Recommendation: The Assistant to the President for National Security Affairs, in coordination with relevant stakeholders from NSC and NEC, should ensure that the plan to implement the 5G national strategy fully addresses all elements of our six desirable characteristics of a national strategy.

Agency: Executive Office of the President: Office of the Assistant to the President for National Security Affairs
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Chairman of the National Security Council, or his designee, should work with relevant federal entities to update strategy documents related to the nation's cybersecurity to better reflect desirable characteristics of a national strategy, to include:

• an assessment of cyber-related risk, based on an analysis of the threats to, and vulnerabilities of, critical assets and operations;

• measures of performance and formal mechanism to track progress of the execution of activities; and

• an analysis of the cost and resources needed to implement the National Cyber Strategy. (Recommendation 1)

Agency: Executive Office of the President: National Security Council
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: Congress should consider legislation to designate a leadership position in the White House with the commensurate authority—for example, over budgets and resources—to implement and encourage action in support of the nation's cyber critical infrastructure, including the implementation of the National Cyber Strategy. (Matter for Consideration 1)

Agency: Congress
Status: Open

Comments: When we determine what steps the Congress has taken, we will provide updated information.

Recommendation: The Secretary of Commerce should direct BIS to identify, analyze, and respond to factors in the process that may cause submission errors. (Recommendation 1)

Agency: Department of Commerce
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Commerce should direct BIS to identify, assess, and make program changes to address issues that have impeded timeliness and created the backlog of exclusion requests. (Recommendation 2)

Agency: Department of Commerce
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Commerce should assign responsibility for regularly reviewing the impact of the tariffs on steel and aluminum imports, including tariff exclusions, and document the results. (Recommendation 3)

Agency: Department of Commerce
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Defense should ensure that the Under Secretary of Defense for Acquisition and Sustainment implements DOD Directive 4715.21 on climate change adaptation and resilience by updating, as appropriate, relevant DOD guidance related to acquisition and supply processes to incorporate the directive's provisions pertaining to those processes. In doing so, the Under Secretary of Defense for Acquisition and Sustainment should consider providing guidance as to how departmental officials may leverage already existing information regarding private companies. (Recommendation 1)

Agency: Department of Defense
Status: Open

Comments: DOD partially concurred with this recommendation. In its response, the department noted that the Under Secretary of Defense for Acquisition and Sustainment will oversee updates to relevant guidance related to supply processes and that they anticipate the updates to be complete by May 31, 2021. The department further noted that the Under Secretary of Defense for Acquisition and Sustainment will ensure updates are made to the acquisition policies, when and if appropriate. However, the department stated that its Adaptive Acquisition Framework currently provides all of the necessary flexibility required. We will continue to monitor the status of this recommendation.

Recommendation: The Secretary of the Army should implement DOD Directive 4715.21 on climate change adaptation and resilience by updating, as appropriate, relevant Department of the Army guidance related to acquisition and supply processes to incorporate the directive's provisions pertaining to those processes. In doing so, the Secretary of the Army should consider providing guidance as to how departmental officials may leverage already existing information regarding private companies. (Recommendation 2)

Agency: Department of Defense: Department of the Army
Status: Open

Comments: DOD concurred with this recommendation. In its response, the department noted that the Army would update, as appropriate, Army guidance related to acquisition and supply upon updates to DOD's climate adaptation directive and other applicable DOD or federal regulations. However, DOD noted that it does not plan to update its acquisition guidance in response to our recommendation that DOD do so. We will continue to monitor the status of this recommendation.

Recommendation: The Secretary of the Navy should implement DOD Directive 4715.21 on climate change adaptation and resilience by updating, as appropriate, relevant Department of the Navy guidance related to acquisition and supply processes to incorporate the directive's provisions pertaining to those processes. In doing so, the Secretary of the Navy should consider providing guidance as to how departmental officials may leverage already existing information regarding private companies. (Recommendation 3)

Agency: Department of Defense: Department of the Navy
Status: Open

Comments: DOD partially concurred with this recommendation. In its response, the department noted that the Department of the Navy had suggested that the recommendation be restated to recommend that the Department of the Navy ensure that its guidance and procedures are updated to align with DOD's directive on climate adaptation upon issuance of an updated directive. However, DOD has not identified any plans to update its directive on climate change adaptation. Thus, we continue to believe that the Department of the Navy should update its guidance related to acquisition and supply to incorporate the current guidance in DOD's climate adaptation directive, which it has not yet done. We will continue to monitor the status of this recommendation.

Recommendation: The Secretary of the Air Force should implement DOD Directive 4715.21 on climate change adaptation and resilience by updating, as appropriate, relevant Department of the Air Force guidance related to acquisition and supply processes to incorporate the directive's provisions pertaining to those processes. In doing so, the Secretary of the Air Force should consider providing guidance as to how departmental officials may leverage already existing information regarding private companies. (Recommendation 4)

Agency: Department of Defense: Department of the Air Force
Status: Open

Comments: DOD concurred with this recommendation. In its response, the department noted that the Air Force will work with the Office of the Under Secretary of Defense for Acquisition and Sustainment and the other military services to develop specific policies that address climate-related risks to DOD contractors. We will continue to monitor the status of this recommendation.

Recommendation: The Secretary of Defense should ensure that the Under Secretary of Defense for Policy, in coordination with the Under Secretary of Defense for Acquisition and Sustainment, the Secretaries of the military departments, and any other governmental and private-sector partners, as appropriate, determine what approaches may be feasible in conducting mission assurance related assessments of commercially owned facilities. (Recommendation 5)

Agency: Department of Defense
Status: Open

Comments: DOD concurred with this recommendation. In its response, the department noted that formal mission assurance assessments are limited in scope in order to provide additional rigor to protect DOD's most critical capabilities. However, the department stated that the Office of the Under Secretary of Defense for Policy would work with the Office of the Under Secretary of Defense for Acquisition and Sustainment's Defense Contract Management Agency to better understand DOD's commercial dependencies. We will continue to monitor the status of this recommendation.

Recommendation: The Secretary of Defense should ensure that the Under Secretary of Defense for Policy, in coordination with the Under Secretary of Defense for Acquisition and Sustainment, the Secretaries of the military departments, and any other governmental and private-sector partners, as appropriate, issue new or update existing guidance, based upon the determination of what approaches may be feasible, to clarify the steps that DOD officials involved in the mission assurance process may take to apply the mission assurance framework to commercially owned facilities, as appropriate, to include consideration of risks related to climate change and extreme weather. (Recommendation 6)

Agency: Department of Defense
Status: Open

Comments: DOD partially concurred with this recommendation. In its response, the department noted that it concurs with the need to clarify steps that officials may take to apply the mission assurance framework to defense critical infrastructure and critical defense industrial base commercially owned facilities, to include consideration of risks related to climate change and extreme weather. However, the department further noted that it does not concur with doing this for all commercial facilities because conducting such assessments for all commercially owned facilities falls outside the capacity and authority of DOD to conduct mission assurance assessments. However, we had not recommended they conduct such assessments for all commercial facilities. We will continue to monitor the status of this recommendation.

Recommendation: The NPO Cost Savings Program Manager should work with CNS to evaluate the remaining site reinvestment funds and develop and implement a plan for how best to aggregate and use them. (Recommendation 1)

Agency: Department of Energy: National Nuclear Security Administration
Status: Open

Comments: NNSA concurred with the recommendation. In comments on a draft of the report, DOE stated that NPO plans to work with CNS on a plan for the remaining reinvestment funds, with an estimated completion date of December 31, 2020.

Recommendation: The Associate Administrator for Acquisition and Project Management should gather data on and document an analysis of the Cost Savings Program, including its cost effectiveness, to determine whether it is exportable to existing or future contracts. (Recommendation 2)

Agency: Department of Energy: National Nuclear Security Administration
Status: Open

Comments: NNSA concurred, in principle, with the recommendation. In its comments on a draft of the report, NNSA stated that potential benefits of the cost savings program should be considered for future contracts, as applicable. NNSA stated that it believes this recommendation is closed with actions to address other recommendations. We disagree and continue to believe that NNSA should document an analysis of the cost savings program, including its cost effectiveness, to determine the exportability of the program to other contracts.

Recommendation: The NPO Cost Savings Program Manager should share relevant lessons learned with other NNSA sites so that those sites can determine if efficiencies CNS has achieved can be implemented at other sites. (Recommendation 3)

Agency: Department of Energy: National Nuclear Security Administration
Status: Open

Comments: NNSA concurred with the recommendation. In its comments on a draft of the report, NNSA stated that it plans to upload lessons learned into DOE's Corporate Lessons Learned Database so they can be considered by other sites by December 31, 2020.

Recommendation: The Associate Administrator for Acquisition and Project Management should evaluate whether to require all other sites to institute an Annual Controlled Baseline. (Recommendation 4)

Agency: Department of Energy: National Nuclear Security Administration
Status: Open

Comments: NNSA concurred with the recommendation. In its comments on a draft of the report, NNSA stated that it plans to evaluate whether to expand use of Annual Controlled Baselines to other sites by December 31, 2020.

