Because the DOD is heavily reliant on software for its weapon systems and other systems (pay, supply, etc.), and because more of DOD's prime contractors are subcontracting work - sometimes overseas - there is a concern about vulnerabilities being exploited in defense software. The study finds that current acquisition and software security policies do not adequately handle this issue. Most policies focus on external hacking and unauthorized access rather than risks from subcontractors who are essentially insiders to the DOD information systems. The majority of groups within DOD that were studied did not make risk from foreign software content an explicit part of their risk identification and mitigation procedures. Moreover, risk mitigation is often delegated by DOD to its vendors, and they are typically more concerned about software functionality and quality assurance than development risks associated with foreign suppliers. It is impractical to check every line of code or conduct security clearances for all subcontractors or monitor software development facilities around the world. The GAO recommends that the responsibility for watching for this risk be placed in the hands of the program manager. DOD balked at this recommendation and wanted the program managers to have support from external sources to determine threat information on suppliers. DOD also wanted oversight of these security risks to be the collaborative responsibility of several offices within DOD.