GAO reported in June 2022 that 15 of 25 DoW major IT business programs could not show a security plan that addresses ICT supply chain risk, and 10 of 25 could not show an approved cybersecurity strategy. Both recommendations were open as of GAO's January 2025 update.
In June 2022, GAO published Business Systems: DOD Needs to Improve Performance Reporting and Cybersecurity and Supply Chain Planning (opens in a new tab) (GAO-22-105330). It reviewed 25 major IT business programs at DoW (formerly DoD), which had planned about $8.8 billion for them across fiscal years 2020 through 2022.
Two counts matter here. Officials at 10 of the 25 programs did not demonstrate (opens in a new tab) an approved cybersecurity strategy, which DoD requires. Officials at 15 of the 25 did not demonstrate a system security plan that addresses information and communication technology (ICT) supply chain risk management. Both counts reflect program responses as of February 2022.
GAO made three recommendations, and DoW concurred. This brief covers two of them. GAO told the Secretary of Defense to direct the Chief Information Officer to ensure that major IT business programs "develop approved cybersecurity strategies, as appropriate," and "develop plans that address information and communication technology supply chain risk management, as appropriate."
GAO put the supply chain gap in plain terms: DoD guidance does not require programs to address ICT supply chain risk management in security plans. DoD Instruction 5200.44 directs programs to apply supply chain risk management disciplines to protect system integrity and trust. It does not make the security plan carry that content.
DoD CIO officials gave GAO two explanations. IT programs might address supply chain risk in program protection plans, and recent supply chain efforts had focused on weapons systems. A business program can therefore have the work done somewhere else and still have nothing in its security plan to show a reviewer.
DoW's later responses follow the same line. By September 2023 it said it was pursuing a strategy to make sure programs implement ICT supply chain risk management "through policy and RMF implementation," and it gave GAO an estimated completion date of December 2024. As of GAO's January 2025 notes, DoW had provided no further information.
The strategy recommendation moved more visibly. DoW's CIO reviewed and approved strategies for several programs in 2022, and as of March 2024 GAO found six programs still without an approved one.
A recompete for authorization support, sustainment, or modernization of a DoW business system inherits the program's security plan and has to keep it defensible.
A technical volume that says "we will address supply chain risk" invites the obvious follow-up: where does that appear in the security plan, against which suppliers, and who approved the strategy it rests on? DoW told GAO its answer runs through RMF implementation, which makes the RMF record the place a reviewer will check.
Transition is the second exposure. GAO's counts include programs that reported having an approved strategy but could not hand it over. An incoming contractor that cannot find a program's approved documents in week one starts the base period with a records problem. An offeror that proposes a document inventory in the first 30 days prices that risk instead of discovering it.
The method comes from Avalon's System & Application Security Plans service, working inside the NIST RMF record. It describes how the work is done, at the methodology level, for unclassified environments.
Strategy approval stays with DoW. This work keeps each program's record pointing at the approved strategy and shows whether the plan matches the system. Avalon writes and validates the documents; it does not issue authorizations or certify supply chain compliance.
GAO's January 2025 notes set the test. On the strategy recommendation, DoW "has not demonstrated" that it addressed it. On the supply chain recommendation, DoW had provided no additional information. Closure therefore rests on DoW showing evidence, not on a policy memo alone.
Program-level targets:
Both recommendations were open as of GAO's January 2025 update. GAO found six programs without an approved strategy in March 2024, and DoW had given an estimated completion date of December 2024 for the supply chain recommendation. The third recommendation, on IT Dashboard reporting, is outside this brief. The program counts in the report date to February 2022.
| Field | Detail |
|---|---|
| NAICS | 541512; 541519 |
| Avalon's sub role | Program document inventory, SR-family control implementation statements against a reconciled supplier list, plan structure in the program's GRC record, and a gap log and maintenance procedure under the prime's A&A or IT support task order, in unclassified environments |
| Small-business status | Small business; HUBZone (in progress) |
| Likely vehicles | GSA MAS (SIN 54151HACS Highly Adaptive Cybersecurity Services); GSA MAS (SIN 54151S IT Professional Services); GSA OASIS+ |
If DoW business-system support is in your capture plan, Avalon teams as the sub that inventories each program's strategy and security plan records, then writes the supply chain control statements, gap log, and maintenance procedure so the prime can put both documents in front of an evaluator.
