Internet Protocol Version 6: DOD Needs to Improve Transition Planning

An internet protocol provides the addressing mechanism that defines how and where information moves across interconnected networks. Increased use of the internet has exhausted available IPv4 address space, spurring the adoption of its successor protocol, IPv6. OMB has required that agencies plan for transitioning from IPv4 to IPv6.

Senate and House reports accompanying the 2020 National Defense Authorization Act included provisions for GAO to review DOD's IPv6 transition planning efforts. This report (1) identifies past DOD attempts to transition to IPv6, (2) examines the extent to which DOD has completed OMB's planning requirements for its current transition effort, and (3) identifies DOD's progress in completing its own IPv6 transition activities. To do so, GAO assessed DOD's IPv6 transition plans and documentation against OMB's requirements, reviewed DOD's planned IPv6 transition activities, and interviewed agency officials.

The Department of Defense's (DOD) current initiative to transition to Internet Protocol version 6 (IPv6), which began in April 2017, follows at least two prior attempts to implement IPv6 that were halted by DOD. In one effort that began in approximately 2003, DOD initially did make progress implementing IPv6 on its systems, but then the department ended the effort due to security risks and a lack of personnel trained in IPv6. DOD initiated another attempt in response to 2010 OMB guidance. However, this initiative was terminated shortly thereafter, again due to security concerns.

For its current initiative, DOD has not completed three of four longstanding OMB requirements (see table). Without an inventory, a cost estimate, or a risk analysis, DOD's plans have a high degree of uncertainty about the magnitude of work involved, the level of resources required, and the extent and nature of threats, including cybersecurity risks.

In February 2019, DOD released its own IPv6 planning and implementation guidance that listed 35 required transition activities, 18 of which were due to be completed before March 2020. DOD completed six of the 18 activities as of March 2020. DOD officials acknowledged that the department's transition time frames were optimistic; they added that they had thought that the activities' deadlines were reasonable until they started performing the work. Without an inventory, a cost estimate, or a risk analysis, DOD significantly reduced the probability that it could have developed a realistic transition schedule. Addressing these basic planning requirements would supply DOD with needed information that would enable the department to develop realistic, detailed, and informed transition plans and time frames.

GAO is making three recommendations to DOD to develop an inventory of IP compliant devices, an estimate of the IPv6 transition costs, and an analysis of IPv6 transition risk. DOD agreed with the recommendations to develop a cost estimate and risk analysis, but disagreed with the recommendation to develop an inventory of IP-compliant devices. Nevertheless, GAO believes the recommendation to develop an inventory is warranted.

The increasing use of the internet has promoted a dramatic expansion in  the number of users and types of devices that communicate with each  other through an internet protocol (IP). An IP is one of the primary  mechanisms used to define how and where information such as text,  voice, and video moves across networks. Proper functioning of this  protocol is dependent upon devices having unique identifiers, or  addresses, to properly transmit and receive information. Without unique  addresses, information transmitted to or from these devices could  inadvertently be sent to unintended destinations. These destinations  could include individuals or entities with malicious intent. Further, without  unique addresses defining each destination, the internet could become  unreliable and chaotic.

The Department of Defense (DOD), like many organizations and federal  agencies, currently uses an older protocol, known as Internet Protocol  version 4 (IPv4), to support its mission requirements. IPv4 is approaching  obsolescence due to expanded internet use and the exhaustion of IPv4  addresses available for distribution.

The inadequate supply of IPv4 addresses spurred the development and  global adoption of its successor protocol, Internet Protocol version 6  (IPv6). In comparison to IPv4’s approximately 4.3 billion addresses, IPv6  provides approximately 340 undecillion (i.e., 340 trillion, trillion, trillion or  3.4 × 10) possible unique addresses, which is enough to assign many  trillions of addresses to every person on Earth.

IPv6 is expected to provide improved, more efficient information  technology (IT) services, mobility, and security. Leading technology firms,  major corporations, and foreign governments have been implementing  the protocol. For example, China announced its goal to establish the  world’s largest IPv6 network by the end of 2025. Further, DOD has begun  efforts to transition its networks and systems from IPv4 to IPv6.

