S&T Inconsistently Managed Critical Infrastructure Security and Resilience Research and Development Activities

The Science and Technology Directorate (S&T) can improve management of its research, development, testing, and evaluation (R&D) activities related to critical infrastructure security and resilience. Although S&T is actively making efforts to improve processes, it: • does not use a risk-based, holistic approach to prioritize critical infrastructure R&D programs and projects department-wide; • does not follow established project management principles and its own project management policies and procedures; and • relies on inaccurate and incomplete information to manage its critical infrastructure R&D projects. These problems occurred because S&T relies on component-based R&D prioritization processes instead of establishing and updating department-wide strategic priorities. Additionally, S&T does not ensure adherence to project management best practices, such as integrating program and project plans, using standard terminology and abbreviations, and tailoring its processes to fit the project needs. Finally, S&T has no formal data validation process to ensure the quality of R&D project management data