Defense Critical Infrastructure:

Actions Needed to Improve the Consistency, Reliability, and Usefulness of DOD's Tier 1 Task Critical Asset List

GAO-09-740R: Published: Jul 17, 2009. Publicly Released: Jul 17, 2009.

Additional Materials:

Contact:

Brian J. Lepore
(202) 512-3000
contact@gao.gov

 

Office of Public Affairs
(202) 512-4800
youngc1@gao.gov

The Department of Defense (DOD) relies on a global network of defense critical infrastructure so essential that the incapacitation, exploitation, or destruction of an asset within this network could severely affect DOD's ability to deploy, support, and sustain its forces and operations worldwide and to implement its core missions, including current missions in Iraq and Afghanistan. Because of its importance to DOD operations, this defense critical infrastructure could be vulnerable to attacks by adversaries, and vulnerable to natural disasters and hazards, such as hurricanes and earthquakes. Since September 2003, the Office of the Assistant Secretary of Defense for Homeland Defense and Americas' Security Affairs (ASD[HD&ASA]) has been responsible for developing and ensuring implementation of critical infrastructure protection policy and program guidance. To identify and help assure the availability of this mission-critical infrastructure, in August 2005 DOD established the Defense Critical Infrastructure Program (DCIP), assigning overall responsibility for the program to ASD(HD&ASA). In April 2008, DOD issued an instruction that further assigned responsibilities and prescribed procedures for the implementation of DCIP, among other things. In October 2008, DOD formalized the process for identifying and prioritizing its critical infrastructure. Since 2006, ASD(HD&ASA) has collaborated with the Joint Staff to compile a list of all DOD- and non-DOD-owned infrastructure essential to accomplish DOD's missions. To support this effort, the combatant commands and military services are to identify and place their critical assets into prioritized tiers, including Tier 1 Task Critical Assets, which are assets of such extraordinary importance that their incapacitation or destruction would have a serious, debilitating effect on the ability of one or more military services, combatant commands, or DCIP Defense Infrastructure Sector Lead Agents to execute the mission essential tasks they support. Defense Critical Assets, on the other hand, are the assets most critical for fulfilling overall DOD missions and are identified from the universe of Task Critical Assets. The Joint Staff worked with the combatant commands, military services, and Defense Infrastructure Sector Lead Agents to develop the current departmentwide list of Tier 1 Task Critical Assets. In October 2008, ASD(HD&ASA) formally accepted the Joint Staff's Defense Critical Asset nomination list as an initial list of Defense Critical Assets. In its May 2008 report on H.R. 5658, the House Committee on Armed Services addressed DOD's lack of progress in analyzing the risks of electrical power outages to critical DOD missions through DCIP and, among other things, directed that GAO continue its review of DCIP. As a result, we initiated our on-going review of the assurance of electrical power supplies to DOD's critical assets.

While DOD has made some progress in developing a Tier 1 Task Critical Asset list, this progress was limited by DOD's lack of consistent criteria for identifying and prioritizing Tier 1 Task Critical Assets. When selecting and submitting their most recent lists of Tier 1 Task Critical Asset submissions to the Joint Staff, the combatant commands and the military services used disparate sets of guidance, including draft and nonbinding guidance, as their criteria. Air Force officials, however, told us they developed formal critical asset identification guidance based on DOD's draft critical asset identification manual. According to military service and combatant command officials, DOD's draft and nonbinding guidance contained unclear definitions of asset tiers, Task Critical Assets, and other key terms, such as "mission essential tasks." DOD has taken some actions toward promoting coordination among the combatant commands, military services, and Joint Staff in compiling DOD's Tier 1 Task Critical Asset list. For example, in August 2005, DOD issued DOD Directive 3020.40, which calls for coordination among the Joint Staff, combatant commands, military services, and other defense agencies for the purpose of identifying and assessing critical assets needed to implement DOD missions. However, DOD has not yet developed formal coordination responsibilities and an effective coordination mechanism within DCIP, including a forum for coordination between the military services and combatant commands when identifying critical assets. Combatant command and military service officials told us that, in considering which assets to submit to DOD's Tier 1 Task Critical Asset list, they coordinate only minimally with each other when determining which assets are critical to combatant command missions. Based on our analysis of the October 2008 manual and discussions with DCIP officials, we found that the Joint Staff, combatant commands, military services, and other DOD agencies still lack clearly defined coordination responsibilities and a mechanism for effective coordination within DCIP. As a result, the communication and coordination efforts among these key DCIP stakeholders when considering assets to nominate as Tier 1 Task Critical Assets have been insufficient and inconsistent. While DOD has developed a strategy and comprehensive management plan for DCIP, it has not fully developed some DCIP program management elements for identifying Tier 1 Task Critical Assets, which could enhance the effectiveness of the program. DOD's formal critical asset identification process manual issued in 2008 lacks some key elements necessary for sound program management, including clearly defined schedules and milestones for meeting performance goals and a formal feedback process. According to our work on sound management practices, comprehensive program schedules and formal communication strategies assist agencies in effectively implementing programs by providing relevant stakeholders with timelines to follow, performance milestones to meet, and shared expectations to guide their efforts. Because DOD lacks a formal process for submitting critical assets, including milestones and formal feedback from ASD(HD&ASA) or the Joint Staff on meeting program goals, the combatant commands and military services are limited in their ability to effectively select, compile, and validate their final nominations to DOD's Tier 1 Task Critical Asset list.

