Tier 1 Task Critical Asset list to DOD decision- 
makers in determining DOD's most critical assets and prioritizing 
funding to address identified vulnerabilities. In October 2008, DOD 
formally issued the current guidance on the identification of critical 
assets--DOD Manual 3020.45, DOD Critical Asset Identification Process-
-that all stakeholders are required to use when identifying and 
prioritizing Task Critical Assets. Nevertheless, officials from U.S. 
Pacific Command and the Air Force we spoke with said that certain 
definitions contained in this current guidance are still subjective. 
According to officials from U.S. Pacific Command, as long as the 
process requires a determination of tier levels after an objective 
analysis of missions, mission essential tasks, and criticality, there 
will be a subjective element to certain definitions. Based on our 
analysis of the guidance and discussions with various officials, 
elements within those definitions may need to be further clarified. For 
example, Air Force officials stated that determining what constitutes a 
mission essential task for combatant command missions is a continuing 
challenge. In discussions with us, ASD(HD&ASA) and Joint Staff 
officials acknowledged that the critical asset identification process 
is still subjective. In the absence of consistent and clear definitions 
for determining appropriate asset tiers and asset criticality, 
combatant commands and military services applied definitions of Tier 1 
Task Critical Assets inconsistently and, going forward, may continue to 
do so until these definitions are further clarified. 

DOD has taken some actions toward promoting coordination among the 
combatant commands, military services, and Joint Staff in compiling 
DOD's Tier 1 Task Critical Asset list. For example, in August 2005, DOD 
issued DOD Directive 3020.40, which calls for coordination among the 
Joint Staff, combatant commands, military services, and other defense 
agencies for the purpose of identifying and assessing critical assets 
needed to implement DOD missions. Additionally, in October 2008, DOD 
issued DOD Manual 3020.45, which defines the combatant command, 
military service, and Joint Staff roles in the critical asset 
identification process. However, DOD has not yet developed formal 
coordination responsibilities and an effective coordination mechanism 
within DCIP, including a forum for coordination between the military 
services and combatant commands when identifying critical assets. 
Combatant command and military service officials told us that, in 
considering which assets to submit to DOD's Tier 1 Task Critical Asset 
list, they coordinate only minimally with each other when determining 
which assets are critical to combatant command missions. Based on our 
analysis of the October 2008 manual and discussions with DCIP 
officials, we found that the Joint Staff, combatant commands, military 
services, and other DOD agencies still lack clearly defined 
coordination responsibilities and a mechanism for effective 
coordination within DCIP. As a result, the communication and 
coordination efforts among these key DCIP stakeholders when considering 
assets to nominate as Tier 1 Task Critical Assets have been 
insufficient and inconsistent. For example, Army officials stated they 
were unaware that an Army-related critical asset was submitted as a 
Defense Critical Asset during the previous data call and did not know 
who submitted it. Army officials think this will continue to be a 
problem under the new asset identification process. This is important 
because the asset owner--the Army in this case--typically uses this 
information to help develop strategies to mitigate risks and provide 
funding to address the asset's identified vulnerabilities. Officials we 
spoke with from all three military services stated that lack of 
coordination with the combatant commands to identify task critical 
assets may continue. Joint Staff officials also acknowledged that 
coordination needs to be strengthened between the military services and 
combatant commands. Without effective coordination, the Joint Staff, 
combatant commands, and military services cannot agree on an accurate 
identification and prioritization of assets most critical to fulfilling 
combatant commands' missions or reach agreement on how to prioritize 
funding to help develop effective actions to protect and mitigate 
against possible attacks on DOD's critical infrastructure. 

While DOD has developed a strategy and comprehensive management plan 
for DCIP, it has not fully developed some DCIP program management 
elements for identifying Tier 1 Task Critical Assets, which could 
enhance the effectiveness of the program. DOD Directive 3020.40 
requires ASD(HD&ASA)--the lead office for DCIP--to develop and ensure 
the implementation of DCIP policy and program guidance for the 
identification, prioritization, and protection of defense critical 
infrastructure. This directive also requires the Joint Staff to assist 
ASD(HD&ASA) in the development and maintenance of DCIP standards. DOD's 
formal critical asset identification process manual issued in 2008 
lacks some key elements necessary for sound program management, 
including clearly defined schedules and milestones for meeting 
performance goals and a formal feedback process. According to our work 
on sound management practices, comprehensive program schedules and 
formal communication strategies assist agencies in effectively 
implementing programs by providing relevant stakeholders with timelines 
to follow, performance milestones to meet, and shared expectations to 
guide their efforts. Because DOD lacks a formal process for submitting 
critical assets, including milestones and formal feedback from 
ASD(HD&ASA) or the Joint Staff on meeting program goals, the combatant 
commands and military services are limited in their ability to 
effectively select, compile, and validate their final nominations to 
DOD's Tier 1 Task Critical Asset list. For example, according to the 
combatant command and military service officials we spoke with, the 
Joint Staff asked them to submit their final nominations for DOD's Tier 
1 Task Critical Asset list in 2008 with relatively little prior notice. 
As a result, these officials expressed concern that they did not 
receive adequate time to develop their submissions thoroughly or 
accurately, and that they did not receive any formal feedback from the 
Joint Staff once their lists were submitted. Recognizing this problem, 
ASD(HD&ASA) officials told us that they are planning to develop a 
formal schedule for the combatant commands and military services to 
follow in developing their Tier 1 Task Critical Asset submissions. 
However, until ASD(HD&ASA) finalizes and formally issues this schedule, 
there may continue to be discrepancies in the expectations among the 
combatant commands, military services, and the Joint Staff regarding 
the timeframes for submitting assets. As a result, DOD's Tier 1 Task 
Critical Asset list may continue to include assets that should not be 
on the list, or exclude assets that should be on the list if the 
services and combatant commands are not allowed sufficient notice or 
time for completing their asset submissions. In addition, without 
formal feedback from the Joint Staff on how DCIP stakeholders are 
adhering to program guidelines, the combatant commands and military 
services may not be aware that some of their asset submissions to the 
Tier 1 Task Critical Asset list do not conform to DCIP criteria. 