Recommendation: The Secretary of Defense should ensure that the DOD CIO takes appropriate steps to ensure implementation of the DC3I tasks. (Recommendation 1)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open
Priority recommendation

Comments: The Department of Defense partially concurred with this recommendation. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Defense should ensure that DOD components develop plans with scheduled completion dates to implement the four remaining CDIP tasks overseen by DOD CIO. (Recommendation 2)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open
Priority recommendation

Comments: The Department of Defense partially concurred with this recommendation. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Defense should ensure that the Deputy Secretary of Defense identifies a DOD component to oversee the implementation of the seven CDIP tasks not overseen by DOD CIO and report on progress implementing them. (Recommendation 3)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open
Priority recommendation

Comments: The Department of Defense did not concur with this recommendation. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Defense should ensure that DOD components accurately monitor and report information on the extent that users have completed the Cyber Awareness Challenge training as well as the number of users whose access to the network was revoked because they have not completed the training. (Recommendation 4)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open

Comments: The Department of Defense partially concurred with this recommendation. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Defense should ensure that the DOD CIO ensures all DOD components, including DARPA, require their users to take the Cyber Awareness Challenge training developed by DISA. (Recommendation 5)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open

Comments: The Department of Defense concurred with this recommendation. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Defense should direct a component to monitor the extent to which practices are implemented to protect the department's network from key cyberattack techniques. (Recommendation 6)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open
Priority recommendation

Comments: The Department of Defense did not concur with this recommendation. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Defense should ensure that the DOD CIO assesses the extent to which senior leaders' have more complete information to make risk-based decisions—and revise the recurring reports (or develop a new report) accordingly. Such information could include DOD's progress on implementing (a) cybersecurity practices identified in cyber hygiene initiatives and (b) cyber hygiene practices to protect DOD networks from key cyberattack techniques. (Recommendation 7)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open
Priority recommendation

Comments: The Department of Defense partially concurred with this recommendation. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of State, in coordination with the Secretary of Energy, should commit to regularly scheduled, substantive briefings for the House Committee on Foreign Affairs and the Senate Committee on Foreign Relations on all initiatives and negotiations related to nuclear cooperation in order to enhance transparency and establish greater confidence with Congress on nuclear cooperation matters. (Recommendation 1)

Agency: Department of State
Status: Open

Comments: We will update this recommendation after receiving information from State regarding its plans to address it.

Recommendation: The Administrator of FAA should conduct and document a risk assessment that considers inherent and residual fraud and abuse risks that may enable criminal, national security, or safety risks. (Recommendation 1)

Agency: Department of Transportation: Federal Aviation Administration: Office of the Administrator
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of FAA should determine impact, likelihood, and risk tolerance as part of a risk assessment. (Recommendation 2)

Agency: Department of Transportation: Federal Aviation Administration: Office of the Administrator
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of FAA should develop a strategy that outlines specific actions to address analyzed risks, including periodic assessments to evaluate continuing effectiveness of the risk response. (Recommendation 3)

Agency: Department of Transportation: Federal Aviation Administration: Office of the Administrator
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of FAA should collect and record information on individual registrants, initially including name, address, date of birth, and driver's license or pilot's license, or both, with subsequent PII elements informed by the risk assessment, once completed. (Recommendation 4)

Agency: Department of Transportation: Federal Aviation Administration: Office of the Administrator
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of FAA should collect and record information on legal entities not traded publicly—on each individual and entity that owns more than 25 percent of the aircraft; for individuals: name, date of birth, physical address, and driver's license or pilot's license, or both; and for entities: name, physical address, state of residence, and taxpayer identification number. (Recommendation 5)

Agency: Department of Transportation: Federal Aviation Administration: Office of the Administrator
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of FAA should verify aircraft registration applicants' and dealers' eligibility and information. (Recommendation 6)

Agency: Department of Transportation: Federal Aviation Administration: Office of the Administrator
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of FAA should increase aircraft registration and dealer fees to ensure the fees are sufficient to cover the costs of FAA efforts to collect and verify applicant information while keeping pace with inflation. (Recommendation 7)

Agency: Department of Transportation: Federal Aviation Administration: Office of the Administrator
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of FAA should ensure, as part of aircraft registry IT modernization, that information currently collected in ancillary files or in PDF format on (1) owners and related individuals and entities with potentially significant responsibilities for aircraft ownership (e.g., beneficial owners, trustors, trustees, beneficiaries, stockholders, directors, and managers) and (2) declarations of international operations is recorded in an electronic format that facilitates data analytics by FAA and its stakeholders. (Recommendation 8)

Agency: Department of Transportation: Federal Aviation Administration: Office of the Administrator
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of FAA should link information on owners and related individuals and entities with significant responsibilities for aircraft ownership through a common identifier. (Recommendation 9)

Agency: Department of Transportation: Federal Aviation Administration: Office of the Administrator
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of FAA should, as part of IT modernization, develop an approach to check OFAC sanctions data on owners and related individuals and entities with potentially significant responsibilities for aircraft ownership for coordination with OFAC and to flag sanctioned individuals and entities across aircraft registration and dealer systems. (Recommendation 10)

Agency: Department of Transportation: Federal Aviation Administration: Office of the Administrator
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of FAA should use data collected as part of IT modernization as well as current data sources to identify and analyze patterns of activity indicative of fraud or abuse, based on information from declarations of international operations, postal addresses, sanctions listings, and other sources, and information on dealers, noncitizen corporations, and individuals and entities with significant responsibilities for aircraft ownership. (Recommendation 11)

Agency: Department of Transportation: Federal Aviation Administration: Office of the Administrator
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of FAA should develop and implement risk-based mitigation actions to address potential fraud and abuse identified through data analyses. (Recommendation 12)

Agency: Department of Transportation: Federal Aviation Administration: Office of the Administrator
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of FAA should develop mechanisms, including regulations if necessary, for dealer suspension and revocation. (Recommendation 13)

Agency: Department of Transportation: Federal Aviation Administration: Office of the Administrator
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of FAA, in coordination with relevant law-enforcement agencies, should enhance coordination within the Aircraft Registry Task Force through collaborative mechanisms such as written agreements and use of liaison positions. (Recommendation 14)

Agency: Department of Transportation: Federal Aviation Administration: Office of the Administrator
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of FAA, in coordination with relevant law-enforcement agencies, should develop a mechanism to provide declarations of international operations for law-enforcement purposes. (Recommendation 15)

Agency: Department of Transportation: Federal Aviation Administration: Office of the Administrator
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of NIST should establish time frames for completing NIST's initiatives, to include the information security measurement program and the cybersecurity framework starter profile, to enable the identification of sector-wide improvements from using the framework in the protection of critical infrastructure from cyber threats. (Recommendation 1)

Agency: Department of Commerce: National Institute of Standards and Technology: Office of the Director
Status: Open

Comments: In written comments provided in July 2020, the Department of Commerce (Commerce) stated that it agreed with our recommendation. It noted that to further establish its Cybersecurity Measurement program, the National Institute of Standards and Technology (NIST) will document its Cybersecurity Measurement program's scope, objectives, and approach, including an inventory of existing measurement resources. Additionally, to further amplify small business awareness of cybersecurity, and of the Cybersecurity Framework, it noted that NIST will develop and publish two Cybersecurity Framework starter profiles tailored toward risk management of business processes important to small business owners. The expected completion date is September 2020.

Recommendation: The Secretary of Agriculture, in coordination with the Secretary of Health and Human Services, should take steps to consult with respective sector partner(s), such as the SCC, DHS, and NIST, as appropriate, to collect and report sector-wide improvements from use of the framework across its critical infrastructure sector using existing initiatives. (Recommendation 2)

Agency: Department of Agriculture
Status: Open

Comments: In written comments provided in April 2020, the United States Department of Agriculture (USDA) stated that it concurred with our recommendation. The department stated that it routinely shared framework guidance provided by the Department of Homeland Security and discussed the framework as part of its monthly Sector conference calls and biannual Sector Meetings. It also added that the department will continue to strengthen its coordination efforts.

Recommendation: The Secretary of Defense should take steps to consult with respective sector partner(s), such as the SCC, DHS, and NIST, as appropriate, to collect and report sector-wide improvements from use of the framework across its critical infrastructure sector using existing initiatives. (Recommendation 3)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open

Comments: In written comments provided in July 2020, the Department of Defense concurred with our recommendation. The department noted that it had developed processes and resources to help determine the type of framework adoption across the Defense Industrial Base. These include conducting assessments on the implementation of NIST Special Publication (SP) 800-171 , "Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations;" and releasing the Defense Industrial Base Implementation Guide for the NIST Cybersecurity Framework. However, the department has yet to report on sector-wide improvements using these processes and resources. Until it does so, its critical infrastructure sector may not fully understand the value of the framework to better protect its critical infrastructure from cyber threats. The expected completion dates are in September and November 2020.

Recommendation: The Secretary of Energy should take steps to consult with respective sector partner(s), such as the SCC, DHS, and NIST, as appropriate, to collect and report sector-wide improvements from use of the framework across its critical infrastructure sector using existing initiatives. (Recommendation 4)

Agency: Department of Energy: Office of the Secretary
Status: Open

Comments: In written comments provided in February 2020, the Department of Energy (DOE) stated that it partially agreed with our recommendation. It noted that DOE will coordinate with the Energy Sector to develop an understanding of sector-wide improvements from use of the framework. The expected completion date is December 2021.

Recommendation: The Administrator of the Environmental Protection Agency should take steps to consult with respective sector partner(s), such as the SCC, DHS, and NIST, as appropriate, to collect and report sector-wide improvements from use of the framework across its critical infrastructure sector using existing initiatives. (Recommendation 5)

Agency: Environmental Protection Agency
Status: Open

Comments: In written comments provided in July 2020, the Environmental Protection Agency (EPA) stated that it agreed with our recommendation. It noted that it will consult with the Water Sector Coordinating Council, the Department of Homeland Security, and the National Institute of Standards and Technology, as appropriate, to investigate options to collect and report sector-wide improvements, consistent with statutory requirements and the Sector's willingness to participate. However, the department did not provide a timeframe for completing these actions.