Senate Report 116-48 and House Report 116-120 included provisions  for us to review DOD’s continued use of IPv4 and its transition to IPv6.  This report specifically (1) identifies DOD’s past attempts to transition to  IPv6, (2) examines the extent to which DOD has completed Office of  Management and Budget (OMB) transition planning requirements, and (3)  identifies DOD’s progress in completing its own required activities for  transitioning to IPv6. The scope of our review focused on DOD’s  department-wide IPv6 transition initiative led by officials within multiple  offices and components, including DOD’s Office of the Chief Information  Officer (CIO) and the Defense Information Systems Agency. We did not  review the efforts or plans of individual DOD component agencies or  military services unless they pertained to department-wide transition  requirements.

To identify DOD’s past attempts to transition to IPv6, we consulted OMB’s  IPv6 implementation guidance to give context and establish a timeline of  DOD’s past transition deadlines. Further, we reviewed DOD reports,  policies, and other documentation pertaining to the department’s past and  current IPv6 transition initiatives. For instance, we reviewed DOD’s  December 2014 Inspector General (IG) report on DOD’s IPv6 transition  efforts. Further, we interviewed and received written responses from the  DOD officials leading the transition to IPv6 about the history of DOD’s  transition attempts, as well as the background of the department’s current  transition initiative. We then used this information to describe the history  of DOD’s past IPv6 transition efforts.

To examine the extent to which DOD has completed OMB transition  planning requirements, we first reviewed OMB guidance related to IPv6  transition planning, including OMB memorandum M-05-22, “Transition  Planning for Internet Protocol Version 6 (IPv6).” While our work was  ongoing, we confirmed with OMB that the criteria were still applicable and  that OMB had not replaced or rescinded them. We also requested and  reviewed DOD’s policies and plans related to its department-wide IPv6  transition efforts. In addition, we reviewed publicly available  documentation related to DOD’s IPv6 planning efforts. Further, we met  with, and received written responses from, the DOD officials leading the  transition to IPv6 about the department’s transition planning efforts.

Using this information, we first selected the applicable criteria in OMB  memorandum M-05-22 that pertained to IPv6 planning. These criteria  called for agencies to: (1) assign an official to lead and coordinate agency  planning, (2) complete an inventory of existing IP-compliant devices and  technologies, and (3) develop an impact analysis containing both a cost  estimate and a risk analysis. We then requested and analyzed DOD’s  responses and documentation regarding the extent to which it had  completed the IPv6 planning activities required by the criteria we selected  from the OMB memorandum.

To identify DOD’s progress in completing its own required IPv6 transition  activities, we reviewed the department’s February 2019 “DOD CIO IPv6  Guidance Memo.” According to the memorandum, it provides initial  direction and guidance for DOD’s IPv6 transition. The memorandum lists  35 transition activities and includes due dates for 27 of them. Over the  course of the engagement, we routinely inquired about the progress DOD  made against all the activities listed in the memorandum, including the  activities that did not have specific due dates. If DOD submitted evidence  for completing an activity, we evaluated the actions taken and compared  them to the specific transition activities. From our analysis, we determined  which activities had sufficient evidence to support completion and which  activities were past due. The full results of this analysis are shown in  appendix I.

We conducted this performance audit from June 2019 to June 2020 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

The internet is a worldwide network of networks comprised of backbone  networks, servers, and routers. Network addresses are used to help send  information from one internet-connected device, such as a computer, to  another by routing the information to its final destination. The protocol that  enables the administration of these addresses is the IP.

IP addresses provide a numerical description of the location of networked  devices such as computers, routers, and smartphones. These numerical  descriptions allow devices to be distinguished from each other over the  internet. In some ways, an IP address is like a physical street address.  For example, in the physical world, if you want to send a letter from one  location to another, the contents of the letter must be placed in an  envelope that lists both the sender’s and the recipient’s addresses.  Similarly, if data is transmitted across the internet from one device to  another, IP addresses must be placed in an IP header with sender and  recipient information. In addition to containing the addresses of the  sender and the receiver, the header also contains a series of fields that  provide information about what is being transmitted. Figure 1 provides a  simplified illustration of this concept.

