The Government Accountability Office (GAO) found performance reporting, fraud-risk management, agile development, cybersecurity, and zero trust gaps across 18 major Department of Defense (DOD) IT business programs, according to GAO’s annual assessment released Sept. 28.
Under the Trump administration, the DOD was rebranded as the Department of War.
Combined, the programs planned to spend $10.3 billion from fiscal years 2024 through 2026. The four largest programs accounted for 50% of that planned spending. Seventeen of the 18 programs were operational, GAO reported.
GAO found that 15 of those 17 operational programs identified the minimum required number of performance metrics across customer satisfaction, strategic and business results, financial performance, and innovation. The remaining two did not, leaving GAO and DOD without enough information to determine the extent to which those programs were improving in several areas.
Among all 17 programs that identified performance metrics, six met all of their performance targets, 10 met more than one target but not all, and one met none.
GAO also identified gaps in fraud risk awareness. Seven of the 18 programs reported that staff were either unaware of available training or had not received training within the previous two years to recognize and report signs of fraud or tampering in IT systems. Ten programs reported assessing the fraud risks they faced.
DOD officials told GAO that the department does not require training specifically focused on recognizing and reporting fraud in IT systems, although personnel receive mandatory general fraud awareness training.
“Programs’ reported lack of awareness of training to manage or report fraud can increase the risk of software development- and cybersecurity-related fraud within IT programs, making them vulnerable to exploitation,” GAO said.
In addition, GAO found shortcomings among programs actively developing software. Ten of the 18 programs reported using recommended agile and iterative software development approaches and practices, but eight of those 10 did not report or demonstrate using required metrics and management tools in areas including customer satisfaction and software development progress.
GAO has previously recommended that DOD address shortcomings in its use of agile metrics and management tools.
Cybersecurity readiness also varied across the programs. Three of the 18 lacked an approved DOD cybersecurity strategy, while six had not developed plans to implement zero trust in their cybersecurity frameworks by DOD’s 2027 deadline. Five programs reported using artificial intelligence tools to help secure their systems.
GAO made one new recommendation, which calls on the secretary of defense to direct the DOD chief information officer (CIO), working with the Office of the Under Secretary of Defense (Comptroller), to ensure major IT business programs promote and sustain an antifraud culture through training focused on fraud awareness, recognizing fraud risks in relevant settings, and understanding fraud risk assessment activities.
The watchdog also reiterated six recommendations from previous annual assessments that DOD has not yet implemented.
DOD partially agreed with the new recommendation and pointed to actions it is taking to address fraud risks, including the DOD comptroller’s departmentwide role in fraud risk management. GAO maintained that the DOD CIO should coordinate with the comptroller’s office to ensure staff working on major IT business systems receive fraud risk training.