Recommendation: The Secretary of Defense should ensure that the Army, in coordination with CYBERCOM and the National Cryptologic School, where appropriate, establish a time frame to validate all of the phase two foundational training courses for which it is responsible. (Recommendation 1)
Agency: Department of Defense
Status: Open
Comments: DOD agreed with the recommendation. According to a DOD status report on implementing the recommendations for GAO-19-362 that was provided to us in February 2020, the Army is performing a validation pilot for its Cyberspace Operations Planners Course. After that validation pilot is complete, the Army will establish a time frame for validating its other courses.
Recommendation: The Secretary of Defense should ensure that the Air Force, in coordination with CYBERCOM and the National Cryptologic School, where appropriate, establish a time frame to validate all of the phase two foundational training courses for which it is responsible. (Recommendation 2)
Agency: Department of Defense
Status: Open
Comments: DOD agreed with the recommendation. According to a DOD status report on implementing the recommendations for GAO-19-362 that was provided to us in February 2020, the Air Force is coordinating with U.S. Cyber Command to obtain a final determination on the validated knowledge, skills, and abilities; proficiency standards, and skills for the various work roles supported by this training. The Air Force is responsible for developing curriculum for seven of the Cyber Mission Force workroles. DOD estimates that it will take 2 to 4 years to complete validation for all of the courses supporting these workroles.
Recommendation: The Secretary of the Army should ensure that Army Cyber Command coordinate with CYBERCOM to develop a plan that comprehensively assesses and identifies specific CMF training requirements for phases two (foundational), three (collective), and four (sustainment), in order to maintain the appropriate sizing and deployment of personnel across the Army's CMF teams. (Recommendation 3)
Agency: Department of Defense
Status: Open
Priority recommendation
Comments: 3. DOD agreed with the recommendation. According to a DOD status report on implementing the recommendations for GAO-19-362 that was provided to us in February 2020, the Army's implementation of this recommendation is dependent upon U.S. Cyber Command establishing master training task lists for phases 2 and 3 of the training. The Army estimates it will complete all required actions to validate phase 2 of its Cyber Mission Force training requirements by June 2020, phase 3 by October 2020, and phase 4 by January 2021.
Recommendation: The Secretary of the Navy should ensure that Fleet Cyber Command coordinate with CYBERCOM to develop a plan that comprehensively assesses and identifies specific CMF training requirements for phases three (collective) and four (sustainment) in order to maintain the appropriate sizing and deployment of personnel across the Navy's CMF teams. (Recommendation 4)
Agency: Department of Defense
Status: Open
Priority recommendation
Comments: DOD agreed with the recommendation. According to a DOD status report on implementing the recommendations for GAO-19-362 that was provided to us in February 2020, the Navy plans to identify the specific training requirements for phase 3 Cyber Mission Force training by October 31, 2020. Additionally, the Navy reported that it published a policy memorandum establishing a 24-month continuous training and certification cycle for its Cyber Mission Force Teams to address its phase 4 training requirements.
Recommendation: The Secretary of the Air Force should ensure that Air Forces Cyber coordinate with CYBERCOM to develop a plan that comprehensively assesses and identifies specific CMF training requirements for phases two (foundational), three (collective), and four (sustainment), in order to maintain the appropriate sizing and deployment of personnel across the Air Force's CMF teams. (Recommendation 5)
Agency: Department of Defense
Status: Open
Priority recommendation
Comments: DOD agreed with our recommendation. According to a DOD status report on implementing the recommendations for GAO-19-362 that was provided to us in February 2020, the Air Force's phase 2 training plan is contingent upon the completion of U.S. Cyber Command validating the tasks, knowledge, skills, abilities, and proficiency levels that establish the training baseline. Those products are still in coordination and are not finalized. The Air Force did not provide timeframes by which it would be able to develop training plans for its phase 2, 3, and 4 training requirements.
Recommendation: The Commandant of the Marine Corps should ensure that Marine Corps Forces Cyberspace coordinate with CYBERCOM to develop a plan that comprehensively assesses and identifies specific CMF training requirements for phases two (foundational), three (collective), and four (sustainment), in order to maintain the appropriate sizing and deployment of personnel across the Marine Corps' CMF teams. (Recommendation 6)
Agency: Department of Defense
Status: Open
Priority recommendation
Comments: DOD agreed with our recommendation. According to a DOD status report on implementing the recommendations for GAO-19-362 that was provided to us in February 2020, the Marine Corps is still developing its response to comprehensively assess and identify Cyber Mission Force training requirements for phases two , three, and four.
Recommendation: The Secretary of Defense should ensure that the commander of CYBERCOM develops and documents a plan for establishing independent assessors to evaluate CMF phase three collective training certification events. (Recommendation 7)
Agency: Department of Defense
Status: Open
Comments: DOD agreed with our recommendation. According to a DOD status report on implementing the recommendations for GAO-19-362 that was provided to us in February 2020, U.S. Cyber Command established procedures for assessing teams participating in Joint Exercise Program collective training events. These procedures include the use of highly skilled and independent assessors from deployable training teams and other units to conduct standard assessments using U.S. Cyber Command criteria. DOD reports that the command has captured lessons learned from these procedures and will promulgate a command-wide instruction to further standardize assessments across the force and guide the development of automated assessments conducted with the Persistent Cyber Training Environment. DOD further reports that the procedures described above were first used in the CYBERFLAG 19-1 exercise in June 2019. We are in the process of obtaining documentation from that exercise to verify these procedures.
Recommendation: The Secretary of Defense should ensure that the commander of CYBERCOM establishes and disseminates the master training task lists covered by each phase two foundational training course and convey them to the military services, in accordance with the CMF Training Transition Plan. (Recommendation 8)
Agency: Department of Defense
Status: Open
Comments: DOD agreed with our recommendation. According to a DOD status report on implementing the recommendations for GAO-19-362 that was provided to us in February 2020, U.S. Cyber Command will complete this task in September 2020. DOD reports that U.S. Cyber Command has established and made individual training standards available through the Joint Cyber Training and Certification Standards to all services prior to the training transition in October 2018. In October 2019, DOD approved a new organizational structure and new Mission Essential Tasks for Cyber Protection Teams. The training standards were updated and provided to the services, who are using them to validate and develop Joint Curriculum. DOD is currently reviewing a U.S. Cyber Command proposal for the organization and mission essential tasks for Cyber Mission Teams and Cyber Support Teams. Pending DOD approval, U.S. Cyber Command will update and publish revisions to the individual training standards.
