Recommendation: The Secretary of Defense should ensure that the Under Secretary of Defense for Research and Engineering revise its IR&D instruction to require USD (R&E) personnel to annually review defense industry IR&D investments to inform DOD's science and technology strategic planning efforts. (Recommendation 1)

Agency: Department of Defense
Status: Open

Comments: DOD concurred with this recommendation stating that USD(R&E) will investigate and revise its IR&D Instruction to require annual review of defense industry IR&D investments.

Recommendation: The Secretary of Defense should ensure that the Administrator, Defense Technical Information Center, assess and determine whether the DTIC IR&D database should require contractors to include additional information on IR&D projects, such as: (a) The IR&D project's linkage, if any, to DOD's modernization priorities; (b) The allowable category (basic research, applied research, technology development, or concept study) to which the IR&D project belongs; (c) The nature of the project as either potentially disruptive or potentially incremental research and development; and (d) The actual IR&D project costs when the project is completed. (Recommendation 2)

Agency: Department of Defense
Status: Open

Comments: DOD concurred with the recommendation stating that the DTIC Administrator will assess whether the DOD IR&D database should require contractors to include additional information on IR&D projects, and make his recommendation to the Director of Defense Research and Engineering for Research and Technology for its decision.

Recommendation: We recommend that the Acting Secretary of Defense direct the Under Secretary for Acquisition and Sustainment to ensure it conducts a comprehensive assessment of the effect that its contract financing and profit policies have on the defense industry and update that assessment on a recurring basis. (Recommendation 1)

Agency: Department of Defense
Status: Open

Comments: DOD concurred with the recommendation. The Department stated that it would seek fiscal year 2020 funds to contract a study on DOD contract financing policies and their effect on the defense industry. In September 2020, DOD stated that this action would be completed by December 31, 2021. The first phase of the report is estimated to be completed September 30, 2021. The department secured funds to complete the study and a contract was awarded on April 23, 2020.

Recommendation: The Under Secretary of Defense for Acquisition, Technology and Logistics, in conjunction with the Defense Contract Management Agency (DCMA) and the military departments, should assess whether risk mitigation actions have been identified in the event of a loss of each task critical assets (TCA) facility in the defense industrial base and, based on this assessment, develop risk mitigation actions with associated implementation plans and time lines, and provide this information to congressional and DOD decision makers. (Recommendation 1)

Agency: Department of Defense: Office of the Secretary of Defense: Office of the Under Secretary of Defense for Acquisition, Technology, and Logistics
Status: Open

Comments: DOD concurred with this recommendation. In June 2019, DOD provided follow up information and identified key corrective actions for recommendations from this report. The key corrective actions identified for this recommendation include the issuance of the mission assurance instruction in August 2018 that guides the identification, prioritization, and assessment of defense critical infrastructure. Further, Executive Order 13806 required that DOD perform a whole-of-government assessment of the manufacturing and the defense industrial base, assess risk, identify impacts, and propose mitigation strategies. DOD issued the resulting report in October 2018, which includes a focus on numerous single source and sole supply risks. Lastly, DOD officials stated that DOD senior leadership and Congress were briefed in May 2019 on investments planned to reduce risks and updates will be included in an annual Industrial Capabilities Report to Congress. DOD placed considerable focus on defense industrial base issues in the past year, we will review the next annual report to ensure this focus is continued and that detailed information on DOD's industrial base risks and task critical assets is provided to DOD and Congressional decision makers.

Recommendation: The Under Secretary of Defense for Acquisition, Technology and Logistics, in conjunction with DCMA and the military departments, should provide congressional and DOD decision makers with information on potential effects on defense capabilities in the event of a loss of each TCA facility in the defense industrial base. (Recommendation 2)

Agency: Department of Defense: Office of the Secretary of Defense: Office of the Under Secretary of Defense for Acquisition, Technology, and Logistics
Status: Open

Comments: DOD concurred with this recommendation. In June 2019, DOD provided follow up information and identified key corrective actions for recommendations from this report. The key corrective actions identified for this recommendation include a description of the mission assurance process and the annual report on the industrial capabilities that were already in place at the time of issuance of this report, therefore do not represent a change or response to this recommendation. Another key corrective action identified is the issuance of the report in response to the Executive Order 13806 in October 2018, which provides a whole of government assessment of the defense industrial base risks and impacts and associated Hill briefing. DOD placed considerable focus on defense industrial base issues in the past year as a result of the Executive Order, we will review the next annual report to ensure this focus is continued and that detailed information on DOD's industrial base risks and task critical assets is provided to DOD and Congressional decision makers.