We are recommending that ASD(HD&ASA) clarify key elements within the 
DCIP definitions of a Task Critical Assets, formalize coordination 
responsibilities and mechanisms within DCIP, and develop processes for 
compiling the Tier 1 Task Critical Asset list, including the 
development of a formal schedule with timelines and milestones and a 
formal feedback process for key DCIP stakeholders when identifying and 
prioritizing critical assets for submission to the Tier 1 Task Critical 
Asset list. 

In written comments on a draft of this report, DOD partially concurred 
with all three of our recommendations. For each recommendation, DOD 
described relevant guidance in place or in draft and additional actions 
it would take in response. Our responses to these comments are 
presented in the Agency Comments and Our Evaluation section of this 
report, and DOD's comments are reprinted in enclosure I. We also 
received technical comments from U.S. Pacific Command, and we 
incorporated these as appropriate. 

Background: 

In response to the guidance contained in Homeland Security Presidential 
Directive 7,[Footnote 20]DOD formalized its critical infrastructure 
efforts in August 2005 by issuing DOD Directive 3020.40, Defense 
Critical Infrastructure Program (DCIP), which established the program 
and assigned overall responsibility to ASD(HD&ASA). DOD Directive 
3020.40 requires, among other things, that ASD(HD&ASA) develop and 
ensure implementation of DCIP policy and program guidance for the 
identification, prioritization, and protection of defense critical 
infrastructure. 

Under DCIP, ASD(HD&ASA) and the Joint Staff have tasked the combatant 
commands, military services, and Defense Infrastructure Sector Lead 
Agents with nominating infrastructure necessary to accomplish the goals 
specified in the National Defense Strategy.[Footnote 21] The combatant 
commands, in collaboration with the Joint Staff, identify and 
prioritize DOD missions that are the basis for determining 
infrastructure criticality, while the military services, as the 
principal owners of DOD infrastructure, identify and link 
infrastructure to the specific mission requirements of the combatant 
commands in coordination with defense infrastructure lead agents. Based 
on these efforts, the combatant commands and military services then 
nominate assets to DOD's consolidated draft critical asset list, which 
ASD(HD&ASA) uses as the basis for developing a final Task Critical 
Asset list and the Defense Critical Asset list. 

According to DCIP guidance for identifying defense critical 
infrastructure, the process used by DCIP stakeholders provides a 
consistent, repeatable, mission-focused analysis process to identify 
Task Critical Assets and an effects-based analysis to identify Defense 
Critical Assets from the list of Tier 1 Task Critical Assets. A Task 
Critical Asset is an asset of such extraordinary importance that its 
incapacitation or destruction would have a very serious debilitating 
effect on the ability of DOD, a military department, combatant command, 
sub-unified command, defense agency, or Defense Infrastructure Sector 
Lead Agent to execute the task that the asset supports. In October 
2008, DOD issued DOD Manual 3020.45 that outlined a process for the 
combatant commands, the military services, the Defense Infrastructure 
Sector Lead Agents, and other DOD organizations to follow when 
identifying assets for submission as DOD Task Critical Assets. This 
process results in a DOD-wide list of Task Critical Assets that are 
tiered into three groups (Tier 1, Tier 2, and Tier 3) based on the 
criticality of their supported missions. The manual then tasks the 
Chairman of the Joint Chiefs of Staff to recommend a list of DOD 
Defense Critical Assets--selected from the Tier 1 Task Critical Asset 
list--to ASD(HD&ASA) for review and approval. 

ASD(HD&ASA) has issued numerous documents with guidance related to 
DCIP, including DOD directives, manuals, and instructions. Figure 1 
illustrates the timeline of issuance of key pieces of DCIP guidance 
related to the identification of Task Critical Assets and Defense 
Critical Assets. 

Figure 1: Timeline of Issuance of Key DCIP Guidance: 

[Refer to PDF for image: time line] 

September 2003: ASD(HD&ASA) becomes responsible for critical 
infrastructure protection policy and program guidance. 

August 2005: DOD issues DOD Directive 3020.40 Defense Critical 
Infrastructure Program (DCIP). 

December 2006: DOD releases the DCIP Defense Critical Infrastructure 
Program Critical Process Guide. 

May 2007: DOD releases the DCIP Security Classification Manual. 

September 2007: DOD releases the draft Critical Asset Identification 
Process manual. 

April 2008: DOD issues DOD Instruction 3020.45 Defense Critical 
Infrastructure Program (DCIP) Management. 

October 2008: DOD issues DOD Manual 3020.45, Vol.1, DOD Critical Asset 
Identification Process. 

Source: GAO analysis of DOD documents. 

[End of figure] 

DOD Lacks Consistent Criteria for Identifying and Prioritizing Critical 
Assets to Develop Its Tier 1 Task Critical Asset List: 

While DOD has made some progress in developing an evolving Tier 1 Task 
Critical Asset list, this progress has been limited by DOD's lack of 
consistent criteria, including unclear definitions, for identifying and 
prioritizing Tier 1 Task Critical Asset nominations. The Joint Staff 
formally requested submissions of task critical assets from the 
military services, combatant commands, and other DCIP stakeholders in 
January 2007, and early in 2008, the Joint Staff asked that the 
military services and combatant commands update their list of their 
Tier I Task Critical Assets. However, the combatant commands and 
military services used different sets of guidance, including draft and 
non-binding guidance, as criteria during their identification and 
prioritization processes for their Tier 1 Task Critical Asset 
submissions. For example, DCIP officials at U.S. Pacific Command, the 
Army, the Air Force, and the Navy told us they had used internally 
developed guidance to identify and prioritize their Tier 1 Task 
Critical Asset nominations, while U.S. Strategic Command officials said 
that they had used the draft version of the DOD Critical Asset 
Identification Process manual that was available during the 2007 data 
call to develop their submissions. Air Force officials also told us 
they developed formal critical asset identification guidance based on 
DOD's draft critical asset identification manual. Based on our review 
of the various forms of guidance, the definitions were varied for Tier 
1 and Task Critical Assets and some versions of the guidance did not 
contain definitions for Tier 1. Similarly, for their nominations to the 
most recent Tier 1 Task Critical Asset list compiled in 2008, the 
combatant commands and military services continued to use different 
sets of draft and non-binding guidance as criteria for selection and 
submission of assets to the Joint Staff, since ASD(HD&ASA) had not yet 
finalized the DOD Critical Asset Identification Process Manual. 