Recommendation: The Administrator of the General Services Administration, in coordination with the Secretary of Homeland Security, should take steps to consult with respective sector partner(s), such as the Coordinating Council and NIST, as appropriate, to collect and report sector-wide improvements from use of the framework across its critical infrastructure sector using existing initiatives. (Recommendation 6)

Agency: General Services Administration: Office of the Administrator
Status: Open

Comments: In April 2020, the General Services Administration (GSA), in coordination with its co-SSA, the Department of Homeland Security (DHS), provided documentation demonstrating that it had initiated steps to collect and report on sector-wide improvements from use of the NIST Cybersecurity Framework across its critical infrastructure sector. Specifically, the agencies from the government sector had submitted their risk management reports to DHS and OMB that described agencies' action plans to implement the framework, as required under Executive Order 13800 and evaluated the agencies against the five functions of the NIST Cybersecurity Framework: Identify, Detect, Protect, Respond, and Recover. The risk management reports are included as part of OMB's FISMA Annual Report to Congress. According to OMB's FISMA Annual Report to Congress, OMB and DHS determined that 71 of 96 agencies (74 percent) have cybersecurity programs that are either at risk or high risk. As a result, improvements were identified in the form of four core actions in the Federal Cybersecurity Risk Determination Report and Action Plan, which include: (1) Implementing the Cyber Threat Framework to increase cybersecurity threat awareness among Federal agencies, (2) Standardize IT and cybersecurity capabilities, (3) Consolidate agency SOCs to improve incident detection and response capabilities, and (4) Drive accountability across agencies through improved governance processes, recurring risk assessments, and OMB's engagements with agency leadership. We are waiting for additional information from GSA and DHS on the status of the four core actions.

Recommendation: The Secretary of Health and Human Services, in coordination with the Secretary of Agriculture, should take steps to consult with respective sector partner(s), such as the SCC, DHS, and NIST, as appropriate, to collect and report sector-wide improvements from use of the framework across its critical infrastructure sector using existing initiatives. (Recommendation 7)

Agency: Department of Health and Human Services: Office of the Secretary
Status: Open

Comments: In written comments provided in January 2020, the Department of Health and Human Services (HHS) stated that it concurred with our recommendation. The department noted that it would work with the appropriate entities to refine and communicate best practices to the sector.

Recommendation: The Secretary of Homeland Security should take steps to consult with respective sector partner(s), such as the SCC and NIST, as appropriate, to collect and report sector-wide improvements from use of the framework across its critical infrastructure sectors using existing initiatives. (Recommendation 8)

Agency: Department of Homeland Security: Office of the Secretary
Status: Open

Comments: In written comments provided in February 2020, the Department of Homeland Security (DHS) stated that it agreed with our recommendation. It noted that in coordination with the IT Sector Coordinating Council, the department recently issued a survey to small and mid-sized IT sector partners to better understand framework adoption and use within the IT sector. Once the results of the survey are received, DHS's Cybersecurity and Infrastructure Security Agency will determine the feasibility of issuing similar surveys to other sectors, and the potential timelines for completing sector-specific survey modifications, issuing surveys, compiling responses, and developing white papers on the status of framework adoption for each sector. The department expects completion of this work by December 31, 2021.

Recommendation: The Secretary of Transportation, in coordination with the Secretary of Homeland Security, should take steps to consult with respective sector partner(s) such as the SCC and NIST, as appropriate, to collect and report sector-wide improvements from use of the framework across its critical infrastructure sector using existing initiatives. (Recommendation 9)

Agency: Department of Transportation: Office of the Secretary
Status: Open

Comments: In written comments provided in April 2020, the Department of Transportation (DOT) stated that it concurred with our recommendation. It noted that the department (through the Office of the Secretary, Office of Intelligence, Security, and Emergency Response) and the Department of Homeland Security (through the Transportation Security Administration and United States Coast Guard) will coordinate as Co-Sector-Specific Agencies for the Transportation Systems Sector to finalize the development and distribution of a survey instrument to determine the level and type of framework adoption in the Sector. The department expects completion of this work by December 31, 2021.

Recommendation: The Secretary of the Treasury should take steps to consult with respective sector partner(s), such as the SCC, DHS, and NIST, as appropriate, to collect and report sector-wide improvements from use of the framework across its critical infrastructure sector using existing initiatives. (Recommendation 10)

Agency: Department of the Treasury: Office of the Secretary
Status: Open

Comments: In written comments provided in January 2020, the Department of the Treasury (Treasury) stated that it agreed with our recommendation. The department noted that it will assess using the identified initiatives and their viability for collecting and reporting sector-wide improvements from the use of the NIST Framework. The department did not provide a timeframe for completing these actions.

Recommendation: The Secretary of Defense should ensure that the Under Secretary of Defense for Personnel and Readiness, in coordination with the Chairman of the Joint Chiefs of Staff and the Secretary of the Navy, determine whether it can assign the required number of Navy officers to the other military departments' JPME programs, consistent with Chairman of the Joint Chiefs of Staff guidance. (Recommendation 1)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Defense should ensure that the Chairman of the Joint Chiefs of Staff, in coordination with the Under Secretary of Defense for Personnel and Readiness and the military services, develop policy concerning actions, if any, the military services can take to mitigate JPME seminar student mix shortfalls and still meet the intent of the OPMEP's joint acculturation requirement. (Recommendation 2)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Defense should ensure that the Under Secretary of Defense for Personnel and Readiness, in coordination with the Chairman of the Chiefs of Staff, develop and issue a department-wide mission statement for PME that will explain the program's purpose and goals, and serve as a basis for performance measures. (Recommendation 3)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Defense should ensure that the Under Secretary of Defense for Personnel and Readiness, in coordination with the Chairman of the Joint Chiefs of Staff, issue and implement performance measures—to include the tracking of costs—that align with the department-wide mission statement for PME. (Recommendation 4)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Defense should ensure that the Under Secretary of Defense for Personnel and Readiness, in coordination with the Chairman of the Joint Chiefs of Staff, require the military services to periodically report information to its office about the military services' PME and JPME programs—such as results of program reviews. (Recommendation 5)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Defense should ensure that the Under Secretary of Defense(Comptroller) updates the DOD Financial Management Regulation to require the Marine Corps to include a budget request data exhibit for the Marine Corps War College in support of DOD's annual budget request. (Recommendation 6)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Defense should ensure that the Under Secretary of Defense (Comptroller), in coordination with the military services and the Chairman of the Joint Chiefs of Staff, issue guidance to standardize the cost data that the military services should include in their annual PME budget request data submissions. (Recommendation 7)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of HHS should direct the Biodefense Coordination Team to establish a plan that includes change management practices—such as strategies for feedback, communication, and education—to reinforce collaborative behaviors and enterprise-wide approaches and to help prevent early implementation challenges from becoming institutionalized. (Recommendation 1)

Agency: Department of Health and Human Services: Office of the Secretary
Status: Open
Priority recommendation

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of HHS should direct the Biodefense Coordination Team to clearly document guidance and methods for analyzing the data collected from the agencies, including ensuring that nonfederal resources and capabilities are accounted for in the analysis. (Recommendation 2)

Agency: Department of Health and Human Services: Office of the Secretary
Status: Open
Priority recommendation

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of HHS should direct the Biodefense Coordination Team to establish a resource plan to staff, support, and sustain its ongoing efforts. (Recommendation 3)

Agency: Department of Health and Human Services: Office of the Secretary
Status: Open
Priority recommendation

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of HHS should direct the Biodefense Coordination Team to clearly document agreed upon processes, roles, and responsibilities for making and enforcing enterprise-wide decisions. (Recommendation 4)

Agency: Department of Health and Human Services: Office of the Secretary
Status: Open
Priority recommendation

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of USCIS should ensure that, in addition to USCIS's basic asylum officer training, all asylum offices provide pre-departure training on the credible and reasonable fear processes before their officers begin screening cases at the family residential centers. (Recommendation 1)

Agency: Department of Homeland Security: United States Citizenship and Immigration Services
Status: Open

Comments: In commenting on a draft of our report, DHS reported that USCIS plans to develop a standardized pre-departure training and provide this training to all detailees prior to deployment to the family residential centers. DHS estimated that these actions would be completed by September 2020. As of August 2020, USCIS told GAO that the number of noncitizens processed under expedited removal has decreased dramatically as a result of Coronavirus Disease 2019. Therefore, details to the Family Residential Centers have largely been paused. USCIS noted that the Asylum Division is reviewing the credible fear and reasonable fear training requirements; working on an enhanced training module; and, developing a standardized pre-departure training by December 31, 2020. USCIS plans to provide the training to all detailees prior to deployment to the Family Residential Centers during calendar year 2021, should the details resume. Providing pre-departure training, in addition to USCIS's basic training for new asylum officers, would help USCIS ensure that officers from all asylum offices are conducting efficient and effective fear screenings of families.

Recommendation: The Director of USCIS should ensure asylum officers systematically record in USCIS's automated case management system if individuals receive credible fear determinations as principal applicants, dependents, or in the interest of family unity, pursuant to regulation or USCIS policy. (Recommendation 3)

Agency: Department of Homeland Security: United States Citizenship and Immigration Services
Status: Open

Comments: In commenting on a draft of our report, DHS reported that USCIS planned to explore ways to modify its case management system so that asylum officers can record whether an individual received a positive credible fear determination as a principal applicant, dependent, or in the interest of family unity. USCIS plans to make any appropriate changes to its case management system and train asylum officers on these changes by December 2020. As of August 2020, USCIS reported that the agency remains on track to complete this work as planned, provided staffing is not affected by USCIS budget issues. Having complete data in its case management system on all outcomes of credible fear screenings at family residential centers would better position USCIS to report on the scope of either the agency's policy for family members who are treated as dependents, pursuant to regulation, or USCIS's use of discretion in the interest of family unity.

Recommendation: The Director of USCIS should collect and analyze additional information on case delays, including specific reasons for delays and how long they last, that asylum officers may face when screening credible and reasonable fear cases. (Recommendation 4)

Agency: Department of Homeland Security: United States Citizenship and Immigration Services
Status: Open

Comments: In commenting on a draft of our report, DHS reported that USCIS will explore ways to collect additional information on credible and reasonable fear case delays in its case management system. USCIS plans to modify the system, as appropriate, to instruct users on the changes, and begin collecting and analyzing the information by December 31, 2020. As of August 2020, USCIS reported that the agency remains on track to accomplish this work by the end of calendar year 2020, provided staffing is not adversely affected by the on-going COVID-19 pandemic and USCIS budget issues. Collecting additional information in its automated case management system on case delays would provide USCIS with more readily available information and analyzing such data could help USCIS identify case delay reasons relevant in the current environment for officers conducting fear screenings and better position USCIS to mitigate the reasons for the delays and improve efficiency in case processing.