Recommendation: The Under Secretary of Defense for Acquisition, Technology and Logistics, in conjunction with DCMA and the military departments, should provide congressional and DOD decision makers with information on DOD organic facilities that have been identified as TCAs, similar to the information provided previously on commercial facilities. This information also should include (1) the potential effects on defense capabilities in the event of a loss of the facility and (2) risk mitigation actions and associated implementation plans with time lines. (Recommendation 3)

Agency: Department of Defense: Office of the Secretary of Defense: Office of the Under Secretary of Defense for Acquisition, Technology, and Logistics
Status: Open

Comments: DOD concurred with this recommendation. In June 2019, DOD provided follow up information and identified key corrective actions for recommendations from this report. The key corrective actions identified for this recommendation include the mission assurance process that was already in place at the time of the issuance of this report, which does not reflect a change in response to this recommendation. However, other key corrective actions identified include the identification of several DOD-owned assets in the report DOD issued in response to Executive Order 13806 in October 2018. Further, DOD states that it will provide yearly updates to Congress in its Industrial Capabilities report. Lastly, the corrective actions state that DOD will continue to execute risk mitigation identified in its October 2018 report. DOD placed considerable focus on defense industrial base issues in the past year as a result of the Executive Order, we will review the next annual report to ensure this focus is continued and that detailed information on DOD's industrial base risks and task critical assets is provided to DOD and Congressional decision makers.

Recommendation: The Under Secretary of Defense for Acquisition, Technology and Logistics, in conjunction with DCMA and the military departments, should take steps to share information on risks identified through the annual Critical Asset Identification Process with relevant program managers or other designated service or program officials. At a minimum, relevant officials should receive information on the most critical facilities (such as TCAs) that produce parts supporting their programs. This information-sharing could occur through service-specific channels of communication or another method of internal communication deemed appropriate by DOD. (Recommendation 4)

Agency: Department of Defense: Office of the Secretary of Defense: Office of the Under Secretary of Defense for Acquisition, Technology, and Logistics
Status: Open

Comments: DOD concurred with this recommendation. As of August 2018, DOD officials stated that they are in the process of developing proactive steps to share information on risks identified through the annual CAIP with relevant program managers, or other designated service or program officials as necessary. However, in June 2019, DOD shared the key corrective actions identified for this recommendation, which include a description of the mission assurance process that was already in place at the time of issuance of this report, therefore do not represent a change or response to this recommendation. It further states that the Critical Asset Identification Process is addressed in semi-annual Joint Industrial Base Working Group meetings, which are attended by all service and agency industrial base representatives. As of November 2019, DOD officials did not respond to a request for more detail, we will continue to assess DOD's actions.

Recommendation: The Under Secretary of Defense for Acquisition, Technology and Logistics, in conjunction with the military departments, should develop a mechanism to ensure that program offices obtain information from contractors on single source of supply risks. (Recommendation 5)

Agency: Department of Defense: Office of the Secretary of Defense: Office of the Under Secretary of Defense for Acquisition, Technology, and Logistics
Status: Open

Comments: DOD concurred with this recommendation. As of August 2018, DOD officials stated that assessing the health of the defense industrial base and associated supply chains was the focus of an Executive Order issued in July 2017 and that the resulting inter-agency report will be released within the next year. DOD officials stated that the issuance of this report will provide significant information towards addressing this recommendation. However, in June 2019, DOD provided key corrective actions for this recommendation, which stated that multiple services and agencies began in 2018 to incorporate contracting language to require prime contractors to track and provide sub-tier data and that this effort will expand to cover more programs. Further, it states that in the Industrial Base Integrated Data System, suppliers are indicated as either single or sole source suppliers and that the services and agencies have access to this list. As of November 2019, DOD officials did not respond to a request for more detail, we will continue to assess DOD's actions.