In addition, according to various combatant command and military 
service officials, the draft and non-binding guidance also contained 
unclear definitions for Task Critical Assets and for Tier 1 Task 
Critical Assets. In our discussions with officials from the U.S. 
Pacific Command, the military services, and the Joint Staff, these 
officials explained that the definitions for a Task Critical Asset and 
for a Tier 1 Task Critical Asset contained in the draft and non-binding 
guidance were subjective and could be interpreted differently by 
combatant commands or military services based on their respective 
missions. For example, officials from one military service stated that 
they were not sure why certain assets they owned were nominated by a 
combatant command. Combatant command officials also acknowledged this 
and added the value of an asset to a combatant command mission may not 
be readily apparent to asset owners at DOD installations. DCIP 
officials from the Army, the Air Force, and the Navy told us that 
clearer descriptions of the combatant commands' mission essential 
tasks--which are used to identify Task Critical Assets--would improve 
the critical asset identification process for DCIP. The military 
services use information about tasks essential to completing combatant 
command missions to help them identify their potential submissions to 
the Tier 1 Task Critical Asset list by providing specific information 
about combatant command missions that they use to identify assets 
needed for those missions. For example, Air Force officials said they 
have a lot of knowledge regarding tasks needed to complete their Air 
Force-specific missions, but do not always have similar knowledge of 
combatant command missions. According to these officials, the military 
services typically obtain combatant command mission task information 
from the Defense Readiness Reporting System,[Footnote 22] as the 
combatant commands do not provide this detailed information directly to 
the military services. However, Air Force and Navy officials stated 
that this information is often inconsistent. Better developed 
information about tasks essential to completing combatant command 
missions, including standards and conditions to determine what 
constitutes a mission failure or mission degradation,[Footnote 23] 
would provide additional clarity in identifying and prioritizing Task 
Critical Assets. 

In the absence of formal DCIP guidance on the critical asset 
identification process, ASD(HD&ASA) encouraged, but did not require, 
the combatant commands and military services to use their draft and non-
binding guidance to identify and prioritize their Tier 1 Task Critical 
Asset submissions in 2007 and 2008. This guidance included the 
Criticality Process Guidance Document, issued in December 2006, and the 
draft version of the DOD Critical Asset Identification Process manual, 
issued in September 2007. 

Our prior work on DCIP management[Footnote 24] and the Standards for 
Internal Control in the Federal Government[Footnote 25] both emphasize 
the importance of management controls to guide program implementation, 
which includes the development and issuance of formal guidance. Based 
on discussions with combatant command and military service officials, 
the lack of consistent criteria, including varying definitions of key 
terms, in the selection of Tier 1 Task Critical Asset submissions and 
the absence of binding guidance from ASD(HD&ASA) have resulted in a 
Tier 1 Task Critical Asset list of limited usefulness to decision- 
makers in determining DOD's most critical assets. Specifically, the 
list may continue to include assets that should not be on the list. 
Also, as noted in our prior work, the absence of formal DCIP guidance 
and policies has led DOD components, such as the combatant commands and 
military services, to pursue varying approaches to identify and ensure 
the availability of their critical assets. ASD(HD&ASA) and Joint Staff 
officials acknowledged that the current version of the Tier 1 Task 
Critical Asset list is problematic and that they expect the current 
list of Tier 1 Task Critical Assets to change significantly over the 
next year because the military services and combatant commands are now 
required to use formal critical asset identification criteria to submit 
an update to their Tier 1 Task Critical Asset lists. ASD(HD&ASA) 
officials believe the use of this new guidance will improve the quality 
of the list. 

DOD issued the final version of the DOD Critical Asset Identification 
Process manual in October 2008. However, officials from the Air Force 
and U.S. Pacific Command we spoke with said that certain definitions 
contained in this current guidance are still subjective and elements 
within those definitions still need to be clarified. For example, Air 
Force officials stated that determining what constitutes a mission 
essential task for combatant command missions is a continuing 
challenge. In addition, U.S. Pacific Command officials explained that 
tiering critical assets is an inherently subjective process with asset 
and mission owners relying on their own individual perspectives and 
interpretations of the definitions to determine the appropriate tier of 
an asset. For example, military services typically have different 
mission-essential tasks and, in some cases, the military services will 
assign the same asset to different tier levels. In discussions with us, 
ASD(HD&ASA) and Joint Staff officials acknowledged that the critical 
asset identification process is still subjective and further 
clarification may be needed. Though DOD has issued the final version of 
the DOD Critical Asset Identification Process manual, based on our 
analysis of this manual and discussions with military service and 
combatant command officials, further clarification of the tier 
definitions and certain elements within those definitions may be 
warranted to prevent future inconsistencies in the combatant commands' 
and the military services' submissions of assets to DOD's Tier 1 Task 
Critical Asset list. 

DOD Has Taken Steps to Promote Coordination among Key DCIP Stakeholders 
but Still Lacks an Effective Coordination Mechanism for Identifying and 
Nominating Critical Assets: 

DOD has taken some actions toward promoting coordination among the 
combatant commands, military services, and the Joint Staff in 
developing DOD's Tier 1 Task Critical Asset list, such as issuing the 
October 2008 DCIP critical asset identification guidance. However, it 
has not yet developed formal coordination responsibilities and an 
effective coordination mechanism within DCIP, including a forum for 
coordination between the military services and combatant commands when 
identifying critical assets. According to combatant command and 
military service officials, they conduct minimal coordination when 
determining which assets are critical to combatant command missions--a 
key step in identifying assets to nominate to DOD's Tier 1 Task 
Critical Asset list. In addition, Navy and Army officials stated they 
only coordinate minimally with the Joint Staff once they submit their 
assets for the Tier 1 Task Critical Asset list. Combatant commands are 
charged in the DCIP guidance with conducting analyses of command 
mission and mission essential tasks with their associated conditions 
and standards and providing the results of these analyses to the 
appropriate DCIP stakeholders to support Task Critical Asset 
identification. In contrast, the military services own most of the 
assets and, in some cases, are responsible for providing resources, 
such as funding, to protect those assets, thereby assuring the 
capabilities needed to implement missions. Consequently, the combatant 
commands and military services each have a role in identifying and 
prioritizing critical assets through DCIP. 

