DEFENSE INFRASTRUCTURE: Guidance Needed to Develop Metrics and Implement Cybersecurity Requirements for Utilities Privatization Contracts

Since Congress provided statutory authority in 1997 for the privatization of utility systems at military installations, the military departments have privatized nearly 600 utility systems. According to DOD officials, utilities privatization enables military installations to obtain safe, reliable, and technologically current utility systems at a relatively lower cost than they would under continued government ownership.

The Senate report accompanying a bill for the National Defense Authorization Act for Fiscal Year 2018 included a provision that GAO review DOD's utilities privatization program. This report assesses the extent to which DOD has (1) tracked utilities privatization contract performance and developed measureable performance standards, and (2) implemented cybersecurity guidance for industrial control systems associated with privatized utility systems. GAO reviewed relevant policies and internal control standards, analyzed a non-generalizable sample of utilities privatization contract documents, and interviewed DOD and selected military installation officials and privatized utility system owners.

The military departments have some types of information about privatized utility systems, but they have not tracked contract performance or developed measurable performance standards for these contracts. Specifically:

Costs for Utility Infrastructure Improvements: The military departments estimated the cost avoidance at the time of contract award; however, none of the military departments have determined whether the utilities privatization contracts are on track to achieve those estimates.

Costs for Utility Commodities: Military department officials stated that they have observed reduced usage of commodity utilities, such as water usage, and thus decreased commodity costs, through utilities privatization; however, the officials have not tracked the data and any associated savings. Furthermore, the officials have not determined whether any savings were fully attributable to utilities privatization, recognizing that other factors may have affected commodity usage.

System Reliability: Military department officials stated that they have perceived improvements in utility system reliability since utilities privatization and have access to contractor-provided data to assess reliability; however, the military departments have not used this data to determine reliability trends over time.

Contractor Performance Evaluations: The military departments use the Contractor Performance Assessment Reporting System to evaluate each utility system owner's performance; however, based on GAO's review of the evaluations associated with the contracts in its sample, the evaluations were anecdotal and varied in frequency and quality.

Department of Defense (DOD) guidance does not require the development of metrics and associated measurable performance standards to track utilities privatization contract performance. Without a requirement to develop these metrics and standards, DOD will lack information on the performance of utilities privatization contracts and thus may not be able to perform effective program management and oversight for these long-term contracts.

DOD has taken steps to add a cybersecurity clause to its utilities privatization contracts that requires contractors take steps to ensure safeguards are put in place to protect covered defense information, which is defined as information that is processed, stored, or transmitted on the contractor's information system or industrial control systems. To implement the clause, DOD first must identify what, if any, covered defense information is provided to or developed by the contractor in performance of the contract. However, the Defense Logistics Agency (DLA) and military department officials stated that they have not begun to implement the clause because they need DOD to issue procedures concerning how the military departments are to determine what, if any, covered defense information associated with utilities privatization contracts is provided or developed by the contractor in performance of the contract. Without these procedures, the military departments and DLA will not have assurance that such information is being safeguarded.

GAO recommends that DOD issue guidance requiring the military departments and DLA to develop metrics to track utilities privatization contract performance, and issue procedures concerning how the military departments are to determine what constitutes covered defense information as it relates to utilities privatization contracts. DOD concurred with both recommendations.

Since Congress provided statutory authority in 1997 for the privatization  of utility systems at military installations, the Department of Defense  (DOD) has privatized nearly 600 of about 2,600 utility systems on military  installations worldwide, including electric, water, wastewater, natural gas,  and thermal systems. According to the Office of the Assistant Secretary  of Defense for Energy, Installations, and Environment (ASD (EI&E)),  utilities privatization enables military installations to obtain safe, reliable,  technologically current, and environmentally sound utility systems at a  relatively lower cost than they would under continued government  ownership. Utilities privatization gets DOD out of the business of owning,  managing, and operating utility systems so that it can focus on its core  missions and benefit from reliable utility systems owned and operated at  industry standards.

DOD installations rely on the use of utilities, such as electricity and water,  to accomplish their missions. Thus, DOD must be prepared for and adapt  to changing conditions and withstand and recover rapidly from  disruptions. This includes disruptions caused by deliberate attacks, such  as cyberattacks on industrial control systems (ICS), accidents, and  equipment failure, or naturally occurring events, such as severe weather.  According to DOD officials, such threats are a risk to ensuring the reliable  provision of utility services to its installations. DOD has issued policies to  its installations, including those with privatized utilities, to enhance energy  resilience, which the department defines as the ability to recover from energy disruptions that impact mission assurance on its installations.  Various efforts can contribute to an installation’s ability to achieve utility  resilience, including upgrading and replacing utility infrastructure or  equipment, which could be achieved through utilities privatization.

In our prior work since 2005, we identified multiple challenges with DOD’s  utilities privatization efforts and utilities resilience. In 2005, we identified  several management weaknesses in DOD’s implementation of the utilities  privatization program. We made eight recommendations to help ensure  the reliability of economic analyses and improve the utilities privatization  guidance and procedures. DOD non-concurred with seven  recommendations and partially concurred with one recommendation in its  response to the report; however, DOD has since implemented all but one  recommendation. In 2006, we reported that DOD’s progress in  implementing the utilities privatization program had been slower than  expected and management concerns remained. We made seven  recommendations to improve DOD’s management of utilities privatization,  and DOD generally concurred with and implemented six  recommendations. In 2015, we identified that DOD faces challenges in  implementing utility resilience efforts, such as collecting and reporting  comprehensive utility disruption data, and developing cybersecurity  policies for its ICS. We made four recommendations to clarify utility  disruption reporting guidance, improve data validation steps, and address  challenges to addressing cybersecurity ICS guidance, and DOD  concurred or partially concurred with all but one recommendation and  implemented three recommendations.