Recommendation: The Under Secretary of Defense for Acquisition, Technology and Logistics, in conjunction with the military departments, should issue department-wide DMSMS policy, such as an instruction, that clearly defines requirements of DMSMS management and details responsibilities and procedures to be followed by program offices to implement the policy. (Recommendation 6)

Agency: Department of Defense: Office of the Secretary of Defense: Office of the Under Secretary of Defense for Acquisition, Technology, and Logistics
Status: Open

Comments: DOD concurred with this recommendation. The DOD official that is the lead for the Diminishing Manufacturing Sources and Material Shortages (DMSMS) program stated that as of July 2019, the department has completed the draft DMSMS instruction and accompanying manual that details program requirements, responsibilities, and procedures to be followed. The draft instruction is undergoing legal review and the official expects the instruction and manual to be issued by December 2019. As of November 2019, this recommendation will remain open and we will review the instruction once issued.

Recommendation: To increase department-wide supply chain efficiencies and effectiveness in support of maintenance at the Army and Marine Corps depots and Navy shipyards, the Secretary of Defense should direct the Assistant Secretary of Defense for Logistics and Materiel Readiness, in conjunction with the Director, Defense Logistics Agency, and the Secretaries of the Army and Navy and the Commandant of the Marine Corps to assess through a comprehensive business case analysis-drawing on lessons learned from previous efforts-the costs and benefits of DLA managing the retail supply, storage, and distribution functions at the Army and Marine Corps depots and Navy shipyards.

Agency: Department of Defense
Status: Open

Comments: DOD concurred with our recommendation. As of August 2018, DOD had designated the transfer of these retail functions as an operating priority and identified it as a key reform effort within logistics in the department. The Marine Corps has conducted its analysis and decided to transition additional supply, storage, and distribution functions to the Defense Logistics Agency (DLA) over a 4-year period, with all implementation activities scheduled to be complete by 2022. The Army continues to analyze requirements for the full transition of supply, storage, and distribution functions to DLA with final decisions to be made in late 2018. Lastly, the Navy and DLA are working on a strategic memorandum of understanding to guide decision on the role of DLA at the Navy shipyards, according to a senior DOD official. Without the Army and Navy finalizing its business case analyses, decision makers will not be positioned to make cost-effective decisions regarding supply operations at military depots.

Recommendation: To increase department-wide supply chain efficiencies and effectiveness in support of maintenance at the Army and Marine Corps depots and Navy shipyards, the Secretary of Defense should direct the Assistant Secretary of Defense for Logistics and Materiel Readiness, in conjunction with the Director, Defense Logistics Agency, and the Secretaries of the Army and Navy and the Commandant of the Marine Corps to use the analysis to make a decision on the degree to which DLA should manage these functions at the Army and Marine Corps depots and Navy shipyards.

Agency: Department of Defense
Status: Open

Comments: DOD concurred with our recommendation. As of August 2018, DOD had designated the transfer of these retail functions as an operating priority and identified it as a key reform effort within logistics in the department. The Marine Corps has conducted its analysis and decided to transition additional supply, storage, and distribution functions to the Defense Logistics Agency (DLA) over a 4-year period, with all implementation activities scheduled to be completed by 2022. However, the Army and Navy have not made any decisions regarding the additional transfer of supply, storage and distribution functions to DLA. Without the Army and Navy making decisions based on business case analyses on the degree to which additional supply, storage, and distribution functions will transfer to DLA, DOD will not be ensured that it is operating its supply operations at military depots in a cost-effective manner.

Recommendation: To improve the efficiency and effectiveness of supply and maintenance operations, in accordance with DOD guidance, the Secretary of Defense should direct the Assistant Secretary of Defense for Logistics and Materiel Readiness, in conjunction with the Director, Defense Logistics Agency, and the Secretaries of the Army, Navy, and Air Force and the Commandant of the Marine Corps to develop and implement metrics that measure the accuracy of planning factors, such as the schedule, bill of materials, and replacement factors, used for depot maintenance.

Agency: Department of Defense
Status: Open

Comments: DOD concurred with our recommendation. As of August 2018, DOD has begun to identify metrics that measure the accuracy of planning factors used for depot maintenance. However, these metrics are not scheduled to be implemented fully implemented in December 2018.

Recommendation: To improve the efficiency and effectiveness of supply and maintenance operations, in accordance with DOD guidance, the Secretary of Defense should direct the Assistant Secretary of Defense for Logistics and Materiel Readiness, in conjunction with the Director, Defense Logistics Agency, and the Secretaries of the Army, Navy, and Air Force and the Commandant of the Marine Corps to take action, as appropriate and necessary, to resolve any issues identified through measuring the accuracy of planning inputs in an effort to improve supply and depot maintenance operations.