In August 2005, DOD issued DOD Directive 3020.40, which calls for 
coordination among the combatant commands, military services, the Joint 
Staff, and other DOD agencies for the purpose of identifying and 
assessing critical assets needed to implement combatant command 
missions. Additionally, in October 2008, DOD issued DOD Manual 3020.45, 
which further defines combatant command, military service, and Joint 
Staff roles in the critical asset identification process. However, 
based on our analysis of the October 2008 manual and discussions with 
DCIP officials, DCIP continues to lack clearly defined coordination 
responsibilities and a mechanism for effective coordination within the 
program among the combatant commands and military services. As a 
result, the communication and coordination efforts among these key DCIP 
stakeholders are insufficient and inconsistent, which hinders the 
ability of the military services to identify critical assets needed to 
fulfill combatant command missions. 

Officials we spoke with from all three military services stated that, 
while the new guidance outlines a critical asset identification 
process, lack of coordination with the combatant commands may continue. 
Military service officials rely on the combatant commands to provide 
detailed information about their missions to help the military services 
identify critical assets. For example, Air Force officials told us that 
they rely on combatant commands to provide them with combatant command- 
related mission essential task information, but that this information 
is not always accurately and consistently provided by the combatant 
commands. Similarly, Army officials stated they were unaware of the 
submission of a particular Army-owned critical asset by a combatant 
command to the Tier 1 Task Critical Asset list--and its subsequent 
selection as a Defense Critical Asset--during the previous Joint Staff 
data call for Task Critical Asset submissions until the Army officials 
viewed the final Tier 1 Task Critical Asset list. According to these 
Army officials, their lack of awareness of this asset's status as a 
Defense Critical Asset hindered their ability to develop and share 
effective risk mitigation strategies for this asset with senior Army 
leaders. Air Force and Army officials stated that the new guidance will 
not specifically address these coordination issues. 

ASD(HD&ASA) and Joint staff officials acknowledge that DCIP-related 
coordination between the combatant commands and military services could 
be strengthened. Officials at U.S. Strategic Command stated they are in 
the process of developing an electronic information sharing field 
within the critical asset database used to track DOD's Task Critical 
Assets for DCIP. U.S. Strategic Command manages the database used to 
track DOD's critical assets. These officials also told us that this 
information sharing mechanism may help the combatant commands, military 
services, and the Joint Staff improve their coordination efforts, but 
that this mechanism has not yet been finalized and is still being 
tested within the DCIP community. Until ASD(HD&ASA) formalizes 
coordination responsibilities among key DCIP stakeholders and develops 
an effective coordination mechanism, coordination among the combatant 
commands, military services, and the Joint Staff for DCIP will continue 
to be limited. Without effective coordination, the Joint Staff, 
combatant commands, and military services cannot agree on an accurate 
identification and prioritization of assets most critical to fulfilling 
combatant commands' missions or reach agreement on how to prioritize 
funding to help develop effective actions to protect and mitigate 
against possible attacks on DOD's critical infrastructure. 

DCIP Lacks Some Key Program Elements Needed to Facilitate the Critical 
Asset Identification and Prioritization Process: 

While DOD has developed a strategy and a comprehensive management plan 
for managing DCIP and issued a new DOD Mission-Based Critical Asset 
Identification Process manual,[Footnote 26] DCIP still lacks certain 
key elements for nominating Tier 1 Task Critical Assets, which could 
enhance the effectiveness of the program, including development of 
clearly defined schedules for meeting performance goals and a formal 
feedback process. According to our work on sound management practices, 
[Footnote 27] comprehensive program schedules and formal communication 
strategies assist agencies in effectively implementing programs by 
providing relevant stakeholders with timelines to follow, performance 
milestones to meet, and shared expectations to guide their efforts. To 
date, the Joint Staff has not requested Tier 1 Task Critical Asset 
submissions from the combatant commands and military services using a 
routine and consistent timeline with milestones. Instead, the Joint 
Staff has requested asset submissions from the combatant commands and 
military services primarily on an ad-hoc basis, without providing a 
formal schedule or deadlines for the responsible organizations to 
follow. Subsequently, the military services expressed concern that they 
were not allowed adequate time to generate thorough and accurate 
nominations for DOD's Tier 1 Task Critical Asset list prior to the 
required 2008 deadline for submission to the Joint Staff. For example, 
according to the combatant command and military service officials with 
whom we spoke, the Joint Staff asked them to submit their final 
nominations for DOD's Tier 1 Task Critical Asset list in 2008 with 
relatively little prior notice. As a result, these officials expressed 
concern that they did not receive adequate time to develop their 
submissions thoroughly or accurately. Furthermore, Air Force and U.S. 
Pacific Command officials expect their future processes for generating 
more accurate Tier 1 Task Critical Asset submissions to take, on 
average, a total of 18 months and 3 years, respectively. However, 
ASD(HD&ASA) and Joint Staff officials indicated they hope to revise the 
current Tier 1 Task Critical Asset list using the new DCIP critical 
asset identification process in approximately 4 months, or by October 
2009. However, until ASD(HD&ASA) clarifies a timeline and milestones 
for submitting critical assets to the combatant commands and military 
services, there may continue to be discrepancies in the expectations 
among the combatant commands, military services, and the Joint Staff 
regarding the expected timeframes for submitting assets. As a result, 
DOD's Tier 1 Task Critical Asset list may continue to include assets 
that should not be on the list, or exclude assets that should be on the 
list if the services and combatant commands are not allowed sufficient 
notice or time for completing asset submissions. 