The Senate Armed Services Committee report accompanying a bill for the  National Defense Authorization Act for Fiscal Year 2018 included a  provision that we review DOD’s utilities privatization efforts. In this report,  we examined the extent to which the department has (1) tracked utilities  privatization contract performance and developed measureable  performance standards, and (2) implemented cybersecurity guidance for  ICS associated with privatized utility systems.

For both objectives, we selected a non-generalizable sample of 9 utilities  privatization contracts, which privatized 11 utility systems, as case studies  to review. To select the case studies, we analyzed data maintained by  ASD (EI&E) and the military departments to identify the universe of utility  systems that were privatized using the legislative authority first granted by  Congress in 1997. We determined that the data were sufficiently reliable  for our objectives by comparing ASD (EI&E) data with the military  department’s data and interviewing military department officials about the  data sources. Using this data, we selected contracts that had been  awarded in 2007 or later, since we had previously reviewed the  department’s privatization efforts in 2005 and 2006. From this group of  contracts, we then selected at least three utility systems from each military department and at least one utility system of each type that was  privatized—electric, water, wastewater, and natural gas in order to try and  broadly capture the range of contracts. For each of these contracts, we  gathered detailed information from installation officials and  representatives of the privatized utility system owner. In addition, we  interviewed officials in ASD (EI&E) and the military departments’ utilities  privatization program management offices. Since our methodology was  based on reviewing a select number of utilities privatization contracts in  depth, we are unable to generalize the results from our review to the  universe of DOD’s utilities privatization contracts. Instead, this report  highlights examples collected from the case studies identified above.  Further information on the selected characteristics of the nine utilities  privatization contracts included in our review can be found in appendix I.

For objective one, we reviewed DOD guidance on installation energy  management and documentation from each military department on the  performance of utilities privatization contracts. We also reviewed  documentation describing any metrics and processes the military  departments use to measure the performance of privatized utilities,  including assessments of utility system owner performance. For each  utility system and associated contract included in our sample, we  reviewed the original contract and any subsequent modifications to the  contract, as well as the associated documentation describing the metrics  and processes used to measure progress and assess performance for  each contract. We examined the modifications for each contract to  calculate the changes in contract value over time. In presenting changes  in contract value, we used constant dollars using a Gross Domestic  Product deflator based on the year the contract was initially awarded.  We also interviewed military department officials and utility system  owners associated with each privatized utility system in our sample on  performance metrics and on any challenges they experience in assessing  the performance of privatized utilities. Because our scope was limited to  utilities privatization contracts, we did not attempt to compare whether the  reported performance results of utilities privatization might have been  achieved through an alternative approach, such as continued government  ownership or other alternative financing arrangements such as energy  savings performance contracts. We compared ASD (EI&E) and military  department efforts to monitor utilities privatization performance with  Standards for Internal Control in the Federal Government and our prior  work on strategic planning to determine whether ASD (EI&E) or the  military departments have implemented controls, such as the  establishment of performance metrics, which may be necessary to  achieve department objectives efficiently and to gauge progress toward  meeting department objectives.

For objective two, we reviewed DOD guidance and documentation to  identify and describe policies regarding requirements for cybersecurity of  ICS associated with privatized utility systems, including requirements in  the Defense Federal Acquisition Regulation Supplement. We  interviewed officials from ASD (EI&E) and the military departments’  utilities privatization program management offices about policies  regarding requirements for cybersecurity of ICS and the implementation  of these policies. In addition, we examined the utilities privatization  contracts included in our sample to identify and describe the extent to  which the contracts characterize any requirements for cybersecurity. We  interviewed military department officials, Defense Logistics Agency (DLA)  officials, and contractors associated with each privatized utility system  included in our sample to determine how these officials have  implemented cybersecurity for ICS associated with privatized utility  systems. We also compared the department’s utilities privatization  policies on cybersecurity with Standards for Internal Control in the  Federal Government requirements for management to evaluate security  threats to information technology, including ICS, which can come from  both internal and external sources, and periodically review policies and  procedures for continued relevance and effectiveness in addressing  related risks facing the entity as it seeks to achieve its objectives.

We conducted this performance audit from July 2017 to September 2018  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

Utilities Privatization Authorities and Intent

Congress provided statutory authority in 1997 for the privatization of utility  systems on military installations to address DOD’s need to supply  reliable, safe, and efficient utility services to its installations. In defining  a utility system, the authority includes systems for the generation and  supply of electric power; the treatment or supply of water; the collection or  treatment of wastewater; the generation or supply of steam, hot water,  and chilled water; the supply of natural gas; and the transmission of  telecommunications. Included in a utility system are the associated  equipment, fixtures, structures, and other improvements, as well as real  property, easements, and rights-of-way. The authority states that the  Secretary of a military department may convey a utility system to a  municipal, private, regional, district, or cooperative utility company or  other entity. DOD’s policy permits the military departments to maintain  ownership of utility systems and not privatize them for unique security  reasons, such as installations with highly sensitive missions, or when  privatization is uneconomical.

