Audit of the Defense Digital Service Support of DoD Programs and Operations

(U) Rec. A.1: The DoD OIG recommended that the Chief Digital and Artificial Intelligence Officer, in coordination with the Washington Headquarters Services Director, develop, resource, and implement a records management program that includes records management training for all personnel in accordance with Federal and DoD records management requirements.

(U) Rec. A.3: The DoD OIG recommended that the Washington Headquarters Services Director ensure that each head of a Washington Headquarters Services?serviced Component has established and resourced a records and information management program within their organization in accordance with DoD policies.

(U) Rec. B.1.b: The DoD OIG recommended that the Chief Digital and Artificial Intelligence Office Chief Information Officer and Authorizing Official, in coordination with the Defense Information Systems Agency Chief Information Officer, assess the hardware, software, cloud services, networks, and any other tools used by the Defense Digital Service since 2015 to determine whether the hardware, software, cloud services, and other tools are approved for use by the DoD.

(U) Rec. B.1.d: The DoD OIG recommended that the Chief Digital and Artificial Intelligence Office Chief Information Officer and Authorizing Official, in coordination with the Defense Information Systems Agency Chief Information Officer, assess the hardware, software, cloud services, networks, and any other tools used by the Defense Digital Service since 2015 to determine whether the hardware, software, cloud services, and other tools were acquired under terms that ensure that the DoD retains ownership of DoD data.

(U) Rec. B.2.b: The DoD OIG recommended that the Chief Digital and Artificial Intelligence Office Chief Information Officer and Authorizing Official, in coordination with the Defense Information Systems Agency Chief Information Officer, conduct a risk assessment of the DoD data stored, processed, or transmitted by the hardware, software, cloud services, networks, and any other tools used by the Defense Digital Service to determine whether the DoD data were and are appropriately protected in accordance with DoD cybersecurity and cloud security policies.

(U) Rec. B.3: The DoD OIG recommended that after completion of Recommendations B.1 and B.2, the Chief Digital and Artificial Intelligence Officer develop and implement a plan of actions and milestones to bring any out-of-compliance hardware, software, cloud services, networks, and other tools used by the Defense Digital Service and other Office of the Chief Digital and Artificial Intelligence Office Components into compliance with DoD policies.

(U) Rec. B.4.b: The DoD OIG recommended that the Chief Digital and Artificial Intelligence Officer develop and implement a formal process for all Chief Digital and Artificial Intelligence Office directorates to follow when requesting waivers of DoD policies and guidance that, at a minimum, requires documentation of the Office of the Secretary of Defense's approval and notification in writing to the policy's issuing DoD Component of the approval of the waiver, if the Office of the Secretary of Defense overrides the denial of the waiver by the Office of the Secretary of Defense Principal Staff Assistant or DoD Component head who issued the policy.

(U) Rec. B.5: The DoD OIG recommended that the Chief Digital and Artificial Intelligence Officer implement Recommendations B.1, B.2, and B.3 for all the Chief Digital and Artificial Intelligence Office directorates.