The Internet Engineering Task Force, the principal body engaged in the  development of internet standards, developed IPv6 in the 1990s to  address IPv4’s limited address space, among other things. Although IPv6  has been available for over 20 years, IPv4, the older IP, is still more  widely deployed. Nevertheless, IPv6 deployment is rising worldwide  amidst the exhaustion of available IPv4 addresses. However, IPv6 is not  backwards compatible with IPv4, which means that organizations such as  DOD have to change their network infrastructure and systems in order to  deploy IPv6.

DOD relies on its current IPv4 networks to fulfill its mission to provide the  military forces needed to deter war and ensure our nation’s security.  According to DOD officials leading the transition to IPv6, the department  utilizes IPv4 for enterprise-wide and mission partner wired and wireless  communications, including infrastructure, technologies, and devices  supporting large-scale globally dispersed command and control systems,  naval vessels, aircraft, satellites, and ground operations. Figure 2  presents a simplified depiction of the department’s use of IPv4.

DOD’s mission requires considerable IP address space. The department  currently has 300,149,760 IPv4 addresses—more than any other  organization in the world. These approximately 300 million addresses  are divided into blocks; each block contains a series of multiple  addresses. DOD has 13 particularly large blocks of addresses, each  containing 16,777,216 addresses. Also included in the approximately  300 million addresses are 59,767,040 IPv4 addresses that currently are  unused. These addresses are reserved for future use by DOD and its  components.

DOD has stated that it expects to exhaust its reserve of unused IPv4  addresses by 2030. According to the officials leading the IPv6 transition  effort, the department expects to have to support IPv4 after it exhausts its  IPv4 address space in 2030 due to mission system modernization and  replacement timelines, as well as new emerging technologies that may  require IPv4 resources while the department transitions to IPv6.

IPv6 May Improve Functionality and Provide Benefits

According to prior government reports and DOD documentation, IPv6’s  improved functionality would benefit the department in many ways. In  addition to the general benefits of eliminating IPv4 address space  limitations, enhancing mobility features, and integrating IP security, IPv6  has the potential to enhance DOD battlefield operations, improve  decision-making with the increased reliance on the Internet of Things  (IoT), support U.S. global technological competitiveness, and enhance  mission partner interoperability.

IPv6 eliminates address space limitations. As previously  mentioned, IPv6 dramatically increases the amount of possible  address space from 4.3 billion addresses in IPv4 to approximately 340  undecillion (3.4 × 10In contrast to IPv4, the massive address space available in IPv6 will allow  almost any device to be assigned a unique IP address. This change  fosters greater end-to-end communication abilities between devices with  unique IP addresses and can better support the delivery of data-rich  content such as voice and video.

Enhanced mobility improves connectivity. IPv6 improves mobility  features by allowing each device to have a unique IP address  independent of its current network or connection point to the internet.  This enables mobile IPv6 users to move from network to network  while keeping the same unique IP address. The ability to maintain a  constant IP address while switching networks is cited as a key factor  for the success of a number of evolving capabilities, such as  telephone technologies, laptop computers, and internet connected  automobiles.

Added IP security helps to protect data. IP security—a means of  authenticating the sender and encrypting the transmitted data—is  better integrated into IPv6 than it is in IPv4. This improved integration,  which helps make IP security easier to implement, can help support  broader data protection efforts. This extra security is accomplished  through the use of two header extensions that can be used together  or separately to improve the authentication and confidentiality of data  being sent via the internet. These headers serve to provide the  receiver with a greater assurance of the sender’s identity and provide  encryption protection for the transmitted data.

Enhanced capabilities could improve DOD battlefield operations.  According to the 2014 DOD IG report on DOD’s IPv6 transition efforts,  use of IPv6 could provide DOD with several potential benefits related  to battlefield operations, such as improved communication, warfighter  mobility, situational awareness, and quality of service. IPv6 auto- configuration capabilities provide secure ad hoc networking and  mobility, as well as improved end-to-end security and simplified  network management capabilities. This could potentially enable  individuals and entire units to disconnect from military base networks,  travel into theater, and quickly establish communications.  Additionally, IPv6 capabilities could allow warfighters and  commanders to improve situational awareness and mission execution  during deployment and battle operations, allowing units to securely  move from one wireless network to another.

