Recommendation: To ensure that DOD is positioned to counter both near and far term threats, consistent with its S&T framework, the Secretary of Defense should direct the new Under Secretary of Defense for Research and Engineering to annually define the mix of incremental and disruptive innovation investments for each military department.

Agency: Department of Defense
Status: Open
Priority recommendation

Comments: In July 2017, the Department of Defense (DOD) disagreed with our recommendation, stating that it would be premature to get ahead of the Secretary of Defense's final decisions on the role of the new Under Secretary of Defense for Research and Engineering (USD(R&E)) until that position is established, as required by law. In July 2018, the Department issued a memorandum finalizing the organizational structures, and roles and responsibilities for USD(R&E), but did not include a requirement for that office to annually define the mix of incremental and disruptive innovation investments for each military department. In September 2019, the Office of the USD(R&E) released an updated science & technology strategy. While the updated strategy acknowledges the need to invest in both incremental and disruptive innovation, the strategy does not define what an appropriate investment mix should be. In lieu of a DOD-wide defined mix set by USD(R&E), in April 2019, the Air Force issued its own science and technology strategy that acknowledged the need for both incremental and disruptive investments and defined what that mix should be. However, recent Army (2019) and Navy (2017) science and technology strategies do not define those military departments' desired mixes of incremental and disruptive innovation investments. In the Conference Report accompanying the National Defense Authorization Act for Fiscal Year 2020, Congress directed USD(R&E) to report further on this issue to the Committees on Armed Services of the Senate and House of Representatives by December 31, 2019.

Recommendation: To ensure that DOD is positioned to counter both near and far term threats, consistent with its S&T framework, the Secretary of Defense should direct the new Under Secretary of Defense for Research and Engineering to annually assess whether that mix is achieved.

Agency: Department of Defense
Status: Open
Priority recommendation

Comments: In July 2017, the Department of Defense (DOD) disagreed with our recommendation, stating that it would be premature to get ahead of the Secretary of Defense's final decisions on the role of the new Under Secretary of Defense for Research and Engineering (USD(R&E)) until that position is established, as required by law. In July 2018, the Department issued a memorandum finalizing the organizational structures, and roles and responsibilities for USD(R&E), but did not require that office to annually assess whether a desired mix of incremental and disruptive innovation investments mix had been achieved. In December 2019, a senior official within the Office of the USD(R&E) stated that DOD's Communities of Interest -- a component of DOD's overarching Reliance 21 framework for science and technology coordination -- are required to plan short- and long-term research and assess that research for an appropriate mix and balance between research priorities. However, as of December 2019, USD(R&E) has not yet articulated what the appropriate mix of incremental and disruptive innovation investments should be for DOD. Therefore, it is unknown the criteria the Communities use to evaluate whether an appropriate balance exists between research priorities, including incremental and disruptive innovation. In the Conference Report accompanying the National Defense Authorization Act for Fiscal Year 2020, Congress directed USD(R&E) to report further on this issue to the Committees on Armed Services of the Senate and House of Representatives by December 31, 2019.

Recommendation: To ensure that DOD is positioned to more comprehensively implement leading practices for managing science and technology programs, the Secretary of Defense should direct the new Under Secretary of Defense for Research and Engineering to define, in policy or guidance, an S&T management framework that includes emphasizing greater use of existing flexibilities to more quickly initiate and discontinue projects to respond to the rapid pace of innovation.

Agency: Department of Defense
Status: Open
Priority recommendation

Comments: In July 2017, the Department of Defense (DOD) disagreed with our recommendation, stating that it would be premature to get ahead of the Secretary of Defense's final decisions on the role of the new Under Secretary of Defense for Research and Engineering (USD(R&E)) until that position is established, as required by law. In July 2018, the Department issued a memorandum finalizing the organizational structures, and roles and responsibilities for USD(R&E), but did not require it to define a science and technology management framework that includes a process for discontinuing projects. In December 2019, a senior official with USD(R&E) reported that DOD has successfully implemented flexible funding vehicles such as the Defense Modernization Account that allowed funds to be rapidly moved to promising prototype projects within DOD's science and technology enterprise. In addition, this senior official reported an increased use of Other Transaction Authority by the Defense Innovation Unit and Defense Advanced Research Projects Agency. Nonetheless, the Office of the USD(R&E) has not yet developed policy or guidance that military departments could use to emphasize greater use of existing flexibilities for initiating and discontinuing science and technology projects. Consequently, DOD's processes for initiating and terminating science and technology projects largely remain linked to the annual federal budgeting process, which is not responsive to the rapid pace of innovation. In the Conference Report accompanying the National Defense Authorization Act for Fiscal Year 2020, Congress directed USD(R&E) to report further on this issue to the Committees on Armed Services of the Senate and House of Representatives by December 31, 2019.

