Federally Funded Research and Development Centers:

Improved Oversight and Evaluation Needed for DOD's Data Access Pilot Program

GAO-20-272: Published: Mar 6, 2020. Publicly Released: Mar 6, 2020.

Additional Materials:

Contact:

Marie A. Mak
(202) 512-4841
makm@gao.gov

 

Office of Public Affairs
(202) 512-4800
youngc1@gao.gov

DOD sponsors research and development activities at 10 Federally Funded Research and Development Centers that provide innovative solutions to national security threats.

These centers sometimes need to access sensitive DOD data (such as proprietary information from DOD’s contractors), which can be a long, time-consuming process. DOD began a pilot in 2017 to streamline these centers’ access to sensitive data.

We found that some centers reported easier access to sensitive data during the pilot. However, DOD has not consistently collected information on the pilot or developed a plan to evaluate it.

We recommended that DOD do so.

Aerial view of the Pentagon

Aerial view of the Pentagon

Additional Materials:

Contact:

Marie A. Mak
(202) 512-4841
makm@gao.gov

 

Office of Public Affairs
(202) 512-4800
youngc1@gao.gov

What GAO Found

The Department of Defense (DOD) launched a 3-year pilot program in December 2017 to enable a streamlined process to share certain sensitive data, such as data collected from its contractors, with its Federally Funded Research and Development Centers (FFRDC). At times, FFRDCs need to access such data to support DOD. The pilot was intended to reduce the burden on FFRDCs to seek permission from hundreds of contractors to access information needed for their research. Six of DOD's 10 FFRDCs have taken part in the pilot, enrolling a combined total of 33 projects, as shown in the table.

Department of Defense (DOD) FFRDC Pilot Projects Enrolled as of September 2019

FFRDC

Project status

Projects (number)

National Defense Research Institute

5 complete; 6 ongoing; 7 removed

18

Systems and Analyses Center

1 complete; 3 ongoing; 3 removed; 1 on hiatus

8

Project AIR FORCE

3 complete; 1 removed

4

Arroyo Center

1 ongoing

1

National Security Engineering Center

1 complete

1

Software Engineering Institute

1 complete

1

Total

 

33

Source: GAO analysis of DOD and Federally Funded Research and Development Centers (FFRDC) information. | GAO-20-272

Note: Projects were removed when researchers discovered that they did not need access to the data requested. The project on hiatus is pending a decision about the continuation of this study.

DOD officials and FFRDC representatives reported that the streamlined process made the use of sensitive data feasible. As a result, FFRDCs with completed projects in GAO's sample indicated they were able to provide more robust analyses or insights to DOD.

DOD guidance for the pilot program established procedures to protect sensitive data. But GAO found that DOD did not incorporate all of the details of the required protections into its agreements with FFRDCs. Further, GAO found that not all FFRDCs were performing annual certification of financial disclosure forms, as required by its agreements with DOD. DOD does not have a process to ensure that all the protections pertaining to FFRDCs' streamlined access to sensitive data are being followed. Without a process that defines roles and responsibilities, DOD cannot ensure that FFRDCs adhere to the protections.

DOD developed goals for the pilot program and outlined what information was to be obtained for each participating project, actions that are consistent with GAO's leading practices for pilot design. However, DOD has not developed a plan for evaluating the program nor has it consistently collected information on about a third of the pilot projects. Leading practices for pilot design call for an evaluation plan, which should include an assessment methodology and identify responsibilities as to how the evaluation will be conducted. Without an evaluation plan and a mechanism to collect information on pilot projects, DOD will not be positioned to identify the effectiveness of the pilot program and benefit from lessons learned. Such information will be useful as Congress considers the path forward after the pilot ends in December 2020.

Why GAO Did This Study

FFRDCs provide federal agencies with research and development functions, technical systems engineering capabilities, and policy development and decision-making studies, among other services. The Federal Acquisition Regulation states that FFRDCs have a special relationship with DOD, which can give FFRDCs access to sensitive data beyond what would commonly be shared with contractors. The National Defense Authorization Act for Fiscal Year 2017 directed DOD to establish a 3-year pilot program that allows FFRDCs streamlined access to sensitive data maintained by DOD. It also included a provision for GAO to report on the pilot program within 2 years of implementation. This report addresses the extent to which (1) FFRDCs are using the pilot program, (2) DOD put procedures in place to protect data accessed, and (3) DOD is evaluating the pilot program.

GAO reviewed DOD guidance and FFRDC processes, pilot reports for January 2018 through September 2019, and DOD's plans and efforts for evaluating the pilot program. GAO also selected a nongeneralizable sample of six projects—at least one from each FFRDC with an enrolled project as of December 2018—for further review. In addition, GAO assessed the pilot program against leading practices for pilot design.

What GAO Recommends

GAO is making six recommendations, including that DOD take steps to ensure data protections are in the agreements and followed, collect information on projects, and evaluate the pilot. DOD agreed with the recommendations.

For more information, contact Marie A. Mak at (202) 512-4841 or makm@gao.gov.

Recommendations for Executive Action

  1. Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: The Under Secretary of Defense for Research and Engineering should direct the Laboratories and Personnel Office to take steps to ensure that the details of the pilot program's data protections are incorporated into the existing agreements. (Recommendation 1)

    Agency Affected: Department of Defense: Office of the Under Secretary of Defense for Research and Engineering

  2. Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: The Under Secretary of Defense for Research and Engineering should direct the Laboratories and Personnel Office to take steps to ensure that the FFRDCs and sponsors are implementing the pilot program's protections for sensitive data. (Recommendation 2)

    Agency Affected: Department of Defense: Office of the Under Secretary of Defense for Research and Engineering

  3. Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: The Under Secretary of Defense for Research and Engineering should direct the Laboratories and Personnel Office to establish a monitoring and oversight mechanism to ensure that primary sponsors submit complete information on pilot projects, as required by DOD's guidance for the pilot program. (Recommendation 3)

    Agency Affected: Department of Defense: Office of the Under Secretary of Defense for Research and Engineering

  4. Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: The Under Secretary of Defense for Research and Engineering should direct the Laboratories and Personnel Office to develop a plan that outlines the methodology by which DOD will assess the pilot and how and when information collected will be analyzed to evaluate the pilot program. (Recommendation 4)

    Agency Affected: Department of Defense: Office of the Under Secretary of Defense for Research and Engineering

  5. Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: The Under Secretary of Defense for Research and Engineering should direct the Laboratories and Personnel Office to develop a plan to identify and evaluate lessons learned from the pilot program. (Recommendation 5)

    Agency Affected: Department of Defense: Office of the Under Secretary of Defense for Research and Engineering

  6. Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: The Under Secretary of Defense for Research and Engineering should direct the Laboratories and Personnel Office to develop a plan for obtaining input from stakeholders on the pilot program. (Recommendation 6)

    Agency Affected: Department of Defense: Office of the Under Secretary of Defense for Research and Engineering

 

Explore the full database of GAO's Open Recommendations »

Mar 26, 2020

Mar 24, 2020

Mar 16, 2020

Mar 12, 2020

Mar 4, 2020

Mar 3, 2020

Feb 28, 2020

Feb 26, 2020

Looking for more? Browse all our products here