Increased use of the IoT may improve decision-making. The  increased address space available with IPv6 enables the increased  connectivity necessitated by the proliferation of the IoT. DOD’s IoT  could include any object for which remote communication, data  collection, or control might be useful, such as vehicles, appliances,  medical devices, electric grids, transportation infrastructure,  manufacturing equipment, or building systems. According to DOD’s  Digital Modernization Strategy from July 2019, IoT could be significant  to the department’s decision-making processes because the  assortment of connected objects that comprise IoT could enable  technology to gain the ability to sense, predict, and respond to DOD’s  needs. The department could use computers to track, count, and  analyze data from these objects in order to reduce waste, loss, and  cost. DOD managers could also know whether these objects were  running well or needed replacing, repairing, or recalling.

IPv6 could support U.S. global technological competitiveness.  According to a DOD presentation, the transition to IPv6 could allow  the department to remain technologically competitive globally.  Interest in IPv6 is gaining momentum around the world, particularly in  parts of the world that have limited IPv4 address space to meet their  industry and consumer communications needs. Regions that have  limited IPv4 address space, such as Asia and Europe, have  undertaken efforts to develop, test, and implement IPv6. For example,

China has been aggressive at deploying IPv6.

Japan has set up an IPv6 Promotion Council, using tax incentives  to encourage research and adoption of IPv6 by its private sector.

Europe has a task force that has the dual mandate of initiating  country and regional IPv6 task forces across European states and  seeking global cooperation around the world.

Transitioning to IPv6 may preserve mission partner  interoperability. According to an August 2017 report from DOD’s  CIO, deploying IPv6 capabilities is essential to preserve  interoperability with mission partners in the private sector and in other  countries and to assure future access to technology. Since the pools  of unassigned IPv4 addresses are exhausted, DOD’s mission  partners may increasingly rely on IPv6 addresses in the future,  furthering the department’s need to increase its IPv6 capabilities.

Transitioning to IPv6 Could Also Present Challenges

Along with the potential benefits, the National Institute of Standards and  Technology (NIST) has indicated that transitioning to IPv6 also could  present challenges for organizations such as DOD. These challenges  include the complexity added by dual IPv4 and IPv6 operations and the  immaturity of IPv6 security products and processes.

Complexity added by dual IPv4/IPv6 operations. DOD plans to  deploy IPv6 while still supporting IPv4 for legacy applications,  services, and clients. This will result in a dual protocol environment  and increased complexity. With two protocols, DOD would have to  ensure the proper functioning of two separate, but interrelated,  networks instead of only one network. Further, hackers and other  online adversaries could exploit either the department’s IPv4 or IPv6  network connections when launching cyberattacks.

Immaturity of IPv6 security processes. While IPv6 could offer  enhanced security, NIST states that its deployment could also lead to  new challenges with respect to the types of threats facing an  organization such as DOD. For example, organizations in the  process of transitioning to IPv6 may lack robust IPv6 security controls  and may have security staff members who lack an overall  understanding of IPv6. This could allow attackers to exploit IPv6  assets or leverage IPv6 access to exploit IPv4 assets. While general  security concepts are the same for both IPv4 and IPv6 protocols, it  may take time and effort for transitioning organizations such as DOD  to acquire the level of operational experience and practical  deployment solutions that have been developed for IPv4 over the  years.

OMB Issued Guidance for Federal Agencies’ IPv6 Transition Planning

In August 2005, OMB issued a memorandum to federal CIOs specifying a  series of IPv6 transition planning and implementation requirements and  associated due dates for federal agencies to enable the use of IPv6.  Specific to planning for the transition, the memorandum required  agencies to assign an official to lead and coordinate IPv6 transition  planning efforts, complete an inventory of IP-compliant devices and  technologies, and complete an impact analysis comprised of a cost  estimate and a risk analysis by specific due dates during fiscal year  2006. Table 1 lists the transition planning requirements and due dates  defined in the OMB memorandum.