Recommendation: To ensure that DOD is positioned to more comprehensively implement leading practices for managing science and technology programs, the Secretary of Defense should direct the new Under Secretary of Defense for Research and Engineering to define, in policy or guidance, an S&T management framework that includes incorporating acquisition stakeholders into technology development programs to ensure they are relevant to customers.

Agency: Department of Defense
Status: Open
Priority recommendation

Comments: In July 2017, the Department of Defense (DOD) disagreed with our recommendation, stating that it would be premature to get ahead of the Secretary of Defense's final decisions on the role of the new Under Secretary of Defense for Research and Engineering (USD(R&E)) until that position is established, as required by law. In July 2018, the Department issued a memorandum finalizing the organizational structures, roles, and responsibilities for USD(R&E), but did not require that office to define, in policy or guidance, a science and technology framework that includes incorporating acquisition stakeholders into technology development programs. In December 2019, a senior official within the Office of the USD(R&E) reported that USD(R&E) actively partners with acquisition stakeholders to ensure technology development programs are relevant to customers. The official cited Rapid Prototyping Programs (RPPs), Joint Capability Technology Demonstrations (JCTDs), and Emerging Capability Technology Development (ECTD) programs as examples where management frameworks in which technology managers actively partner with (1) operational managers from the Combatant Commands or military departments and (2) technology transition managers from the military departments to ensure programs are relevant to customers. However, these efforts are narrow in scope and do not constitute the majority of science and technology investments DOD makes. In addition, the senior official reported that the Army and the Air Force are taking steps to incorporate and integrate acquisition stakeholders into their science and technology projects, but these efforts are in their infancy. In the Conference Report accompanying the National Defense Authorization Act for Fiscal Year 2020, Congress directed USD(R&E) to report further on this issue to the Committees on Armed Services of the Senate and House of Representatives by December 31, 2019.

Recommendation: To ensure that DOD is positioned to more comprehensively implement leading practices for managing science and technology programs, the Secretary of Defense should direct the new Under Secretary of Defense for Research and Engineering to define, in policy or guidance, an S&T management framework that includes promoting advanced prototyping of disruptive technologies within the labs so the S&T community can prove these technologies work to generate demand from future acquisition programs.

Agency: Department of Defense
Status: Open
Priority recommendation

Comments: In July 2017, the Department of Defense disagreed with our recommendation, stating that it would be premature to get ahead of the Secretary of Defense's final decisions on the role of the new Under Secretary of Defense for Research and Engineering (USD(R&E)) until that position is established, as required by law. In July 2018, the Department issued a memorandum finalizing the organizational structures, and roles and responsibilities for USD(R&E), but did not require it to define, in policy or guidance, a science and technology framework that includes promoting advanced prototyping of disruptive technologies within the labs. In December 2019, a senior official within the Office of the USD(R&E) reported that the Emerging Capability Technology Development (ECTD) program is one framework USD(R&E) uses to promote the prototyping of disruptive technologies within the labs. Under this framework, USD(R&E) co-funds and co-sponsors projects with Federally Funded Research and Development Centers (FFRDCs), University Affiliated Research Centers (UARCs), and the military department laboratories. An integrated management team leads the evaluation and demonstration of technologies and connects technology managers with acquisition programs in the Combatant Commands and the military departments. The senior official further reported that USD(R&E) leverages Rapid Prototyping Funds (RPFs) and Rapid Prototyping Programs (RPPs) to promote and prove advanced demonstrations in military department laboratories. In the Conference Report accompanying the National Defense Authorization Act for Fiscal Year 2020, Congress directed USD(R&E) to report further on this issue to the Committees on Armed Services of the Senate and House of Representatives by December 31, 2019.