Recommendation: The Director of DHA should develop and implement plans with timeframes and specific actions needed for all 13 required elements to be reflected in the TRICARE contracts. (Recommendation 1)

Agency: Department of Defense: Office of the Under Secretary for Personnel and Readiness: Defense Health Agency
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of GSA should coordinate with agencies to ensure that street address information in the public database is complete and correctly formatted. (Recommendation 1)

Agency: General Services Administration
Status: Open
Priority recommendation

Comments: GSA has taken steps to address this recommendation. GSA revised certain data elements' definitions in 2020 and incorporated them into the 2020 FRPP data dictionary to enhance the accuracy and completeness of the data reported to FRPP. In addition, the Federal Real Property Council established a data governance working group that meets regularly to address challenges to reliable and complete data in the FRPP. In September 2020, that group committed to developing an action plan to outline the steps to improve the location information in FRPP that we identified in February 2020. If these efforts succeed, GAO will close this recommendation as implemented.

Recommendation: The Administrator of GSA should coordinate with agencies to review V&V anomaly categories to better target incorrect data. (Recommendation 2)

Agency: General Services Administration
Status: Open

Comments: GSA has taken steps to address this recommendation. The Federal Real Property Council established a data governance working group that meets regularly to address challenges to reliable and complete data in the FRPP. In September 2020, GSA described step that the working group has taken to make V&V anomaly categories better target incorrect data. GSA is currently assessing these actions.

Recommendation: The Administrator of GSA should work in consultation with agencies to determine which, if any, data should be withheld from public release. (Recommendation 3)

Agency: General Services Administration
Status: Open

Comments: GSA staff said that the agency now agrees with this recommendation and in an September 2020 meeting said that GSA staff were working with relevant agencies to address it. GAO will continue to monitor their progress.

Recommendation: The Administrator of GSA should instruct each agency to apply a consistent, risk-based approach in determining which, if any, assets or asset-specific information should be withheld from public release. (Recommendation 4)

Agency: General Services Administration
Status: Open

Comments: GSA agreed with this recommendation and in an September 2020 meeting said that GSA staff were working with relevant agencies to address it. GAO will continue to monitor their progress.

Recommendation: The Administrator of GSA should allow agencies to provide summary data for secure installations. (Recommendation 5)

Agency: General Services Administration
Status: Open

Comments: In April 2020, GAO staff met with GSA and Interagency Security Committee officials. The officials explained that they had had discussions to determine what installations would be considered secure installations and were considering what changes to make to the data. GAO will continue to monitor their actions. In September 2020, GSA confirmed that the Federal Real Property Council was working on the issue.

Recommendation: The Administrator of GSA should link all of GSA's publicly available realproperty data sources. (Recommendation 6)

Agency: General Services Administration
Status: Open

Comments: GSA agreed with this recommendation and in an September 2020 meeting said that GSA staff summarized the actions the agency has taken to link all of the real property data sources. GAO is currently assessing the actions.

Recommendation: The Program Director for Financial Integration, with input from NNSA's Office of Management and Budget and respective program offices, should establish and implement a work breakdown structure change control process for common financial reporting that ensures changes are approved by program office management, at a minimum; documented; and communicated to M&O contractors on a timely basis. (Recommendation 1)

Agency: Department of Energy: National Nuclear Security Administration
Status: Open

Comments: NNSA agreed with the recommendation and officials said they are working to establish a work breakdown structure change control process by June 30, 2020.

Recommendation: The Program Director for Financial Integration should assess the extent to which M&O contractors make manual changes to their financial data to reconcile with STARS and determine whether it has an effect on the accuracy of the data collected for common financial reporting. (Recommendation 2)

Agency: Department of Energy: National Nuclear Security Administration
Status: Open

Comments: NNSA agreed with the recommendation and plans to review how management and operating (M&O) contractors make manual changes to their financial data as part of an ongoing review of M&O contractors indirect cost data. The review is expected to be completed by September 30, 2020.

Recommendation: The Program Director for Financial Integration should develop and implement an internal process for NNSA to verify how the M&O contractors crosswalk financial data from their systems to the appropriate NNSA work breakdown structure to ensure the reported data are accurate and consistent. (Recommendation 3)

Agency: Department of Energy: National Nuclear Security Administration
Status: Open

Comments: NNSA agreed with the recommendation and plans to establish a process to verify that the management and operating (M&O) contractors are crosswalking their financial data to the appropriate NNSA work breakdown structure by September 30, 2020. As of April 2020, NNSA has hired two federal employees who will be conducting site visits to work with M&O contractors on verifying their crosswalks.

Recommendation: The Program Director for Financial Integration should develop and implement an internal process for NNSA to verify that the M&O contractors are consistently applying common cost element definitions at their sites and across the nuclear security enterprise. (Recommendation 4)

Agency: Department of Energy: National Nuclear Security Administration
Status: Open

Comments: NNSA agreed with the recommendation and plans to establish a process to verify that the management and operating (M&O) contractors are consistently applying common cost element definitions at their sites and across the nuclear security enterprise by September 30, 2020. As of April 2020, NNSA has hired two federal employees who will be conducting site visits to work with M&O contractors on verifying their crosswalks.

Recommendation: We recommend the Secretary of the Air Force issue policy emphasizing the following three key reliability practices when planning and executing acquisition programs: (1) leveraging reliability engineers early and often, (2) establishing realistic reliability requirements, and (3) employing reliability engineering activities to improve a system's design throughout development. (Recommendation 1)

Agency: Department of Defense: Department of the Air Force: Office of the Secretary of the Air Force
Status: Open

Comments: The Air Force agreed with this recommendation and told us they will be updating Air Force Instruction AFI63-101/20-101 to ensure the inclusion of key practices to improve weapon system reliability, including leveraging reliability engineers early and often, establishing realistic reliability requirements, and employing reliability engineering activities to improve a system's design throughout development. The Air Force said it plans to complete this effort by December 31, 2020.

Recommendation: We recommend the Secretary of the Navy issue policy emphasizing the following three key reliability practices when planning and executing acquisition programs: (1) leveraging reliability engineers early and often, (2) establishing realistic reliability requirements, and (3) employing reliability engineering activities to improve a system's design throughout development. (Recommendation 3)

Agency: Department of Defense: Department of the Navy: Office of the Secretary
Status: Open

Comments: The Navy agreed with this recommendation and told us they plan to address GAO's recommendation in two ways. First, they are developing a guidebook for program managers and leadership to emphasize the importance of leveraging reliability engineers early and often, establishing realistic reliability requirements, and employing reliability engineering activities to improve a system's design throughout development. The Navy anticipates the guidebook will be completed by the end of fiscal year 2021. Second, the Navy plans to update the SECNAV 5000.2 when it is open for changes. They noted, this is dependent on the Office of the Secretary of Defense (OSD) completing its ongoing update to DOD-wide acquisition guidance. The Navy anticipates OSD's efforts will be completed by end of calendar year 2020.

Recommendation: The Secretary of Defense should ensure that the Under Secretary of Defense for Acquisition and Sustainment develop and implement a plan to guide and coordinate efforts to implement the Wideband AOA recommendations to support timely, informed decisions on its next wideband satellite communications architecture. (Recommendation 1)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open

Comments: DOD concurred with our recommendation, but as of July 2020 is still working to implement its corrective action plan.

Recommendation: The NASA Administrator should ensure that the NASA Associate Administrator for Human Exploration and Operations directs the Advanced Exploration Systems division to define and determine a schedule for synchronization reviews, including the role of the proposed Lunar Exploration Control Board, to help ensure that requirements between mission and program levels are reconciled. (Recommendation 1)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: NASA agreed with this recommendation and stated that the Advanced Exploration Systems division will review program life-cycle review plans to ensure enterprise and program requirements are reconciled across the mission. NASA is in the process of determining the organizational structure of the Human Exploration and Operations Mission Directorate. Following this completion, NASA officials stated that the appropriate control board and division structures for review and program direction will become active.

Recommendation: The NASA Administrator should ensure that the NASA Associate Administrator for Human Exploration and Operations directs the Gateway program to conduct a joint cost and schedule confidence level at the program level for the Artemis III mission. (Recommendation 2)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: NASA agreed with this recommendation and stated it would conduct a joint cost and schedule confidence level analysis or equivalent. The Gateway program is planning to conduct a series of project- and program-level reviews and assessments aligned with key decision point reviews. This includes conducting a joint cost and schedule confidence level analysis or equivalent of the Gateway initial configuration to support a program key decision point planned for fall 2021. NASA has not yet taken action on this recommendation.

Recommendation: The NASA Administrator should ensure that the NASA Associate Administrator for Human Exploration and Operations directs the Gateway program to update its overall schedule for 2024 to add a KDP II to occur before system integration. (Recommendation 3)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: NASA agreed with this recommendation, but has not yet taken action on it. NASA stated that it would provide a schedule for future reviews, including whether there will be a Key Decision Point (KDP) II, at the KDP-I review currently scheduled for fall 2021.

Recommendation: The NASA Administrator should ensure that the NASA Associate Administrator for Human Exploration and Operations creates a life-cycle cost estimate for the Artemis III mission. (Recommendation 4)

Agency: National Aeronautics and Space Administration
Status: Open
Priority recommendation

Comments: NASA agreed with the recommendation and stated that the agency will provide a preliminary cost estimate for the Artemis III mission by the end of 2020. Further, NASA stated that it will provide an updated cost estimate for the Artemis III mission after it establishes cost and schedule commitments for some of the projects that compose the lunar mission, currently planned for the Spring of 2021. To fully implement this recommendation, NASA will need to provide a cost estimate.