DOD Has Engaged in IPv6 Transition Efforts since 2003

Aware of the limitations of IPv4, DOD first began planning for the  implementation of IPv6 in June 2003. At that time, the department’s CIO  issued the memorandum, “Internet Protocol Version 6 (IPv6).” According  to this memorandum, the department’s initial goal was to complete its  transition to IPv6 by fiscal year 2008.

Within a month of the issuance of DOD’s June 2003 memorandum, the  department designated the Defense Research and Engineering Network  (DREN) as the first DOD IPv6 pilot network. DREN, being a research  and development network, is not connected to DOD’s operational  networks, such as the department’s nonclassified IP router network,  which transmits nonclassified operations traffic. According to a DOD  report about the DREN pilot, the entire DREN wide-area network was  routinely supporting end-to-end IPv6 traffic by July 2005. According to  the department, DREN remains DOD’s only IPv6-enabled network.

Further, DOD’s IG reported that the department had undertaken an initial  transition effort that temporarily satisfied OMB’s August 2005  implementation requirement to demonstrate IPv6 on its infrastructure by  the end of June 2008. Specifically, DOD was able to demonstrate IPv6  within the department’s Defense Information Systems Network.  However, according to the report, the department’s IPv6 transition  manager said DOD disabled IPv6 functionality due to a lack of trained  personnel and potential security risks. We received additional information  about why DOD disabled the IPv6 functionality, but we are not including it  in the report due to the information being marked as for official use only.

DOD began its next effort to plan and implement IPv6 in response to  OMB’s subsequent 2010 guidance. In this guidance, OMB gave  agencies—including DOD—requirements intended to further their  transitions to IPv6. Two of these requirements stated that agencies were  to: upgrade their public-facing IT servers and services (e.g., web and  email) to IPv6 by the end of September 2012; and upgrade internal client applications that communicate with public  internet servers and supporting enterprise networks to IPv6 by the  end of September 2014.

According to DOD, the department originally planned to meet the 2010  OMB requirements; however, it decided not to complete the upgrades  due to security concerns. Again, we received additional information about  the department’s security concerns; however, we are not including those  details in this report because they were marked as for official use only.

DOD Had Not Completed Most of the Selected OMB Planning Requirements

OMB’s IPv6 transition guidance requires federal agencies, such as DOD,  to perform specific tasks as part of their IPv6 planning efforts. These  tasks include: (1) assigning an official to lead and coordinate agency  planning, (2) completing an inventory of existing IP-compliant devices and  technologies, (3) developing a cost estimate (as part of an impact  analysis), and (4) developing a risk analysis (as part of an impact  analysis). Although these requirements were originally due in 2005 or  2006, they are still applicable; OMB has not replaced or rescinded them.

Assigning an official to lead and coordinate agency planning can help  agencies better manage their transition to IPv6. Specifically, a senior- level focal point to lead IPv6 transition efforts can provide assurance that  the program is based on a coherent strategy and is well coordinated. A  lead official may also help an agency avoid duplicative, overlapping, and  fragmented efforts, which can result in avoidable additional costs.

According to NIST, having an inventory of IP-compliant assets is crucial  to IPv6 transition planning because it helps determine transition  requirements and give an agency a clear understanding of the IP  capabilities of the devices on the network. Specifically, an inventory  helps determine which assets will transition to IPv6, the order in which  assets will transition, the transition methods selected, and the security  controls that would need to be implemented.

Further, cost estimates are critical to decision-makers not only because  they help establish budgets, but also because they are integral to  determining and communicating a realistic view of likely cost and  schedule outcomes that could be used to plan the work necessary to  develop, produce, install, and support a program. As we have previously  reported, without the ability to generate reliable cost estimates, agencies  are at risk of experiencing cost overruns, missed deadlines, and  performance shortfalls. In addition, a risk analysis enables an agency to  assess the significance of potential threats to the success of its transition  to IPv6, as well as assess how those threats could be mitigated or  avoided. Further, without a risk analysis to help the agency understand  the potential threats and obstacles facing the IPv6 transition initiative,  agencies run the risk of creating goals and plans that are too optimistic.