DCIP guidance does not contain a process for providing formal feedback 
to the combatant commands and military services regarding their 
selection of assets for the Tier 1 Task Critical Asset list. Based on 
discussions with combatant command, military, and Joint Staff 
officials, only minimal informal feedback has occurred to date. Our 
prior work, including Standards for Internal Control in the Federal 
Government,[Footnote 28]emphasizes the need for formal feedback as a 
management control. The lack of formal feedback from the Joint Staff 
may result in a Tier 1 Task Critical Asset list that includes 
inappropriate assets that do not meet DOD criteria. For example, Army, 
Navy, and Air Force officials we spoke with stated they would find 
formal feedback useful when submitting future nominations for the DOD 
Tier 1 Task Critical Asset list to the Joint Staff. Without any formal 
feedback, the combatant commands and military services may continue to 
either submit assets for the Tier 1 Task Critical Asset lists that 
should not be on the list or may exclude assets that should be on the 
list from their submissions. As a result, DOD's Tier 1 Task Critical 
Asset list maintained by the Joint Staff may continue to include assets 
that are not appropriate. Without fully developed timelines for data 
submissions and a formal feedback process regarding those submissions 
within DCIP, combatant commands and military services might not 
accurately identify the assets most critical to their missions and make 
fully informed budgetary and resource allocation decisions necessary to 
protect those assets from possible threats or hazards. 

Conclusions: 

DOD's recent issuance of DOD Manual 3020.45 Volume 1, DOD Critical 
Asset Identification Process, is a positive step toward developing a 
consistent and reliable Tier 1 Task Critical Asset list; however, 
further action is needed. Having a complete and reliable list of 
prioritized and assessed critical assets will enable DOD to target 
resources to its most mission-critical assets at highest risk. 
Subjectivity and a lack of clarity regarding the appropriate guidance 
to clarify key definitions may continue to result in inappropriate 
assets being nominated by the combatant commands and military services, 
and prevent DOD from having a complete and accurate list of critical 
assets. DOD officials acknowledged that the current definitions of Task 
1 and Task Critical Asset are subjective. Also, until coordination 
within the program is formalized and strengthened, the military 
services, combatant commands, and the Joint Staff may not be in a 
position to coordinate effectively with each other to determine which 
assets are most critical to DOD and levels of funding to address 
identified vulnerabilities. Finally, while DOD has made progress in 
issuing a strategy for critical infrastructure, DOD's lack of effective 
program management practices may continue to limit the program's 
effectiveness in identifying and prioritizing critical assets. 

Recommendations for Executive Action: 

We are recommending that the Secretary of Defense take the following 
three actions: 

* To improve the consistency and reliability of the Tier 1 Task 
Critical Asset list, direct the Assistant Secretary of Defense for 
Homeland Defense and Americas' Security Affairs and the Joint Staff to 
further clarify the definitions of a Tier 1 Task Critical Asset 
contained in DOD Manual 3020.45 Volume I, Critical Asset Identification 
Process, along with definitions of key elements, such as "mission 
essential tasks." Potential approaches could include establishing and 
issuing a set of test questions to apply to a proposed critical asset 
or providing a set of hypothetical examples to use in identifying 
critical assets. 

* To facilitate effective coordination among the combatant commands, 
military services, and the Joint Staff in compiling the Tier 1 Task 
Critical Asset list, direct the Assistant Secretary of Defense for 
Homeland Defense and Americas' Security Affairs and the Joint Staff to 
develop specific coordination responsibilities and a coordination 
mechanism within DCIP for each of those stakeholders to use when 
compiling the list. 

* To improve the overall effectiveness of DOD's process to develop a 
list of Tier 1 Task Critical Assets, direct the Assistant Secretary of 
Defense for Homeland Defense and Americas' Security Affairs and the 
Joint Staff to formalize processes for compiling the Tier 1 Task 
Critical Asset list, including the development of a formal schedule 
with timelines and milestones for submitting Tier 1 Task Critical Asset 
data and a formal process for the Joint Staff to provide feedback to 
the combatant commands and military services regarding the assets they 
propose to include on the Tier 1 Task Critical Asset list. 

Agency Comments and Our Evaluation: 

In written comments on a draft of this report, which included three 
draft recommendations, DOD partially concurred with all three of our 
recommendations. For each recommendation, DOD described relevant 
guidance in place or in draft and additional actions it would take in 
response. Also, U.S. Pacific Command provided technical comments, which 
we incorporated in the report where appropriate. DOD's comments are 
reprinted in enclosure I. 

DOD partially concurred with our first recommendation, which called for 
clarification of definitions of a Tier 1 and a Task Critical Asset, and 
elements within those definitions. In its written comments, DOD stated 
that Manual 3020.45 Volume 1, Mission-Based Critical Asset 
Identification Process provides comprehensive procedures for 
identifying critical assets through a mission-focused process. They 
added that when considering the impact to the mission, the concept of 
"mission (or function) failure" depends on the organizational level, 
nature, scope, conditions, and standards associated with the mission 
and that each mission is different. While we recognize the validity of 
this observation, we continue to believe that the identification of a 
set of Tier 1 Task Critical Assets with similar levels of mission 
criticality would be facilitated by the use of consistent definitions. 
Based on our interviews with military service officials, these 
different determinations of mission failure make it difficult for the 
services to determine which assets are critical for combatant command 
missions. Further, while DOD stated in its written comments that 
guidance already exists on mission essential tasks, such as the Joint 
Mission Essential Task List Development Handbook, this guidance is not 
referenced in DCIP directives and instructions. Finally, DOD stated 
that ASD(HD&ASA) will work with the Joint Staff to provide additional 
clarification in their critical asset guidance, an action we believe is 
responsive to our recommendation. 