Recommendation: To help FAA better manage and oversee its portfolio of R&D activities, the Secretary of Transportation should direct the FAA to take a more strategic approach to identifying research priorities across the agency, including developing guidance to identify long-term priorities and emerging issue areas, as part of FAA's portfolio development process.

Agency: Department of Transportation
Status: Open

Comments: In June 2019, FAA issued a redesigned National Aviation Research Plan (NARP) for 2017/2018. In September 2019, FAA officials told GAO that the redesigned NARP helped the agency take a more strategic approach to identifying research priorities. FAA officials also said that the agency has taken actions to understand emerging aviation issues requiring FAA's research attention and those emerging issues will be incorporated into future plans. In June 2020, FAA officials told us that they are developing guidance--to be finalized by December 2020--to ensure that future NARPs continue to take a strategic approach. GAO will review FAA's actions to implement the recommendation once the guidance is completed.

Recommendation: To help FAA better manage and oversee its portfolio of R&D activities, the Secretary of Transportation should direct the FAA to develop guidance to ensure that future National Aviation Research Plans (NARP) and R&D Annual Reviews meet statutory requirements to the extent practicable, including (a) The NARP lists activities that are carried under cooperative agreements. (b) The NARP describes the rationale for the prioritized research programs. (c) The NARP identifies how resources were allocated for long-term and near-term research. (d) The NARP identifies REDAC recommendations that are accepted, not accepted, and the reasons for non-acceptance. (e) The NARP provides a detailed description of technology transfer to government, industry, and academia. (f) The Annual Review describes new technologies developed and the dissemination of research results to the private sector. (g) The Annual Review allows a comparison to the NARP. (h) The Annual Review is prepared and presented in accordance with agency performance reporting requirements.

Agency: Department of Transportation
Status: Open

Comments: In June 2019, FAA issued a redesigned the National Aviation Research Plan (NARP) to include, among other things, information required by statue. In June 2020, FAA officials told us that they redesigned the R&D Annual Review in 2019 to also address the statutory requirements. The officials said that they are also in the process of revising guidance that the agency uses to develop the NARP and R&D Annual Review to ensure that future documents meet statutory requirements. FAA plans to finalize the guidance by December 2020. GAO will review FAA's actions to implement the recommendation once FAA provides GAO the redesigned R&D Annual Review and once guidance for both the NARP and R&D Annual Review are completed.

Recommendation: To enhance the ability of the Executive Office of the President to implement the Revitalize American Manufacturing and Innovation Act of 2014 requirements related to reporting on advanced manufacturing, the Director of the Office of Science and Technology Policy, working through the National Science and Technology Council and agency leadership, as appropriate, should identify the information they will collect from federal agencies to determine the extent to which the objectives outlined in the National Strategic Plan for Advanced Manufacturing are being achieved.

Agency: Executive Office of the President: Office of Science and Technology Policy
Status: Open

Comments: In October, 2018, the Subcommittee on Advanced Manufacturing, Committee on Technology of the National Science Technology Council released a Strategy for American Leadership in Advanced Manufacturing. This strategy provided some information on progress toward achieving the objectives of the prior National Strategic Plan for Advanced Manufacturing; however, it is unclear what information is to be collected from agencies and likewise how progress toward achieving the goals of the current strategy will be measured. We will update the status of this recommendation when the Office of Science and Technology Policy identifies the information to be collected from federal agencies and how this information will be used to assess progress in achieving the current goals, objectives, and priorities.

Recommendation: To effectively measure 18F's performance, the Administrator of GSA should direct the Commissioner for the Technology Transformation Service to assess actual results for each performance measure.

Agency: General Services Administration
Status: Open

Comments: The General Services Administration (GSA) agreed with, and has begun to take steps to implement, this recommendation. Specifically, in a March 2020 written response, GSA stated that Technology Transformation Service (TTS) leadership will be briefed on the program's performance measures on a quarterly basis. We are following up with GSA to confirm that its TTS leadership has been briefed on the results on these performance measures. We will continue to evaluate GSA's progress in implementing this recommendation.

