GAO: Improvements in DOD Reporting and Cybersecurity Implementation Needed to Enhance Utility Resilience Planning

Jul 23

Editor’s Note: The complete GAO report is available here. Below is an excerpt.

Recommendations for Executive Action

In order to provide DOD and Congress with more comprehensive and accurate information on all types of utility disruptions, we recommend that the Secretary of Defense direct the Secretaries of the Army, Navy, and Air Force; the Commandant of the Marine Corps; and the Assistant Secretary of Defense for Energy, Installations and Environment to take the following two actions to provide more consistent guidance to the installations:

First, in guidance provided to their installations, the military services should clearly state that all disruptions lasting 8 hours or longer should be reported, regardless of the disruptions’ impact or mitigation. In addition, the military services and OSD should work together to revise the data collection template’s instructions, clarifying that disruptions in all four categories of utility service—electrical, potable water, wastewater, and natural gas—should be reported.
Second, the military services and OSD should revise the data collection template’s instructions to include reporting of disruptions caused by DOD-owned utility infrastructure.

Also, in order to improve the comprehensiveness and accuracy of certain data submitted by the military services to OSD and reported in the Energy Reports—such as potentially underreported data on mitigation costs and inaccurate data on both disruptions’ duration and cost—we recommend that the Secretary of Defense direct the Secretaries of Army, Navy, and Air Force, the Commandant of the Marine Corps, and the Assistant Secretary of Defense for Energy, Installations and Environment to work together to improve the effectiveness of data validation steps in DOD’s process for collecting and reporting utilities disruption data. For example, the military services and OSD could determine whether more time in the 5-month process should be devoted to data validation and whether equal priority should be given to validating all types of data included in the Energy Reports.

Further, in order to minimize the risk of delays in their efforts to implement DOD Instruction 8510.01, we recommend that the Secretary of Defense direct the Secretaries of the Army, Navy, and Air Force; and the

Commandant of the Marine Corps to address challenges related to inventorying existing ICS, identifying personnel with the appropriate expertise, and programming and identifying funding, as necessary.