According to DOD, the department began its most recent effort to  transition to IPv6 in April 2017. As part of this effort, in November 2019,  the department released its IPv6 implementation strategy, which  articulates DOD’s overarching vision for its IPv6 transition initiative: to  provide secure and reliable IPv6 services that enable innovation for  competitive advantage. According to the strategy, DOD’s goals for the  effort include implementing an interim solution of using both IPv4 and  IPv6 and then planning for an eventual IPv6-only environment.

As of March 2020, DOD had not yet completed three of the four selected  transition planning requirements. Specifically, the department had  completed the requirement of appointing an agency lead for its IPv6  transition efforts. However, it had not yet completed the three other  requirements: complete an inventory, develop a cost estimate, and  develop a risk analysis. Table 2 summarizes the status of DOD’s  completion of the four selected OMB IPv6 transition planning  requirements.

DOD completed OMB’s requirement to have an official lead the IPv6  planning efforts by first assigning its Joint Information Environment  Executive Committee responsibility for overseeing the department’s  transition to IPv6 in August 2017. The committee, in turn, established  the DOD IPv6 Working Group in November 2017 to coordinate and  manage department-wide IPv6 planning, implementation, and testing. An  official in the Office of the CIO serves as the chair of the working group,  and, according to the group’s charter, is responsible for leading meetings,  soliciting and prioritizing issue topics for review, and overseeing the  coordination of working group activities supporting the department-wide  transition to IPv6.

However, DOD did not complete the requirement to develop an inventory  of existing IP-compliant devices and technologies. In November 2005,  DOD provided a memorandum to OMB that indicated that the department  would not complete the inventory of IP-compliant devices and  technologies; instead, DOD would continue following its existing transition  plan, which did not require an inventory. Further, the DOD officials  leading the IPv6 transition effort informed us that the department had not  developed such an inventory and that it still does not plan to do so. The  officials said that conducting a task of this size would be impractical given  DOD’s size and the number of IP-compliant devices in the department.

The officials leading the IPv6 transition also said that DOD has been  mitigating the risk of not having an inventory by ensuring that the  department has only been acquiring IPv6-capable IT devices since  December 2009. However, while only acquiring IPv6-capable devices  and applications could help the transition move forward, it would not be  as complete as an inventory, given that an inventory would include  technology purchased before December 2009.

DOD also did not complete a cost estimate or a risk analysis. According  to the DOD officials leading the IPv6 transition effort, the initiative was not  a top priority until the CIO released the “Internet Protocol Version 6  Implementation Direction and Guidance” memorandum in February 2019.  This memorandum, which was developed to guide the department’s IPv6  transition planning and implementation efforts, gave the transition  initiative greater attention in the department. Prior to the issuance of the  memorandum, the officials stated that they did not have sufficient  resources to conduct the cost estimate and did not have enough  understanding to complete the risk analysis. DOD officials leading the  IPv6 transition effort explained that the department plans to develop these  requirements by the end of May 2020; however, we have not received  any documentation confirming this deadline.

Until DOD develops an inventory of IP-compliant technologies and  devices, a cost estimate, and a risk analysis, the department’s IPv6  transition initiative may have an increased likelihood of cost overruns,  schedule delays, and security vulnerabilities. Specifically, not having an  inventory of IP-compliant devices and technologies may lead to the  department developing plans without being aware of all the system and  infrastructure requirements necessary to successfully transition a large  organization such as DOD to IPv6. Further, without a cost estimate, DOD  may be making decisions without the benefit of relevant information on  the initiative’s potential cost and schedule outcomes, thereby introducing  unnecessary risk into the implementation process. Finally, by moving  forward without a risk analysis, DOD increases the probability that it is not  proactively managing potential threats that could disrupt the transition or  introduce new IT security vulnerabilities.

DOD Had Not Completed Most of Its Own Required Transition Activities

DOD’s February 2019 memorandum lists 35 required activities for  transitioning to IPv6 that DOD’s various components or offices, such as  the Office of the CIO, are to complete or work on during fiscal years 2019  through 2021. Of these 35 activities, 18 were to be completed prior to  March 2020.