Recommendation: To effectively measure performance, prioritize USDS's resources, and ensure that CIOs play an integral role in agency digital service teams, the Director of the Office of Management and Budget should direct the Federal Chief Information Officer to ensure that all goals and associated performance measures are outcome-oriented and that performance measures have targets.

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: The Office of Management and Budget (OMB) generally agreed with, and has begun to take steps to implement, this recommendation. Specifically, in its December 2016 report to Congress, OMB developed three goals for U.S. Digital Service (USDS): (1) rethink how the federal government builds and buys digital services; (2) expand the use of common, platforms, services, and tools; and (3) bring top technical talent into public service. In addition, OMB established performance measures with targets for its third goal and for each of the program's major projects. However, OMB has not established performance measures for the first two USDS goals. Further, the program's third goal is not outcome-oriented. In May 2018, an USDS staff member stated that USDS established goals for and measured performance on each of the projects the program supports in its fall 2017 report to Congress. Although measuring performance on projects can provide USDS with valuable information, this effort does not address goals and performance measurement on the overall USDS program. In May 2020, OMB stated that they would provide an update on the agency's efforts to address the recommendation by June 2020. We will continue to evaluate OMB's progress in implementing this recommendation.

Recommendation: To effectively measure performance, prioritize USDS's resources, and ensure that CIOs play an integral role in agency digital service teams, the Director of the Office of Management and Budget should direct the Federal Chief Information Officer to assess actual results for each performance measure.

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: The Office of Management and Budget (OMB) generally agreed with, and has begun to take steps to implement, this recommendation. Specifically, in its December 2016 report to Congress, OMB assessed the results of performance measures for one of the U.S. Digital Service (USDS) program's goals--bring top technical talent into public service--and for each of the program's major projects. However, OMB has not established performance measures for the other two USDS goals--rethink how the federal government builds and buys digital services; and expand the use of common, platforms, services, and tools. In May 2018, an USDS staff member stated that USDS established goals for and measured performance on each of the projects the program supports in its fall 2017 report to Congress. As of July 2019, USDS has not publicly released any subsequent reports to Congress or additional information on its goals and performance measures. Although measuring performance on projects can provide USDS with valuable information, this effort does not address performance measurement on the overall USDS program. In May 2020, OMB stated that they would provide an update on the agency's efforts to address the recommendation by June 2020. We will continue to evaluate OMB's progress in implementing this recommendation.

Recommendation: To effectively measure performance, prioritize USDS's resources, and ensure that CIOs play an integral role in agency digital service teams, the Director of the Office of Management and Budget should direct the Federal Chief Information Officer to update USDS policy to clearly define the responsibilities and authorities governing the relationships between CIOs and the digital service teams and require existing agency digital service teams to address this policy. In doing so, the Federal Chief Information Officer should ensure that this policy is aligned with relevant federal law and OMB guidance on CIO responsibilities and authorities.

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: The Office of Management and Budget (OMB) generally agreed with, and has begun to take steps to implement, this recommendation. In particular, OMB updated its digital service team policy to require that teams appropriately inform their chief information officers (CIO) regarding U.S. Digital Service (USDS) projects. However, the policy does not describe the responsibilities or authorities governing the relationships between CIOs and digital service teams. In May 2018, an USDS staff member stated that the program updated digital service team charters to address the role of agency CIOs. As of May 2020, USDS has yet to provide us with the updated digital service team charters. In May 2020, OMB stated that they would provide an update on the agency's efforts to address the recommendation by June 2020. We will continue to evaluate OMB's progress in implementing this recommendation.

Recommendation: To improve agency information security programs, Acting Director of the Office of Personnel Management should provide and track specialized training for all individuals, including contractors, who have significant security responsibilities.

Agency: Office of Personnel Management
Status: Open
Priority recommendation

Comments: OPM partially agreed with this recommendation. In December 2018, OPM stated that it is working with its learning management system vendor to develop requirements, but had not yet targeted an expected completion date. To fully implement the recommendation, OPM needs to complete its efforts to ensure that it provides and tracks training for individuals with significant security responsibilities. As of March 2020, OPM has not provided evidence that it has completed these actions.

