DOD to look at potential consolidations across cyber enterprise

Pentagon officials plan to assess the department’s sprawling cyber enterprise for potential consolidations that could yield efficiencies and cost savings, according to a new report from the Government Accountability Office.

The Defense Department has more than 400 organizations and upwards of 60,000 military and civilian personnel and contractors that perform cyberspace operations, according to the GAO study released Wednesday.

“These organizations are most often aligned with U.S. Cyber Command (CYBERCOM) or retained by the military services and conduct a mixture of offensive, defensive, and DOD Information Network operations,” the watchdog explained. “CYBERCOM-aligned organizations include organizations such as Navy cyber strike activities and Army cyber protection battalions that oversee tactical Cyber Mission Force teams. Military service organizations include units such as Air Force communications squadrons and Marine Corps radio battalions. Other organizations include cybersecurity service providers that provide network protection services to non-service components, such as the Defense Threat Reduction Agency and the Defense Advanced Research Projects Agency.”

Eighty-one of those organizations and more than 14,000 personnel are aligned with Cybercom, and more than 45,000 personnel and 330 organizations are service-retained, according to Pentagon data provided to GAO, which examined the department’s cyber enterprise to comply with a congressional directive.

The watchdog also identified 70 organizations and approximately 3,400 personnel that provide “support” to cyber ops.

“GAO found that some of the functions of these organizations may overlap. These include training courses the military services provide to organizations conducting cyberspace operations and the administration of DOD’s 23 cybersecurity service providers that conduct cybersecurity for DOD organizations. Although some overlap can be intentional and appropriate, unnecessary overlap can lead to organizations paying for the same service or product twice or more. As DOD considers the future organization and composition of its cyberspace operations forces, it will be important to take steps to reduce cost and inefficiencies while maintaining mission effectiveness,” per the report.

The watchdog made two recommendations to the Pentagon: that the secretary of defense ensure the assistant secretary of defense for cyber policy assesses the extent to which training courses provided by the services overlap and can be consolidated “to ensure that the military services are implementing a federated and joint training model in a manner that achieves efficiencies and reduces training development and delivery costs” — and that the ASD looks for opportunities to achieve cost savings and efficiencies by consolidating DOD cybersecurity service providers.

The Pentagon concurred with the report’s content and agreed with the watchdog’s recommendations.

The ASD for cyber policy, which serves as the principal cyber advisor to the SecDef, will conduct the recommended assessments in coordination with the Pentagon CIO, the military services, Cybercom and DOD cybersecurity service providers, according to the department’s response to GAO’s draft report, which was provided to the Pentagon in June for comment.

As they conduct the reviews, officials will take “a pragmatic approach prioritizing both efficiency and security,” the department noted in its response, adding that service-specific needs, diverse mission requirements, Cybercom’s authority and standards, Cyber Mission Force readiness and “the value of some redundancy” must be “carefully considered” before the Pentagon makes determinations about potential consolidations.