Utilities Privatization Roles and Responsibilities

ASD (EI&E) oversees DOD’s utilities privatization program, which is part  of the department’s installation energy management portfolio. In this  capacity, ASD (EI&E) is responsible for developing policies and  overseeing the program. There are two main sources of guidance for  utilities privatization— a DOD instruction on energy management at the  installation level, DOD Instruction 4170.11, Installation Energy  Management, and a series of memorandums specific to utilities  privatization. The instruction and memorandums direct the military  departments to attempt to privatize all utility systems, unless the  Secretary of the military department determines that the system is exempt  from privatization for security or economic reasons. Some of the  memorandums were issued to provide the military departments with  guidance to implement certain changes to the statutory authority related  to utilities privatization. For example, the congressional authority was  amended in 2006 to require the Secretary of Defense’s (or a designee’s)  approval for utilities privatization contracts with terms longer than 10  years, but not to exceed 50 years. The subsequent guidance memo  delegated the approval from the Secretary of Defense to the Secretaries  of the military departments and the Director of the DLA.

The military departments have the responsibility for program  implementation, as the statutory authority to privatize utility systems is  granted to the Secretaries of the military departments. As such, the  military departments determine which systems will be privatized and  which systems may be exempted from privatization due to economic or  security reasons. According to military department officials, each military  department considers utilities privatization as an option for the  recapitalization of utility infrastructure. The Army views utilities  privatization as the preferred option, while the Navy and the Air Force  consider utilities privatization to be one option among others. Specifically,

Army officials stated that they follow the statute and ASD EI&E  program guidance documents. Those documents state that utilities  privatization is the preferred method for recapitalizing utility  infrastructure and officials stated that the Army plans to assess all of  its utility systems for privatization. The Army prioritizes systems in the  worst condition and systems with important missions for  privatization. According to Army officials, in cases where the utility  system is in poor condition and the installation performs important  missions, the Army may privatize utility systems even if the costs in  the contractor’s proposal exceed the costs in the government’s  “should cost” estimate by as much as 15 percent.

The Air Force’s utilities privatization policy states that the program’s  goal is to permanently convey utility systems on Air Force active,  reserve, and guard installations to private or public utility  companies in conjunction with an award of a long-term utility  services contract for the operation and maintenance of those  systems. The purpose of privatizing a utility system is to restore  utility infrastructure to industry standards for operations,  maintenance, recapitalization, health, and safety while achieving a  monetary savings over the cost of continued Air Force ownership.

According to Navy officials, the Navy has not pursued utilities  privatization in recent years but is currently in the process of  assessing utility systems for potential conveyance. Any decisions to  convey utility systems will be based on a business case analysis for  total ownership cost and the ability to improve reliability, resilience,  and efficiency for priority missions. Navy officials noted that the Navy  follows DOD policy for utility conveyance authority.

DLA works with the military departments to plan for utilities privatization  and procures and administers 61 utilities privatization contracts for the  Departments of the Army and Air Force from the pre-solicitation phase  and into the post-award phase. According to DLA officials, the entire pre- award process takes approximately 915 days, based on the assumption  that the solicitation receives 1 to 6 proposals from contractors. Once an  award decision is made, privatization involves two transactions with the  successful contractor—the conveyance of the utility system infrastructure  and the acquisition of utility services for upgrades, operations, and  maintenance under a long-term contract of up to 50 years. According to  DLA officials, the contract term can be up to 50 years because it allows  the military departments the opportunity to spread the high costs to repair  and replace existing utility infrastructure over a long period of time. The  Department of the Navy administers its own utilities privatization contracts  for Navy and Marine Corps installations.

DOD’s Privatization of Utility Systems Since 1988

As of January 2017, the military departments have privatized  approximately 23 percent (601 of 2,574) of their utility systems. As  shown in table 1, the Army has privatized the most systems (369),  followed by the Air Force (174), and then the Navy (58). In addition, table  1 shows the number of utility systems the military departments have  exempted for either economic or security reasons. As of January 2017,  the military departments have 600 systems that have not been privatized  or exempted from privatization. The Army and the Air Force have plans to  privatize more systems in the coming years.

Industrial Control System Vulnerabilities and Cybersecurity Policies and Guidance

According to an ASD (EI&E) official, information residing on ICS  associated with privatized utilities systems, and more broadly, information  on any ICS, may be used by adversaries to gain insights into operations  on installations or to conduct a cyberattack. According to U.S. Cyber  Command, DOD’s ICS are a potential target and an adversary could gain  unauthorized access and attack DOD in a variety of ways, including  removing data from an ICS, inserting false data to corrupt the monitoring  and control of utility infrastructure through ICS, and physically destroying  utility infrastructure controlled by an ICS. As such, DOD’s 2015 Cyber  Strategy recognizes the need to protect DOD information regardless of  where it resides—on DOD’s own information systems and ICS or on  contractor-owned information systems and ICS— so that DOD  capabilities are not exploited, misdirected, countered, or cloned. Figure 1  illustrates a potential cyberattack using false data in an ICS.

In addition, there have been reports of successful attacks using ICS  associated with infrastructure. Specifically, the Office of the Director of  National Intelligence issued a report in 2017 describing several of these  attacks. For example, the report noted that in 2010, Stuxnet was the first  computer virus specifically targeting ICS, and it allowed attackers to take  control of the systems and manipulate real-world equipment without the  operators knowing. The attacker targeted certain equipment at the Natanz  uranium enrichment plant in Iran, manipulated computer systems that  control and monitor the speed of the centrifuges, and reportedly  destroyed roughly one-fifth of Iran’s nuclear centrifuges by causing them  to spin out of control. The attacker increased the pressure on spinning  centrifuges while showing the control room that everything appeared  normal by replaying recordings of the plant’s protection system values  during the attack. In another example, the report noted that in 2012, a  U.S. power utility’s ICS was infected with a virus when a third-party  technician used an infected USB drive to upload software to the systems.  The virus resulted in downtime for the systems and delayed plant restart  by approximately 3 weeks.

