GAO told DoW (formerly DoD) to assess whether senior leaders have complete information for cyber risk decisions and to revise its recurring reports. The recommendation is open, and DoW's scorecard still omitted two topics in its April 2024 version.
GAO's May 2025 letter, Chief Information Officer Open Recommendations: Department of Defense (opens in a new tab) (GAO-25-108211), lists 54 open recommendations to DoW (formerly DoD), seven of them aimed at component-level CIOs. One asks DoW to find out whether its senior leaders have enough cybersecurity information to make risk-based decisions.
The recommendation comes from Cybersecurity: DOD Needs to Take Decisive Actions to Improve Cyber Hygiene (opens in a new tab) (GAO-20-241, April 2020). GAO found that two recurring reports kept senior leaders updated on the Cyber Discipline Implementation Plan. Leaders did not regularly receive information on the other cyber hygiene initiatives, or on whether hygiene practices were actually in place.
Recommendation 7 told the Secretary of Defense to ensure the DoW CIO assesses the extent to which senior leaders have more complete information to make risk-based decisions, and then revises the recurring reports or develops a new one.
The reporting followed the plan, not the risk. GAO reviewed three cyber hygiene initiatives: the 2015 Cybersecurity Culture and Compliance Initiative, the 2015 Cyber Discipline Implementation Plan, and the Cyber Awareness Challenge training. Only the Cyber Discipline plan had recurring reports behind it.
The data gap sat further down. GAO found some components could not say how many users had finished Cyber Awareness training or how many had lost network access for skipping it. DoW had identified the adversary techniques it sees most often and the practices that counter them, but it did not know how widely those practices were applied, partly because no component monitored them.
DoW later folded its reporting requirements into the Cybersecurity Hardening Scorecard, which tracks tiered and prioritized initiatives for cyber maintenance and operations. GAO's status note says DoW has taken some action.
The note also says the April 2024 version left out two things: the cybersecurity practices in DoW's hygiene initiatives, and the hygiene practices that protect networks from key cyberattack techniques. GAO's 2020 findings point to the same two gaps at the source. A scorecard cannot report what nobody measures.
The recommendation goes to the DoW CIO, not to contractors, and it creates no contract clause. It still shapes what evaluators want to see. Cybersecurity operations, continuous monitoring, and RMF support task orders at DoW components all end in a report that someone above the program office reads, and GAO has told the department that its own version of that report was incomplete.
An offeror that treats reporting as a dashboard screenshot invites the same gap. A technical volume that names each measure, its data source, how often it refreshes, and who acts on it reads as understanding of the requirement. Two weak patterns stand out to an evaluator: measures built on tool counts instead of on whether a practice is in place, and a report with no stated reader and no escalation path.
Recompetes add a transition angle. An incoming contractor inherits the incumbent's data feeds and definitions. If those were never documented, the first months go to finding out what the numbers meant.
The method below comes from Avalon's NIST RMF Implementation service, with coverage mapping and dashboard work from its Enterprise Monitoring service. It is scoped at the assessment and design level, one component at a time, for unclassified environments. It supports the CIO's assessment; it does not perform it.
Avalon designs the metrics and builds the reporting. It does not make the CIO's assessment, decide what leaders do with the data, assess controls, or make or promise an authorization decision, which stays with the Authorizing Official.
GAO has not published closure evidence for this recommendation. Its status note describes the bar: the CIO assesses the extent to which senior leaders have information on the two missing topics, then revises the recurring reports or develops a new one.
Practical targets, written as targets:
GAO's product page for GAO-20-241 shows recommendation 7 as open and partially addressed, and its latest dated reference is the April 2024 scorecard version. No separate update date appears. The May 2025 CIO letter, GAO-25-108211, still lists the recommendation among DoW's open items.
| Field | Detail |
|---|---|
| NAICS | 541512, 541519 |
| Avalon's sub role | Report-to-source inventory, telemetry coverage map, continuous monitoring metrics and reporting cadence, and a leadership view built from the feeds, under the prime's cybersecurity operations or RMF support task order, in unclassified environments |
| Small-business status | Small business; HUBZone (in progress) |
| Likely vehicles | GSA MAS (SIN 54151HACS Highly Adaptive Cybersecurity Services); GSA MAS (SIN 54151S IT Professional Services); GSA OASIS+ |
If cybersecurity operations, continuous monitoring, or RMF support at a DoW component is in your capture plan, Avalon teams as the sub that maps what leadership reports are built from, writes the metrics behind them, and builds the view leaders read.