Recommendation: The NASA Administrator should ensure that the NASA Associate Administrator for Human Exploration and Operations directs the Advanced Exploration Systems division to commit to a completion date and finalize a cohesive document outlining the rationale for selecting its current lunar architecture and lunar programs. (Recommendation 5)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: NASA agreed with this recommendation and stated that it is developing a document that will summarize the trades and architectural studies, but the document is not yet complete.

Recommendation: The NASA Administrator should ensure that the Office of the Chief Engineer determines under what conditions it is appropriate to complete an analysis of alternatives, particularly when there are multiple pathways—including architectures or programs—that NASA could pursue in the future, and document the justification for not completing an analysis. (Recommendation 6)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: NASA agreed with this recommendation, but has not yet taken any action on it. NASA stated that it will provide additional clarifying guidance for conducting analyses of alternatives for new programs in the next update to NASA Procedural Requirements 7120.5E, "NASA Space Flight Program and Project Management Requirements." NASA plans to complete the update of the procedural requirement in September 2021.

Recommendation: The Office of the Undersecretary of Defense (Comptroller) (OUSD[C]) should include an assessment of risks related to contractor ownership as part of its ongoing efforts to plan and conduct a department-wide fraud risk assessment. As part of this assessment, consistent with leading practices, DOD should involve relevant stakeholders with knowledge of emerging risks and use this information to help inform other types of risk assessments across the department, including for national security concerns. (Recommendation 1)

Agency: Department of Defense: Under Secretary of Defense (Comptroller)
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary for Homeland Security should direct the Director of OTE to revise T&E policy or guidance as necessary to fully meet the key practice for programs to test that components and subsystems work together as a system in a controlled setting before finalizing a system's design. (Recommendation 1)

Agency: Department of Homeland Security
Status: Open

Comments: In providing comments on this report DHS concurred with our recommendation and stated that it planned to update its T&E policy to specify that acquisition programs demonstrate that components and subsystems work together before finalizing a system's design. In July 2020, DHS Test and Evaluation Division (TED) officials said they were in the process of updating the policy and that it was undergoing management review with an anticipated completion in fall 2020. Once finalized, GAO will evaluate the revised policy to determine whether DHS has met the intent of this recommendation.

Recommendation: The Secretary for Homeland Security should direct the Director of OTE, in coordination with OCPO, to develop an assessment process-including establishing performance measures-to help ensure T&E training achieves desired results. (Recommendation 2)

Agency: Department of Homeland Security
Status: Open

Comments: In providing comments on this report, DHS concurred with our recommendation and stated that it planned to assess the knowledge and skill requirements for the T&E workforce and establish performance goals for the training. DHS Test and Evaluation Division (TED), in coordination with OCPO, also plan to develop strategies to address any deficiencies with the current training that do not meet the identified requirements. In April 2020, TED officials said that they developed a new survey process to obtain recurring feedback from participants on the training's impact on their ability to perform T&E duties as assigned over time to inform the annual review of the T&E curriculum. However, this effort is still in a piloting stage so the extent to which this information is used to assess the training is still unknown at this time. As of July 2020, TED was still in the process of executing these efforts.

Recommendation: The Secretary for Homeland Security should direct the Director of OTE to revise T&E policy or guidance as necessary to specify when in the acquisition life cycle a major acquisition program manager should designate a level III certified T&E manager. (Recommendation 3)

Agency: Department of Homeland Security
Status: Open

Comments: In providing comments on this report DHS concurred with our recommendation and stated that it planned to update its T&E policy to specify when in the acquisition lifecycle acquisition program managers should designate a qualified T&E manager. In July 2020, DHS Test and Evaluation Division (TED) officials said they were in the process of revising the policy to include this specification and that it was undergoing management review with an anticipated completion in fall 2020. Once finalized, GAO will evaluate the revised policy to determine whether DHS has met the intent of this recommendation.

Recommendation: The Secretary for Homeland Security should direct the Director of OTE to establish an internal control process to ensure that data collected and maintained on major acquisition programs' T&E managers are reliable. (Recommendation 4)

Agency: Department of Homeland Security
Status: Open

Comments: In providing comments on this report, DHS concurred with our recommendation and stated that it planned to establish an internal control process to reliably collect and maintain data on acquisition programs' assigned test and evaluation managers. In April 2020, DHS Test and Evaluation Division (TED) reported taking steps to ensure the validity of this data including establishing points of contacts within each component to cross-check collected information for accuracy and having the Director review collected data on a quarterly basis beginning in third quarter fiscal year 2020. As of July 2020, TED was still in the process of improving its internal collection process, but had not completed these efforts.

Recommendation: The Secretary for Homeland Security should direct the Under Secretary for Science and Technology to assess OTE's workforce to ascertain the extent to which it has the appropriate number of staff with the necessary skills to fulfill its responsibilities. (Recommendation 5)

Agency: Department of Homeland Security
Status: Open

Comments: In providing comments on this report, DHS concurred with our recommendation and stated that it planned to assess the Test and Evaluation Division's (TED) workforce by reviewing current staffing levels and vacancies against the division's roles and responsibilities. The Senior Official Performing the Duties of the Under Secretary for Science and Technology plans to use the results of this review to inform strategic hiring in future years, if needed. In February 2020, DHS released its fiscal year 2020 strategic guidance memorandum for the Science and Technology (S&T) Directorate which included a statement pertaining to resourcing S&T's test and evaluation capabilities. However, as of July 2020, S&T had not yet conducted its review of TED's workforce.

Recommendation: The Secretary of Energy, in coordination with the Administrator of NNSA, should formally communicate to the relevant congressional committees concerns about, and suggested changes to, the enhanced procurement authority in a timely manner. (Recommendation 1)

Agency: Department of Energy
Status: Open

Comments: NNSA agreed with the recommendation. NNSA officials said they submitted an assessment that includes information on suggested changes to the authority to the congressional committees in March 2020. We requested a copy of the assessment and will update the status of this recommendation after we receive and review it.

Recommendation: The Secretary of Defense should ensure that the Army, in coordination with CYBERCOM and the National Cryptologic School, where appropriate, establish a time frame to validate all of the phase two foundational training courses for which it is responsible. (Recommendation 1)

Agency: Department of Defense
Status: Open

Comments: DOD agreed with the recommendation. According to a DOD status report on implementing the recommendations for GAO-19-362 that was provided to us in February 2020, the Army is performing a validation pilot for its Cyberspace Operations Planners Course. After that validation pilot is complete, the Army will establish a time frame for validating its other courses.

Recommendation: The Secretary of Defense should ensure that the Air Force, in coordination with CYBERCOM and the National Cryptologic School, where appropriate, establish a time frame to validate all of the phase two foundational training courses for which it is responsible. (Recommendation 2)

Agency: Department of Defense
Status: Open

Comments: DOD agreed with the recommendation. According to a DOD status report on implementing the recommendations for GAO-19-362 that was provided to us in February 2020, the Air Force is coordinating with U.S. Cyber Command to obtain a final determination on the validated knowledge, skills, and abilities; proficiency standards, and skills for the various work roles supported by this training. The Air Force is responsible for developing curriculum for seven of the Cyber Mission Force workroles. DOD estimates that it will take 2 to 4 years to complete validation for all of the courses supporting these workroles.

Recommendation: The Secretary of the Army should ensure that Army Cyber Command coordinate with CYBERCOM to develop a plan that comprehensively assesses and identifies specific CMF training requirements for phases two (foundational), three (collective), and four (sustainment), in order to maintain the appropriate sizing and deployment of personnel across the Army's CMF teams. (Recommendation 3)

Agency: Department of Defense
Status: Open
Priority recommendation

Comments: 3. DOD agreed with the recommendation. According to a DOD status report on implementing the recommendations for GAO-19-362 that was provided to us in February 2020, the Army's implementation of this recommendation is dependent upon U.S. Cyber Command establishing master training task lists for phases 2 and 3 of the training. The Army estimates it will complete all required actions to validate phase 2 of its Cyber Mission Force training requirements by June 2020, phase 3 by October 2020, and phase 4 by January 2021.

Recommendation: The Secretary of the Navy should ensure that Fleet Cyber Command coordinate with CYBERCOM to develop a plan that comprehensively assesses and identifies specific CMF training requirements for phases three (collective) and four (sustainment) in order to maintain the appropriate sizing and deployment of personnel across the Navy's CMF teams. (Recommendation 4)

Agency: Department of Defense
Status: Open
Priority recommendation

Comments: DOD agreed with the recommendation. According to a DOD status report on implementing the recommendations for GAO-19-362 that was provided to us in February 2020, the Navy plans to identify the specific training requirements for phase 3 Cyber Mission Force training by October 31, 2020. Additionally, the Navy reported that it published a policy memorandum establishing a 24-month continuous training and certification cycle for its Cyber Mission Force Teams to address its phase 4 training requirements.

Recommendation: The Secretary of the Air Force should ensure that Air Forces Cyber coordinate with CYBERCOM to develop a plan that comprehensively assesses and identifies specific CMF training requirements for phases two (foundational), three (collective), and four (sustainment), in order to maintain the appropriate sizing and deployment of personnel across the Air Force's CMF teams. (Recommendation 5)

Agency: Department of Defense
Status: Open
Priority recommendation

Comments: DOD agreed with our recommendation. According to a DOD status report on implementing the recommendations for GAO-19-362 that was provided to us in February 2020, the Air Force's phase 2 training plan is contingent upon the completion of U.S. Cyber Command validating the tasks, knowledge, skills, abilities, and proficiency levels that establish the training baseline. Those products are still in coordination and are not finalized. The Air Force did not provide timeframes by which it would be able to develop training plans for its phase 2, 3, and 4 training requirements.

Recommendation: The Commandant of the Marine Corps should ensure that Marine Corps Forces Cyberspace coordinate with CYBERCOM to develop a plan that comprehensively assesses and identifies specific CMF training requirements for phases two (foundational), three (collective), and four (sustainment), in order to maintain the appropriate sizing and deployment of personnel across the Marine Corps' CMF teams. (Recommendation 6)

Agency: Department of Defense
Status: Open
Priority recommendation

Comments: DOD agreed with our recommendation. According to a DOD status report on implementing the recommendations for GAO-19-362 that was provided to us in February 2020, the Marine Corps is still developing its response to comprehensively assess and identify Cyber Mission Force training requirements for phases two , three, and four.