Agency: Department of Defense
Status: Open

Comments: DOD concurred with our recommendation. As of August 2018, DOD has begun to identify metrics that measure the accuracy of planning factors used for depot maintenance. However, these metrics are not scheduled to be implemented fully implemented in December 2018. Thus, no actions have been taken to resolve any identified issues based on the results of the metrics.

Recommendation: To be able to assess the cost-effectiveness of supply and depot maintenance operations, in accordance with DOD supply chain management guidance, the Secretary of Defense should direct the Assistant Secretary of Defense for Logistics and Materiel Readiness, in conjunction with the Director, Defense Logistics Agency, the Secretaries of the Army, Navy, and the Air Force, and the Commandant of the Marine Corps to take steps to develop and implement metrics, to the extent feasible, to measure and track disruption costs created by the lack of parts at depot maintenance industrial sites by, for example, establishing a team of supply and depot maintenance experts from DLA and the services to assess potential data sources, approaches, and methods.

Agency: Department of Defense
Status: Open

Comments: DOD concurred with our recommendation. As of August 2018, DOD has begun to develop metrics that measure and track disruption costs created by the lack of parts at depot maintenance industrial sites. However, these metrics are not scheduled to be implemented until October 2018.

Recommendation: To be able to assess the cost-effectiveness of supply and depot maintenance operations, in accordance with DOD supply chain management guidance, the Secretary of Defense should direct the Assistant Secretary of Defense for Logistics and Materiel Readiness, in conjunction with the Director, Defense Logistics Agency, the Secretaries of the Army, Navy, and the Air Force, and the Commandant of the Marine Corps to take action, as appropriate, to address any inefficiencies identified by the disruption cost metrics in supply and depot maintenance operations.

Agency: Department of Defense
Status: Open

Comments: DOD concurred with our recommendation. As of August 2018, DOD has begun to develop metrics that measure and track disruption costs created by the lack of parts at depot maintenance industrial sites. However, these metrics are not scheduled to be implemented until October 2018. Thus, no actions have been taken to resolve any identified issues based on the results of the metrics.

Recommendation: To provide greater compliance with the GIDEP reporting requirement among the DOD components and their defense supplier-base, the Undersecretary of Defense for Acquisition, Technology and Logistics should establish mechanisms for department-wide oversight of defense agencies' compliance with the GIDEP reporting requirement.

Agency: Department of Defense: Office of the Secretary of Defense: Office of the Under Secretary of Defense for Acquisition, Technology, and Logistics
Status: Open

Comments: In providing comments to this report DOD concurred with this recommendation but has not completed actions to implement it. DOD has drafted new combined DOD instruction and guidance that addresses the process of reporting suspected counterfeit parts to GIDEP. As of August 2020, the document is still in the process of being formally approved. DOD estimated that it could be approved in the first quarter of fiscal year 2021.

Recommendation: To provide greater compliance with the GIDEP reporting requirement among the DOD components and their defense supplier-base, the Undersecretary of Defense for Acquisition, Technology and Logistics should develop a standardized process for determining the level of evidence needed to report a part as suspect counterfeit in GIDEP, such as a tiered reporting structure in GIDEP that provides an indication of where the suspect part is in the process of being assessed.

Agency: Department of Defense: Office of the Secretary of Defense: Office of the Under Secretary of Defense for Acquisition, Technology, and Logistics
Status: Open

Comments: In providing comments to this report DOD concurred with this recommendation but has not completed actions to implement it. DOD has drafted new combined DOD instruction and guidance that addresses the process of reporting suspected counterfeit parts to GIDEP. As of August 2020, the document is still in the process of being formally approved. DOD estimated that it could be approved in the first quarter of fiscal year 2021.

Recommendation: To provide greater compliance with the GIDEP reporting requirement among the DOD components and their defense supplier-base, the Undersecretary of Defense for Acquisition, Technology and Logistics should develop guidance for when access to GIDEP reports should be limited to only government users or made available to industry.

Agency: Department of Defense: Office of the Secretary of Defense: Office of the Under Secretary of Defense for Acquisition, Technology, and Logistics
Status: Open

Comments: In providing comments to this report DOD concurred with this recommendation but has not completed actions to implement it. DOD has drafted new combined DOD instruction and guidance that addresses the process of reporting suspected counterfeit parts to GIDEP. As of August 2020, the document is still in the process of being formally approved. DOD estimated that it could be approved in the first quarter of fiscal year 2021.