However, DOD had not completed most of the required activities.  Specifically, of the 18 activities that were to be completed by March 2020,  the department had completed six and had not completed 12. In addition,  the department had completed one of eight other activities that did not  have specific due dates. Table 3 outlines the department’s seven IPv6  transition activities that had been completed as of March 2020. (See  appendix I for a full list of DOD’s transition activities and their completion  status.)

One notable required activity that DOD completed was to develop a CIO- approved strategy to implement its transition to IPv6. DOD’s strategy  outlines, among other things, the overall goals for the IPv6 transition  initiative. These goals include implementing a network that is both IPv4  and IPv6 capable; planning for an IPv6-only environment; and  establishing and optimizing training for IPv6.

In addition, DOD’s Defense Information Systems Agency leveraged  online training providers to offer on demand IPv6 training courses for  network engineers and cybersecurity personnel. In addition to basic  familiarization training for those new to IPv6, select training courses are  labeled as being at the advanced level.

However, the department had not completed 12 of 18 activities that were  due prior to March 2020. Notably, DOD missed its original September  2019 deadline to enable IPv6 on all commercially hosted public facing  unrestricted services. According to the department officials leading the  IPv6 transition, DOD expects to be able to complete this task by the end  of July 2021. The department also missed its original June 2019 deadline  for identifying the public facing unrestricted services hosted by DOD. The  officials leading the IPv6 transition initiative stated that DOD currently  plans to complete this activity by May 2020. Other activities that were  past due in March 2020 include: developing supplemental guidance for  the acquisition of IPv6-capable products, updating and maintaining IPv6  standards and implementation profiles, and determining DOD’s  cybersecurity architecture and posture impacts, among others.

DOD officials leading the IPv6 transition effort stated that the department  had not yet completed its required activities because the original time  frames that the department had established were unrealistic. Although the  activities were initially thought to have been reasonable, DOD adjusted  the activities’ due dates after the department began executing the tasks  and realized that it would take a large amount of work to accomplish their  goals and complete the activities.

One contributing factor for the unrealistic due dates is that DOD  developed this list of required activities without the benefit of an inventory  of IP-compliant devices and technologies, a cost estimate, or a risk  analysis. Without completing these basic planning requirements, DOD  significantly reduced the probability that it could have developed a  realistic transition schedule. Addressing requirements would supply DOD  with sources of meaningful information that would enable the department  to develop realistic, detailed, and informed transition plans and time  frames.

While DOD’s current IPv6 transition effort is showing progress, the  department has not completed most of OMB’s planning requirements.  Notable signs of progress include the appointment of an official to lead  the initiative and the development of an overarching strategy document  that outlines the transition’s scope and goals. Nevertheless, DOD had not  completed an inventory of IP-compliant technologies, a cost estimate, or  a risk analysis before moving ahead with developing its February 2019  guidance and working against the guidance’s list of transition activities.  The lack of an inventory is problematic due to the role that it should play  in developing transition requirements. In addition, without a cost estimate  to guide decision-makers, DOD’s current IPv6 transition plans could be  based on unrealistic assumptions about costs and resource demands.  Further, by moving forward without a risk analysis, DOD increases the  probability that it is not proactively managing potential threats that could  either disrupt the transition or introduce new IT security vulnerabilities.  Completing these longstanding planning requirements would enable DOD  to develop realistic plans with accurate transition requirements and  proactive risk mitigation strategies, among other things.

We are making three recommendations to DOD.

The Secretary of Defense should direct the DOD CIO to complete a  department-wide inventory of existing IP-compliant devices and  technologies to help with planning efforts and requirements development  for the transition to IPv6. (Recommendation 1)

The Secretary of Defense should direct the DOD CIO to develop a cost  estimate as described in OMB memorandum M-05-22 for the  department’s transition to IPv6. (Recommendation 2)

The Secretary of Defense should direct the DOD CIO to develop a risk  analysis as described in OMB memorandum M-05-22 for the  department’s transition to IPv6. (Recommendation 3)

We provided a draft of this report to DOD and OMB for review and  comment. In response, DOD agreed with two recommendations and  disagreed with one recommendation that we made to the department.  OMB did not state whether it agreed or disagreed with the report’s  findings.

