Defense Acquisitions: Joint Cyber Warfighting Architecture Would Benefit from Defined Goals and Governance
DOD is procuring new capabilities to support cyber warfighting. To integrate new systems, U.S. Cyber Command introduced an overarching vision for all cyber systems, called the Joint Cyber Warfighting Architecture.
Command officials told us that the main feature of the JCWA concept is interoperability, or the ability to share information among its systems. But Cyber Command has not defined JCWA interoperability goals for the systems.
We recommended that Cyber Command define JCWA interoperability goals to ensure that the systems will be able to work together as planned.
What GAO Found
U.S. Cyber Command created the Joint Cyber Warfighting Architecture (JCWA) as a concept to integrate cyber warfighting systems. Department of Defense (DOD) officials told GAO that the JCWA is to serve as a guiding concept for cyber warfighting acquisitions and investment decisions, rather than a traditional architecture that DOD's systems engineering guidance states would address functions, relationships, and dependencies of constituent systems. As of August 2020, the JCWA consisted of a diagram of systems, including four acquisition programs and the cyber tools and sensors that support cyber warfighting (see figure). Three of these programs were in development before Cyber Command began efforts to link them together to create a more integrated set of systems.
Joint Cyber Warfighting Architecture Conceptual Diagram
Although the primary element of the JCWA concept, according to Cyber Command officials, is the interoperability and information sharing among these systems, Cyber Command has not defined JCWA interoperability goals for constituent systems. The lack of defined goals is due in part to most programs now included in the JCWA being in development prior to the concept being initiated. However, goals are essential to ensuring that operators have system capabilities as anticipated. Cyber Command recently established two new offices that would be responsible for prioritizing JCWA program acquisition requirements but as of August 2020, had not yet assigned roles and responsibilities for these key offices. Until Cyber Command develops a governance structure for the new offices with defined roles and responsibilities, it risks delays in providing needed joint cyber warfare capabilities.
Why GAO Did This Study
Cyberspace is a growing, human-made environment that touches many parts of life, including education, economic development, health, and other public services. For DOD, cyberspace is as important as the traditional land, sea, air, and space warfighting domains. To integrate these disparate cyber systems into a more cohesive capability, U.S. Cyber Command introduced an overarching vision for cyber capabilities known as the Joint Cyber Warfighting Architecture.
The Senate Armed Services Committee included a provision for GAO to review the status of the JCWA. This report (1) describes the JCWA concept, systems, and planned capabilities; and (2) assesses the extent to which DOD has defined interoperability goals and a governance structure to guide JCWA cyber system acquisitions.
To do this work, GAO reviewed acquisition program documents and joint cyber warfighting requirements information. GAO conducted interviews with DOD officials from key cyber warfighting organizations, including Cyber Command, as well as JCWA program offices and stakeholders.
GAO is making two recommendations for Cyber Command to define and document JCWA interoperability goals as well as the JCWA governance structure roles and responsibilities of key offices. DOD concurred with the first and partially concurred with the second recommendation. DOD's plans are consistent with the intent of GAO's recommendations.
Recommendations for Executive Action
|Department of Defense||The Secretary of Defense should direct the Commander, U.S. Cyber Command, to define and document Joint Cyber Warfighting Architecture goals for interoperability requirements to help synchronize acquisition efforts. (Recommendation 1)||
DOD concurred with our recommendation and addressed Joint Cyber Warfighting Architecture goals for interoperability in its Concept of Operations for the architecture. Cyber Command finalized this Concept of Operations in September 2021.
|Department of Defense||The Secretary of Defense should direct the Commander, U.S. Cyber Command, to further develop the Joint Cyber Warfighting Architecture governance structure by defining and documenting the roles and responsibilities of the Joint Cyber Warfighting Architecture Integration Office and Joint Cyber Warfighting Architecture Capabilities Management Office. (Recommendation 2)||
DOD partially concurred with this recommendation. Since our report, U.S. Cyber Command documented roles and responsibilities for its Joint Cyber Warfighting Architecture Integration Office and Joint Cyber Warfighting Architecture Capabilities Management Office.