In the fiscal year 2020 National Defense Authorization Act (NDAA), the U.S. Department of Defense (DoD) is tasked with performing a zero-based review (ZBR) of its cyber and information technology (IT) personnel. The NDAA requires that DoD departments, components, and agencies complete ZBRs for their cyber and IT workforces and that those ZBRs be submitted to the Principal Cyber Advisor (PCA), DoD Chief Information Officer (DoD CIO), and the Under Secretary of Defense for Personnel and Readiness (USD P&R).

DoD CIO asked the RAND Corporation’s National Defense Research Institute (NDRI) to produce a transparent and repeatable process for validating and ensuring the consistency of data and analysis used for the ZBR. The scope of this RAND study includes ten organizations selected from across the four DoD services—the U.S. Air Force, Army, Marine Corps, and Navy—plus the Defense Information Systems Agency. This report describes the methods used in the repeatable process and summarizes our findings across the ten organizations that were selected to participate in the DoD cyber ZBR.