DOD partially concurred with our second recommendation, calling for the 
development of coordination responsibilities and a coordination 
mechanism within DCIP for stakeholders to use when compiling the Tier 1 
Task Critical Asset list. DOD stated that its current guidance 
establishes coordination responsibilities within DCIP; DOD Directive 
3020.40, DOD Instruction 3020.45, and DOD Manual 3020.45 Volume 1 
outline coordination responsibilities among key DCIP stakeholders. We 
acknowledge this DOD guidance in our report. However, based on our 
discussions with military service and combatant command officials, we 
continue to believe that these coordination responsibilities need to be 
specifically identified. DOD stated that the Joint Staff uses a formal 
Joint Staff Action Process, which provides ample opportunity for 
military service and combatant command feedback and a means for seeking 
clarification of guidance. However, we were told by a Joint Staff 
official that a formal Joint Staff Action Process was not issued for 
the March 2009 Tier 1 Task Critical Asset list, and we have not found 
evidence of the issuance of one since January 2007. In addition, DOD 
also stated in its written comments that coordination mechanisms exist 
within DCIP, such as the Operational Advisory Board and the Defense 
Critical Infrastructure Integration Staff. According to DOD, both of 
these forums meet quarterly and are specifically designed to facilitate 
information sharing. However, military service and combatant command 
officials told us that the coordination promoted by these existing 
mechanisms does not address asset identification, prioritization, and 
mission impact assessment. Finally, DOD stated it will work with the 
Joint Staff to determine what further coordination guidance is needed 
and why existing coordination mechanisms are not being used to identify 
and prioritize assets. We agree that this is a necessary action for DOD 
in order to improve coordination within DCIP and, if pursued, could be 
responsive to our recommendation. 

DOD partially concurred with our third recommendation, calling for the 
development of a formal schedule, milestones, and feedback process for 
critical asset identification. According to DOD's written comments, 
ASD(HD&ASA) has developed a draft DOD Manual 3020.45 Volume 6 Defense 
Critical Infrastructure Program (DCIP) Execution Timeline. DOD intends 
for this manual to provide uniform procedures for the execution of DCIP 
activities and timelines for DCIP stakeholders to use in coordinating 
the execution of DCIP activities outlined in current DCIP guidance and 
ensure that feedback is provided to the components. With regard to the 
DCIP Critical Asset Identification Process Collaboration Tool that DOD 
intends to use as a way to establish a standard timeline and 
milestones, we note that this tool could potentially improve the 
critical asset identification process once it is implemented if the 
military services and combatant use the tool. We continue to believe 
that the military services and combatant commands could benefit from a 
more formal data call with deadlines, milestones, and an opportunity to 
receive feedback from the Joint Staff. 

As agreed with your offices, we are sending copies of this report to 
the Chairmen and Ranking Member of the Senate and House Appropriations 
Subcommittees on Defense and on Military Construction, Veterans 
Affairs, and Related Agencies; Senate and House Committees on Armed 
Services; and other interested congressional parties. We also are 
sending copies to the Secretary of Defense; the Chairman, Joint Chiefs 
of Staff; the Secretaries of the Army, the Navy, and the Air Force; the 
Commandant of the Marine Corps; and the Director, Office of Management 
and Budget. In addition, the report will be available at no charge on 
GAO's Web site at [hyperlink, http://www.gao.gov]. 

If you or your staff have any questions concerning this report, please 
contact me at (202) 512-5431 or by e-mail at dagostinod@gao.gov. 
Contact points for our Offices of Congressional Relations and Public 
Affairs may be found on the last page of this report. GAO staff who 
made key contributions to this report are listed in enclosure II. 

Signed by: 

Davi M. D'Agostino:
Director:
Defense Capabilities and Management: 

Enclosures - 2: 

List of Committees: 

The Honorable Carl Levin:
Chairman:
The Honorable John McCain:
Ranking Member:
Committee on Armed Services:
United States Senate: 

The Honorable Daniel Inouye:
Chairman:
The Honorable Thad Cochran:
Ranking Member:
Subcommittee on Defense:
Committee on Appropriations:
United States Senate: 

The Honorable Tim Johnson:
Chairman:
The Honorable Kay Bailey Hutchison:
Ranking Member:
Subcommittee on Military Construction, Veterans Affairs, and Related 
Agencies:
Committee on Appropriations:
United States Senate: 

The Honorable Ike Skelton:
Chairman:
The Honorable Howard McKeon:
Ranking Member:
Committee on Armed Services:
House of Representatives: 

The Honorable John P. Murtha:
Chairman:
The Honorable C.W. Bill Young:
Ranking Member:
Subcommittee on Defense:
Committee on Appropriations:
House of Representatives: 

The Honorable Chet Edwards:
Chair:
The Honorable Zach Wamp:
Ranking Member:
Subcommittee on Military Construction, Veterans Affairs, and Related 
Agencies: 
Committee on Appropriations:
House of Representatives: 

[End of section] 

Enclosure I: Comments from the Department of Defense: 

Assistant Secretary Of Defense: 
Homeland Defense: Americas' Security Affairs: 
2600 Defense Pentagon: 
Washington, D.C. 20301-2600: 

July 15, 2009: 

Ms. Davi M. D'Agostino: 
Director, Defense Capabilities and Management: 
U.S. Government Accountability Office: 
441 G Street, N.W. 
Washington, DC 20548: 

This is the Department of Defense (DoD) response to the GAO draft 
report, GAO09-740R, "Defense Critical Infrastructure: Actions Needed to 
Improve the Consistency, Reliability, and Usefulness of DoD's Tier 1 
Task Critical Asset List," dated June 22, 2009 (GAO Code 351341). DoD 
partially concurs with all three recommendations. Our response to the 
recommendations is enclosed. 

Our point of contact for this action is Mr. Antwane Johnson, Office of 
the Assistant Secretary of Defense for Homeland Defense and Americas' 
Security Affairs (OASD (HD&ASA)), (703) 602-5730, Extension 143 or 
Antwane.Johnson@osd.mil. 