Recommendation: To improve agency information security programs, the Secretary of the Department of Veterans should conduct security control assessments for the two selected systems and ensure the procedures comprehensively test technical controls.

Agency: Department of Veterans Affairs
Status: Open

Comments: VA concurred with our recommendation. The agency has conducted security control assessments for the two systems, but these assessments did not show that technical controls were comprehensively tested. According to VA, the agency will complete the next security control assessment in October 2019 and complete the system assessment report in December 2019. As of March 2020, the agency has not provided evidence that it has implemented this recommendation. Subsequent to VA informing us that it has completed implementation, we plan to verify the agency's actions.

Recommendation: To improve security over federal systems, including those considered to be high impact, the Director of the Office of Management and Budget should issue plan and practices specified in the Cybersecurity Strategy and Implementation Plan.

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: OMB concurred with our recommendation. On December 9, 2016, OMB issued memorandum M-17-09, Management of Federal High Value Assets, which lists some existing policies and guidance and other actions that agencies need to take to protect IT assets. Further information is needed to validate implementation of the recommendation. As of March 2020, the agency has not provided evidence that it has implemented this recommendation. Subsequent to OMB informing us that it has completed implementation, we plan to verify the agency's actions.

Recommendation: To strengthen FCC's data collection efforts, the Chairman of FCC should develop a strategy to gather additional information on the IP transition to assess the transition's potential effects on public safety and consumers.

Agency: Federal Communications Commission
Status: Open

Comments: As of April 2020, FCC officials said they are exploring options to address this recommendation and hope to have it implemented in fiscal year 2020.

Recommendation: To ensure that the increasing risks of GPS disruptions to the nation's critical infrastructure are effectively managed, the Secretary of Homeland Security should increase the reliability and usefulness of the GPS risk assessment by developing a plan and time frame to collect relevant threat, vulnerability, and consequence data for the various critical infrastructure sectors, and periodically review the readiness of data to conduct a more data-driven risk assessment while ensuring that DHS's assessment approach is more consistent with the National Infrastructure Protection Plan (NIPP).

Agency: Department of Homeland Security
Status: Open

Comments: DHS officials had previously indicated that DHS's Office of Infrastructure Protection (IP) and Office of Cyber and Infrastructure Analysis (OCIA) have discussed an update of the GPS risk assessment. Additionally, information from DHS shows that DHS has continued other efforts to collect potentially relevant threat, vulnerability, and consequence data for various GPS equipment in use. For example, according to DHS officials, DHS has conducted visits to major maritime, finance, wireless communications, and electricity firms to gauge their understanding of GPS vulnerabilities and of technology- and strategy-based efforts to improve GPS resilience, and DHS documentation shows that DHS has held events to test GPS receivers as part of assessing vulnerabilities. In August 2020, DHS officials provided GAO with additional information regarding their progress on implementing the recommendation. We will update the status of this recommendation after we review the additional information from DHS.

Recommendation: Congress should consider strengthening the current consumer privacy framework to reflect the effects of changes in technology and the marketplace--particularly in relation to consumer data used for marketing purposes--while also ensuring that any limitations on data collection and sharing do not unduly inhibit the economic and other benefits to industry and consumers that data sharing can accord. Among the issues that should be considered are: (1) the adequacy of consumers' ability to access, correct, and control their personal information in circumstances beyond those currently accorded under FCRA; (2) whether there should be additional controls on the types of personal or sensitive information that may or may not be collected and shared; (3) changes needed, if any, in the permitted sources and methods for data collection; and (4) privacy controls related to new technologies, such as web tracking and mobile devices.

Agency: Congress
Status: Open

Comments: As of July 2020, Congress has not taken action on this matter.

Recommendation: To improve DOD's corrosion-prevention and control program, and to enhance DOD in its oversight of the status and potential benefits of its equipment-related corrosion projects, the Under Secretary of Defense for Acquisition, Technology and Logistics should require the Director, Corrosion Policy and Oversight Office, to revise the DOD Corrosion Prevention and Mitigation Strategic Plan or other guidance to require that the military departments include in all follow-on reports the details of measures of achievement other than ROI, such as the features, results, and potential benefits of the project.