Recommendation: The Secretary of Defense should ensure that the commander of CYBERCOM develops and documents a plan for establishing independent assessors to evaluate CMF phase three collective training certification events. (Recommendation 7)

Agency: Department of Defense
Status: Open

Comments: DOD agreed with our recommendation. According to a DOD status report on implementing the recommendations for GAO-19-362 that was provided to us in February 2020, U.S. Cyber Command established procedures for assessing teams participating in Joint Exercise Program collective training events. These procedures include the use of highly skilled and independent assessors from deployable training teams and other units to conduct standard assessments using U.S. Cyber Command criteria. DOD reports that the command has captured lessons learned from these procedures and will promulgate a command-wide instruction to further standardize assessments across the force and guide the development of automated assessments conducted with the Persistent Cyber Training Environment. DOD further reports that the procedures described above were first used in the CYBERFLAG 19-1 exercise in June 2019. We are in the process of obtaining documentation from that exercise to verify these procedures.

Recommendation: The Secretary of Defense should ensure that the commander of CYBERCOM establishes and disseminates the master training task lists covered by each phase two foundational training course and convey them to the military services, in accordance with the CMF Training Transition Plan. (Recommendation 8)

Agency: Department of Defense
Status: Open

Comments: DOD agreed with our recommendation. According to a DOD status report on implementing the recommendations for GAO-19-362 that was provided to us in February 2020, U.S. Cyber Command will complete this task in September 2020. DOD reports that U.S. Cyber Command has established and made individual training standards available through the Joint Cyber Training and Certification Standards to all services prior to the training transition in October 2018. In October 2019, DOD approved a new organizational structure and new Mission Essential Tasks for Cyber Protection Teams. The training standards were updated and provided to the services, who are using them to validate and develop Joint Curriculum. DOD is currently reviewing a U.S. Cyber Command proposal for the organization and mission essential tasks for Cyber Mission Teams and Cyber Support Teams. Pending DOD approval, U.S. Cyber Command will update and publish revisions to the individual training standards.

Recommendation: The Director of DHS's National Protection and Programs Directorate's Infrastructure Security Compliance Division (ISCD) should incorporate vulnerability into the CFATS site security scoring methodology to help measure the reduction in the vulnerability of high-risk facilities to a terrorist attack, and use that data in assessing the CFATS program's performance in lowering risk and enhancing national security. (Recommendation 1)

Agency: Department of Homeland Security
Status: Open

Comments: DHS concurred with this recommendation and has taken steps to implement and monitor two new performance metrics intended to better demonstrate the CFATS program's effectiveness in enhancing national security and reducing national risk. Specifically, according to DHS, these new performance metrics allow for the (1) evaluation of the progress individual facilities have made in enhancing their security while part of the CFATS program, and (2) comparison of the security measures employed by CFATS-covered chemical facilities upon first entering the program against the improved and enhanced security measures contained in their approved CFATS security plans. DHS began reporting the two measures, "Average score of approved Site Security Plans" and "Average score of initial Site Security Plans", for the first quarter of fiscal year 2019. DHS stated that these measures will be used to demonstrate the percent increase in security score of facilities' security plans, resulting in a representation of the increase in the security posture across the facility population, which will be used internally to assess progress. GAO continues to monitor the results of these two new performance metrics.

Recommendation: The Secretary of Defense should assess CFIUS resource requirements within the Office of Manufacturing and Industrial Base Policy (MIBP) and DOD component reviewers in light of increasing workload, and prioritize personnel and funding resources accordingly to review, mitigate, and monitor transactions that are of concern to the department. (Recommendation 1)

Agency: Department of Defense
Status: Open

Comments: DOD agreed with this recommendation and in August 2020, stated it had augmented the personnel in the Office of the Deputy Assistant Secretary of Defense for Industrial Policy (formally the Office of Manufacturing and Industrial Base Policy) to include 15 federal civilians and 60 contractors to support the current CFIUS caseload. Industrial Policy officials stated that DOD CFIUS component reviewers have also augmented their personnel resources, and that approximately 15 of their contractor employees will support DOD CFIUS stakeholders. However, documentation of the efforts to prioritize personnel and funding resources within DOD CFIUS component reviewers was not available at the time of our follow-up.

Recommendation: The Secretary of Defense, in coordination with the Deputy Assistant Secretary of Defense for MIBP and Office of the Under Secretary of Defense, Personnel and Readiness, should incorporate the results of its efforts to identify, assess, and prioritize national security concerns related to foreign investment in emerging technologies and in proximity to certain critical military locations, into DOD Instruction 2000.25 and communicate the results to DOD component reviewers. (Recommendation 2)

Agency: Department of Defense
Status: Open

Comments: DOD agreed with this recommendation and stated in July 2019 that it believes the passage of the Foreign Investment Risk Review Modernization Act of 2018 (FIRRMA) will help the department to address concerns related to foreign investment in emerging technologies and in proximity to critical military locations. In August 2020, officials from the Office of the Deputy Assistant Secretary of Defense for Industrial Policy stated that some of the regulations implementing FIRRMA are currently being written, and that the department is also still in the process of updating DOD Instruction 2000.25, which they anticipate completing in April 2021.

Recommendation: Following the completion of its emerging technology study, the Deputy Assistant Secretary of Defense for MIBP should assess what additional authorities may be necessary to address risks related to foreign investment in critical and emerging technologies, and seek legislative action to address risks posed by these investments as appropriate. (Recommendation 3)

Agency: Department of Defense: Office of the Under Secretary of Defense for Acquisition, Technology and Logistics: Office of Manufacturing and Industrial Base Policy: Deputy Assistant Secretary of Manufacturing and Industrial Base Policy
Status: Open

Comments: DOD agreed with this recommendation and stated in July 2019 that it believes the passage of the Foreign Investment Risk Review Modernization Act of 2018 (FIRRMA) should provide the department with the necessary authorities to address concerns related to foreign investment in emerging technologies. However, in August 2020, officials from the Office of the Deputy Assistant Secretary of Defense for Industrial Policy stated that the regulation implementing FIRRMA requrements related to emerging technology is still in the process of being written by the Department of Commerce, and that until these regulations are issued the Department of Defense cannot assess their ability to address concerns related to foreign investment in critical and emerging technologies.

Recommendation: The Deputy Assistant Secretary of Defense for MIBP should update DOD Instruction 2000.25, to include additional guidance and clarification regarding DOD component responsibilities during the CFIUS process and DOD processes for identifying non-notified transactions. (Recommendation 6)

Agency: Department of Defense: Office of the Under Secretary of Defense for Acquisition, Technology and Logistics: Office of Manufacturing and Industrial Base Policy: Deputy Assistant Secretary of Manufacturing and Industrial Base Policy
Status: Open

Comments: DOD agreed with this recommendation and stated in July 2019 that it was working with other CFIUS member agencies to make the formal non-notified process DOD established in 2016 a more robust, interagency process. In August 2020, DOD stated it is still in the process of revising DOD Instruction 2000.25 to include additional information on identifying non-notified transactions, but does not anticipate that the revisions will be completed until April 2021.

Recommendation: The Deputy Assistant Secretary of Defense for MIBP should update and implement requirements identified in DOD Instruction 2000.25 regarding management and oversight of mitigation agreements, such as taking into account the resources needed to effectively monitor agreements, improving communication methods between MIBP and the DOD components, and clarifying component responsibilities in developing and monitoring mitigation agreements. (Recommendation 7)

Agency: Department of Defense: Office of the Under Secretary of Defense for Acquisition, Technology and Logistics: Office of Manufacturing and Industrial Base Policy: Deputy Assistant Secretary of Manufacturing and Industrial Base Policy
Status: Open

Comments: DOD agreed with this recommendation and stated in July 2019 that it is in the process of revising DOD Instruction 2000.25 regarding the management and oversight of mitigation agreements, and have more than doubled their resources for mitigation monitoring. As of August 2020, officials from the Office of Industrial Policy stated that that revisions to DOD Instruction 2000.25 will not be completed until April 2021.

Recommendation: The Secretary of the American Battle Monuments Commission should designate a chief FOIA officer at the assistant secretary level or equivalent. (Recommendation 1)

Agency: American Battle Monuments Commission
Status: Open

Comments: American Battle Monument Commission (ABMC) officials stated they are working to implement GAO's recommendations by the end of fiscal year 2020.

Recommendation: The Secretary of the American Battle Monuments Commission should update and publish comprehensive FOIA regulations that include requirements established by law and Justice guidance. (Recommendation 2)

Agency: American Battle Monuments Commission
Status: Open

Comments: American Battle Monument Commission (ABMC) officials stated they are working to implement GAO's recommendations. On February 18, 2020, ABMC published proposed revised FOIA regulations which are pending final rule in the Federal Register.

Recommendation: The Chief Executive Officer and Director of the Broadcasting Board of Governors should update and publish comprehensive FOIA regulations that include requirements established by law and Justice guidance. (Recommendation 3)

Agency: U.S. Agency for Global Media
Status: Open

Comments: The U.S. Agency for Global Media (formally known as the Broadcasting Board of Governors) performed a comprehensive review of its FOIA regulations and updated its regulations in accordance with GAO's recommendation. The agency anticipates publishing proposed updates for notice and comment in spring 2020, followed by a final rule.

Recommendation: The Secretary of DHS should take steps to develop and document a plan that fully addresses best practices with regards to reduction of backlogged FOIA requests. (Recommendation 4)

Agency: Department of Homeland Security
Status: Open

Comments: In April 2018, the Department of Homeland Security initiated a department-wide compliance assessment and stated that it plans to use the results of the assessment to help guide the department in identifying best practices and areas of improvement. The department does not have an estimate for when the plan will be complete.