In recognition of these threats, DOD has developed cybersecurity policies  and guidance for ICS that apply to both DOD-owned ICS and contractor- owned ICS. Specifically,

For DOD-owned ICS, the department has issued several policies and  guidance for the cybersecurity of ICS. For example, in 2016, in  response to one of our prior recommendations that ASD (EI&E)  address challenges the military services faced in implementing the  risk management framework guidance, ASD (EI&E) directed the  services to develop plans identifying the goals, milestones, and  resources needed to identify, register and implement cybersecurity  controls on DOD facility-related ICS. Further, DOD issued additional  guidance that was intended to assist the military services in  developing implementation plans to meet these requirements. In  2016, DOD issued guidance, in the form of Unified Facilities Criteria,  which provides criteria for the inclusion of cybersecurity in the design  of control systems in order to address appropriate security controls  during design and subsequent construction. Also, in 2016, the U.S.  Cyber Command and the Office of the Secretary of Defense issued  guidance that identifies device anomalies that could indicate a cyber  incident, specific detection procedures to assess the anomaly, and  procedures to recover electronic devices, including removing and  replacing the device.

For contractor-owned ICS, including ICS owned by privatized utility  system owners, DOD has a Defense Federal Acquisition Regulation  Supplement clause to require that contractors take steps to ensure  safeguards are put in place to protect covered defense information,  which is defined as unclassified controlled technical information or  other information that is processed, stored, or transmitted on the  contractor’s information system or ICS. Controlled unclassified  information is information that requires safeguarding or dissemination  controls pursuant to and consistent with law, regulations, and  government-wide policies. The clause also requires the contractor to  report cyber incidents.

Military Departments Have Some Types of Information on Their Privatized Utility Systems, but Have Not Tracked Contract Performance or Developed Measurable Performance Standards

The military departments have information about utility systems that have  been privatized, but they have not tracked utilities privatization contract  performance or developed measurable performance standards for these  contracts. Specifically, for the systems in our sample the military  departments have some information on the costs for utility infrastructure  improvements and commodities, system reliability, and contractor  performance evaluations.

Costs for Utility Infrastructure Improvements: The military departments  have information on the estimated cost avoidance at the time of  contract award for utility infrastructure improvements; however, none  of the military departments have determined whether the utilities  privatization contracts are on track to achieve those cost avoidance  estimates. For example, officials at Fort Bragg, North Carolina,  estimated at the time of contract award that it would have cost the  Army $61.4 million to provide natural gas utility services over the life  of the utilities privatization contract, while the successful proposal  from the contractor estimated a cost of $52.3 million for the same  services. Therefore, the Army initially projected that it would avoid an  estimated cost of $9.1 million for natural gas utility services at Fort  Bragg over the life of the contract.

However, the estimate at the time of contract award used by each  military department does not account for changes in the cost of the  contract over time. Moreover, none of the military departments  measure actual cost avoidance over time, and some utilities  privatization contracts have experienced cost increases. Specifically,  we found that six of the nine utilities privatization contracts in our  sample included modifications, which increased the original cost of  the contract by more than 5 percent after adjusting for inflation. For  example, the contract to privatize electric and water services at  Tyndall Air Force Base, Florida, had 59 modifications, which have  increased the total estimated contract value by 36 percent ($42  million) to $159 million since it was awarded in September 2010. In  addition, the water and wastewater privatization contract at Fort Bragg  had 219 modifications, which has increased the total estimated  contract value by 96 percent ($552 million) to about $1.1 billion since  it was awarded in September 2007.

According to military department and DLA officials, there are limitations to  using the information in the modifications to analyze changes in cost over  time associated with the utilities privatization contracts because some  cost changes may have occurred even if the government had retained  ownership of the utility system. DLA officials stated that the modifications  are made for a number of different reasons, including changes in mission  requirements, changes to the utility service requirements, and capital  upgrade projects on the installation. According to military department  officials, cost changes associated with changes in the installation’s  mission would likely have occurred had the military department retained  ownership and would not be a cost increase due to privatization. Thus, it  is difficult to determine the extent to which cost increases affect the cost  avoidance estimated at the time of contract award.

In 2006, we reported that cost growth in DOD’s utilities privatization  contracts may become a concern because once a utility system is  privatized, the government enters into a sole-source relationship with the  privatized utilities system owner, which may put the government at a  disadvantage when negotiating prices for utility system changes. To  mitigate this disadvantage, DLA and Air Force officials stated that they  use experts who review proposals from the privatized utility system  owners to help ensure that costs are fair and reasonable.

Costs for Utility Commodities: Military department officials stated that  they have observed reduced usage of the commodity provided by the  utility, such as water usage, and thus decreased commodity costs  through utilities privatization; however, installation officials have not  tracked the data and associated savings. Furthermore, the officials  have not determined whether any savings were fully attributable to  utilities privatization, recognizing that other factors may have affected  commodity usage. For example, officials at Tyndall Air Force Base,  Florida, stated that repairs to their privatized water system  infrastructure have resulted in less water usage, and that there has  been a decrease in the number of leaks. An Army official estimated  commodity cost savings by comparing commodity costs prior to  utilities privatization with commodity costs after utilities privatization.  This approach was based on the assumption that any such savings  were primarily due to utilities privatization. However, an Army official  stated that the commodity cost savings the Army estimated could be  attributed to other factors outside of utilities privatization, such as  decreases in base population or execution of Energy Savings  Performance Contracts. Air Force and Navy officials stated they did  not estimate commodity cost savings.