Agency: Department of Defense: Office of the Under Secretary of Defense for Acquisition, Technology and Logistics
Status: Open

Comments: DOD did not concur with this recommendation. As of March 2016, DOD had not implemented this recommendation and stated that the DoD Corrosion Prevention and Mitigation Strategic Plan currently provide sufficient guidance in this regard. As of March 2019, DOD has decided to take action to implement this recommendation. According to DOD Corrosion Office officials, they plan to list measures of achievement for the military departments to follow on the departments' corrosion project in a new DOD manual on corrosion. The Office's goal is to create this new manual by the end of calendar year 2020. We will monitor the extent to which DOD implements this recommendation.

Recommendation: Further, to provide greater assurance that the military departments will meet reporting milestones for future projects, the Under Secretary of Defense for Acquisition, Technology, and Logistics--in coordination with the Director of the Office of Corrosion Policy and Oversight-- should revise corrosion-related guidance to clearly define a role for the military departments' Corrosion Control and Prevention Executives to assist the Office of Corrosion Policy and Oversight in holding their departments' project management offices accountable for submitting infrastructure-related reports in accordance with the DOD Corrosion Prevention and Mitigation Strategic Plan.

Agency: Department of Defense: Office of the Secretary of Defense: Office of the Under Secretary of Defense for Acquisition, Technology, and Logistics
Status: Open

Comments: On July 24, 2013, DOD reported that it non-concurred with our recommendation. DOD reported that the Military Department Corrosion Control and Prevention Executives are given the freedom to manage their programs in the most efficient and effective manner for their respective departments. Additionally, DOD reported that the Corrosion Control and Prevention Executives know the reporting requirements and are working closely with the Corrosion Policy and Oversight Office and the project managers to ensure reports are submitted in accordance with the DoD Corrosion Prevention and Mitigation Strategic Plan. Therefore, DOD reported that further guidance is not necessary as the requirements are already clearly stated in the DoD Corrosion Prevention and Mitigation Strategic Plan. Our audit work showed that DOD's strategic plan and guidance do not define a role for the Corrosion Executives in assisting the Corrosion Office in the project reporting process. Our recommendation was intended to fortify the role of Corrosion Executives in ensuring that project management offices within the Corrosion Executives' respective military departments submit project reports as required in the strategic plan. We continue to believe that the Corrosion Executives could provide the additional management oversight necessary to strengthen corrosion project reporting. In May 2016, the Senate Armed Services Committee informed us that it have included language in its National Defense Authorization Act Bill for fiscal year 2017. Specifically, the language reads: SEC. 312. REVISION OF GUIDANCE RELATED TO CORROSION CONTROL AND PREVENTION EXECUTIVES. Not later than 90 days after the date of the enactment of this Act, the Under Secretary of Defense for Acquisition, Technology, and Logistics, in coordination with the Director of Corrosion Policy and Oversight, shall revise corrosion-related guidance to clearly define the role of the corrosion control and prevention executives of the military departments in assisting the Office of Corrosion Policy and Oversight in holding the appropriate project management office in each military department accountable for submitting the report required under section 903(b)(5) of the Duncan Hunter National Defense Authorization Act for Fiscal Year 2009 (Public Law 110-417; 10 U.S.C. 2228 note) with an expanded emphasis on infrastructure, as required in the long-term strategy of the Department of Defense under section 2228(d) of title 10, United States Code. As of October 2016, legislation was not passed. As of March 2019, DOD has since decided to take action to implement this recommendation. According to Corrosion Office officials, they will include a definition of the military departments' Corrosion Executives' role in: an update to DOD Instruction 5000.67 (Prevention and Mitigation of Corrosion on DOD Military Equipment and Infrastructure), a new DOD manual on corrosion, an update to the DOD Corrosion Prevention and Mitigation Strategic Plan, and an update to the Corrosion Prevention Control Integrated Product Team charter. The Corrosion Office's goal is to complete these updates and create the new manual by the end of calendar year 2020. We will monitor the extent to which DOD implements this recommendation.