Sincerely, 

Signed by: 

Christine E. Wormuth: 
Principal Deputy: 

Enclosure: As stated: 

[End of letter] 

GAO Draft Report - Dated June 22, 2009: 
GAO Code 351341 /GAO-09-740R: 

"Defense Critical Infrastructure: Actions Needed to Improve the 
Consistency, Reliability, and Usefulness of DoD's Tier 1 Task Critical 
Asset List" 

Department Of Defense Comments To The Recommendations: 

Recommendation 1: The GAO recommends that the Secretary of Defense 
direct the Assistant Secretary of Defense for Homeland Defense and 
Americas' Security Affairs and the Joint Staff to further clarify the 
definitions of a Tier 1 Task Critical Asset contained in DoD Manual 
3020.45 Volume I, Critical Asset Identification Process, along with 
definitions of key elements, such as "mission essential tasks." 
Potential approaches could include establishing and issuing a set of 
test questions to apply to a proposed critical asset or providing a set 
of hypothetical examples to use in identifying critical assets. 

DOD Response: Partially concur. DoD Manual 3020.45 Volume I, Critical 
Asset Identification Process, provides comprehensive procedures for 
identifying critical assets through the use of a mission-focused 
process. The process begins with an analysis of assigned missions and 
decomposes them to a level that can be directly tied to an asset. The 
loss of the asset is then analyzed to determine the impact on the 
mission. If the impact is mission failure, it is considered a Tier 1 
task critical asset. As each mission is different, the analysis must 
consider the organizational level, nature, scope, conditions, and 
standards associated with the mission. Mission-essential tasks 
represent a commander's priority of warfighting requirements based on 
assigned missions. The Joint Mission Essential Task List (JMETL) 
Development Handbook provides guidance to help commanders define their 
mission-essential tasks along with associated conditions and measurable 
standards. The DCIP Office will work with the Joint Staff to provide 
additional clarification of this guidance. 

Recommendation 2: The GAO recommends that the Secretary of Defense 
direct the Assistant Secretary of Defense for Homeland Defense and 
Americas' Security Affairs and the Joint Staff to develop specific 
coordination responsibilities and a coordination mechanism within the 
Defense Critical Infrastructure Program (DCIP) for each of those 
stakeholders to use when compiling the list. 

DOD Response: Partially concur. Existing guidance (DoD Directive 
3020.40, DoD Instruction 3020.45, and DoD Manual 3020.45, Volume 1) 
provides specific coordination responsibilities for each of the 
components during the critical asset identification process. In 
addition, the Joint Staff, when issuing a data call for TCA 
submissions, uses a formal Joint Staff Action Process which provides 
ample opportunity for Combatant Command and Service feedback and a 
means for seeking clarification of guidance. OASD (HD&ASA) has 
established forums, such as the Joint Staff-chaired Operational 
Advisory Board (OAB) and the DCIP Office-chaired Defense Critical 
Infrastructure Integration Staff (DCIIS). Both of these forums meet 
quarterly and are specifically designed to provide for the 
identification, clarification, and resolution of CIP issues among 
stakeholders and to facilitate information sharing 

The DCIP Office will work with the Joint Staff to determine what, if 
any, further guidance is required regarding specific coordination 
responsibilities, and why stakeholders failed to employ existing 
coordination mechanisms when compiling their TCA lists. 

Recommendation 3: The GAO recommends that the Secretary of Defense 
direct the Assistant Secretary of Defense for Homeland Defense and 
Americas' Security Affairs and the Joint Staff to formalize processes 
for compiling the Tier 1 Task Critical Asset list, including the 
development of a formal schedule with timelines and milestones for 
submitting Tier 1 Task Critical Asset data and a formal process for the 
Joint Staff to provide feedback to the Combatant Commands and military 
services regarding the assets they propose to include on the Tier 1 
Task Critical Asset list. 

DOD Response: Partially concur. OASD (HD&ASA) is formalizing the 
process for compiling Tier 1 Task Critical Task Asset list in a draft 
manual, DoDM 3020.45 Volume 6, Defense Critical Infrastructure Program 
(DCIP) Execution Timeline. The manual will provide uniform procedures 
for the execution of DCIP activities, a standard timeline, and exact 
milestones that OASD (HD&ASA), the Joint Staff, Military Departments, 
Combatant Commands, Defense Agencies, and the Defense Infrastructure 
Sector Lead Agencies will use to coordinate the execution of activities 
and responsibilities assigned in DoDD 3020.40, Defense Critical 
Infrastructure Program, DoDI 3020.45, Defense Critical Infrastructure 
Program Management, and DoD Manual 3020.45, Defense Critical 
Infrastructure Program: DoD Mission-Based Critical Asset Identification 
Process, Volumes 1, 5, and 7. The execution timeline will ensure the 
development of the Tier 1 TCA List and provide feedback to the 
components. The DCIP Office is also developing a collaboration tool 
which, in conjunction the publication of DoDM 3020.45 , will improve 
stakeholder situational awareness of each step in the process of 
identifying TCAs. 

[End of section] 

Enclosure II: 

GAO Contact and Staff Acknowledgments: 

GAO Contact: 

Davi M. D'Agostino, (202) 512-5431 or dagostinod@gao.gov: 

Acknowledgments: 

In addition to the contact named above, Mark A. Pross, Assistant 
Director; David G. Artadi; James D. Ashley; Yecenia C. Camarillo; Gina 
M. Flacco; Brian K. Howell; Katherine S. Lenane; Michael S. Pose; Terry 
L. Richardson; and Cheryl A. Weissman made key contributions to this 
report. 

[End of section] 

Footnotes: 

[1] DOD Directive 3020.40, Defense Critical Infrastructure Program 
(DCIP), (Aug. 19, 2005). 

[2] Earlier programs analogous to DCIP can be traced back to 1998. 

[3] DOD Instruction 3020.45, Defense Critical Infrastructure Program 
(DCIP) Management (Apr. 21, 2008). 

[4] DOD Manual 3020.45-M, Defense Critical Infrastructure Program 
(DCIP): DOD Mission-Based Critical Asset Identification Process (CAIP), 
Volume 1 (Oct. 24, 2008). 

