Defense Management: Electronic Commerce Implementation Strategy Can Be Improved

DOD concurred with this recommendation and stated that DOD Directive 8190.2, issued on June 23, 2000, incorporate the thrust of this recommendation.

DOD concurred with this recommendation and stated that it had incorporated it into DOD Directive 8190.2 which was issued on June 23, 2000. In addition, DOD provided GAO with additional performance metrics which it had prepared in response to the recommendation.

DOD established an Electronic Business Board of Directors to oversee its electronic commerce program. As part of its charter, the Board is expected to support and develop an approach for an electronic commerce architecture. It is expected to ensure that the architecture is developed in accordance with existing DOD guidance and is compatible with DOD's Global Information Grid. In May 2001, the Assistant Secretary of Defense (C3I) informed the DOD Inspector General that an electronic commerce common architecture was completed in July 2000 in the required format of the C4ISR framework. However, this version of the architecture included only the procurement process. Until DOD includes its many other functions into the common architecture framework, it will not have fully responded to this recommendation.

On July 7, 2000, the DOD Chief Information Officer created an Electronic Business Board of Directors and chartered it with the responsibility and authority to oversee electronic commerce policies, plans, and architecture development. Board membership is comprised of senior DOD managers at the general officer level. The Board began meeting in August 2000 and continues to oversee and address electronic commerce issues across DOD.

DOD agreed with this recommendation and created an office under the Deputy CIO that it believes has the authority and independence to program resources and act from a DOD-wide perspective. DOD incorporated this decision in DOD Directive 8190.2, which was issued in June 2000.

DOD concurred with this recommendation and noted that a number of technical issues still needed to be resolved before realistic timeframes and costs could be determined. In May 2001, the Assistant Secretary of Defense (C3I) reported that the Department had taken a number of actions that addressed this recommendation. On January 16, 2001, the Under Secretary of Defense (P&R) and the DOD CIO co-signed a memo establishing policies and timeliness for implementing aspects of the PKI. On April 1, 2004, DOD issued Instruction 8520.2, "Public Key Infrastructure (PKI) and Public Key (PK) Enabling." This instruction implemented policy, assigned responsibilities, and prescribed procedures for developing and implementing a Department-wide PKI and enhancing the security of DOD information systems by enabling these systems to use PKI for authentication, digital signatures, and encryption. The instruction aligned DOD PKI and PK (Public Key)-Enabling activities with DOD Directive 8500.1, as implemented by DOD Instruction 8500.2, and the DOD Common Access Card (CAC) program, as specified by DOD Directive 8190.3. The instruction was responsive to GAO's recommendation.