System Reliability: Military department officials stated that they have  perceived improvements in utility system reliability since utilities  privatization and have access to contractor-provided data to assess  reliability; however, the military departments have not used the  contractor-provided data to determine reliability trends over time. For  example, Army officials at Arlington National Cemetery, Virginia,  stated that they could not recall an unscheduled outage since the  privatization of the electric system in 2015. In addition, officials at  Tyndall Air Force Base, Florida, stated that there was a significant  drop in outages after the electric system was privatized in 2010.  However, we found that none of the military departments have  formally measured improvements in reliability due to utilities  privatization, because, according to military installation officials, they  did not track reliability statistics prior to utilities privatization nor were  they required to do so. In addition, we found that not all installations in  our sample of cases have analyzed contractor-provided outage data,  which includes information on the number of scheduled and  unscheduled outages and the causes of the outages, to verify  perceived reliability improvements. However, officials at Hill Air Force  Base, Utah, stated that the system owner provides reports that track  reliability over time and trends could be determined through this data  collection. As we previously reported, there are benefits to collecting  utility disruption information since it can be used to identify repairs and  to prioritize funding for those repairs.

Contractor Performance Evaluations: The military departments use  the Contractor Performance Assessment Reporting System to  subjectively evaluate each utility system owner’s performance across  several categories, including management, schedule, and cost  control, among others; however, based on our review of the  evaluations associated with the nine contracts in our sample, we  found that the evaluations were anecdotal and varied in frequency  and quality. While we found that the assessing officials generally  reported satisfactory system owner performance, the performance  periods in the evaluations varied. For example, one evaluation for the  water privatization contract at Naval Air Station Key West, Florida,  covered 4 years, while the subsequent evaluation for the same  contract covered 1 year. Another evaluation for the natural gas  privatization contract at Fort Bragg, North Carolina, covered a  performance period of 1 year and 4 months. Guidance for these  contractor assessments indicates that agencies should conduct  contractor performance evaluations on an interim annual basis and  upon final completion of the contract. In addition, evaluation  information supporting ratings varied. In one evaluation for the electric  and water privatization contract at Tyndall Air Force Base, Florida, an  assessing official cited multiple concerns in the supporting narrative  for an evaluation area and rated it as “unsatisfactory,” while the  subsequent evaluation for the same contract provided an  “exceptional” rating for the same evaluation area with no explanation  of how previous concerns were addressed.

The military departments have not tracked utilities privatization contract  performance and have not developed measurable performance standards  because ASD (EI&E) has not issued guidance requiring the military  departments to develop metrics and measurable performance standards.  Standards for Internal Control in the Federal Government state that  management should design control activities—such as the establishment  of performance measures and indicators—to achieve objectives. In  addition, our prior work has shown that an element of sound planning  focuses on developing a set of metrics that will be applied to gauge  progress toward attainment of the plan’s long-term goals. The metrics  can be used to evaluate the plan through objective measurement and  systematic analysis to determine the manner and extent to which  privatized utility systems meet measurable performance standards.  According to our prior work, performance measurement focuses on  whether a program has achieved its objectives, expressed as measurable  performance standards. Moreover, DOD’s guidebook for the acquisition  of services states that services acquisition is about acquiring performance  results that meet performance requirements needed to successfully  execute an organization’s mission. Those performance requirements and  how the government will assess the contractor’s performance must be  determined before the contract is awarded.

DOD has guidance that requires the military departments to conduct a  post-conveyance review for each privatized utility system. That guidance  states that the military departments shall compare utilities privatization  costs after the contract award to projected costs to identify whether there  is a problem with cost growth. The guidance does not require the  development of metrics and associated measurable performance  standards to report on the performance of utilities privatization contracts.

ASD (EI&E) officials stated that performance metrics are needed to  improve DOD’s oversight of utilities privatization efforts. According to  Standards for Internal Control in the Federal Government, it is important  for management to design performance metrics and standards because  they help the entity achieve its goals. For example, ASD (EI&E) officials  stated that they issued a data call to the military departments in January  2017 requesting information about the performance of utilities  privatization contracts. Officials noted that they received different  information from each military department and did not believe that the  information would enable the department to determine whether the  privatized utilities systems are improving reliability or achieving the cost  savings originally estimated. For example, these officials stated that some  installations provided contractor performance evaluation ratings, but  these ratings were anecdotal and could not be used to determine  improved reliability or estimated cost savings. Air Force officials also  stated that they needed performance metrics to improve their  management of utilities privatization. Officials explained that the  information they receive from contracting officers and contracting officer  representatives specific to privatized utilities is anecdotal and qualitative,  and they have no metrics in place that allow the Air Force to track the  performance of utilities privatization contracts over time or to identify  trends and issues that would enable the Air Force to take steps to  improve utilities privatization. However, Air Force officials stated that the  Air Force is working on developing a standardized reporting template,  called the Monthly System Performance Report, which will enable the Air  Force to track reliability for its privatized utility systems and to identify  reliability trends over time.

DOD’s utilities privatization program has been in place for 21 years and  some information, such as the contractor-provided reliability data, is  available that could be used to track performance over time. Performance  metrics and standards would help ASD (EI&E) track the outcomes of the  utilities privatization program. In addition, the life of utilities privatization  contracts can extend to 50 years, producing a long-term, one-to-one  relationship between the utility system owner and the government. The  ability of ASD (EI&E), DLA, and the military departments to track  performance over the life of utilities privatization contracts may help  mitigate the risks of being in a one-to-one relationship with the utility  system owner. Without issuing guidance that requires the military  departments and DLA to develop and implement metrics and measurable  performance standards to track contract performance for future utilities  privatization contracts and to develop similar guidance for current utilities  privatization contracts, the department will lack information on the  performance of utilities privatization contracts. As a result, ASD (EI&E),  the military departments, and DLA may not be able to perform effective  program management and oversight for these long-term utilities  privatization contracts.