Recommendation: The Secretary of DOI should take steps to develop and document a plan that fully addresses best practices with regards to reduction of backlogged FOIA requests. (Recommendation 7)

Agency: Department of the Interior
Status: Open

Comments: In August 2018, the Department of Interior informed GAO that the department has created a preliminary backlog reduction plan that includes expanding the use of automation tools, expanding the use of interim responses, and closing the Department's 10 oldest requests. Currently, GAO is awaiting a copy of the Department's backlog reduction plan.

Recommendation: The Chair of EEOC should designate a chief FOIA officer at the assistant secretary level or equivalent. (Recommendation 8)

Agency: Equal Employment Opportunity Commission
Status: Open

Comments: GAO is currently awaiting the agency's response to GAO recommendations..

Recommendation: The Chair of EEOC should take steps to develop and document a plan that fully addresses best practices with regards to reduction of backlogged FOIA requests. (Recommendation 9)

Agency: Equal Employment Opportunity Commission
Status: Open

Comments: GAO is currently awaiting the agency's response to GAO recommendations.

Recommendation: The Attorney General of the United States should take steps to develop and document a plan that fully addresses best practices with regards to reduction of backlogged FOIA requests. (Recommendation 11)

Agency: Department of Justice
Status: Open

Comments: In August 2018, the Department of Justice acknowledged that it plans to reexamine its progress and take steps for continued improvement in reducing its backlog. Currently, GAO is awaiting a response from the Department on a publication date.

Recommendation: The Administrator of NASA should provide agency records of final opinions online. (Recommendation 14)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: In August 2018, NASA agreed to provide agency records of final opinions online. NASA noted that final opinions will be provided online as they are issued and released for public posting. To date, the Department has not posted any final opinions.

Recommendation: The Chairman of NTSB should take steps to develop and document a plan that fully addresses best practices with regards to reduction of backlogged FOIA requests. (Recommendation 16)

Agency: National Transportation Safety Board
Status: Open

Comments: In August 2018, NTSB provided a plan that laid out tasks for reducing its backlog. The plan did not, however provide milestones or dates for when these tasks would be completed. GAO is currently waiting for the finalized backlog FOIA plan.

Recommendation: The Director of OMB should designate a chief FOIA officer at the assistant secretary level or equivalent. (Recommendation 18)

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: GAO is currently awaiting the agency's response to GAO recommendations.

Recommendation: The Director of Pension Benefit Guaranty Corporation should designate a chief FOIA officer at the assistant secretary level or equivalent. (Recommendation 19)

Agency: Pension Benefit Guaranty Corporation
Status: Open

Comments: The Pension Benefit Guaranty Corporation stated that it has designated the deputy director as the chief FOIA officer. It also noted that the director is at the Senior Level. However, this position is not equivalent to the assistant secretary level identified by GAO.

Recommendation: The President of TVA should ensure its FOIA tracking system is compliant with section 508 requirements. (Recommendation 22)

Agency: Tennessee Valley Authority
Status: Open

Comments: In August 2018, TVA provided a response to GAO's recommendation to ensure their FOIA tracking systems is compliant with section 508 requirements. TVA is currently performing an in-depth assessment of their tracking system to identify where updates can be made to ensure 508 compliance. TVA expects the assessment to be completed by the end of January 2020.

Recommendation: The President of the U.S. African Development Foundation should update and publish comprehensive FOIA regulations that inform a requester of limited unusual circumstances fees. (Recommendation 24)

Agency: African Development Foundation
Status: Open

Comments: U.S. African Development Foundation officials have stated that their FOIA regulations are currently under review and expect them to be published in the first half of calendar year 2020.

Recommendation: The Director of the Defense Security Service should determine how it will collaborate with stakeholders as it pilots a new approach to overseeing contractors with cleared facilities (DSS in Transition), including identifying roles and responsibilities and the related resources needed. (Recommendation 1)

Agency: Department of Defense: Defense Security Service
Status: Open

Comments: DOD agreed with this recommendation and as of February 2019, stated that it continues to pilot DSS in Transition at cleared facilities and use information gathered from stakeholders, including key government and industry stakeholder organizations to refine the process. On August 12, 2020, DOD stated that DSS was in the process of drafting a Corrective Action Plan. At that time, DOD officials explained that this plan would be completed in the fourth quarter of fiscal year 2019. As of September 2020, this plan has not been completed.

Recommendation: The NNSA Administrator should revise the scope of the mission need statement to clarify which mission need it seeks to achieve and, as appropriate, adjust the range of options considered in the analysis of alternatives process. (Recommendation 1)

Agency: Department of Energy: National Nuclear Security Administration
Status: Open

Comments: NNSA disagreed with our recommendation and has not taken steps to implement it. In August 2019, GAO requested an update on the status of the small centrifuge project at Oak Ridge since NNSA officials indicated in May 2019 that the status of the small centrifuge project will impact NNSA's ability to complete the analysis of alternatives (AOA) process by December 2019, as originally planned. Early in calendar year 2020, NNSA announced that completion of the AOA would be delayed to the end of fiscal year 2020. In September 2020, NNSA stated that the COVID-19 pandemic had further delayed the AOA and that the agency had not determined a revised target date for completion. We will continue monitoring the AOA process and will review the AOA once it is completed to determine whether we can close this recommendation at that time.

Recommendation: The NNSA Administrator should--following clarification of the scope of the mission need statement--ensure that the agency's cost estimates for whichever options it considers going forward are aligned with the scope of the mission need that the enrichment capability is intended to fulfill and that they are developed consistent with best practices. (Recommendation 2)

Agency: Department of Energy: National Nuclear Security Administration
Status: Open

Comments: NNSA disagreed with our recommendation and has not taken steps to implement it. In August 2019, GAO requested an update on the status of the small centrifuge project at Oak Ridge since NNSA officials indicated in May 2019 that the status of the small centrifuge project will impact NNSA's ability to complete the analysis of alternatives (AOA) process by December 2019, as originally planned. Early in calendar year 2020, NNSA announced that completion of the AOA would be delayed to the end of fiscal year 2020. In September 2020, NNSA stated that the COVID-19 pandemic had further delayed the AOA and that the agency had not determined a revised target date for completion. We will continue monitoring the AOA process and will review the AOA once it is completed to determine whether we can close this recommendation at that time.

Recommendation: The Secretary of the Treasury, as the chair of CFIUS, and working with member agencies, should coordinate member agencies' efforts to better understand the staffing levels needed to address the current and projected CFIUS workload associated with core committee functions. (Recommendation 1)

Agency: Department of the Treasury
Status: Open
Priority recommendation

Comments: In commenting on the report in February 2018, Treasury concurred with the recommendation. In December 2018, Treasury noted that the Foreign Investment Risk Review Modernization Act of 2018 requires each CFIUS member agency to submit detailed spending plans annually for seven years to appropriate congressional committees, including estimated expenditures and staffing levels, and requires annual testimony for seven years from the CFIUS staff chairperson regarding anticipated resource needs. As of November 2019, GAO continues to monitor this recommendation.

Recommendation: The Assistant Secretary of Defense for Homeland Defense and Global Security, in coordination with the Chairman of the Joint Chiefs of Staff and other appropriate DOD components, should update the department's cyber incident coordination training to incorporate the tenets of PPD-41.

Agency: Department of Defense
Status: Open

Comments: DOD partially concurred with this recommendation. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Chairman of the Joint Chiefs of Staff should maintain a list of senior DOD officials from organizations that could represent DOD during a Cyber Unified Coordination Group and that are trained in the National Incident Management System.

Agency: Department of Defense
Status: Open

Comments: DOD concurred with this recommendation. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: To enhance DOD's efforts to better integrate and improve intelligence support to major defense acquisition programs, and to better enable personnel to provide intelligence inputs to their portfolios of acquisition programs, the Secretary of Defense should direct--as appropriate--the Under Secretary of Defense for Acquisition, Technology, and Logistics; the Under Secretary of Defense for Intelligence; and/or the Secretaries of the military departments, in coordination with one another, to establish certifications that include having these personnel complete required training.

Agency: Department of Defense
Status: Open

Comments: The Department of Defense (DOD) concurred with the recommendation. DOD provided corrective action plans that show they expect to complete efforts that will address this recommendation in 2019. We will continue to monitor the status of DOD's actions and whether these actions address the intent of our recommendations.

Recommendation: To enhance DOD's efforts to better integrate and improve intelligence support to major defense acquisition programs, and to facilitate implementation of improved processes and procedures developed by the Acquisition Intelligence Requirements Task Force and by the Air Force for the integration of intelligence into major defense acquisition programs, the Secretary of Defense should direct--as appropriate--the Under Secretary of Defense for Acquisition, Technology, and Logistics; the Under Secretary of Defense for Intelligence; and/or the Secretaries of the military departments, in coordination with one another, to revise relevant guidance and procedures--including DOD Instruction 5000.02 and DOD Directive 5250.01-- require that intelligence mission data at the acquisition program, service, and department levels be prioritized.

Agency: Department of Defense
Status: Open

Comments: The Department of Defense (DOD) concurred with the recommendation. DOD provided corrective action plans that show they expect to complete efforts that will address this recommendation in 2019. We will continue to monitor the status of DOD's actions and whether these actions address the intent of our recommendations.

Recommendation: To enhance DOD's efforts to better integrate and improve intelligence support to major defense acquisition programs, and to better ensure that DOD obtains useful feedback from stakeholders and the intended users of the Validated Online Lifecycle Threat tool, the Secretary of Defense should direct--as appropriate--the Under Secretary of Defense for Acquisition, Technology, and Logistics; the Under Secretary of Defense for Intelligence; and/or the Secretaries of the military departments, in coordination with one another, to instruct the Director of the Defense Intelligence Agency to develop a communication plan for the tool that includes plans for communicating with and obtaining feedback from stakeholders and intended users such as acquisition program offices and personnel providing intelligence support to acquisition programs.

