The announced objective of this audit was to assess the progress made by the Departments of the Navy (DON) and Air Force in mitigating the Defense Critical Infrastructure (DCI) cybersecurity vulnerabilities identified during the installation evaluations conducted in response to section 1650 of the National Defense Authorization Act (NDAA) for FY 2017. During the audit, we revised the objective to focus on the DON because our initial analysis identified that the DON did not have a plan for responding to the cybersecurity vulnerabilities identified during the Section 1650 assessments. The revised objective of this audit was to assess the progress made by the DON in mitigating the DCI cybersecurity vulnerabilities identified during the installation evaluations conducted in response to section 1650 of the NDAA for FY 2017.