DOD Has Cybersecurity Requirements for Industrial Control Systems, but Has Not Begun to Implement Those Requirements for Utilities Privatization Contracts

DOD Has Cybersecurity Requirements for Industrial Control Systems

In November 2013, DOD issued guidance in the form of a Defense  Federal Acquisition Regulation Supplement clause to establish minimum  requirements for safeguarding covered defense information on a  contractor’s ICS. The clause requires contractors to implement a  minimum set of security controls on contractor information technology and  ICS, to report cyber incidents, and to support DOD damage assessments  as needed. According to DOD, the Defense Federal Acquisition  Regulation Supplement clause for safeguarding covered defense  information is required to be added to all new solicitations and contracts  as of November 2013. The clause is not required to be incorporated  retroactively into DOD contracts awarded prior to 2013, but that does not  preclude a contracting officer from modifying existing contracts to  incorporate the clause.

To implement the clause for safeguarding covered defense information,  the contractor must apply a minimum set of security controls on its ICS.  For the contractor to know what the appropriate security controls are,  DOD first must identify what, if any, covered defense information is  provided to or developed by the contractor in performance of the contract.  If the requiring activity determines that covered defense information is  provided to or developed by the contractor, then the contracting officer  notifies the contractor by documenting what information is considered  covered defense information. Then, to secure DOD’s covered defense  information, the contractor must apply adequate security to its ICS on  which that information resides and document, in a system security plan,  how the requirements were met or how the contractor plans to meet the  requirements. When requested by the requiring activity, the system  security plan should be submitted to demonstrate that adequate security  has been implemented. Figure 2 shows the responsibilities for identifying,  marking, and securing DOD’s covered defense information on contractor  information and industrial control systems.

DOD Has Not Begun to Implement Cybersecurity Requirements for Utilities Privatization Contracts

DOD officials stated that while they have taken steps to incorporate the  clause requiring the safeguarding of covered defense information into  many of their utilities privatization contracts, they have not begun to  implement the cybersecurity requirement in the clause to ensure that  covered defense information is appropriately safeguarded for those  contracts. DLA, Army, and Air Force officials stated that they have added  cybersecurity requirements to some of the utilities privatization contracts  they administer, but the Navy has not. Specifically:

DLA: According to DLA officials, of the 61 privatized utility contracts  DLA manages on behalf of the Army and Air Force, officials have  incorporated the clause requiring the safeguarding of DOD covered  defense information into 60 contracts, and are in the process of  modifying one contract to incorporate the clause. According to DLA  officials, beginning in June 2015, they determined that the utilities  privatization contracts needed to be modified to incorporate the  cybersecurity requirements to safeguard DOD covered defense  information associated with its utilities privatization contracts for two  reasons. First, DLA officials stated that they interpreted DLA- contracting guidance issued in 2015 to direct them to incorporate the  clause into all contracts. Second, DLA officials stated that the clause  should be applied to all utilities privatization contracts so that there  was consistency across the program. Since the issuance of the DLA  contracting guidance in 2015, DLA officials stated that they have  provided direction to the utilities privatization contracting officers on  multiple occasions to incorporate the clause into all contracts and plan  to ensure that the remaining contracts are modified to include the  clause. DLA officials stated that most of the contract modifications to  include this clause were completed in 2015 and 2016; however, some  modifications occurred as late as 2017.

Army: Army officials who manage the Army’s other utilities  privatization contracts stated that the clause requiring the  safeguarding of covered defense information has been added to some  contracts, but could not state definitively that the clause was added to  all of the utilities privatization contracts that the Army manages. Army  officials stated that Army contracting guidance issued in 2015 did not  specifically address utilities privatization; however, the guidance did  require that the clause be added to several different types of  contracts, including all contracts for programs where officials expect  covered defense information to be furnished by the government or  developed by the contractor, and contracts that were active in fiscal  year 2016 and later, among other contracts, or provide a rationale for  not including the clause. Army officials stated that they did not know  if their utilities privatization contracts contained covered defense  information. However, Army officials determined that the guidance  required the clause to be added to utilities privatization contracts  because these contracts fell into the category of contracts that were  active in fiscal year 2016 and later. Another contracting officer for  several Army privatization contracts stated that he does not recall how  information about the guidance to incorporate the clause into utilities  privatization contracts was shared. However, he stated that the issue  was discussed at utilities privatization meetings, and he believed that  it was implied at these meetings that the clause should be  incorporated into existing utilities privatization contracts.

Air Force: The Air Force official who manages the Air Force’s utilities  privatization program stated that two of the nine contracts managed  by the Air Force included the clause, and the clause was being added  to two additional contracts at the time of our review. Further, the Air  Force stated that it was planning on adding the clause to the  remaining five contracts. An Air Force official stated that it was not  clear whether the clause was required to be incorporated into all  existing utilities privatization contracts. However, since DLA added the  clause across all of the utilities privatization contracts it managed, the  Air Force official assumed that all non-DLA managed utilities  privatization contracts should do the same.

Navy: Navy officials stated that they have not taken steps to  incorporate the requirement into any of their utilities privatization  contracts. According to Navy officials, they have not added the  cybersecurity clause to the Navy’s utilities privatization contracts  because they are waiting for guidance from ASD (EI&E) regarding  whether the clause is necessary for all utilities privatization contracts  and, if so, additional guidance on how to implement the clause.

