Defense Critical Infrastructure: Actions Needed to Improve the Consistency, Reliability, and Usefulness of DOD's Tier 1 Task Critical Asset List

The Department of Defense (DOD) relies on a global network of defense critical infrastructure so essential that the incapacitation, exploitation, or destruction of an asset within this network could severely affect DOD's ability to deploy, support, and sustain its forces and operations worldwide and to implement its core missions, including current missions in Iraq and Afghanistan. Because of its importance to DOD operations, this defense critical infrastructure could be vulnerable to attacks by adversaries, and vulnerable to natural disasters and hazards, such as hurricanes and earthquakes. Since September 2003, the Office of the Assistant Secretary of Defense for Homeland Defense and Americas' Security Affairs (ASD[HD&ASA]) has been responsible for developing and ensuring implementation of critical infrastructure protection policy and program guidance. To identify and help assure the availability of this mission-critical infrastructure, in August 2005 DOD established the Defense Critical Infrastructure Program (DCIP), assigning overall responsibility for the program to ASD(HD&ASA). In April 2008, DOD issued an instruction that further assigned responsibilities and prescribed procedures for the implementation of DCIP, among other things. In October 2008, DOD formalized the process for identifying and prioritizing its critical infrastructure. Since 2006, ASD(HD&ASA) has collaborated with the Joint Staff to compile a list of all DOD- and non-DOD-owned infrastructure essential to accomplish DOD's missions. To support this effort, the combatant commands and military services are to identify and place their critical assets into prioritized tiers, including Tier 1 Task Critical Assets, which are assets of such extraordinary importance that their incapacitation or destruction would have a serious, debilitating effect on the ability of one or more military services, combatant commands, or DCIP Defense Infrastructure Sector Lead Agents to execute the mission essential tasks they support. Defense Critical Assets, on the other hand, are the assets most critical for fulfilling overall DOD missions and are identified from the universe of Task Critical Assets. The Joint Staff worked with the combatant commands, military services, and Defense Infrastructure Sector Lead Agents to develop the current departmentwide list of Tier 1 Task Critical Assets. In October 2008, ASD(HD&ASA) formally accepted the Joint Staff's Defense Critical Asset nomination list as an initial list of Defense Critical Assets. In its May 2008 report on H.R. 5658, the House Committee on Armed Services addressed DOD's lack of progress in analyzing the risks of electrical power outages to critical DOD missions through DCIP and, among other things, directed that GAO continue its review of DCIP. As a result, we initiated our on-going review of the assurance of electrical power supplies to DOD's critical assets.

While DOD has made some progress in developing a Tier 1 Task Critical Asset list, this progress was limited by DOD's lack of consistent criteria for identifying and prioritizing Tier 1 Task Critical Assets. When selecting and submitting their most recent lists of Tier 1 Task Critical Asset submissions to the Joint Staff, the combatant commands and the military services used disparate sets of guidance, including draft and nonbinding guidance, as their criteria. Air Force officials, however, told us they developed formal critical asset identification guidance based on DOD's draft critical asset identification manual. According to military service and combatant command officials, DOD's draft and nonbinding guidance contained unclear definitions of asset tiers, Task Critical Assets, and other key terms, such as "mission essential tasks." DOD has taken some actions toward promoting coordination among the combatant commands, military services, and Joint Staff in compiling DOD's Tier 1 Task Critical Asset list. For example, in August 2005, DOD issued DOD Directive 3020.40, which calls for coordination among the Joint Staff, combatant commands, military services, and other defense agencies for the purpose of identifying and assessing critical assets needed to implement DOD missions. However, DOD has not yet developed formal coordination responsibilities and an effective coordination mechanism within DCIP, including a forum for coordination between the military services and combatant commands when identifying critical assets. Combatant command and military service officials told us that, in considering which assets to submit to DOD's Tier 1 Task Critical Asset list, they coordinate only minimally with each other when determining which assets are critical to combatant command missions. Based on our analysis of the October 2008 manual and discussions with DCIP officials, we found that the Joint Staff, combatant commands, military services, and other DOD agencies still lack clearly defined coordination responsibilities and a mechanism for effective coordination within DCIP. As a result, the communication and coordination efforts among these key DCIP stakeholders when considering assets to nominate as Tier 1 Task Critical Assets have been insufficient and inconsistent. While DOD has developed a strategy and comprehensive management plan for DCIP, it has not fully developed some DCIP program management elements for identifying Tier 1 Task Critical Assets, which could enhance the effectiveness of the program. DOD's formal critical asset identification process manual issued in 2008 lacks some key elements necessary for sound program management, including clearly defined schedules and milestones for meeting performance goals and a formal feedback process. According to our work on sound management practices, comprehensive program schedules and formal communication strategies assist agencies in effectively implementing programs by providing relevant stakeholders with timelines to follow, performance milestones to meet, and shared expectations to guide their efforts. Because DOD lacks a formal process for submitting critical assets, including milestones and formal feedback from ASD(HD&ASA) or the Joint Staff on meeting program goals, the combatant commands and military services are limited in their ability to effectively select, compile, and validate their final nominations to DOD's Tier 1 Task Critical Asset list.