Status Legend:

More Info
  • Review Pending-GAO has not yet assessed implementation status.
  • Open-Actions to satisfy the intent of the recommendation have not been taken or are being planned, or actions that partially satisfy the intent of the recommendation have been taken.
  • Closed-implemented-Actions that satisfy the intent of the recommendation have been taken.
  • Closed-not implemented-While the intent of the recommendation has not been satisfied, time or circumstances have rendered the recommendation invalid.
    • Review Pending
    • Open
    • Closed - implemented
    • Closed - not implemented

    Recommendations for Executive Action

    Recommendation: To improve the consistency and reliability of the Tier 1 Task Critical Asset list, the Secretary of Defense should direct the Assistant Secretary of Defense for Homeland Defense and Americas' Security Affairs and the Joint Staff to further clarify the definitions of a Tier 1 Task Critical Asset contained in DOD Manual 3020.45 Volume I, Critical Asset Identification Process, along with definitions of key elements, such as "mission essential tasks." Potential approaches could include establishing and issuing a set of test questions to apply to a proposed critical asset or providing a set of hypothetical examples to use in identifying critical assets.

    Agency Affected: Department of Defense

    Status: Closed - Implemented

    Comments: To ensure further clarity of definitions, the Joint Staff requires that before an asset is validated and submitted to the critical asset database, known as the Strategic Mission Assurance Data System (SMADS), both the asset owner and mission owner must coordinate and agree upon the tier level assigned for this asset. DOD subsequently implemented our recommendation in 2011 when the U.S. Strategic Command modified the SMADS database by creating a discussion board for each asset owner to generate coordination on asset issues, including defining Tier levels. This is now the standard tool used by the Defense Critical Infrastructure Protection community. This mandated coordination and tool guarantee that all components have the same basis for Tier definitions. Moreover, all existing assets in the database were re-verified during the summer of 2012, and again asset owners and mission owners agreed on the final tier decisions. According to DOD officials, no issues of confusion on the definition of these terms were raised at the November 2012 Defense Critical Infrastructure Integration Staff forum where this process was discussed. As a result of this action, the Joint Staff, combatant commands, and military services are now able to use consistent criteria for identifying and prioritizing Tier 1 Task Critical Assets and improving the consistency and reliability of its Tier 1 Task Critical Asset list.

    Recommendation: To facilitate effective coordination among the combatant commands, military services, and the Joint Staff in compiling the Tier 1 Task Critical Asset list, the Secretary of Defense should direct the Assistant Secretary of Defense for Homeland Defense and Americas' Security Affairs and the Joint Staff to develop specific coordination responsibilities and a coordination mechanism within DCIP for each of those stakeholders to use when compiling the list.

    Agency Affected: Department of Defense

    Status: Closed - Implemented

    Comments: For the 2015 Critical Asset Identification Process cycle, each step of the process is officially tasked to the appropriate components for execution and the results are submitted to the Joint Staff and shared with all members of the Critical Infrastructure Protection community. DOD implemented our recommendation in 2011 when the U.S. Strategic Command modified its critical asset database, known as the Strategic Mission Assurance Data System (SMADS), by creating a discussion board for each asset to generate coordination on asset issues, including defining Tier levels. This is now the standard tool used by the DCIP community. This mandated coordination and tool guarantee that all components have the same basis for Tier definitions. Concerns over coordination are regularly reviewed and addressed at the semi-annual Defense Critical Infrastructure Integration Staff forum and through program reviews with each component. Issues of concern are addressed by the Office of the Assistant Secretary of Defense and the Joint Staff. As a result of modifying this database, DOD is in a better position to improve the consistency and reliability of its Tier 1 Task Critical Asset list by facilitating effective coordination among the Joint Staff, combatant commands, and military services in compiling its Tier 1 Task Critical Asset list.

    Recommendation: To improve the overall effectiveness of DOD's process to develop a list of Tier 1 Task Critical Assets, the Secretary of Defense should direct the Assistant Secretary of Defense for Homeland Defense and Americas' Security Affairs and the Joint Staff to formalize processes for compiling the Tier 1 Task Critical Asset list, including the development of a formal schedule with timelines and milestones for submitting Tier 1 Task Critical Asset data and a formal process for the Joint Staff to provide feedback to the combatant commands and military services regarding the assets they propose to include on the Tier 1 Task Critical Asset list.

    Agency Affected: Department of Defense

    Status: Closed - Implemented

    Comments: On May 24, 2010, DOD published the Defense Critical Infrastructure Program (DCIP) Execution Timeline in DOD Manual 3020.45 Volume 5. Collaboration and coordination in execution of critical asset identification is now also task directed by the Joint Staff through their Joint Staff Action Processing system to the DCIP community with established timelines and delivery requirements. DOD implemented our recommendation in 2011 when the U.S. Strategic Command modified its critical asset database, known as the Strategic Mission Assurance Data System (SMADS), by creating a discussion board for each asset to generate coordination on asset issues, including defining Tier levels. This is now the standard tool used by the DCIP community. As a result of this updated manual and the modification to the database that formalized the process for compiling the list, DOD is in a better position to improve the overall effectiveness of DOD's processes to develop a list of Tier 1 Task Critical Assets.

    Apr 22, 2014

    Apr 18, 2014

    Apr 16, 2014

    Apr 11, 2014

    Apr 10, 2014

    Apr 9, 2014

    Apr 8, 2014

    Looking for more? Browse all our products here