DLA, Army, and Air Force officials stated that while they have taken steps  to incorporate the clause requiring the safeguarding of covered defense  information into many of their utilities privatization contracts, they have  not begun to implement the cybersecurity requirement for those contracts.  As previously discussed, DOD acquisition guidance states that the  requiring activity, which in the case of utilities privatization contracts is the  military departments, must identify what information is considered  covered defense information and provide that information to the  contractor. However, before officials can fully implement these  requirements, they must first identify what information is considered  covered defense information.

According to an ASD (EI&E) official, information residing on ICS  associated with privatized utility systems could be considered covered  defense information because it could be used by adversaries to gain  insights into operations on installations or to conduct a cyberattack. For  example, information about energy or other commodity usage, water or  gas pressure in pipes, or the amount of chemicals that need to be added  during water treatment processes might be useful information to an  adversary seeking to disrupt operations on a military installation. In one  example of a cyber incident on an ICS associated with the operation of a  dam in New York, a threat actor repeatedly obtained information on the  status and operation of the dam, including information about the water  levels, temperature, and status of the gate that controls water levels and  flow rates. This access would allow the attacker to remotely operate and  manipulate the dam’s gate. However, in this instance, the gate had been  manually disconnected for maintenance at the time of the intrusion. In  another example, threat actors obtained control-level access to a water  treatment ICS and altered settings that controlled the amount of  chemicals used to treat tap water and water flow rates, disrupting water  distribution. The activity triggered an alert within the ICS, notifying the  water treatment utility to quickly identify and reverse the chemical and  flow changes, largely minimizing the impact on customers. Had the threat  actors been more familiar with the flow control system, the attack could  have been far more consequential.

However, DLA officials stated that there are currently no procedures that  state what, if any, information associated with utilities privatization  contracts is considered covered defense information. DLA officials stated  that they conferred with Army and Air Force officials, and DLA’s own  policy division, and reached out to ASD (EI&E) to obtain a clear definition  on what information associated with DOD’s utilities privatization contracts  might be considered covered defense information.

DLA’s efforts to obtain clarification from ASD (EI&E) on how to implement  the clause for utilities privatization contracts began in 2016. For example,  in 2016, DLA officials stated they met with ASD (EI&E) officials to discuss  the issue of covered defense information specific to the utilities  privatization program, discussing what, if any, information on ICS  associated with privatized utilities should be identified as covered defense  information. Further, DLA officials asked for procedures regarding what  steps to take to evaluate a contractor’s compliance with the provision. In  addition, DLA officials asked privatized utilities system owners to conduct  a self-assessment of the cybersecurity controls they currently use for their  ICS. DLA officials stated that they provided this information to ASD  (EI&E) to aid decision making on how to approach cybersecurity for these  systems. However, DLA officials stated that they did not receive a clear  response from ASD (EI&E). DLA officials stated that because there are  no procedures that definitively state which, if any, utilities privatization- related information should be categorized as covered defense  information, they have been unable to provide clear procedures to the  utilities privatization contractors who must implement the clause to  safeguard any such information. Moreover, according to DLA officials,  some of the utilities privatization contractors were reluctant to modify the  contract to incorporate the clause for safeguarding DOD covered defense  information because it was unclear how it was to be implemented. Also,  Navy officials stated that they have not yet incorporated the clause into  any of their utilities privatization contracts because they are waiting for  procedures from ASD (EI&E). In addition, DLA and military department  officials stated that the current costs associated with implementing the  clause are unknown.

Standards for Internal Control in the Federal Government require  management to evaluate security threats to information technology, which  can come from both internal and external sources, and periodically review  policies and procedures for continued relevance and effectiveness in  addressing related risks. Information technology refers to processes that  are enabled by technology, including ICS, which are computer-controlled  systems that monitor or operate physical utility infrastructure, among  other things. DLA and military department officials stated they have not  begun to implement the requirements in the clause because they are  waiting for ASD (EI&E) officials to issue procedures concerning how the  military departments are to determine what, if any, covered defense  information associated with utilities privatization contracts is provided or  developed by the contractor in performance of the contract. Such  procedures are needed to help the military departments and DLA take the  appropriate steps to implement the defense acquisition regulation clause  for their utilities privatization contracts and safeguard covered defense  information. An ASD (EI&E) official acknowledged that specific  procedures concerning how the military departments are to determine  what, if any, information associated with utilities privatization contracts is  considered covered defense information are lacking and the office plans  to update the policies. However, at the time of our review, it was not clear  what that guidance will require.

In the absence of a clear understanding of how to implement the clause  requiring the safeguarding of covered defense information, both  installation officials and some system owners reported having taken  various actions to address and enhance the cybersecurity of ICS  associated with privatized utility systems. For example,

An Air Force installation official stated that he and an employee of the  privatized utility system worked closely with the installation’s office  that handles cybersecurity and followed service guidance to try to  ensure mitigation of risks to and the security of the ICS. For  example, officials ensured that the ICS could not be accessed  remotely and that authorized users are required to use strong  passwords. The Air Force official stated that the privatized utility  system owner may be required to apply additional cybersecurity  measures in the future, depending on what decisions are made  regarding the provision to safeguard covered defense information.

A Navy installation official stated that he had no knowledge of what, if  any, cybersecurity practices the privatized utility system owner had  implemented for the ICS it uses to help operate an electrical  distribution system. However, an official from the privatized utility  system owner stated that the company has adopted some  cybersecurity practices, which have been audited by an independent  organization for 3 of the last 4 years, and the company plans to make  this a standard part of business operations.

Army officials stated that the installation relies on the privatized utility  system owner to employ industry practices for cybersecurity efforts.  Officials from the privatized utility system owner stated that the  company has robust cybersecurity practices and the ability to  continuously monitor the system to detect any unusual activities.

