Audit of Cybersecurity of DoD Classified Mobile Devices

(U) Rec 1.a: The DoD OIG recommended that the U.S. European Command Chief Information Office Division Chief update inventory records for all classified mobile devices to include information for the six elements required in an accountable property system of record

(U) Rec 1.c: This recommendation is Controlled Unclassified Information

(U) Rec 1.e: The DoD OIG recommended that the U.S. European Command Chief Information Office Division Chief take immediate action to

(U) Rec 1.g: The DoD OIG recommended that the U.S. European Command Chief Information Office Division Chief revise existing or develop new classified mobile device training programs that include information on all 23 Office of the Secretary of Defense memorandum requirements.

(U) Rec 1.i: The DoD OIG recommended that the U.S. European Command Chief Information Office Division Chief update the classified mobile device user agreement to include all Committee on National Security Systems Directive No. 520 requirements and ensure that all users have acknowledged the updated user agreement.

(U) Rec 1.k: This recommendation is Controlled Unclassified Information

(U) Rec 2.b: The DoD OIG recommended that the U.S. Special Operations Command Director for Command, Control, Communications and Computer/Cyber, Chief Information Officer update the Commercial Solution for Classified Implementation Guidance to define the frequency for conducting inventories and reporting results to U.S. Special Operations Command Headquarters; immediately conduct an inventory of all Component classified mobile devices; update their inventory records; and take appropriate action if you are unable to properly reconcile a classified mobile device.

(U) Rec 2.d: This recommendation is Controlled Unclassified Information

(U) Rec 2.f: This recommendation is Controlled Unclassified Information

(U) Rec 2.h: The DoD OIG recommended that the U.S. Special Operations Command Director for Command, Control, Communications and Computer/Cyber, Chief Information Officer revise existing or develop new classified mobile device training programs that include information on all 23 Office of the Secretary of Defense memorandum requirements.

(U) Rec 2.j: The DoD OIG recommended that the U.S. Special Operations Command Director for Command, Control, Communications and Computer/Cyber, Chief Information Officer update the classified mobile device user agreement to include all Committee on National Security Systems Directive No. 520 and National Security Agency requirements and ensure that all users have acknowledged the updated user agreement.

(U) Rec 2.l: This recommendation is Controlled Unclassified Information

(U) Rec 2.n: The DoD OIG recommended that the U.S. Special Operations Command Director for Command, Control, Communications and Computer/Cyber, Chief Information Officer Implement a cyber incident response plan and controls to ensure \that the plan is reviewed and approved annually.

(U) Rec 3.b: The DoD OIG recommended that the Director of the Defense Information Systems Agency's Joint Enterprise Services Directorate develop and implement a process to ensure inventories are conducted periodically and records are updated in a timely manner; immediately reconcile all issued and on-site classified mobile devices; update inventory records; and take appropriate action if you are unable to properly reconcile a classified mobile device.

(U) Rec 3.d: This recommendation is Controlled Unclassified Information

(U) Rec 3.f: This recommendation is Controlled Unclassified Information

(U) Rec 3.h: The DoD OIG recommended that the Director of the Defense Information Systems Agency's Joint Enterprise Services Directorate revise existing or develop new classified mobile device training programs that include information on all 23 Office of the Secretary of Defense memorandum requirements.

(U) Rec 3.j: The DoD OIG recommended that the Director of the Defense Information Systems Agency's Joint Enterprise Services Directorate establish a mechanism to track the status of all classified mobile device user agreements and ensure that all users have acknowledged the most recent version of the user agreement.

(U) Rec 3.l: The DoD OIG recommended that the Director of the Defense Information Systems Agency's Joint Enterprise Services Directorate develop and implement procedures to verify that their classified mobile device users XXXXXXXXXX as required by Committee on National Security Systems Directive No. 520.

(U) Rec 4: The DoD OIG recommended that the DoD Chief Information Officer direct the DoD Component heads to review their classified mobile device programs for the issues identified in this report, take corrective actions as applicable, and report the results of their review and any corrective actions taken to the DoD Chief Information Officer. At a minimum, DoD Component heads should ensure that their classified mobile device programs,
a. (U) maintain complete and accurate inventory records,
b. (CUI) XXXXXXXXX,
c. (CUI) XXXXXXXXX,
d. (CUI) XXXXXXXXX,
e. (U) include all requirements in their classified mobile device training,
f. (U) include all requirements in their classified mobile device user agreements,
g. (CUI) XXXXXXXXX, and
h. (U) annually review and approve incident response plans