[5] According to DOD's critical asset identification guidance, the 
definitions of the tiered Task Critical Assets are: Tier 1--An asset 
the loss, incapacitation, or disruption of which could result in 
mission (or function) failure at the DOD, military department, 
combatant command, sub-unified command, defense agency, or defense 
infrastructure sector level. Tier 2--An asset the loss, incapacitation, 
or disruption of which could result in severe mission (or function) 
degradation at the DOD, military department, combatant command, sub- 
unified command, defense agency, or defense infrastructure sector 
level. Tier 3--An asset the loss, incapacitation, or disruption of 
which could result in mission (or function) failure below the military 
department, combatant command, sub-unified command, defense agency, or 
defense infrastructure sector level. (Emphasis added by GAO.) 

[6] Defense Critical Assets are of such extraordinary importance to DOD 
operations in peace, crisis, and war that their incapacitation or 
destruction would have a very serious, debilitating effect on the 
ability of DOD to fulfill its missions. Defense critical assets are a 
subset of Tier 1 Task Critical Assets. Currently, there are about 675 
Tier 1 Task Critical Assets and 29 Defense Critical Assets. 

[7] H.R. Rep. No. 110-652, pp. 523-524 (May 16, 2008). 

[8] Although we found a number of duplicate assets on the Tier 1 Task 
Critical Asset list, combatant command officials said that duplication 
of Task Critical Assets is not a serious issue and is due mainly to the 
different naming conventions between the military services and 
combatant commands. Moreover, combatant command officials noted that if 
several combatant commands identify an asset as a Task Critical Asset, 
then this merely reflects its criticality to multiple mission owners. 

[9] The actual number of Tier 1 Task Critical Assets can change 
frequently, since critical assets are regularly added and deleted from 
the list by the combatant commands, military services, defense 
agencies, and Defense Infrastructure Sector Lead Agents. 

[10] Department of Defense, Defense Critical Infrastructure Program 
Criticality Process Guidance Document (Dec. 21, 2006). 

[11] Department of Defense, Critical Asset Identification Process, 
Draft, Version 2.0 (Sept. 1, 2007). 

[12] DOD 3020.45-M Volume 1 (Oct. 24, 2008). 

[13] DOD Directive 3020.40 (Aug. 19, 2005). 

[14] DOD Instruction 3020.45 (Apr. 21, 2008). 

[15] These include the Department of Defense, Strategy for Defense 
Critical Infrastructure (Washington, D.C.: March 2008) and Department 
of Defense, National Defense Strategy (Washington, D.C.: June 2008). 

[16] See, for example, U.S. Air Force, The Identification of Critical 
Assets and Infrastructures--Methodology, Version 2.0 (Apr. 7, 2006); 
Air Force Policy Directive 10-24, Air Force Critical Infrastructure 
Program (CIP) (Apr. 28, 2006); and U.S. Army, Critical Infrastructure 
Risk Management; The Identification of Critical Assets Methodology 
(Jan. 6, 2007). 

[17] See GAO, Standards for Internal Control in the Federal Government, 
[hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1] 
(Washington, D.C.: November 1999). 

[18] GAO, Defense Infrastructure: Actions Needed to Guide DOD's Efforts 
to Identify, Prioritize, and Assess Its Critical Infrastructure, 
[hyperlink, http://www.gao.gov/products/GAO-07-461] (Washington, D.C.: 
May 24, 2007). 

[19] [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1]. 

[20] Homeland Security Presidential Directive 7, issued in December 
2003, requires, among other things, that all federal departments and 
agencies identify, prioritize, and coordinate the protection of 
critical infrastructure and key resources from terrorist attacks. DCIP 
encompasses the full spectrum of threats--ranging from terrorist 
attacks to natural disasters and catastrophic accidents--that can 
adversely affect critical defense infrastructure. 

[21] Department of Defense, The National Defense Strategy of the United 
States of America (Washington, D.C.: June 2008). 

[22] The Defense Readiness Reporting System is a real-time information 
system that measures and reports on the readiness of military forces 
and the supporting infrastructure to meet missions and goals assigned 
by the Secretary of Defense. 

[23] According to the DOD Critical Asset Identification Process manual, 
a Tier 1 Task Critical Asset is defined by mission failure if the asset 
is lost, incapacitated, or disrupted. However, a Tier 2 Task Critical 
Asset is defined by severe mission (or function) degradation if the 
asset is lost, incapacitated, or disrupted. 

[24] [hyperlink, http://www.gao.gov/products/GAO-07-461]. 

[25] [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1]. 

[26] DOD 3020.45-M Volume 1 (Oct. 24, 2008). 

[27] [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1]. 

[28] [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1]. 

[End of section] 

GAO's Mission: 

The Government Accountability Office, the audit, evaluation and 
investigative arm of Congress, exists to support Congress in meeting 
its constitutional responsibilities and to help improve the performance 
and accountability of the federal government for the American people. 
GAO examines the use of public funds; evaluates federal programs and 
policies; and provides analyses, recommendations, and other assistance 
to help Congress make informed oversight, policy, and funding 
decisions. GAO's commitment to good government is reflected in its core 
values of accountability, integrity, and reliability. 

Obtaining Copies of GAO Reports and Testimony: 

The fastest and easiest way to obtain copies of GAO documents at no 
cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each 
weekday, GAO posts newly released reports, testimony, and 
correspondence on its Web site. To have GAO e-mail you a list of newly 
posted products every afternoon, go to [hyperlink, http://www.gao.gov] 
and select "E-mail Updates." 

Order by Phone: 

The price of each GAO publication reflects GAO’s actual cost of
production and distribution and depends on the number of pages in the
publication and whether the publication is printed in color or black and
white. Pricing and ordering information is posted on GAO’s Web site, 
[hyperlink, http://www.gao.gov/ordering.htm]. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card,
MasterCard, Visa, check, or money order. Call for additional 
information. 

To Report Fraud, Waste, and Abuse in Federal Programs: 

Contact: 

Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]: 
E-mail: fraudnet@gao.gov: 
Automated answering system: (800) 424-5454 or (202) 512-7470: 

Congressional Relations: 

Ralph Dawn, Managing Director, dawnr@gao.gov: 
(202) 512-4400: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7125: 
Washington, D.C. 20548: 

Public Affairs: 

Chuck Young, Managing Director, youngc1@gao.gov: 
(202) 512-4800: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7149: 
Washington, D.C. 20548: