Information and Communications Technology: DOD Needs to Fully Implement Foundational Practices to Manage Supply Chain Risks
Fast Facts
IT and communications technologies use parts and services from around the globe. Emerging threats in the supply chain for these technologies can put federal agencies—including DOD—at risk. For example, communications hardware with compromised components could lead to the loss of sensitive data.
Of our practices for managing agency-wide supply chain risks, DOD addressed 4 and partially addressed the other 3. Specifically, DOD still needs to update and finalize an agency-wide strategy and implement processes for reviewing potential suppliers and detecting counterfeits. We recommended committing to a time frame for addressing these issues.
Highlights
What GAO Found
The Department of Defense (DOD) has fully implemented four and partially implemented three of seven selected foundational practices for managing information and communications technology (ICT) supply chain risks (see figure). These risks include threats posed by counterfeiters who may exploit vulnerabilities in the supply chain. Supply chain risk management is the process of identifying, assessing, and mitigating the risks associated with the global and distributed nature of ICT product and service supply chains.
Assessment of the Department of Defense's (DOD) Implementation of Selected Foundational Information and Communications Technology (ICT) Supply Chain Risk Management Practices
By fully implementing four of the foundational practices, DOD has taken steps to mitigate potential threats and secure its ICT supply chain. Regarding the three partially implemented practices, the department has begun several efforts that are not yet complete. For example, the department has developed a risk management strategy but has not approved guidance for implementing it. DOD has also piloted the use of several tools to review potential suppliers but the review of the results is ongoing. However, DOD did not specify time frames for when these actions would be completed. Fully implementing the three remaining practices would enhance the department's understanding and management of supply chain risks.
DOD provided leadership and support for several government-wide efforts to protect the ICT supply chain. For example, the department offered a course and assisted small businesses in protecting their supply chains. Additionally, the department developed an action plan to facilitate cyber threat sharing and briefed a federal acquisition community of practice on performing cyber test and evaluations. DOD also shared ICT supply chain responsibilities as a member of the Federal Acquisition Security Council. Further, the council has the authority to issue exclusion orders to prevent purchasing from suppliers that may be compromised.
Why GAO Did This Study
Federal agencies rely extensively on ICT products and services (e.g., computing systems, software, and networks) to carry out their operations. However, agencies face numerous ICT risks that can compromise the confidentiality, integrity, or availability of an organization's systems and the information they contain.
Senate Report 117-39 accompanying the Fiscal Year 2022 National Defense Authorization Act included a provision for GAO to provide an assessment of DOD's efforts to address ICT supply chain risks. The specific objectives for GAO's report were to (1) assess the extent to which DOD is implementing foundational ICT supply chain risk management practices and (2) describe the extent to which DOD is leading or supporting government-wide efforts to protect the ICT supply chain.
GAO compared the department's policies, procedures, and related documentation to seven foundational practices. These practices are based on National Institute of Standards and Technology guidance for ICT risk management. In addition, GAO analyzed documentation describing DOD's efforts to lead or support government-wide efforts to protect its supply chains. GAO also interviewed relevant agency officials.
Recommendations
GAO is making three recommendations to DOD to commit to time frames for fully implementing the remaining foundational practices in its ICT supply chain risk management efforts. DOD concurred with the recommendations.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Department of Defense | The Secretary of Defense should direct the DOD CIO to commit to a time frame to fully implement an agency-wide ICT SCRM strategy, including how the department will assess, respond to, or monitor ICT supply chain risks across the life cycle of ICT products and services. (Recommendation 1) |
Open
The Department of Defense (DOD) concurred with this recommendation and, in comments on the draft report, described plans to address this recommendation. Specifically, the DOD identified actions it is taking to finalize a document (the DOD Chief Information Officer's internal information and communications technology (ICT) supply chain risk management (SCRM) strategy) in April 2023. That document is intended to be the basis for a DOD enterprise-wide ICT SCRM strategy. DOD expects to finalize the draft of its enterprise-wide strategy in September 2023. We will continue to monitor the department's actions to address this recommendation.
|
| Department of Defense | The Secretary of Defense should direct the Undersecretary of Defense for Acquisition and Sustainment and the DOD CIO to commit to a time frame to fully implement a process to conduct SCRM reviews of potential suppliers. (Recommendation 2) |
Open
The Department of Defense (DOD) concurred and, in its response, identified several key policies it is in the process of updating to incorporate relevant policies and procedures, as appropriate. Specifically, DOD indicated it was updating DOD Instruction (DODI) 5200.44, "Protection of Mission Critical Functions to Achieve Trusted Systems and Networks (TSN)" and intended to update DODI 5000.82, "Acquisition of Information Technology (IT)". The department stated that it would also update other DOD policy documents as needed to address all departmental information and communications technology acquisition. We will continue to monitor the department's actions to address this recommendation.
|
| Department of Defense | The Secretary of Defense should direct the Undersecretary of Defense for Acquisition and Sustainment and the DOD CIO to commit to a time frame to fully implement organizational counterfeit detection procedures for products prior to deployment. In doing so, the department should take into consideration the results of its pilot efforts of applicable tools. (Recommendation 3) |
Open
The Department of Defense (DOD) concurred with the recommendation and, in comments on the draft report, described actions DOD planned to take to address the recommendation. For example, the department noted that it expects the completion of its pilot efforts to evaluate various ICT counterfeit detection tools and development of related policies and procedures in fiscal year 2023. DOD expects to incorporate those policies and procedures into department-wide policy by the end of March 2024. We will continue to monitor the department's actions to address this recommendation.
|