Cybersecurity Policy Report, DoD’s Sprawling Cyber Operations Might Need Streamlining, GAO Says, (Sep 18, 2025)
Organizations Mentioned:U.S. Cyber Command
The Defense Department’s 70,500 cyberspace personnel and contractors are scattered across 440 organizations within the department and should be assessed for overlaps and inefficiencies, according to the Government Accountability Office.
“DOD has established almost 440 organizations that contain about 61,000 military and civilian personnel (and over 9,500 contractors), to conduct cyberspace operations. These organizations are most often aligned with U.S. Cyber Command (CYBERCOM) or retained by the military services and conduct a mixture of offensive, defensive, and DOD Information Network operations,” GAO said in a report published yesterday.
“To enable organizations conducting cyberspace operations, each unit is supported by organizations providing budgetary, personnel, policy, and training support. GAO identified 70 organizations and about 3,400 personnel that provide support to cyberspace operations,” GAO noted.
“GAO found that some of the functions of these organizations may overlap. These include training courses the military services provide to organizations conducting cyberspace operations and the administration of DOD’s 23 cybersecurity service providers that conduct cybersecurity for DOD organizations,” it said.
“Although some overlap can be intentional and appropriate, unnecessary overlap can lead to organizations paying for the same service or product twice or more. As DOD considers the future organization and composition of its cyberspace operations forces, it will be important to take steps to reduce cost and inefficiencies while maintaining mission effectiveness,” GAO added.
GAO recommended “that DOD assess whether (1) similar cyberspace training courses provided by the services can be consolidated and (2) there are opportunities to increase mission effectiveness and cost savings by consolidating DOD cybersecurity service providers.”
The DoD concurred with GAO’s findings and said it was looking at ways to streamline its cyber operations.
“The DoD agrees with assessing cyberspace training course overlap for possible consolidation,” and an assessment will be conducted by the assistant secretary–cyber policy, the department said in its response to the report.
“However, service-specific needs, U.S. Cyber Command (USCYBERCOM) standards, and the value of some redundancy must be carefully considered prior to any potential consolidation,” it said.
DoD said it would also assess its cadre of cybersecurity service provider contractors in search of “cost savings and efficiencies,” aiming for a “pragmatic approach prioritizing both efficiency and security.”
The GAO report was required by the National Defense Authorization Act for fiscal year 2024 and sent to the House and Senate Armed Services committees and the Appropriations subcommittees on Defense.
News: FederalLegislation DataSecurity