Agency: Department of Defense
Status: Open

Comments: The Department of Defense (DOD) concurred with the recommendation. DOD provided corrective action plans that show they expect to complete efforts that will address this recommendation by the end of 2018. We will continue to monitor the status of DOD's actions and whether these actions address the intent of our recommendations.

Recommendation: To enhance DOD's efforts to better integrate and improve intelligence support to major defense acquisition programs, and to ensure that it fulfills the needs of acquisition programs and the intelligence community and works as intended, the Secretary of Defense should direct--as appropriate--the Under Secretary of Defense for Acquisition, Technology, and Logistics; the Under Secretary of Defense for Intelligence; and/or the Secretaries of the military departments, in coordination with one another, to assess the need for the Acquisition Intelligence Support Assessment tool and, if validated by this assessment, define this tool's requirements for development and identify the entity responsible for providing oversight and funding for its continued development, implementation, and operation.

Agency: Department of Defense
Status: Open

Comments: The Department of Defense (DOD) concurred with the recommendation. DOD provided corrective action plans that show they expect to complete efforts that will address this recommendation sometime in the future. We will continue to monitor the status of DOD's actions and whether these actions address the intent of our recommendations.

Recommendation: To implement DOD guidance requiring the military departments to prepare readiness and Operation and Maintenance (O&M) budget impact assessments during drawdown planning, the Secretary of Defense should direct the Secretaries of the military departments to develop guidance that assigns responsibility for the preparation of impact assessments and includes direction on how such assessments should be conducted as part of drawdown planning.

Agency: Department of Defense
Status: Open

Comments: In commenting on the draft report, DOD concurred with the recommendation. As of August 2018, we are in the process of following up with the department to determine the current status.

Recommendation: To implement DOD guidance requiring the military departments to prepare readiness and O&M budget impact assessments during drawdown planning, the Secretary of Defense should direct the Director, DSCA, to develop an internal control mechanism to determine whether the military departments have completed the required impact assessments before moving forward with drawdown planning and execution.

Agency: Department of Defense
Status: Open

Comments: In commenting on the draft report, DOD concurred with the recommendation. As of August 2018, we are in the process of following up with the department to determine the current status.

Recommendation: To ensure that DOE's control activities continue to be relevant and effective for managing supply chain risk, the Secretary should direct the Under Secretary for Nuclear Security, as the Administrator of the NNSA, to work with the Office of Intelligence and Counterintelligence and other DOE organizations, as appropriate, to assess the circumstances that might warrant using the enhanced procurement authority, and (1) if this assessment identifies circumstances that might warrant using the authority, the Secretary should direct the Under Secretary for Nuclear Security to work with other DOE organizations, as appropriate, to establish processes for using it and examine whether adequate resources are in place to support those processes, and (2) communicate the results of this assessment to the relevant congressional committees for their use in determining whether to extend the authority past its current termination date.

Agency: Department of Energy
Status: Open

Comments: In an October 7, 2016, letter the Under Secretary for Nuclear Security and Administrator of the National Nuclear Security Administration (NNSA) said he agreed with GAO's recommendation to assess situations that might warrant the use of the enhanced procurement authority and, should specific circumstances be identified for use of the authority, NNSA would develop a process for its use. The assessment would include an examination of resources to support use of the authority. NNSA would work with other Department of Energy organizations as appropriate in conducting the assessment. NNSA officials said they submitted the assessment to the congressional committees in March 2020. We requested a copy of the assessment and will update the status of this recommendation after we receive and review it.

Recommendation: To provide greater assurance that the Interagency Rotation Program for national security personnel will be implemented as provided in section 1107 of the National Defense Authorization Act for Fiscal Year 2013, the Director of the Office of Personnel Management, in collaboration with the Committee on National Security Personnel, should establish a clear leadership and oversight structure to guide future implementation efforts.

Agency: Office of Personnel Management
Status: Open

Comments: OPM generally concurred with the recommendations, but raised issues primarily about the roles and responsibilities that GAO addresses in the report. As of November 2019, OPM has not taken any action on this recommendation.

Recommendation: To provide greater assurance that the Interagency Rotation Program for national security personnel will be implemented as provided in section 1107 of the National Defense Authorization Act for Fiscal Year 2013, the Director of the Office of Personnel Management, in collaboration with the Committee on National Security Personnel, should work with the departments and agencies to identify and take action on necessary next steps to proceed with the program's implementation, including developing and issuing required guidance for implementation within identified timeframes.

Agency: Office of Personnel Management
Status: Open

Comments: OPM generally concurred with the recommendations, but raised issues primarily about the roles and responsibilities that GAO addresses in the report. As of November 2019, OPM has not taken any action on this recommendation.

Recommendation: To improve the internal control environment for oversight using information from CAS and develop a consistent approach to the use of information from CAS in M&O contractor oversight and performance evaluation across the nuclear security enterprise, the Administrator of NNSA should establish comprehensive NNSA policies and guidance, beyond a general framework as included in NAP-21, for using information from CAS to conduct oversight of M&O contractors, clarifying whether CAS is to cover mission-related activities, and describing how to conduct assessments of risk, CAS maturity, and the level of the contractor's past performance.

Agency: Department of Energy: National Nuclear Security Administration
Status: Open
Priority recommendation

Comments: We recommended that NNSA establish comprehensive policies and guidance, beyond a general framework, for using information from contractor assurance systems (CAS) to conduct oversight of management and operating (M&O) contractors, clarifying whether CAS is to cover mission-related activities and describing how to conduct assessments of risk, CAS maturity, and the level of the contractor's past performance. NNSA agreed with the recommendation and has taken an important step to revise its policy. However, NNSA needs to take additional action. Specifically, NNSA approved a revised corporate site governance policy in August 2016, and NNSA further revised its policy in October 2019. The revised policy improves on the agency's prior policy by clarifying one element in our recommendation that CAS is to cover mission-related activities. However the policy is still a general framework and NNSA has not established associated implementing guidance. Specifically, NNSA needs to develop guidance for NNSA headquarters' and field offices' procedures to use information from CAS and appropriately balance use of information from CAS with other more direct activities to oversee M&O contractors. As of April 2020, this recommendation remains open.

Recommendation: To help ensure that efforts to counter piracy and maritime crime are coordinated and prioritized to effectively address the evolving threat, the Assistant to the President for National Security Affairs, in collaboration with the Secretaries of Defense and State, should work through the Counter-Piracy Steering Group or otherwise collaborate with the Secretaries of Homeland Security, Transportation, and the Treasury, and the Attorney General to determine whether additional actions to address counterpiracy and maritime security, such as developing an action plan that includes elements of a strategic approach, are needed to guide and coordinate activities.

Agency: Executive Office of the President: Office of the Assistant to the President for National Security Affairs
Status: Open

Comments: In June 2014, the Executive Office of the President issued the United States Counter Piracy and Maritime Security Action Plan, which includes an annex specific to activities in and around the Gulf of Guinea. While the plan outlines some of the planned indicators of effectiveness for activities in and around the Gulf of Guinea, the extent to which the agencies have assessed or plan to assess costs and benefits are not explicitly addressed. The plan states that the Counter Piracy Steering Group will coordinate, implement, and monitor the objectives outlined in the plan and will assess methods and agency activities to reduce risk and protect the maritime industry from acts of piracy and related maritime crime. The plan identifies an increase in investigating and prosecuting cases and a reduction in the trend of piracy and related maritime crime as tangible indicators of successful implementation of the plan. However, GAO's past work on piracy off the Horn of Africa recommended that, as part of a strategic approach, agencies (1) identify the costs of U.S. counterpiracy efforts including operational, support, and personnel costs; and (2) assess the benefits, and effectiveness of U.S. counterpiracy activities. The 2014 plan and its Gulf of Guinea annex do not include a discussion of these elements of a strategic approach. In August 2018, officials from the State Department noted that the Action Plan has not been updated because the drafting of the U.S. National Strategy for Maritime Security-which was being led by the National Security Council staff and would have addressed the Action Plan-was indefinitely suspended in June 2018. As of September 2019, neither the Strategy nor the Action plan have been updated. Including these elements of a strategic approach in the plan can help assess the effectiveness of current efforts, prioritize future efforts, and leverage resources. GAO will continue to monitor progress in this area.

Recommendation: To help ensure that DOD and Congress have visibility over the necessity of the Selective Service System to meeting DOD's needs, the Secretary of Defense should direct the Under Secretary of Defense for Personnel and Readiness to establish a process of periodically reevaluating DOD's requirements for the Selective Service System in light of changing threats, operating environments, and strategic guidance.

Agency: Department of Defense
Status: Open

Comments: DOD concurred with this recommendation and said that it would establish a process to review the mission and requirements for the Selective Service System. The National Defense Authorization Act for Fiscal Year 2017 established the National Commission on Military, National and Public Service (i.e., the Commission) to, among other things, review the military selective service process. The Commission is to submit a report to the President and Congress no later than March 2020 with recommendations concerning the need for a military draft and means by which to foster a greater ethos of public service among American youth. Further, the Commission was directed to conduct hearings and meetings open to the public in various locations throughout the country to provide maximum opportunity for public comment and participation in order to help develop its recommendations. In January 2019, the Commission released an Interim Report. The Interim Report shared what the Commission learned throughout its first year, explored options the Commission is considering to increase service participation among all Americans, and outlined issues involved in the Commission's review of the military selective service process. In March 2020, the Commission issued its final report, and it recommended that (1) the Congress require the Secretary of Defense to update the personnel requirements and timeline for obtaining draft inductees in the event of an emergency requiring mass mobilization and (2) the President direct the Secretary of Defense to include in future Quadrennial Defense Reviews and National Defense Strategies a section on the state of the Selective Service System and the ability of the United States to rapidly mobilize personnel in the event of an emergency. The Commission's report reinforced our recommendation; however, until DOD takes action to respond to our recommendation to take actions to establish a process to periodically review the mission and requirements of the Selective Service System, this recommendation should be left open.