In written comments, DOD stated that it agreed with our  recommendations to develop a cost estimate and risk analysis for the  department’s transition to IPv6 (Recommendations 2 and 3). The  department said that it plans to complete both the cost estimate and the  risk analysis by the end of May 2020.

However, DOD stated that it did not agree with our recommendation to  complete a department-wide inventory of existing IP-compliant devices  and technologies (Recommendation 1). Specifically, the department  referred to the draft IPv6 guidance that OMB developed in March 2020,  stating that the draft guidance will rescind OMB’s fiscal year 2005 IPv6  guidance, which includes the inventory requirement. DOD also said that  creating such an inventory would be impractical given the department’s  size. It added that it has been mitigating the risk of not having an  inventory by only acquiring IPv6-capable devices since December 2009.

We acknowledge that OMB’s March 2020 draft IPv6 guidance, once  finalized, would rescind its fiscal year 2005 IPv6 guidance. However, the  draft guidance focuses on completing the operational deployments of  IPv6, not on the initial key transition step of completing an inventory, as  required in the 2005 guidance.

The draft guidance also requests information on agencies’ completion of  certain milestones using the percentage of IP-enabled devices that are  IPv6-only as the metric. DOD’s completed inventory would be essential to  accurately responding to OMB’s draft requirement. In addition, NIST’s  current IPv6 transition guidance cites an inventory of IP devices as a key  step in transitioning to IPv6 since such information would help identify  requirements for transitioning, including which assets would transition and  what security controls would be needed. As DOD has acknowledged,  however, it has not yet completed an inventory. Accordingly, we believe  that our recommendation that DOD complete a department-wide  inventory of its existing IP-compliant devices and technologies is  warranted.

In addition, DOD provided a technical comment, which we incorporated  as appropriate. DOD’s comments are reprinted in appendix II.

In comments provided via email on May 8, 2020, an Associate General  Counsel in OMB’s Office of General Counsel expressed OMB’s  appreciation for the opportunity to review and comment on our draft  report. The official did not state whether OMB agreed or disagreed with  the report’s findings. OMB also provided a technical comment, which we  incorporated as appropriate.

We are sending copies of this report to the appropriate congressional  committees, the Secretary of DOD, and the Acting Director of OMB. In  addition, the report is available at no change on the GAO website at  https://www.gao.gov.

If you or your staff have any questions about this report, please contact  me at (202) 512-6240 or dsouzav@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix III.

Appendix I: DOD’s IPv6 Implementation and Planning Activities

In February 2019, the Department of Defense’s (DOD) Chief Information  Officer (CIO) released “Internet Protocol Version 6 Implementation  Direction and Guidance,” a memorandum containing guidance and a list  of required implementation and planning activities for the department’s  transition to Internet Protocol version 6 (IPv6). For each activity, the  memorandum included information such as the component or office  responsible for completing the work and a description of the work to be  completed. Out of 35 total activities, seven were completed and 12 were  past due as of March 2020. One key contributing factor behind the  activities’ unrealistic deadlines was that the department developed this list  of required activities without having completed key planning efforts, such  as an inventory of IP-compliant devices and technologies, a cost  estimate, or a risk analysis. Table 4 shows the status of the completion of  the required transition activities as called for in the department’s  guidance.

Appendix II: Comments from the Department of Defense

Appendix III: GAO Contact and Staff Acknowledgments

In addition to the contact named above, Larry Crosland (Assistant  Director), Meredith Raymond (Analyst in Charge), Amy Apostol, Chris  Businsky, West Coile, Kristi Dorsey, Vernetta Marquis, and Evan Rapson  made key contributions to this report.

An internet protocol or “IP” address allows devices to send each other information over the internet. DOD began planning for its transition to the next version of IP in 2017, following at least 2 prior attempts to do so since 2003.

But, DOD has yet to clearly define the magnitude of work involved, the level of resources required, and the extent or nature of cybersecurity risks if vulnerabilities aren’t proactively managed.

We made 3 recommendations to DOD to inventory IP-compliant devices, estimate transition costs, and assess risks to develop more realistic transition plans and proactively address potential threats.