Recommendation: To better monitor and provide a basis for improving the effectiveness of cybersecurity risk mitigation activities, informed by the sectors' updated plans and in collaboration with sector stakeholders, the Secretary of the Treasury should direct responsible officials to develop performance metrics to provide data and determine how to overcome challenges to monitoring the financial services sector's cybersecurity progress.

Agency: Department of the Treasury
Status: Open

Comments: The Department of the Treasury, as the sector-specific agency for the financial services sector, continues to develop initiatives intended to enhance the sector's cybersecurity. In 2016, Treasury developed and promulgated a set of seven fundamental elements or critical building blocks for sector stakeholders' cybersecurity, disseminated a template for financial sector cyber exercises, and promoted the NIST Cybersecurity Framework throughout the sector. However, they have not provided evidence of metrics implemented, and the 2015 sector-specific plan does not include specific metrics to track and report on their effectiveness. We will continue to monitor Treasury's efforts to create specific metrics and related reports on the sector's cybersecurity progress.

Recommendation: To better monitor and provide a basis for improving the effectiveness of cybersecurity risk mitigation activities, informed by the sectors' updated plans and in collaboration with sector stakeholders, the Secretaries of Agriculture and Health and Human Services (as co-SSAs) should direct responsible officials to develop performance metrics to provide data and determine how to overcome challenges to monitoring the food and agriculture sector's cybersecurity progress.

Agency: Department of Agriculture
Status: Open

Comments: The Department of Agriculture (USDA), as the co-sector specific agency for the food and agriculture sector, with the Department of Health and Human Services (HHS) continues to implement cybersecurity-related activities for the sector. In particular, USDA, through the sector coordination council, routinely shares best practices and informational bulletins from the Department of Homeland Security on cybersecurity with sector stakeholders via the Homeland Security Information Network. In addition, at semi-annual council meetings, USDA has hosted roundtable discussions of cybersecurity challenges and best practices. No evidence of performance metrics to track and report on the SSAs' activities or the sector's cybersecurity progress has been provided. As USDA and HHS continue to carry out their sector-specific agency role, we will continue to monitor their efforts and associated performance metrics to be developed to demonstrate the effectiveness of these activities

Recommendation: To better monitor and provide a basis for improving the effectiveness of cybersecurity risk mitigation activities, informed by the sectors' updated plans and in collaboration with sector stakeholders, the Secretaries of Agriculture and Health and Human Services (as co-SSAs) should direct responsible officials to develop performance metrics to provide data and determine how to overcome challenges to monitoring the food and agriculture sector's cybersecurity progress.

Agency: Department of Health and Human Services
Status: Open

Comments: The Department of Health and Human Services (HHS), as the co-sector specific agency for the food and agriculture sector, with the Department of Agriculture (USDA) continues to implement cybersecurity-related activities for the sector. In particular, through the sector coordination council, they routinely share best practices and informational bulletins from the Department of Homeland Security on cybersecurity with sector stakeholders via the Homeland Security Information Network. In addition, at semi-annual council meetings, they have hosted roundtable discussions of cybersecurity challenges and best practices. No evidence of performance metrics to track and report on the SSAs' activities or the sector's cybersecurity progress has been provided. As HHS and USDA continue to carry out their sector-specific agency role, we will continue to monitor their efforts and associated performance metrics to be developed to demonstrate the effectiveness of these activities

Recommendation: To better monitor and provide a basis for improving the effectiveness of cybersecurity risk mitigation activities, informed by the sectors' updated plans and in collaboration with sector stakeholders, the Administrator of the Environmental Protection Agency should direct responsible officials to develop performance metrics to provide data and determine how to overcome challenges to monitoring the water and wastewater systems sector's cybersecurity progress.

Agency: Environmental Protection Agency
Status: Open

Comments: The Environmental Protection Agency (EPA) continues to develop and implement activities in support of the water and wastewater sector's cybersecurity such as a cyber-attack risk assessment tool and cybersecurity training for sector partners. The 2015 water and wastewater sector-specific plan calls for assessing performance and reporting on sector cybersecurity progress; however, the plan does not state specific measures. In 2017, agency officials stated that the development of performance metrics in collaboration with sector partners was underway; however, EPA has not provided evidence of the metrics or any tracking effort. As EPA continues to carry out its sector-specific agency role, we will continue to monitor its efforts and associated performance metrics to be developed to demonstrate the effectiveness of these activities.