While installation officials and some system owners reported having taken  some steps to address and enhance the cybersecurity of ICS associated  with privatized utility systems, the lack of procedures may result in  uncertainty as to whether covered defense information across utilities  privatization contracts is safeguarded by the military departments and  DLA. As previously reported, vulnerabilities in ICS can be exploited by  various methods, causing loss of data, denial of service, or the physical  destruction of infrastructure. Without procedures concerning how the  military departments are to determine what, if any, covered defense  information is provided to or developed by the contractor in the  performance of the utilities privatization contract, the military departments  and DLA may not be able to take steps to adequately and consistently  protect DOD’s information associated with utilities privatization contracts.

As of January 2017, the military departments have privatized over 600  utility systems, and the Army and the Air Force have plans to privatize  more systems in the coming years. While the military departments have  some types of information on their privatized utilities, they have not  tracked utilities privatization contract performance or developed  measurable performance standards, as asked for in the Standards for  Internal Control in the Federal Government. In addition, while military  department officials stated that they have perceived improvements in  utility system reliability since utilities privatization, the military departments  have not used contractor-provided data to determine reliability trends over  time. Without issuing guidance that requires the military departments and  DLA to develop and implement metrics and measurable performance  standards to track contract performance for future utilities privatization  contracts and to develop similar guidance for current utilities privatization  contracts, the department will lack information on the performance of  utilities privatization contracts. As a result, ASD (EI&E), the military  departments, and DLA may not be able to perform effective program  management and oversight for these long-term utilities privatization  contracts.

DOD officials stated that they have taken steps to incorporate the clause  requiring the safeguarding of covered defense information into many of  their utilities privatization contracts, but they have not begun to implement  the cybersecurity requirement for those contracts. DLA, Army, and Air  Force officials stated they have not begun to implement the cybersecurity  requirement for those contracts that include the clause because ASD  (EI&E) has not issued specific procedures regarding how the military  departments are to determine whether covered defense information is  provided to or developed by the contractor in the performance of the  utilities privatization contract. The lack of procedures may result in  uncertainty as to whether covered defense information across utilities  privatization contracts is safeguarded by the military departments and  DLA. As previously reported, vulnerabilities in ICS can be exploited by  various methods, causing loss of data, denial of service, or the physical  destruction of infrastructure. Without procedures concerning how the  military departments are to determine what, if any, types of information  are considered covered defense information and are provided to or  developed by the contractor in the performance of the utilities privatization  contract, the military departments and DLA will not be able to adequately  and consistently protect DOD’s information associated with utilities  privatization contracts.

We are making two recommendations to the Secretary of Defense.

The Secretary of Defense should ensure that the Assistant Secretary of  Defense for Energy, Installations, and Environment, in consultation with  the military departments, issues guidance requiring the military  departments and DLA to develop and implement performance metrics  and measurable performance standards to track utilities privatization  contract performance for future utilities privatization contracts, and  develops similar guidance for current utilities privatization contracts.  (Recommendation 1)

The Secretary of Defense should ensure that the Assistant Secretary of  Defense for Energy, Installations, and Environment (a) issues procedures  concerning how the military departments are to determine what  constitutes covered defense information and what, if any, of this  information is provided to or developed by the contractor in the  performance of utilities privatization contracts, and (b) takes appropriate  steps to protect such information. (Recommendation 2)

We provided a draft of this report to DOD for review and comment. In  written comments, DOD concurred with both of our recommendations.  DOD’s comments are reprinted in their entirety in appendix II. DOD also  provided technical comments, which we incorporated as appropriate.

We are sending copies of this report to the appropriate congressional  committees, the Secretary of Defense, and the Secretaries of the military  departments. In addition, the report is available at no charge on our  website at http://www.gao.gov.

If you or your staff members have any questions about this report, please  contact Brian Lepore at (202) 512-4523 or LeporeB@gao.gov. Contact  points for our Offices of Congressional Relations and Public Affairs may  be found on the last page of this report. GAO staff who made key  contributions to this report are listed in appendix III.

Appendix I: Selected Characteristics of the Department of Defense’s (DOD) Utilities Privatization Contracts Included in GAO’s Review

This appendix provides information on the nine utilities privatization  contracts that we selected as case studies to review. Each of seven  contracts privatized one utility system, and each of two contracts  privatized two utility systems, for a total of 11 utility systems covered by  the nine contracts. Table 2 lists selected characteristics of each contract.

Appendix II: Comments from the Department of Defense

Appendix III: GAO Contact and Staff Acknowledgments

In addition to the contact named above, Kristy Williams (Assistant  Director), Michael Armes, John Bauckman, Emily Biskup, Vincent  Buquicchio, Cаrolyṇn Cаvanаugh, Desiree Cunningham, Michael  Gilmore, Simon Hirschfeld, Gina Hoover, Kush Malhotra, Richard  Powelson, and Jack Wang made key contributions to this report.

Defense Infrastructure: Actions Needed to Strengthen Utility Resilience  Planning. GAO-17-27. Washington, D.C., November 14, 2016.

Defense Infrastructure: Improvements in DOD Reporting and  Cybersecurity Implementation Needed to Enhance Utility Resilience  Planning. GAO-15-749. Washington, D.C., July 23, 2015.

GAO, Defense Infrastructure: Actions Taken to Improve the Management  of Utility Privatization, but Some Concerns Remain. GAO-06-914.  Washington, D.C.: September 5, 2006.

Defense Infrastructure: Management Issues Requiring Attention in Utility  Privatization. GAO-05-433. Washington, D.C.: May 12, 2005.